Channel 2 Investigative Reporter Aaron Diamant has learned two more states’ election agencies have confirmed suspected cyberattacks linked to the same U.S. Department of Homeland Security IP address as last month’s massive attack in Georgia.
BREAKING: 2 other states’ election agencies confirm cyber-attacks linked to same DHS IP address as 11/15 cyber-attack on GA network. @wsbtv pic.twitter.com/3430zQZ8KZ
— Aaron Diamant (@AaronDiamantWSB) December 15, 2016
The two states reporting the suspected cyberattacks were West Virginia and Kentucky.
“We need somebody to dig down into this story and figure out exactly what happened,” said Georgia Secretary of State Brian Kemp.
In the past week, the Georgia Secretary of State’s Office has confirmed 10 separate cyberattacks on its network over the past 10 months that were traced back to DHS addresses.
“We’re being told something that they think they have it figured out, yet nobody’s really showed us how this happened,” Kemp said. “We need to know.”
He says the new information from the two other states presents even more reason to be concerned.
“So now this just raises more questions that haven’t been answered about this and continues to raise the alarms and concern that I have,” Kemp said.
- Dec. 14, 2016: Georgia Sec. of State says cyber-attacks traced to DHS addresses
- Dec. 9, 2016 : Homeland Security investigating cyber-attack against Secretary of State’s Office
- Dec. 8, 2016: Georgia Sec. of State wants answers from DHS after apparent breach attempt
Through an open-records request, Diamant acquired the results of a survey Kemp asked the National Association of Secretaries of State to send to its members.
West Virginia wrote back, “This IP address did access our election night results on November 7, 2016.” Kentucky responded the same IP address “did touch the KY (online voter registration) system on one occasion, 11/1/16.”
In a letter this week, DHS Secretary Jeh Johnson told Kemp the department sourced the mid-November activity in Georgia to a federal contractor conducting what he called “normal” internet searches on the Secretary of State’s website. But Kemp says there’s a problem with that answer.
“We haven’t been able to recreate this the way they explained it to us,” Kemp said.
Kemp also told Diamant that DHS has yet to explain at least nine other suspected network scans linked to DHS IP addresses over the last year on or around important primary and presidential election dates. Kemp’s call for answers is amplified now by the National Association of Secretaries of State, or NASS.
“We have one administration leaving town and another coming in so it does remain to be seen just who will be left holding the bag if we don’t get a great explanation on what has occurred very soon,” said Kay Stimpson, with NASS.
Unsatisfied with the response he got from Johnson, Kemp fired off a letter Wednesday to loop in President-elect Donald Trump. He is still awaiting a response.
“We just need to ask the new administration to take a look at this and make sure that we get the truth the people of Georgia are deserving to know that and really demanding it,” Kemp said.
In an emailed statement the Kentucky Secretary of State’s office told us it believes the IP address that sparked all this did not attack its system. West Virginia’s Secretary of State did not respond to our request for comment, neither did DHS.