The Denver district attorney’s office has begun an investigation to find out how many Colorado voting machine passwords ended up online.

Voting machine passwords for equipment in 34 of Colorado’s 64 counties were listed on a hidden tab on a spreadsheet posted on the Secretary of State’s website in June. The state removed the passwords on Oct. 24 after an election vendor discovered it. The public first became aware of it through an announcement by the Colorado GOP.

A spokesman for the Denver district attorney’s office would not provide more information about the ongoing investigation, other than to confirm that it is ongoing.

It is not the only prosecutor’s office with an eye on data breaches.

The El Paso County District Attorney’s Office said in a news release Friday that it began looking into the situation after receiving two affidavits alleging violations of state law.

In 2022, state lawmakers responded Tina Peters data breach by passing a law that “any person who knowingly publishes or causes to be published passwords or other confidential information relating to a voting system shall be immediately revoked authorized access and is guilty of a Class 5 felony.”

The El Paso County District Attorney’s Office said it will cooperate with the Denver investigation and provide resources as needed.

“This office will review the investigation conducted by the Denver District Attorney’s office to determine whether further investigation should be conducted and which office is best suited to complete any additional investigation,” the statement concluded.

Office of the Secretary of State characterized the violation as accidental.

Secretary of State Jena Griswold said as far as she knows, the spreadsheet, including the hidden tab, was originally created by an employee who left the office on amicable terms earlier this year and by a later employee who apparently was unaware of the hidden situation . data, posted the spreadsheet online. That person still works for the state.

The visible portions of the spreadsheet also contained other information about voting machines that Colorado must make public.

Hart Van Denburg/CPR News

Through it all, state, local officials and equipment manufacturers have emphasized that Colorado’s election equipment remains safe. BIOS passwords, which allow access to a type of “firmware” or low-level software that controls hardware functions, cannot be accessed remotely. Passwords can only be entered into the machines by personnel, and they are stored in Colorado counties in locked rooms under 24-7 video surveillance, with access limited to a small number of vetted personnel.

What are the Colorado car bios passwords?

Griswold’s office hired attorney David Powell, with the Denver law firm Garnett Powell Maximon Barlow & Farbes, to conduct a personnel investigation. She said she would release the results as permitted by law.

“It is our understanding that there is no evidence that the staff who posted the spreadsheet were aware of the hidden tab,” Griswold told CPR News.

Democratic lawmakers interviewed by CPR News said they support an outside investigation, but that it is premature to comment on whether the scope of Griswold’s staff investigation will meet their request.

“I think we need to look at how something like this could happen,” said House Democratic Speaker Julie McCluskie. “I think it’s wise to have that perspective from outside the department, and I certainly think it helps all of us continue to see what more we can do to ensure election security going forward.”

When the situation came to light, some Republicans on the legislature’s bipartisan Audit Committee called for an emergency meeting and called for a formal audit.

However, McCluskie said he didn’t see that as the best approach.

“It felt like a political play to throw the Legislative Audit Commission into the mix for the group to review this situation.”

Democratic Sen. Dafna Michaelson Jenet is on the committee and does not believe an audit is necessary at this time.

“An audit takes about a year. What we need now is an independent, swift investigation to find out what is going on. If something untoward is discovered, then a full audit would be appropriate.”

Michaelson Jenet said he will also need more details to determine whether the investigation led by Powell, the attorney hired by the secretary of state’s office, constitutes a sufficient external examination.

“I didn’t look at the credentials of who was hired at this point,” Michaelson Jenet said.

Republican Rep. Lisa Frizell, the current chairwoman of the audit committee, plans to introduce a proposal to audit the secretary of state in the coming weeks. The commission is scheduled to meet in December.