Hacker News Reader

Comment by ddoolin | Hacker News Reader

How is this not immediately obstruction of justice? The article makes it seem like they know who actually wiped it, so just ask them who ordered it and follow the trail, no? It can't even be an accident since not one but two backups were also wiped.

View on HN

Later in the article, they mention that wiping the server was in response to a security vulnerability leaving 6.7 million sensitive voter records vulnerable. The governor's office claims to not be aware, so it sounds like they're still following the trail, as you put it. Fortunately:

> The FBI is known to have made an exact data image of the server in March when it investigated the security hole

They could've just unplugged the server from the internet if it's vulnerable.

Electronic access, phyiscal access...it sounds more like it was a "routine" disposal of sensitive information 10 months after the election.

United States national ballot records must be kept for 22 months, and then they are likewise disposed. Florida kept (keeps?) its ballots especially long after the 2000 recount.

> Electronic access, phyiscal access...it sounds more like it was a "routine" disposal of sensitive information 10 months after the election.

When a lawsuit is filed (or even when you reasonably know lawsuit will be filed), you can not legally destroy evidence related to it, even in the course of otherwise routine document destruction.

In state agencies and other large orgs, it's common to receive mass email orders from legal to preserve all documents and communications related to matter under dispute, regardless of normal retention policies, with reminders of severe legal consequences to the org and dire personal consequences if the directive is not complied with.

Of course. And that's exactly why Florida kept around its 2000 ballots especially long.

My claim is that this sort of action in itself is not bizzare.

That it was done with a pending lawsuit is bizzare. Whether it was due to malice or incompetance remains to be seen.

They were informed 3-4 weeks before the lawsuit was filed that they were going to be sued and they should not delete the data. But did it anyway so seems like they might be hiding something

Either they are acting in bad faith, or are completely incompetent. Neither sounds like what we want out of the folks running elections.

>Electronic access, phyiscal access...it sounds more like it was a "routine" disposal of sensitive information 10 months after the election.

There was a special election in Georgia on June 20; the servers were wiped two and a half weeks later on July 7.

Those couple of paragraphs are confusing to read. They don't mention if the backup servers were also vulnerable to whatever the security problem is, and if they weren't, how they also ended up getting wiped. The article also says the failed attempt also left all that data vulnerable for months -- how is that? I wish the article was more clear and with more info. They also got the name of the coalition wrong. It's the Coalition for Good Governance*, not Governments.

In any case, I hope the FBI still has the image.

KSU does not have the... "most academically rigorous" reputation. How they ended up handling election records instead of GaTech (literally 30 minutes away, and closer to the Capitol) boggles the mind.

But then, why would you possibly want to house sensitive records at a state university with an actual cybersecurity research focus [1]? That would just be crazy.

[1] https://cyber.gatech.edu/

Most of the GA state legislature went to or has ties to UGA. Not saying that a school rivalry would affect their decisions, but not saying it wouldn’t either.

I wonder if it was a physical image backup or a logical image backup. If the latter then deleted data on the server would be likely lost if the original disks were reformatted.

Because this is a new norm:

https://www.forbes.com/sites/robertwood/2016/01/20/irs-wipes...

Unless you’re aware of a lot more incidents in the past few years, I don’t think twice in 2 years makes for a new norm. The IRS found a backup of that hard drive, according to this article.

http://www.washingtontimes.com/news/2016/feb/3/irs-promises-...

In any case these events are making news because they are not normal.

> In any case these events are making news because they are not normal.

What’s troubling is that we don’t have a good way to know how often this behavior actually occurs. Would the IRS have found the missing data if there hadn’t been press about it? I suppose that depends on your outlook and level of skepticism.

Or, put another way, I once asked my father if the state of political corruption in the news had always been as dour as what we see today. He said that this was the worst during his lifetime.

I then asked if he thought that the state of world affairs was actually worse, or if technology had simply made it more well known. He was silent for a long time before he answered. He said that he hadn’t considered that.

