Report: Panhandle county computers hacked

The Washington Post and Politico reported Friday that a small Panhandle county was one of the two in Florida breached by Russian hackers in 2016.

Voter information files in Washington County, home to about 24,000 residents halfway between Pensacola and Tallahassee, were infiltrated, the Post reported.

Washington elections supervisor Carol Rudd said in a statement Friday the county “can neither confirm or deny” that they are one of the counties affected.

But Washington was one of three Florida counties that did not acknowledge the receipt of an April 24 public records request from the South Florida Sun Sentinel asking whether they received a suspected “spearphishing” email impersonating VR Systems, a Tallahassee elections vendor.

On Thursday, Rudd sent the Sun Sentinel an email refusing to respond to a folon low-up request, “because my answers could either directly or indirectly allow yourself or others, including nation states trying to do harm to our elections process, to ascertain details harmful to national security.”

Rudd added, “Information such as that which you are requesting could aid actors trying to harm our democratic process.”

In 2018, Rudd told the Panama City News Herald she was “disappointed” by former U.S. Sen. Bill Nelson’s statement that Russian hackers had penetrated Florida elections systems, saying her office had not seen any of that kind of activity.

“There is nothing we have discovered,” Rudd said at the time. “We really want to put that to rest, because we’ve worked really hard and have used grant funds in recent weeks to fortify our security systems.”

Politico also reported that “two people” in Florida “said they suspect the second hacked elections office was in a mid-sized county the East Coast of the state.”

The Mueller Report indicated the FBI believed Russian hackers sent more than 120 “spearphishing” emails to elections officials throughout the state, but did not state how many counties were targeted.

Thirteen counties had confirmed with the Sun Sentinel before Thursday that they were sent an email from the counterfeit VR Systems address but said they did not open it: Alachua, Broward, Citrus, Clay, Duval, Gulf, Lee, Leon, Pasco, Putnam, Taylor, Volusia and Wakulla.

Charlotte, Escambia, Highlands and Hillsborough counties acknowledged receiving the public records request but hadn’t responded with a follow-up, while Calhoun, Jefferson and Washington counties never responded until Washington did on Thursday.

Lisa Lewis, elections supervisor for Volusia County on the east coast, acknowledged in 2017 that her office had received the email but insisted no one had clicked on it.

She gave more details in response to an Orlando Sentinel records request last month, releasing a copy of the email purporting to be from VR Systems, which had contracts with 52 counties across Florida in 2016.

The email asked elections officials to “please take a look at the instructions for our modernised products. Best regards, VR Systems Inc,” using the British spelling of “modernized.”

It included several attachments at the bottom, including a Word document that Lewis again said the office did not open.

Brevard County on the Space Coast said it did not receive the infected email.

In Broward County, Supervisor of Elections Peter Antonacci originally told the Sun Sentinel he was unaware of any phishing attempts. But emails obtained by the Sun Sentinel revealed phishing emails were sent in 2016 to former supervisor of elections Brenda Snipes and her administrative assistant, Patricia Santiago.

Antonacci later acknowledged he had been mistaken, saying on April 25, “it is now apparent that a hack was indeed attempted, and we were made aware of the potential email incident by VR sometime after that inquiry. We apologize for the confusion, but to be clear, our security system worked as it was supposed to; no ‘phishing’ emails made it through the system, and, as a result, our system was not hacked.”

The Duval elections office did not respond to the Sun Sentinel’s initial request, but in response to a second one it released an email from June 8, 2017, in which the infected email was discussed.

“ITD has finished the search for the item,” the 2017 email read. “Our office did receive it on early next to last month last year.”

It was sent to five office addresses, but one of those people was no longer at the office at the time.

“As a guess Robert, Julie and Jean saw my name, but didn’t worry about it since they thought I saw it,” the 2017 email read. “But I didn’t receive it.”

Congress members angrily called on the FBI Thursday to release the names of the two counties, with U.S. Rep. Matt Gaetz calling the bureau’s reasoning that the counties were victims and needed to give permission first “ludicrous.” The FBI also said revealing the names would alert the hackers to strategies and methods of investigation.

Members also revealed that while the FBI said there was “no evidence” that voter rolls were changed, “they couldn’t say with certainty [the hackers] did not manipulate data,” U.S. Rep. Debbie MucarselPowell said.

Gov. Ron DeSantis and U.S. Sen. Rick Scott, also briefed on the hacking this week, also called for the names to be released. DeSantis said he had to sign a non-disclosure agreement.

South Florida Sun Sentinel staff writer Aric Chokey contributed to this report.