6 million Georgia voters' records exposed: 'Could have easily been compromised'

GA voter info exposed in giant breach

(CNN) - Georgia's Republican candidate for governor, Brian Kemp, says his state's election system is secure.

But Kemp is being accused in a federal lawsuit of allowing a massive breach that exposed the voting records and personal information of millions.

Right around the same time Russians were trying to penetrate state voting systems in the summer of 2016, cyber security expert and part-time hacker Logan Lamb decided to check out how Georgia's centralized voter system was holding up.

What he found was an open window.

"There were documents with election day supervisor passwords," Lamb said. "There was a voter registration database with 6.3 million records of all of Georgia's voters."

The records included full names, dates of birth, even driver's license and partial social security numbers, all wide open to anyone snooping around.

And now it is known that during the same time, Russians were snooping around.

According to the Justice Department's special counsel investigation, that included hacking websites of certain counties in Georgia to identify vulnerabilities.

Lamb didn't know about the Russians, but he did know having voting records so easily accessible was a problem.

"The website security itself is inexcusable," Lamb told CNN. "Never mind the nation-state threats of countries like Russia, it could have easily been compromised by [anyone]."

So he emailed and then he called Georgia's Center for Election Systems, run out of a house on the campus of Kennesaw State University, to warn them

Six months later, all that Georgia voter data was still unprotected. all the passwords, everything was still available to anybody who wanted it.

"Georgia's election systems - this should not be trusted," Lamb said.

Eventually, Kennesaw State closed the security loophole and notified the state.

A lawsuit was filed challenging the security of Georgia's elections. Then, shockingly, evidence of what took place vanished.

IT workers at Kennesaw State wiped the election system's computer hard drives clean, deleting any potential evidence of tampering.

The person in charge of Georgia's elections is the state secretary of state, Kemp.

He is the Trump-styled Republican now running for governor.

And the voting mess under his watch has turned into a mild campaign issue.

Kemp's office said the secretary of state had no idea Georgia's voter information system was so vulnerable to attack until months after Lamb's warning.

His office also said the federal lawsuit revealed only visits, not penetration of any Georgia systems by Russians.

Kemp blamed Kennesaw State's election systems center for the entire debacle, ended the state's long-running contract with the school and shut it down.

On Facebook, he called the actions of the election center employees reckless, inexcusable and showing undeniable ineptitude.

And then he hired the director of the center to work with him at the secretary of state's office and to assure everyone all this didn't mean anything.

He posted a graphic saying the state's election systems remain secure.

"He cannot possibly say that with a straight face," said Marilyn Marks, a self-funded advocate for improving election integrity.

She is part of a group that has sued Georgia.

She says the state system is easily penetrable, and if the system fails, if it's hacked or infected with malware, there would be no way for Georgia to double-check the votes.

In part, she wants a paper ballot backup for the upcoming midterm elections.

The state has said no.

"When told that, 'Hey, you've been exposed to bad guys, you've been exposed to viruses, you've been exposed to every known bad thing that could happen to an election system,' they just say, 'OK, next election,'" Marks said.

Kemp's office said switching to a completely different voting system this close to an election would cause confusion and potentially suppress turnout.

Copyright 2018 CNN. All rights reserved.