Finally, when I was a teen I was frustrated when I was lectured after I got caught sneaking out in the night. My mother, with a healthy degree of smug satisfaction, told me that she was always one step ahead of me. I couldn’t throw it in her face that I got away with it on a regular basis, of course.

You must assume that when you catch someone behaving badly once then there may be other incidents that you didn’t recognize. The worst aspect of corruption is not the time that we found out about it. It’s the question of how much we’ve missed.

It would seem a simple matter to charge each individual from the lowest levels with a straightforward crime, and flip them as they ladder up toward the people who gave the order/suggestion/plausibly-deniable-wish.

Simple, that is, if the prosecutor wanted to prosecute.

We are all mere resources.

Or it could be a part of a well-scheduled maintenance schedule that was agreed by IT and the system owners.

I used to have a system like that under my purview, a voice recording system. Unless we were under court order or internal compliance instruction, all back up tapes were to be erased after 1 month of the conversation being recorded. This was a daily job for the VR system admins -- pull tapes from 1 month prior, erase, and recycle back into the recording system to be used again. No special instruction needed to do a BAU task.

If a court order was received a tape was pulled out of the general pool, and sent off to compliance for safeguarding. So if we received a court order, that order would go to CEO / COO, to head of legal &/or compliance, who would then instruct head of IT, who would instruct the VR system admin to pull a tape. If somebody dropped the ball in that chain on day 29 and the order didn't reach the VR system guy, the tape was erased the next day.

The importance of this monthly VR tape deletion process was important enough to have some extremely senior compliance person flying out to assure themselves it was actually happening, and happening according to this procedure.

Why 30 days only you ask? Because we were only obligated under law to maintain 30 days worth of recordings. Anything longer than that became a regulatory risk to us.

Under my VR system erasure policy, the guy in question who wiped the election system might not have anybody to point to as ordering him/her to wipe.

In which case he'd have the existing policy to point to as why the wipe was performed when it was, and the legal department to point to for not informing him of the lawsuit and to not delete those tapes. The organization is still liable, it merely shifts which individual within that organization is at fault.

Because you have to pay to even read the state laws of Georgia, so nobody knows the law?

Wut?

They were referencing this:

https://arstechnica.com/tech-policy/2017/03/public-records-a...

The text of Georgias law is publicly available, but there is a version with annotations from legal precendents that is considered necessary to understand the law as it is currently interpreted. LexisNexis collates those annotations for the state of Georgia and maintains a copyright on the annotations, you cannot access them without paying. The government in Georgia feel this is perfectly acceptable as you can tehcnically access the law even though, in practice, you have no idea

The annotated version is freely available: http://www.lexisnexis.com/hottopics/gacode/default.asp. What the kerfuffle is about is that the State of Georgia has (1) Georgia law is highly unusual in giving the annotations authoritative force; (2) the State of Georgia has asserted copyright over the annotated version.

ah my mistake

It depends upon what you mean by "free." There are limitations on what you may do with the "freely" available version.

https://arstechnica.com/tech-policy/2017/03/public-records-a...

True. But how is that relevant? Nobody can read the law (the annotated copy), so nobody knows that wiping the servers is destroying evidence, and therefore illegal? I doubt that that's how this went down...

False. You don't need to pay to read the laws, but you do need to pay if you want to read a private groups annotations to the laws, which include things like judicial rulings. The annotations are a value add and not required to understand or practice law in GA. You can also access the judicial rulings and all other sources which the annotations are derived from for free, but you would need to put the work in yourself to compile that data.

It's not quite that clear cut. Georgia places unusual weight to these specific annotations so simply having access to the rulings will not result in the same exact output.

Yes it’s very unusual. The official version is the annotated one, and the annotations have legal force.

Supposedly the annotated version is actually the official Georgia code.

Georgia is somewhat unique in that the annotations actually are part of the codified law. You absolutely do need the annotations to practice, because they are authoritative. So not "false" after all.

It is obstruction of justice.

Reply on news.ycombinator.com