Cybersecurity report probes Supt. Walters' TV history: 'We may never know what actually happened'

A newly released cybersecurity report was conducted to support law enforcement's investigation, which involved a forensic examination of the smart television in the state superintendent’s office.

RELATED: OSDE board members respond to Speaker Hilbert's claims on Walters' investigation: 'We are deeply disturbed'

The report was requested by the Oklahoma Office of Management and Enterprise Services and was conducted by Alias Cyber Security. According to the report, “The goal was to identify any available data related to device usage, content access, and potential sources such as streaming services, screen mirroring features, or external input devices.”

Report logistics

1. “A forensic examination of a smart television to assess whether it was possible to determine what content may have been displayed during a specific timeframe in the recent past, and to identify the source of that content.”
2. Investigators examined the TV, including HDMI inputs, coaxial connections, and network interfaces, and reviewed internal system settings and smart application configurations.

Key finding

“No conclusive evidence was identified to either confirm or deny that particular content was displayed on the television during the timeframe of interest.”

“It essentially said: we're going to have to rely upon witness testimony and further investigations and interviews in order to determine what actually happened here,” said Collin Walke, Hall Estill's Cybersecurity & Data Privacy practice.

Walke explains the difficulty of looking at the history of what was shown on a TV like the one that was in Walters’ office. 

“In this particular circumstance, I think it's gonna be very difficult to prove from a technical perspective. The TV does not keep the same kind of logs that a computer does,” said Walke. “So everything you do on your computer you can pretty much go back and trace. You can look at what files were looked at, when they were looked at, when they were opened, whether you forwarded them on whether you downloaded them.”

“In this particular case dealing with this type of TV, it’s not capable of telling you what was viewed, when it was viewed, how it was viewed,” said Walke.

Those sentiments were echoed in the cybersecurity report.

“The device’s limited logging capabilities and lack of retained viewing or playback history prevented the ability to verify whether specific media had been accessed.”

The report goes on to say:

“While the forensic analysis of the smart television did not yield conclusive evidence regarding the display of specific content during the timeframe in question, the device’s configuration indicated that remote casting and screen-sharing features, such as Apple AirPlay, were enabled. This suggests that content could have been transmitted to the television from an external device without leaving a persistent record on the TV itself.”

“The room itself isn't necessarily secure, there are a lot of people that can come in and out of that room,” said Walke. “I can tell you that at the capitol it's quite frequent for legislators to go into other legislators offices and you would be watching a TV and somebody at that point could play apple play and share their screen from their phone onto a different representative’s TV.”

“So that is a feasible option even if there is a passcode on it,” said Walke.

The conclusion of the report states: “Due to the device’s limited logging functionality and the absence of any retained viewing or playback history, it was not possible to determine whether specific media content had been accessed or displayed. This lack of historical data significantly constrained the scope of the forensic analysis. Consequently, no definitive evidence could be established to either confirm or refute the viewing of particular content on television during the timeframe in question. Without corroborating logs or playback records, the investigation remains inconclusive regarding media activity on the device.”

Regardless of the outcome of the investigation, Walke says this is an example of why government leaders should take a second look at their cybersecurity, privacy and protections.  

“Because if somebody was capable of going into State Superintendent Ryan Walters' office and showing something that he didn't want there, it begs the question of how they gained access to do that in the first place,” said Walke. “We are lagging behind, and I think this is another example of something we need to do to improve our security systems.”