It's not that formalized or that well thought out of a process overall. How voting is conducted is fairly federated, and CES had a huge unsecured dump of voting

It's not that formalized or that well thought out of a process overall. How voting is conducted is fairly federated, and CES had a huge unsecured dump of voting data from all over the state open to anyone who knew about it. The guy at the Black Hat conference covered it pretty completely, I think. Just assume that the people involved in the voting process don't understand data management and storage practices or things like access control or asset value and have no budget to train or retain, and it makes sense. The upload interface was depracated, unpatched Drupal of that's any indication of their IT effort. Set it and forget it. From what I was told, the FBI already had copies of the data, and I'm sure a college who gave the state some space and services to run things didn't want to be responsible any more than a datacenter would want to be for hoating a MEGA storage node after the Dotcom raid. Get the hot potato out of there, let the law enforcement handle it. This means no data was lost or rendered unavailable, just that it would be the FBI's responsibility to furnish that evidence in event of any further lawsuits.