The other Mueller finding: How one state addresses Russian hacking risk
| Bedford, N.H.
Amid all the debate over whether the Mueller report incriminates or exonerates President Donald Trump, one salient point is being largely overlooked: Russia interfered in the 2016 election to undermine American democracy as a whole. And the damaging effects go beyond any one party or candidate.聽
The intent of Russian meddling was to sow discord in the U.S. political system, said special counsel Robert Mueller in his report to the U.S. Justice Department. The intelligence community and others say that the Kremlin will likely launch more sophisticated attacks in 2020 鈥� both cyberattacks and disinformation campaigns on social media.
鈥淚 guarantee you that Russia is working on hacking this election right now,鈥� says Seth Moulton, a decorated Marine and Democratic congressman from Massachusetts who entered the presidential race this week on promises to bolster national security and restore America鈥檚 moral authority in the world.
Why We Wrote This
Florida has been a poster child for election glitches. Yet its efforts since 2016 show both the scope of a nationwide threat of election hacking and paths for states to face that threat.
鈥淎nd the fact that we are just letting them undermine our democracy, undermine the very fundamental principle that every vote counts in a democracy, is complete dereliction of duty by the commander in chief of the United States,鈥� says Representative Moulton, responding to a question amid campaigning in Bedford, New Hampshire, on Wednesday.
Nearly half the nation鈥檚 states by Russian hacking in 2016, and the Mueller report revealed that at least one county government in Florida was breached by it. It also revealed that Russians compromised the computer network of Illinois鈥� Board of Elections and gained access to information about millions of voters there.
Florida is of particular concern as a key swing state and one which has faced numerous crises in its election system going back to the 鈥渉anging chad鈥� controversy in the 2000 race between George W. Bush and Al Gore.
And it makes an important case study for other reasons. Its efforts since 2016 to step up election security and improve its cyber defenses illustrate both the scope of the challenge and possible paths to address it.
鈥淲e definitely here in the state of Florida have been and will continue to make this issue one of the most important issues moving forward,鈥� says David Stafford, supervisor of elections for Escambia County and one of nine local election officials on the national Government Coordinating Council (GCC) for election infrastructure.
How Florida has stepped up security
One thing the Trump administration has done, with the help of the GCC, is establish the (EI-ISAC), which monitors election security threats.
Paul Lux, president of the Florida State Association of Supervisors of Elections, says the state was one of the first to get all local election offices to join EI-ISAC or a related national information sharing network, MS-ISAC, which alert election officials to new and ongoing threats.
In addition, 66 of 67 Florida counties have installed ALBERT sensors, which help detect malicious activity in their networks (the final county is in process).
Congress, for its part, last March approved $380 million to be disbursed to states for election security.
Florida鈥檚 then-Gov. Rick Scott directed the state to spend all $19.2 million of its allocation on shoring up its 2018 election. That covered everything from physical fences to digital defenses, including hiring five roving cybersecurity specialists.
The state has also worked with the federal Election Assistance Commission to provide cybersecurity training to state and local officials. They like, 鈥淧asswords are like underwear 鈥� change them frequently and don鈥檛 share them with anybody.鈥�
The University of West Florida鈥檚 Center for Cybersecurity provided additional training, including live simulations in their Florida Cyber Range. The range provides a virtual environment in which attacks can be launched, giving election officials and IT workers an opportunity to learn how to identify such attacks and respond to them in a highly realistic scenario.
鈥淐ybersecurity needs to be everybody鈥檚 business, from the elections supervisor to the volunteer,鈥� says Eman El-Sheikh, a computer scientist who directs the university鈥檚 center. 鈥淵ou鈥檙e only as secure as your weakest link.鈥�
Despite all this, a February 2018 report by the Center for American Progress gave Florida an 鈥淔鈥� for its election security.
The think tank made that assessment based on incomplete information because the Department of State declined to participate, but lead author Danielle Root says that even with all requested information, the highest rating Florida could have received would have been a 鈥淒.鈥� Department of State spokeswoman Sarah Revell counters that the department could not provide the information , and that the report is misleading as a result. 鈥淚t鈥檚 ironic that because we kept protected information secure, we earned a failing grade,鈥� she writes in an email.
Mueller report: At least one county office breached
Florida has 67 county election offices, which service anywhere from 10,000 to 1.4 million voters with staffs ranging from one or two people up to 50 to 70 employees.
The , on page 51, says that according to an FBI investigation, Russia sent spear-phishing emails to 120 Florida county election officials. The FBI concluded that Russia was able to 鈥済ain access to the network of at least one Florida county government.鈥�
Then-Sen. Bill Nelson, a Democrat, that multiple counties had been breached.
The Mueller report provided the first confirmation from a federal entity that Russians gained access to a Florida county government.
In response, Florida鈥檚 Department of State said it was not notified of any such breach, including by any of the 67 counties, and that the FBI had declined to provide further information.
鈥淭he Florida Voter Registration System was and remains secure, and official results or vote tallies were not changed,鈥� the department said in a statement.
There is no evidence that Russian interference affected actual ballots or vote tallies.
Mr. Stafford says even if the FBI hasn鈥檛 divulged details of any attack, information from such threats is likely being incorporated in the ALBERT monitors and the alerts going out through EI-ISAC.
In addition, Mr. Lux says there鈥檚 an important distinction between a system being accessed and being compromised. He compares access to someone who sneaks into the lobby of a New York City apartment building behind someone who has a key.
鈥淵ou don鈥檛 have the key to operate the elevator, you don鈥檛 have the key to open any of the doors, you鈥檙e just kind of sitting in the lobby and you鈥檙e not doing anything,鈥� he says. 鈥淭hat鈥檚 the difference between being accessed and compromised.鈥�
The road ahead
Mr. Trump has played down claims of Russian interference, apparently equating the issue with attempts to delegitimize his election. According to The New York Times, recently ousted Homeland Security chief Kirstjen Nielsen in her efforts to develop a more comprehensive and robust plan to protect the 2020 elections 鈥� a point Representative Moulton echoed on the campaign trail.
鈥淗e鈥檚 more concerned about his own personal reputational security than the security of the United States of America,鈥� said the congressman.
Lawrence Norden, deputy director of the Democracy Program at the Brennan Center for Justice, says he is concerned that Russia鈥檚 success in 2016 will not only encourage them to try again 鈥� but could open a Pandora鈥檚 box of interference from multiple actors.
鈥淯p to 2016, whether it was said publicly or not, there was a feeling among some that nobody would attempt to meddle in our elections because we鈥檙e the United States, we鈥檙e the world鈥檚 superpower, and to do something like that would risk a tremendous pushback with real repercussions,鈥� he says.
鈥淣ow that it鈥檚 happened and there weren鈥檛 such repercussions, I do fear that others will say, 鈥榃ell, we want to get in this game, too.鈥欌��
Dr. El-Sheikh, the computer scientist and head of UWF鈥檚 Center for Cybersecurity, says the key is not preventing all attacks but being prepared to respond to them.
鈥淭here are always going to be threats, and the threat landscape continues to evolve. Every attack is more complex than the one we鈥檝e seen before,鈥� she says. 鈥淭he solution isn鈥檛 in trying to reach 100% security. The solution is to create more awareness, education, and training 鈥� so that we try to prevent damage from attacks to the extent that鈥檚 possible.鈥�
