Florida Governor Says Russian Hackers Breached 2 Counties In 2016

Enlarge this image toggle caption Rhona Wise/AFP/Getty Images Rhona Wise/AFP/Getty Images

Russian hackers breached the systems of two county elections systems in Florida in 2016, Florida Gov. Ron DeSantis said Tuesday at a news conference. DeSantis said no data were tampered with and vote tallies were not affected.

The intrusions, which had not ever been publicly confirmed, were first disclosed in special counsel Robert Mueller's report about Russian interference in the 2016 election last month.

"I recently met with the FBI concerning the election issue mentioned in the Mueller report," DeSantis said. "Two Florida counties experienced intrusion into the supervisor of election networks. There was no manipulation."

DeSantis said he could not disclose which counties' networks were compromised, but he said the voter data that the attackers gained access to was already public.

"Nothing that affected the vote count," DeSantis said.

One sentence in the Mueller report prompted DeSantis' meeting with the FBI: "We understand the FBI believes that this operation enabled [Russian military intelligence] to gain access to the network of at least one Florida county government" during the 2016 election.

The mention that Russian hackers had accessed Florida networks came as a surprise to many in the state.

"I haven't heard even a whisper" about such a breach, said Paul Lux, president of the Florida State Association of Supervisors of Elections in an interview with NPR last month.

To break into the Florida elections systems, the Russian hackers used a spear-phishing campaign, where they used email addresses designed to look like a voting system vendor to trick the election officials into giving them access to their networks.

A leaked document from the National Security Agency in 2017 identified the company as Florida-based VR Systems.

The campaign was detailed in an indictment filed last summer by Mueller's office:

In or around November 2016 and prior to the 2016 U.S. presidential election, KOVALEV and his co-conspirators used an email account designed to look like a Vendor 1 email address to send over 100 spearphishing emails to organizations and personnel involved in administering elections in numerous Florida counties. The spearphishing emails contained malware that the Conspirators embedded into Word documents bearing Vendor 1's logo.

Last year, former Florida Sen. Bill Nelson warned that Russia had "penetrated" Florida's voter registration systems, but election officials denied that vehemently at the time.

Then-Gov. Rick Scott, who defeated Nelson in the Senate race, decried Nelson's claims and said they "only serve to erode public trust in our elections at a critical time." </s> The Mueller report confirmed at least one Florida elections office was compromised by Russia during the 2016 vote.

This Thursday the FBI will hold a classified briefing with members of the Florida congressional delegation to discuss the hacking.

Former Leon County Elections Supervisor Ion Sancho told the Florida Roundup why the FBI has not been transparent.

“The FBI actually lied to the 67 supervisors of elections and the secretary of state staff that was on that call,” said Sancho.

“The penetration had already taken place, but the FBI did not want to inform the Russians and so they didn’t inform us.”

According to Politico, Governor Ron DeSantis is also expected to meet with the FBI.

Last month DeSantis expressed frustration that Florida officials didn’t know more about the incident. </s> Florida finds familiar territory with allegations of voter fraud and accusations of voter suppression dashing between Republicans and Democrats as the state prepares for an election recount.

Florida Secretary of State Ken Detzner on Saturday ordered a machine recount, which includes three key races: Florida governor, Florida agriculture commissioner and U.S. Senate.

"Trying to STEAL two big elections in Florida! We are watching closely!" President Donald Trump wrote on Twitter on Saturday after the recount was announced.

Trump on Friday said that Broward County "miraculously started finding Democrat votes" after Democrats sent Marc Elias – "their best Election stealing lawyer."

"Don’t worry, Florida - I am sending much better lawyers to expose the FRAUD!" Trump wrote.

Ron DeSantis, the Republican candidate who in the first unofficial results was ahead of Andrew Gillum by a margin of 0.41 percent, released a video statement on Saturday in which he said he was preparing to serve as Florida's governor

DeSantis – described in the video as the "governor-elect" – said Florida voters chose him to lead, citing "clear and unambiguous" results.

"It is important that everyone involved in the election process strictly adhere to the rule of law, which is the foundation for our nation. Since the election a few days ago, we have begun our transition efforts to build an administration that can secure Florida's future," DeSantis said. "With the election behind us, it's now time to come together as a state as we prepare to serve all Floridians."

Rick Scott's campaign spokesman, Chris Hartline, released a statement in which he said Scott won a "close but decisive victory" with a 0.15 percent margin.

"It’s time for Senator Nelson to accept reality and spare the state of ... Florida the time, expense and discord of a recount," Hartline wrote.

Matt Caldwell, the Republican candidate for Florida agriculture commissioner, said he filed a lawsuit against Broward County Supervisor of Elections Brenda Snipes to "hold her accountable, follow Florida law and uphold the integrity of our elections."

