1. Florida Politics
  2. /
  3. The Buzz

Website hack could be as bad as vote attack, warns Florida officials

Hackers don’t need to break into elections systems to cause chaos. They could just change the results on every county’s website.
Florida Secretary of State Laurel Lee speaks at an October news conference in Tallahassee. [STEVE CANNON  |  Associated Press]
Florida Secretary of State Laurel Lee speaks at an October news conference in Tallahassee. [STEVE CANNON | Associated Press]
Published Dec. 4, 2019
Updated Dec. 4, 2019

Florida’s top election official on Tuesday warned that attackers could attempt to disrupt elections without even breaking into the voting systems — by simply changing the results on election websites.

Secretary of State Laurel Lee told the governor’s Cybersecurity Task Force that Florida’s elections tabulation system is secure, but state and county elections websites “are far more vulnerable to being attacked or defaced and pose a very real threat, not of changing election results, but of undermining voter confidence.”

“If our website is defaced such that it reflects that the losing candidate won, and I have to go out the next morning and explain to the press and the public that the actual winner was the other candidate, we’ve lost critical public trust,’’ Lee told the group meeting at Florida International University in Miami.

RELATED: U.S. attorney for Northern District of Florida tries to restore confidence in elections

To address that possibility, Lee said the department is “working very hard to secure those sites and stay on top of evolving threats and tactics to keep them secure.”

She offered few details but said the Department of State has established the Joint Election Security Initiative, also referred to as JESI, to work with and train the 67 county elections offices to identify any vulnerabilities in the election infrastructure.

But the threat of hackers hijacking social media, email accounts and web sites is a looming concern that has been raised across the country as elections security comes under intense focus since Special Counsel Robert Mueller released the “Report On The Investigation Into Russian Interference In The 2016 Presidential Election.”

On the same day the Mueller report was released, a civil grand jury in San Mateo County California, released a report outlining what it perceived were significant vulnerabilities in that county’s election security. The county had strong safeguards against voter fraud and manipulation of election results, the report concluded, but officials shared passwords and rarely used two-factor verification and other safeguards. Hackers could easily infiltrate the website, emails, or Facebook and Twitter pages to disrupt voter confidence in the election.

Lee is issuing a similar warning in Florida.

“If one of our adversaries can compromise a supporting system associated with the voting system, they can do significant damage,’’ she said. “This could include hijacking the elections website or social media page and creating misleading information about where and when to vote.”

RELATED: Florida’s election system is under ‘daily’ attack, top official concedes

After the Mueller report, the FBI said hackers sent spear-phishing emails to more than 120 email addresses at local elections offices around Florida. One phishing email, for example, was sent to Volusia County officials disguised as an email from VR Systems, a Tallahassee-based vendor that handled registration software for 52 counties. Volusia County officials said they did not open the attachments or click links that would have allowed the hackers access to their computers.

U.S. Sen. Marco Rubio said hackers were in a position to manipulate voter registration data, although Gov. Ron DeSantis has since said the FBI told him that voting data had not been altered in 2016.

Lee said her office is attempting to deal with these potential threats through rigorous security training of local officials, conditioning them to recognize phishing emails, denial of service, or Trojan horses and instill good “cyber hygiene” into the culture.

“Many, if not most, of these vulnerabilities come from exploiting human behavior instead of an actual technical shortcoming,’’ Lee said.

“We refer to this part of our resiliency efforts as the human firewall,’’ she said. “As many an IT professional has said to me, sometimes to my dismay, you can invest millions in the latest software, assets, and firewalls, but a single employee who clicks the wrong link can undermine and expose your network.”

RELATED: 'Crisis point’: Florida election website for petition gatherers is broken, state acknowledges

The task force asked Lee to outline what her agency is doing to be prepared for a potential cyber attack on Florida’s elections system.

Lee responded with a prepared speech, which she had previously given last month in Orlando to the annual meeting of one of the top lobbying groups in the state, the Associated Industries of Florida.

She described the five-person cyber team that is conducting a “thorough elections-specific assessment in every Florida county.”

When weaknesses and vulnerabilities are found, she said, state and county elections officials have “agreed to share critical incident information.’’

To guard against voting systems being hacked, Lee said the state relies on a paper ballot system because “you can’t hack paper.” The state also conducts logic and accuracy tests on all its hardware and software and the source code is “sent through an independent, federally-certified test lab.”

