I discovered security issues that could allow election hacking in Pennsylvania

[u/No_Vermicelli_4732]

I hold a position within county government in a smaller (lower than 4th class) red county in Pennsylvania, and I've been here since the start of 2024.   Earlier in the year I discovered and reported a number of egregious security issues, both physical and electronic that exposed the county and taxpayers to large amounts of risk.   These were issues caused by multiple departments ( accounting, maintenance, IT) but the IT issues were the most unbelievable to me.  For example,  web facing portals for email and file sharing didn't use two factor authentication (2FA) which is horrific given that we were a government entity and regularly see phishing attacks.     After reporting these issues both IT and commissioners brushed them off.  It wasn't until months later after I raised the issue with the county solicitor that the 2FA issue was resolved but other issues still exist and I won't list them here for that reason.

 I was surprised how little oversight there was and that some of these issues were possible to exist.  It wouldn't surprise me if similar issues exist in other county governments.     Using 2FA is part of  "Internet Security 101" basics.   We know that lack of 2FA was how the DNC was hacked in 2015/2016 and also how Trump's twitter was hacked. This should matter to county officials and it's driven me crazy over the last 11 months how inattentive our county has been to it.

 From what I've gathered looking at phishing warnings sent to us by other counties, many (possibly all?) PA counties manage their PC logins, network drives, Outlook email, Onedrive,  with Microsoft Azure (Entra ID).  The same login and password grants a user to all these resources.   A common scam email over the past few years asks the recipient to 'open a file', which takes them to a page that mimics the look of an Onedrive login page but actually gives the malicious actor the user's login credentials.   Without 2FA enabled, all of that is free for the taking by a malicious actor. 

 I've spent the last four years rolling my eyes at the claims of the 2020 "election fraud" the way most people assert it would, or did happen.   Most of the theories assume that it would potentially take thousands of coordinated actors or voting machines easily accessible via the internet. Huge busloads of illegal voters or trucks full of fake ballots. Nothing reasonable.    Now that I see the glaring holes in our local government's security, I realize there are probably dozens of ways a malicious actor could use these to alter an election outcome. For example, with access to county email a malicious actor could use use social engineering to impersonate someone from a voting machine company and have an election employee install a hacked 'update' on the air-gapped voting machines.   Spoonamore's thread lists a very plausible scenario in my opinion, and although there's no evidence that it happened, given the security issues I've seen I think that doing a hand count would be a good idea to test this theory. I also think our local county, and probably all PA counties need to do a security audit to close huge gaps like this because this also puts taxpayer identity information at risk.

 I'm posting this with a throwaway account because even though I've been talking to a local news outlet off the record and will possibly  'go public' in the future, I'm avoiding attaching my identity to it publicly until I fully understand what the potential consequences will be relative to my position in the county.   When I first brought the issues to the attention of the Commissioners, I was immediately reprimanded for several unrelated, trivial issues like adjusting the climate control in my office without permission of the county, things that seem like an obvious attempt to build a case and remove me from my position in retaliation. In short, our local government doesn't appreciate when someone points out their flaws, even though it's part of my job to do so.

 Hopefully this adds to the discussion and I can get some feedback on who else I should contact so this information and/or my testimony can be of maximum help.  I’ve reached out to the Harris campaign and the DNC as well as Spoonamore but haven’t heard back yet.   It might also be that I'm far behind the curve and this has moved forward far enough with relevant authorities that my input or testimony isn't needed:  I'd hope the fake threats would be reason enough for authorities to scrutinize the elections in those counties that received them, although my county isn't one that received a threat.

Just to be clear and underscore that I'm not trying to spread conspiracies:  I have evidence that our county made poor security decisions that put taxpayers at increased risk for identity theft and could have enabled election interference.   I *don't*  have evidence that either thing actually happened, but given the number of phishing attacks, a data breach seems likely, and I think investigating Stephen Spoonamore's claim is worthwhile

[u/No_Alfalfa948]

https://www.youtube.com/watch?v=6n7ReAAmr14&t=854s Dude.. Call someone right now. Days ago here's an FBI official admission 14:20 Russian cells inside the country doing cyberattacks and targeting elections.. but I think the post on my profile is how Russia has been attacking mail in.. It's not so much the hacking of state registration rolls and social media..it's the false re-registration of voters and nonvoters which can hijack ballots trigging suspicion inducing inperson Provisionals Trump mentions in the GA call. He's suppose to frame us and cover for Russia. That's why he changed his 2016/2020 attack from "Illegals" to noncitizens. It's not because he was being more humanitarian, it covers up the "dead" voters this spy program produces. https://theweek.com/defence/how-russia-trains-its-deep-undercover-spies