Though Caldwell was initially leading on Election Day, Democratic candidate Nikki Fried surpassed Caldwell in the first unofficial results and holds a lead of 0.06 percent.

Despite accusations of wasting taxpayer dollars and voter fraud, Democrats are not backing down and are even suggesting or outright accusing Republicans of attempts to suppress votes.

"I am replacing my earlier concession with an unapologetic and uncompromised call to count every vote," Gillum said in a press conference.

"This process is about one thing: making sure every legal ballot is counted and protecting the right of every Floridian to participate in our democracy," Nelson wrote on Twitter.

Sen. Bernie Sanders, D-Vt., who endorsed and campaigned with Gillum, also called for every vote to be counted.

"No surprise. Law enforcement says Rick Scott’s allegation of voter fraud was not based in reality. He and Trump are just trying to undermine the results if he loses," Sanders wrote on Twitter.

Soon after the first unofficial results were released, Fried said that her campaign was "confident that once the votes were counted we would win the Agriculture Commissioner race!"

"Now that the deadline has come & the votes have been processed, the people’s will is clear – I’m honored to serve as Florida’s next Commissioner of Agriculture," Fried wrote on Twitter.

U.S. Rep. Frederica Wilson, who serves in Florida's District 24, said that Scott and Sen. Marco Rubio "are making reckless and unfounded accusations about the midterm election in an attempt to prevent every vote from being counted. What are they afraid of?" </s> Hackers targeted voter registration systems in Illinois and Arizona, and the FBI alerted Arizona officials in June that Russians were behind the assault on the election system in that state.

The bureau described the threat as "credible" and significant, "an eight on a scale of one to 10," Matt Roberts, a spokesman for Arizona Secretary of State Michele Reagan (R), said Monday. As a result, Reagan shut down the state's voter registration system for nearly a week.

It turned out that the hackers had not compromised the state system or even any county system. They had, however, stolen the user name and password of a single elections official in Gila County.

Roberts said FBI investigators did not specify whether the hackers were criminals or employed by the Russian government. Bureau officials on Monday declined to comment.

The Arizona incident is the latest indication of Russian interest in U.S. elections and party operations, and follows the discovery of a high-profile penetration into Democratic National Committee computers. That hack produced embarrassing emails that led to the resignation of DNC Chairwoman Debbie Wasserman Schultz and sowed dissension on the eve of Hillary Clinton's nomination as the party's presidential candidate.

The Russian campaign is also sparking intense anxiety about the security of this year's elections. Earlier this month, the FBI warned state officials to be on the lookout for intrusions into their elections systems. The "flash" alert, which was first reported by Yahoo News, said investigators had detected attempts to penetrate election systems in several states and listed Internet protocol addresses and other technical fingerprints associated with the hacks.

In addition to Arizona, Illinois officials discovered an intrusion into their elections system in July. Although the hackers did not alter any data, the intrusion marks the first successful compromise of a state voter-registration database, federal officials said.

"This was a highly sophisticated attack most likely from a foreign (international) entity," said Kyle Thomas, director of voting and registration systems for the Illinois State Board of Elections, in a message that was sent to all election authorities in the state.

The Illinois hackers were able to retrieve voter records, but the number accessed was "a fairly small percentage of the total," said Ken Menzel, general counsel for the Illinois elections board.

State officials alerted the FBI, he said, and the Department of Homeland Security also was involved. The intrusion in Illinois led to a week-long shutdown of the voter registration system.

The FBI has told Illinois officials that it is looking at foreign government agencies and criminal hackers as potential culprits, Menzel said.

At least two other states are looking into possible breaches, officials said. Meanwhile, states across the nation are scrambling to ensure that their systems are secure.

Until now, countries such as Russia and China have shown little interest in voting systems in the United States. But experts said that if a foreign government gained the ability to tamper with voter data - for instance by deleting registration records - such a hack could cast doubt on the legitimacy of U.S. elections.

"I'm less concerned about the attackers getting access to and downloading the information. I'm more concerned about the information being altered, modified or deleted. That's where the real potential is for any sort of meddling in the election,"said Brian Kalkin, vice president of operations for the Center for Internet Security, which operates the MS-ISAC, a multistate information-sharing center that helps government agencies combat cyberthreats and works closely with federal law enforcement.

James R. Clapper Jr., the director of national intelligence, has told Congress that manipulation or deletion of data is the next big cyberthreat - "the next push on the envelope."

Tom Hicks, chairman of the federal Election Assistance Commission, an agency set up by Congress after the 2000 Florida recount to maintain election integrity, said he is confident that states have sufficient safeguards in place to ward off attempts to manipulate data.

For example, if a voter's name were deleted and did not show up on the precinct list, the individual could still cast a provisional ballot, Hicks said. Once the voter's status was confirmed, the ballot would be counted.

