Is Florida’s elections system safe from a cyber-attack?

“A cyber attack is like a hurricane,” said Klint Walker, a U.S. Department of Homeland Security cyber expert. “It’s always brewing out there."
Matt Masterson is a cybersecurity expert at the Department of Homeland Security [Steve Bousquet - Times]
Matt Masterson is a cybersecurity expert at the Department of Homeland Security [Steve Bousquet - Times]
Published May 24, 2018

FORT LAUDERDALE — The people who run Florida's elections used to fret about having enough poll workers and voting machines.

Now they talk about incident response teams and threat detectors.
They buy expensive sensors that can detect malicious intruders bent on creating havoc. They field sales pitches from election vendors selling cyber-insurance. It may be a matter of time before elections workers have to pass a Level 2 criminal background check — just to be on the safe side.

Absentee ballots are important, but so are "hacktivists," computer hackers on a social or political mission.

"A cyber attack is like a hurricane," said Klint Walker, a U.S. Department of Homeland Security cyber expert. "It's always brewing out there."

Florida faces another busy election season. If it's like the last few, it will be close, as the nation's biggest swing state elects a governor, U.S. senator and scores of federal, state and local officials and decides 13 changes to the state Constitution.

Memories are still fresh of the Russian phishing expedition that used email attachments to try to penetrate at least five county election systems before the 2016 election. U.S. Senators Bill Nelson and Marco Rubio both say Florida remains vulnerable to election disruption.

This is the first election in which America's voting systems are considered part of the nation's critical infrastructure, similar to airports, water, and the energy grid.

"We are under a microscope more than ever in this election cycle," said Secretary of State Ken Detzner, state's top elections officer, at a packed conference of Florida election supervisors this week in Fort Lauderdale.

Meanwhile, U.S. Secretary of State Mike Pompeo was before Congress, citing a need for "effective deterrence" to prevent more Russian meddling in the next election.

"Everybody's scared," said Mike Hogan, the Duval County supervisor of elections in Jacksonville. "There's so much pressure on all sides."

Florida is used to being under intense scrutiny in election years.

There was the 2000 recount with its manual recounts, dimpled chads and butterfly ballots, and seven-hour waits in 2012 that shamed a Republican legislature into expanding early voting days and locations.

At this week's elections conference, the talk was about network protocols, firewalls and RVAs — shorthand for risk and vulnerability assessments.

Passwords are like underwear, elections workers were told: Change them frequently and don't share them with anybody.

When a speaker asked for a show of hands for hurricane response plans, every hand went up. When the question was about election cyber-attack plans? Not so much.

The main conference attraction was a team of specialists from the U.S. Department of Homeland Security, who praised Florida as a state on the leading edge of election security but an obvious target of cyber-attacks.
"Sophisticated, persistent actors are targeting our systems. That's part of our reality now that we need to accept," said Matt Masterson, a Homeland Security cybersecurity expert.

Six DHS representatives attended the four-day conference that ended Thursday, and no subject dominated the agenda as much as security.
DHS offered complimentary security evaluations. Tech experts discussed the fine points of ALBERT, the sensor that can monitor and detect — but not prevent — electronic intruders.

The state will use $1.9 million in federal Help America Vote Act (HAVA) money to reimburse counties for the costs of buying and installing the ALBERT sensors.

Not all counties are convinced it's a wise investment against bad actors, Russians or otherwise.

"It won't block them. It just monitors them," said Polk County supervisor of elections Lori Edwards. "I don't know who the hell it benefits, but it won't benefit me."

The level of anxiety was evident in tense exchanges in which county voting officials complained that the state doesn't notify them when the statewide voter database malfunctions and is briefly accessible.

Gov. Rick Scott personally overruled Detzner and pushed for the state to seek $19 million more in federal money to help counties harden election systems against future risks.

Florida's 67 election supervisors, all but one of them elected, have to face voters too. They are in the business of registering voters and counting votes, and they are data geeks learning to be technology geeks.

Alan Hays, a former state senator who was elected supervisor of elections in Lake County in 2016, had the county's IT experts explain the security of the county's voting system. He said it took 20 minutes.

"They drew it out on a white board for me," Hays said. "I want to be able to confidently convey to people that we have several layers of protection."

All elections experts agree on the need to prepare, but not all are worried about an imminent attack.

They note that the Florida voter database and vote tabulation systems are separate and distinct, and that they are not accessible to the public on the Internet.

They note that Florida voters, except for those with disabilities, vote with paper ballots that leave a permanent trail and can't be changed.

"Your vote is safe and secure. We've got redundancies in place," said Hillsborough's supervisor of elections, Craig Latimer. "You can't hack paper."

At a cyber-resiliency workshop, all counties were told to join EI-ISAC, a national information sharing and analysis center about election security (most have).

"Florida will be watched closely," said Jamie Ward, an Internet security expert. "The right to vote and making it go 100 percent flawlessly, that's precision work."