Outside investigation faults Griswold in Colorado election breach

Driving the news: An independent investigation conducted by the Baird Quinn law firm on behalf of the Secretary of State's Office determined that election equipment passwords were "mistakenly, unknowingly and unintentionally" posted online.

• The secretary and the office were cited for violating state information security rules, but no repercussions are expected.

Catch up quick: The BIOS passwords to election equipment in 34 counties were posted online on June 21 but not discovered by the state until Oct. 24.

• Griswold, the state's elections chief, did not disclose the breach until five days later when the Republican Party made it public.
• The secretary said the disclosure posed no immediate threat to the state's election system and all the passwords for voting equipment were reset before Election Day.

Zoom in: The former employee who created the spreadsheet that contained the passwords was not admonished because she left the office before the material was posted.

• Other staff who put the spreadsheet on the secretary's website avoided blame because they didn't know it contained hidden tabs with passwords.

The intrigue: The secretary's office did not release the full report — making it difficult to gauge the extent of the investigation.

• A Griswold spokesperson refused to say whether any employees were disciplined.
• Griswold recently told lawmakers the investigation is expected to cost up to $30,000, but the full cost remains unknown.

What's next: The investigation made seven recommendations to avoid the disclosure of confidential information in the future by updating various procedures and policies, such as storing all passwords in a digital safe rather than hidden spreadsheet tabs.

• In a statement, Griswold thanked the law firm for "their thorough review" and said her office is committed to implementing the recommendations.