LA Sec of State website down on National Voter Registration Day (1 Viewer)

[TaylorB]

The website for Louisiana's Secretary of State -- headed by Republican Kyle Ardoin -- was down for "scheduled maintenance" yesterday until midnight. Here's what the site looked like:

Yesterday was National Voter Registration Day, a civic holiday observed since 2012. In the context of Ardoin's other efforts to keep people from casting ballots, the move has the hallmarks of voter suppression. Ardoin denied any political gamesmanship, calling the move "an unfortunate error":

Louisiana voting website down on voter registration day was 'unfortunate error'

Pilloried with angry criticism and accusations of nefarious intent, Secretary of State Kyle Ardoin had a more human reason for the state’s online voter registration website being down on the

www.theadvocate.com

This afternoon, I sent a public records request to Ardoin's office seeking any and all records pertaining to this "maintenance."

Ardoin's office generally has three days to respond, but it's likely they'll seek to delay compliance. This shouldn't have to be said, but it is not the job of the Secretary of State to ensure that people do not register to vote.

 

[TaylorB]

OK, I've had a quick scan through, and I can't add much. Their Director of Special Projects wrote an email post-update claiming it was "required to ensure our continued cybersecurity posture and to prepare for the heavy traffic we expect between now and Election Day", but that's the only direct mention of security.

The update notes in the release aren't complete; it refers to the build notes being found elsewhere and the items listed are 'additional changes that may impact your division'. Of those, one is a security feature (multi-factor authentication on the Vote Import site) as opposed to an urgent fix, and the performance update seems to be a change to 'make the process of locking Commissioner files more efficient', where it does note that there were 'some reports of this operation taking an unusual amount of time when performed on election night.' But it's not impossible that there were other bug fixes or security vulnerabilities being patched that aren't listed in the 'additional changes'.

It is plausible that the updates could take three hours and require front-ends to be down; if, for example, the changes requires updates to a large database on the backend, and for that database to be offline while the operations are performed, that can take quite a while. I don't know about ERIN specifically of course. This - https://gcrincorporated.com/elections-registration-information-network-erin/ - suggests it's '24/7/365' for 'availability and reliability', but if that's applicable, it was also built on .NET and SQL Server in 2006, so it may be creaking a bit after fourteen years of patches, updates, and extra originally unanticipated features being shoehorned in there. So regardless of the '24/7/365' claim there, I couldn't say that the downtime in itself is inherently implausible.

I don't know for sure what "starting the release at 8 pm to give the registrars more time to work their queues" means, but if the system going offline prevents registrar data entry, I'd hazard a guess it's just referring to pushing the release a couple of hours past the end of the working day to try to ensure they've all finished before the update.

Overall, it's what's not there that stands out; there's not a lot of internal discussion at all. The key part of determining the date for the update is just referred to, "as we discussed this morning," so all that tells us is that (at least) the IT Deputy Director and the Commissioner of Elections discussed it. The implication is that the latter requested the move, since that email chain has her being concerned about the original. There's also an email from her after the downtime, stating, "I am going to draft a plan for ERIN updates to try and help us prevent this in the future." And maybe the plan says, "Everyone, mark National Voter Registration Day in your calendars." But without more insight into how that process ran this time, I don't think it's going to be possible to determine whether it's, "None of us realised what day it was," or, "Some of us didn't realise what day it was, and some of us are just pretending we didn't."

And the only other thing I'd note is they've tried to redact out the ERIN Build number wherever it appears for some reason, but they missed one in the subject of an embedded forwarded email. Oops. Not that I can see why that'd be significant, but presumably someone thinks it might be if they were redacting it.

This is extremely thorough and helpful. I can’t respond meaningfully at the moment, but I will. Thanks for all the work to clarify this, Rob!