Child’s play or a signs of a serious security problem in one of the nation’s swing states?
That’s the question confronting Florida election officials who are pushing back against reports that an 11-year-old hacked a replica of the state’s election website.
Multiple media outlets over the weekend reported that children at a hacking conference in Las Vegas were able to easily hack into a version of the website that reports election results to the public. An 11-year-old boy got into Florida’s site within 10 minutes, while an 11-year-old girl did it in 15 minutes, according to the organizers of the event called DEFCON Voting Machine Hacking Village.
State officials contend there’s no way that the replica used by hackers is an actual representation of the state’s website.
“This was a mock site with likely very few, if any, security measures in place,” said Sarah Revell, a spokeswoman for Secretary of State Ken Detzner. “It is not a real-life scenario and it offers a wholly inaccurate representation of the security of Florida’s elections websites, online databases and voting systems that does not take into account the state-of-the-art security measures the Florida Department of State has in place to prevent any possible hacking attempts from being successful.”
Florida’s election website that displays results is not connected to the actual local election systems responsible for tabulating votes. Instead, on election night supervisors upload unofficial results to state officials through a completely different network.
Still if someone was able to manipulate the website it could create confusion and sow doubts about the actual results once they were announced. Investigators in May found evidence of a cyberattack on a Tennessee county’s elections website from a computer in Ukraine, which likely caused the site to crash just as it was reporting vote totals during a primary.
Nico Sell, one of the organizers of the event, told PBS Newshour on Sunday that the replicas used at the conference were accurate representations.
“The site may be a replica but the vulnerabilities that these kids were exploiting were not replicas, they’re the real thing,” the television network quoted her. “I think the general public does not understand how large a threat this is, and how serious a situation that we’re in right now with our democracy.”
Mark Earley, the elections supervisor in Leon County who is a cybersecurity liaison between state and local officials, questioned how outsiders could obtain the security protocols used by Florida if they weren’t already behind the system’s firewalls. He said that all this “hacking noise” and “misinformation plays into the hands of the folks who are trying to undermine democracy.”
Jeff Kosseff, a lawyer and assistant professor at the United States Naval Academy Cyber Studies Department, said states are struggling with election security threats. He said they should work with outsiders in order to see if there are flaws in their systems.
“All states should look at this as a wake-up call,” Kosseff said. “What were the shortcomings identified and how they can fix it. I don’t think it should be an adversarial.”
The reports of hacking into Florida’s website that reports election results coincide with a dust-up between U.S. Sen. Bill Nelson and Gov. Rick Scott over possible Russian meddling in other parts of the state’s election system.
Nelson last week said Russians were able to get inside the election systems of “certain counties” and “now have free rein to move about.” He added that “the threat is real and elections officials — at all levels — need to address the vulnerabilities.”
The senator has not provided any more details, saying that additional information is classified. Scott has demanded that Nelson provide proof of his claims. Last Friday two Republicans who are on the Senate intelligence community declined to confirm or deny Nelson’s statements.
Russian hackers targeted at least 21 states, including Florida, ahead of the 2016 election and breached the voter registration system in at least one, Illinois, investigators say. An indictment released last month said Russian operatives sent over 100 fake emails to elections offices and personnel in Florida as part of the hacking effort. State officials have never acknowledged how many counties were targeted by the Russians.
