Security expert arrested after allegedly failing to report flaws in election website

David Levin, who is the chief technology officer of pen-testing firm Vanguard Cybersecurity, was testing the Lee County elections website for SQL injection vulnerabilities in December. He was reportedly using Havij, a free SQL testing software.

Levin claimed that the website was largely unencrypted and he could, if he wished, have stolen personal data that it had stored, including usernames and passwords, according to reports. Levin went on to publish a video online in January with local politician Dan Sinclair, who will be running for supervisor of elections in the county, where they revealed the vulnerabilities.

Police subsequently issued a warrant for his arrest on three counts of third-degree felony property crimes. He turned himself in and was later released on $15,000 bail.

The point of contention in Levin’s work is not that he found vulnerabilities but rather that he was able to harvest this at-risk data using a third-party tool. He then used some of this data to log in to the website as part of his testing, according to reports. Secondly, he only notified the election authorities after the video was published.

Troy Hunt, another security researcher, wrote that the lack of security put in place by Lee County was “egregious” but Levin should have stopped when he realized what he had discovered and immediately contacted the authorities.

“Dave obviously found a serious risk, but rather than just stopping there and reporting it, he pointed a tool at it that sucked out a volume of data,” said Hunt.

Levin has since taken commented on his actions. “I let hubris get the best of me,” he tweeted.

The incident has taken on a political element, too, with Sinclair accusing Sharon Harrington, the current supervisor of elections and his opponent in the election for that office, of using the arrest to smear him.

“Dave didn’t do anything wrong,” he said in defense of the researcher. “This is political corruption.”

Sinclair told local media that he did not ask Levin to hack any sites for him and that Levin had approached him about his discovery.