I hacked an election. So can the Russians.
Tuesday’s primary is a dry run for democracy in a tense time of cyber-threats. It will be the most thorough test of voting operations since Russian operatives tried to hack Florida voting rolls before the 2016 presidential election.
But it’s not one election, it’s 67 — one in every county from the Key West to Pensacola.
As counties plan for what’s often a low-turnout election, they have spent millions of dollars safeguarding computer servers, installing surveillance cameras and card readers, building security barriers and training workers to detect threats they can’t see.
“We want to make sure that our employees know what a phishing email looks like,” says Lisa Lewis, supervisor of elections in Volusia County, a county the Russians targeted two years ago. “If there’s no subject line, I tell people, ‘Don’t open it.’ ”
Election workers have taken cyber-security training classes, the Department of Homeland Security has inspected counties’ operations and a U.S. senator has issued ominous and unproven warnings that Russians are meddling in voting records.
It happened before. In 2016, Russians tried to penetrate voting systems in at least five counties: Hillsborough, Pasco, Citrus, Clay and Volusia, according to the National Security Agency, and Russian actors targeted VR Systems, a vendor that sells voter registration software to most Florida counties.
Like most states, Florida’s voting apparatus is decentralized. Votes are counted in 67 places and merged into a final result in Tallahassee, giving bad actors a multitude of options to disrupt a system seen as highly vulnerable to intrusions, or “a beacon for interference,” as U.S. Sen. Marco Rubio describes it.
“We must remain vigilant,” Gov. Rick Scott told election supervisors in a letter, placing the responsibility clearly on them. “You are each tasked with a sacred duty to protect the right of Florida voters.”
Florida’s front-line election supervisors are elected, like sheriffs, and they zealously guard their independence from the state elections operation, which is run by a political appointee of the governor.
Tensions between counties and the state are common, and counties realize that if all goes right this election year, Scott will take a bow, and if things go badly, the counties will get the blame.
“Those of us whose names are on the door are responsible for making sure that an election goes smoothly,” says Paul Lux, the supervisor of elections in Okaloosa County.
To improve election security, the state divided $15.5 million in federal money among counties and told them it must be spent for this election cycle only, a condition many counties opposed as short-sighted, because technology keeps changing and the threat will still be there in 2020 and beyond.
“There are threats tomorrow that are not known today,” says Clay County Supervisor of Elections Chris Chambless.
By waiting until late May to request the federal money and by imposing a July 18 deadline for counties to submit security plans, Scott’s administration forced counties to spend money faster than they would prefer and to forgo long-term fixes.
Exactly how all the security money is being spent is largely a secret.
Counties, acting on advice from Scott’s Division of Elections, blacked out many details of security enhancement plans in response to public records requests by the Herald/Times, citing confidentiality provisions in federal and state law.
Pinellas County earmarked $263,000 for a specific purchase that’s blacked out in its plan. Miami-Dade blacked out or redacted its performance goals and 10 budget items totaling more than $1 million.
“They’re awfully heavy-handed with redactions,” says Dan McCrea of Verified Voting, a nonpartisan watchdog group. “I think these officials could do a better job of providing a level of transparency that allows the public to know exactly what’s being addressed.”
The state and counties say it makes no sense for every detail of their security plans to be known. But if something goes awry, the public will have little knowledge of whether the money was spent properly.
“It’s a balancing act,” says Pasco Supervisor of Elections Brian Corley. “We’re telling voters, ‘We’re doing everything we can do, and you just have to trust us.’”
The role classified information plays in elections was highlighted by Democratic U.S. Sen. Bill Nelson’s surprise and cryptic assertion earlier this month that Russians have penetrated county systems. That assertion was followed by a charge from Scott, his opponent in this fall’s Senate race, that Nelson is recklessly scaring Floridians without proof.
The dispute baffled elections officials. If Nelson’s comments were true, that meant vital information was not being shared with them at the same time they are reassuring voters that they know of no current threats.
“This is like me telling you, ‘Watch out.’ ‘Watch out for what?’ ‘Well, I can’t tell you,’ ” said Lux, who once held a top-secret clearance as an Army intelligence officer. “How does that help anybody?”
Florida’s other senator, Republican Rubio, says that for the second year in a row, he has worked to provide security clearances for state elections officials. Rubio says the Russia threat is distinct, and he’s pushing bipartisan legislation that would retaliate against interference with economic sanctions.
Rubio sounded an earlier alarm when he claimed that some local elections officials were overconfident and not taking threats seriously enough. He didn’t name names, but it sparked a backlash from counties.
“It’s important that all of them take this seriously, even if you think you are too small for someone to target you,” Rubio told the Herald/Times.
County officials say Florida’s wide five-week voting window acts as an early warning system that would reveal irregularities long before Election Day.
If past trends continue, more than two-thirds of all participating voters will have cast ballots before polls open on Tuesday.
Nearly all Florida voters cast ballots on an optical scan voting system that provides a paper trail in case problems occur. But a national voting expert says there’s no way any state can be immune to threats.
“Even if you build up the strongest wall possible, there is no system that is completely un-hackable,” said David Becker of the Center for Election Innovation and Research in Washington. “You need to make sure, as Florida does, to take backups of the voter registration database, and have plenty of provisional ballots.”
Contact Steve Bousquet at email@example.com. Follow @stevebousquet.