Hicks also said the actual systems used to cast votes "are not hooked up to the Internet" and so "there's not going to be any manipulation of data." However, more than 30 states have some provisions for online voting, primarily for voters living overseas or serving in the military.

This spring, a DHS official cautioned that online voting is not yet secure.

"We believe that online voting, especially online voting in large scale, introduces great risk into the election system by threatening voters' expectations of confidentiality, accountability and security of their votes and provides an avenue for malicious actors to manipulate the voting results," said Neil Jenkins, an official in the department's Office of Cybersecurity and Communications.

Private-sector researchers are also concerned about potential meddling by Russians in the U.S. elections system. Rich Barger, chief information officer at ThreatConnect, said that several of the IP addresses listed in the FBI alert trace back to a website-hosting service called King Servers that offers Russia-based technical support. Barger also said that one of the methods used was similar to a tactic employed in other intrusions suspected of being carried out by the Russian government, including one this month on the World Anti-Doping Agency.

"The very fact that [someone] has rattled the doorknobs, the very fact that the state election commissions are in the cross hairs, gives grounds to the average American voter to wonder: Can they really trust the results?" Barger said.

Earlier this month, DHS Secretary Jeh Johnson held a conference call with state elections officials, offering his assistance in protecting against cyberattacks.

Johnson said that DHS was "not aware of any specific or credible cybersecurity threats relating to the upcoming general election systems," according to a readout of the call.

It was not clear whether he was aware at the time of the FBI's investigations in Arizona and Illinois. </s> On Saturday, the Florida secretary of state announced that the races for governor, senator, and agriculture commissioner are all officially headed for a recount. According to the Washington Post, Republican Rick Scott’s lead for Senate has shrunk to just over 12,000 votes, while gubernatorial candidate Republican Ron DeSantis is leading by about 33,000 votes. The Florida election has once again gained national attention as accusations of fraud and problems with ballots have brought the races to the forefront of the midterm elections.

In his race against Democrat Senator Bill Nelson, Governor Rick Scott leads by just 12,500 votes. Rick Scott’s campaign has accused Broward County election supervisor Brenda Snipes of election fraud after she was forced to admit that she had counted about a dozen rejected ballots.

“Three days after Election Day, the vote tally continues to change and Supervisor Snipes still refuses to explain where and how the new votes came to light,” the campaign said. “The public deserves a clear and direct answer.”

After vote counts were made public, Scott’s campaign called for Nelson to concede the election and spare the cost of a recount, but Nelson stayed the course. Meanwhile, Scott escalated tensions by claiming, without evidence, that “left-wing activists” were attempting to steal the election.

President Trump has joined in the accusations, spending the past few days tweeting about the midterm elections, calling into question the results.

“Law Enforcement is looking into another big corruption scandal having to do with Election Fraud in Broward and Palm Beach. Florida voted for Rick Scott!” he tweeted on Friday.

Trump suggested that the narrowing margin between Scott and Nelson is attributed to fraud.

“Rick Scott was up by 50,000+ votes on Election Day, now they “found” many votes and he is only up 15,000 votes. ‘The Broward Effect.’ How come they never find Republican votes?” he said.

The race for governor between Representative Ron DeSantis and Democrat Mayor Andrew Gillum has a wider gap, but is still within the margin for a recount. The president commented on the race, saying that Gillum had conceded the election, but was now “back in play.” “This is an embarrassment to our Country and to Democracy!” he wrote.

The Florida Department of State, which is run by individuals appointed by Scott, said that no evidence of criminal activity was found. After the news of the Florida recount was announced, Trump once again took to Twitter to call the process an attempt to “steal” the election. “Trying to STEAL two big elections in Florida! We are watching closely!” he said.

Andrew Weinstein, a representative for the Democratic Lawyers Council, countered Trump’s claims of fraud, saying that more Democratic votes have been counted in the past few days as the Broward County results come in because there are more Democrats in that county.

“Florida has never had a full statewide recount. It’s about to have three,” he said. “Buckle up.”

Florida has until Thursday to complete the recount. </s> Hackers targeted voter registration systems in Illinois and Arizona, and the FBI alerted Arizona officials in June that Russian hackers were behind the assault on the election system in that state.

The bureau told Arizona officials that the threat was “credible” and severe, ranking as “an 8 on a scale of 1 to 10,” said Matt Roberts, a spokesman for the secretary of state’s office.

As a result, Secretary of State Michele Reagan shut down the state voter registration system for almost a week.

It turned out that the hackers did not succeed in compromising the state system or even any county system, but rather had managed to steal the user name and password for one Gila County elections official.
• August 15, 2016 Hotels in 10 states, including Colorado, and D.C. may have been hit by hackers Nonetheless, the revelation comes amid news that the FBI is investigating suspected foreign hacks of state election computer systems, and earlier this month warned states to be on the alert for intrusions.

