Hack target: Software in 52 Florida counties
Osceola, Volusia use system that IDs voters
When Volusia County Supervisor of Elections Lisa Lewis received a warning about a cyberattack on voting software just days before last year’s elections, she had no idea Russian hackers might have been behind the sinister effort.
“I just thought it was some scam,” Lewis said Tuesday. “Never once did the thought cross my mind.”
But according to a “top-secret” document by the National Security Agency, Russia’s military intelligence officials helped orchestrate a hack into VR Systems, a Tallahassee-based company that provides the software used in Volusia, Osceola and 50 other Florida counties to identify voters when they go to a polling location.
The confidential NSA document dated May 5 was leaked to
the online news website The Intercept that same day. A federal contractor, Reality Leigh Winner, 25, was arrested and charged this week with leaking the “Top Secret level” document to the website after it was discovered she printed out the document and sent it to the website.
The NSA report does not say whether the cyberattack effort had any effect on the election results. State elections officials said there is no evidence hackers infiltrated supervisor of elections’ computer systems or had any impact on the outcome of elections. The software is not used to tabulate voting results.
“Florida’s online elections databases and voting systems remained secure in 2016,” Sarah Revell, a spokeswoman for the Florida Division of Elections, wrote in an email. “We have multiple safeguards in place to protect against elections fraud and prevent any possible hacking attempts from being successful. All voting in Florida is done on paper ballots so we can always refer to the original record. … Additionally, voting machines are not connected to the Internet.”
In late October, Russian officials sent emails with attachments that seemed as if they were from the company to county elections officials who used VR Systems software. If the reader of the email opened the attachment, it would release malicious software that could disrupt the system, according to the NSA document.
The emails looked authentic because Russian hackers persuaded several VR Systems employees in late August to enter their credentials into a fake website, the document said.
On Nov. 1, VR Systems sent emails to nearly all county supervisor of elections officials warning them not to open the attachments after the company was alerted to the hacking by a customer.
“We immediately notified all our customers and advised them not to click on the attachment,” VR Systems said in a statement. “Phishing and spear-phishing are not uncommon in our society. We regularly participate in cyber alliances with state officials and members of the law enforcement community in an effort to address these types of threats.”
The fraudulent email came through as a gmail.com account, and VR Systems told elections officials that emails from the company “will never come from an ‘@gmail.com’ email address.”
Amber Smith of the Osceola County Supervisor of Elections Office said her office did not receive the phishing email. Sumter County — home to a large portion of The Villages retirement community — also uses the software. Sumter officials did not respond to requests for comment, and it is unclear if they received the email.
Seminole Supervisor of Elections Michael Ertel uses VR Systems software for voter registration but not the software for identifying voters at the polls, which was the target of the cyberattack attempt.
Ertel said his staff is constantly on the lookout for hacking or efforts to subvert the voting process.
“The data and physical security measures our office employs for our technology infrastructure is top-notch,” he said. “We have to be extra vigilant because the impact it’s going to have is a lack of confidence in the [voting] system.”
The Orange County Supervisor of Elections Office designed its own software and does not contract with VR Systems.
In late September, elections officials in all of Florida’s 67 counties took part in an informational call with FBI officials, who warned about possible hacking attempts to subvert or tamper with the upcoming elections.
Dmitry Peskov, spokesman for Russian President Vladimir Putin, denied the hacking and phishing allegations Tuesday, saying the Kremlin did not see “any evidence to prove this information is true.” He said Moscow categorically denies “the possibility” of the Russian government being behind it.
The Intercept, a digital magazine founded by journalists involved in the release of documents leaked by NSA contractor Edward Snowden, said some material was withheld at U.S. intelligence agencies' request because it wasn't “clearly in the public interest.”
Winner, 25, of Augusta, Ga., has been charged with copying classified documents and mailing them to a reporter with an unnamed news organization, according to the U.S. Justice Department. Prosecutors did not say which federal agency employed Winner, but FBI agent Justin Garrick said in an affidavit filed with the court that she had previously served in the Air Force and held a top-secret security clearance.
Volusia’s Lewis said such hacking attempts erode the public’s trust in the country’s voting process.
“Unfortunately, something like this does have the potential for the public not having confidence in the system,” she said. “But we work very hard and take great pride in the security that we have.”