In Illinois, officials discovered an intrusion into their state voter registration system in July.

The FBI’s Aug. 18 warning follows heightened concern over Russian hacks of Democratic Party organizations and possible meddling in the presidential election.

Although the hackers did not alter any data, the intrusion into the Illinois database marks the first succesful compromise of a state election database, federal officials said.

Until now, countries such as Russia and China have shown little interest in voting systems in the United States. But experts said that if a foreign government gains the ability to tamper with voter data, for instance by deleting registration records, such a hack could cast doubt on the legitimacy of U.S. elections.

Meanwhile, the recently discovered hacks have state officials across the country scrambling to ensure that their systems have not been compromised. At least two other states are looking into potential breaches, officials said.

“This was a highly sophisticated attack most likely from a foreign (international) entity,” said Kyle Thomas, director of voting and registration systems for the Illinois State Board of Elections, in a message that was sent to all election authorities in the state.

In July, officials in that state discovered the intrusion, in which hackers were able to retrieve voter records. The amount accessed was “a fairly small percentage of the total,” said Ken Menzel, general counsel for the Illinois elections board.

State officials alerted the FBI, he said. The Department of Homeland Security also got involved, he said. The intrusion led the state election board to shut down the voter registration system for a week.

In June, the Arizona Secretary of State’s office shut down part of its website after the FBI found a potential threat to its state voter registration system, according to the Arizona Republic.

Following those breaches, the FBI issued its “flash” alert, which listed Internet protocol addresses and other technical fingerprints associated with the hacks.

“The FBI is requesting that states contact their Board of Elections and determine if any similar activity to their logs, both inbound and outbound, has been detected,” said the FBI alert, which was first reported by Yahoo News.

The FBI declined official comment other than to note it “routinely advises private industry of various cyber threat indicators” it turns up in investigations.

The bureau has told Illinois officials that they’re looking at possible foreign government agencies as well as criminal hackers, Menzel said.

The technical details in the alert were gathered by the MS-ISAC, a multi-state information-sharing center that helps state, local and tribal government agencies combat cyber threats and that works with federal law enforcement agencies.

“I’m less concerned about the attackers getting access to and downloading the information,” said Brian Kalkin, vice president of operations for the Center for Internet Security, which operates the MS-ISAC. “I’m more concerned about the information being altered, modified or deleted. That’s where the real potential is for any sort of meddling in the election.”

And James Clapper, the Director of National Intelligence, has told Congress that ma­nipu­la­tion or deletion of data is the next big cyber threat–”the next push on the envelope.”

But Tom Hicks, chairman of the federal Election Assistance Commission, an agency set up by Congress after the 2000 Florida recount to maintain election integrity, said he is confident that states have sufficient safeguards in place to ensure efforts at ma­nipu­la­tion will be unsuccesful.

For one, he said, if a voter’s name does not show up on the list, the individual can still cast a provision ballot and once his or her status is confirmed, the ballot will be counted. Also, he said, in general the voting systems themselves “are not hooked up to the Internet” and so “there’s not going to be any ma­nipu­la­tion of data.”

Nonetheless, more than 30 states have some provisions for online voting, primarily for voters living overseas of serving in the military. An official at the Department of Homeland Security cautioned this spring that online voting is not yet secure.

“We believe that online voting, especially online voting in large scale, introduces great risk into the election system by threatening voters’ expectations of confidentiality, accountability and security of their votes and provides an avenue for malicious actors to manipulate the voting results,” Neil Jenkins, an official in the Office of Cybersecurity and Communications at the Department of Homeland Security,

Some private-sector researchers say some of the information released by the FBI points to a potential Russian link, but they caution that their work is preliminary. Rich Barger, chief information officer at ThreatConnect, said that several of the IP addresses trace back to a website-hosting service called King Servers that offers Russia-based technical support. He also said that one of the methods used was similar to a tactic in other intrusions suspected of being carried out by the Russian government, including one this month on the World Anti-Doping Agency.

“The very fact that [someone] has rattled the doorknobs, the very fact that the state election commissions are in the cross-hairs gives grounds to the average American voter to wonder: Can they really trust the results?” said Barger.

On Aug. 15, Homeland Security Secretary Jeh Johnson held a conference call with state election officials, offering the Department of Homeland Security’s assistance in protecting against cyberattacks.

He said that DHS was “not aware of any specific or credible cybersecurity threats relating to the upcoming general election systems,” according to a readout of the call. It was not clear whether he was aware at the time of the FBI’s investigation into the Arizona and Illinois intrusions.
Florida Governor Ron DeSantis announces that Russian hackers accessed voter databases in two Florida counties prior to the 2016 presidential election. No data or vote tallies were affected.