When votes are scanned by the machines that tabulate the vote totals, they are “not connected to the Internet while they are tabulating ballots” and “at no point in the process is there any connectivity,” she said.

And once each polling site completes its tabulation, “the encrypted results are modemed up to the Division of Elections.”

It is there where things could go wrong if the web site is hacked, Lee conceded.

RELATED: New report on U.S. elections hacking raises old question: What happened in Florida?

Lee noted that while some counties “have an ample budget and large IT staff, others have significantly less” and so the state will provide a baseline level of support for those who need it.

“I’ve said many times, we will succeed or fail together and no county will be left alone to face a foreign adversary,’’ she said.

To that end, she said DeSantis is asking the Legislature to expand the five-member cyber security bureau at the Department of State by adding 10 full-time positions.

“We don’t pay much, but we can promise a very, very interesting opportunity,’’ she said.

Lieutenant Gov. Jeanette Nuñez, who chairs the task force, asked Lee what the worst-case scenario was used for their hypothetical “tabletop” exercise. Lee said they imagined a county’s election system being hacked and what might be needed to get the county’s system back in operation as quickly as possible.

One lesson learned from local governments faced with ransomware attacks, she said, is that communication early and quickly is key.

“If the threat is disclosed it equips nearby agencies to protect themselves from the threat spreading,’’ she said. If the local government notifies both state and federal authorities effectively, “we have the full complement of resources deployed.”

Mary Ellen Klas can be reached at and @MaryEllenKlas


  1. Pinellas Sheriff Bob Gualtieri, left, and Florida Attorney General Ashley Moody were appointed to the Presidential Commission on Law Enforcement and the Administration of Justice by Attorney General Bob Barr. [Tampa Bay Times]
    Florida Attorney General Ashley Moody will also join a commission that will “explore modern issues affecting law enforcement," according to the Department of Justice.
  2. Tiffany Carr — shown during a 2004 visit to a Hollywood nail salon, where she spoke on domestic violence — did not respond this past week to requests from the Miami Herald to address her $761,560 annual salary. She is head of the Florida Coalition Against Domestic Violence. [MIAMI HERALD  |  [Bob Eighmie Miami Herald file photo]]
    A bill removes a statute ensuring a state contract with the Florida Coalition Against Domestic Violence following a flap over how much its former CEO was paid.
  3. State Rep. Wyman Duggan, a Jacksonville Republican, presents his bill to create a "do not hire" list for any school employee who has been terminated, or resigned in lieu of termination, from employment as a result of sexual misconduct with a student. [The Florida Channel]
    The measure would apply to district, charter and private schools.
  4. A green iguana strolls around Eco Golf Club in Hollywood, Florida on Oct. 28. [MATIAS J. OCNER  |  Miami Herald]
    The Senate Environment and Natural Resources committee voted 4-0 on a bill that would prohibit green iguanas from being kept as pets or sold in pet shops.
  5. Pasco County Supervisor of Elections Brian Corley, middle, looks over an absentee ballot.
    A nonprofit is mailing millions of voter registration forms to Floridians this month in hopes of getting people on voter rolls in time for the 2020 election. Pasco’s supervisor of elections issued an...
  6. Sen. Kelli Stargel, R-Lakeland. [STEVE CANNON  |  Special to the Times]
    Sen. Kelli Stargel said lawmakers deserved the same level of privacy as police officers and judges, but offered no proof why such an extraordinary exemption in public records was necessary.
  7. In this Feb. 14, 2018, file photo, students hold their hands in the air as they are evacuated by police from Marjory Stoneman Douglas High School in Parkland, Fla., after a shooter opened fire on the campus. (Mike Stocker/South Florida Sun-Sentinel via AP, File) [MIKE STOCKER  |  AP]
    But this year’s bill may provoke fewer fireworks than the bitter debates seen in the past two sessions.
  8. The four candidates for Clearwater mayor in 2020. Clockwise from the top left: Frank Hibbard, Morton Myers, Bill Jonson and Elizabeth "Sea Turtle" Drayer. [[Frank Hibbard (Courtesy of Hibbard); Morton Myers [Douglas R. Clifford | Times]; Bill Jonson [Douglas R. Clifford | Times]; Elizabeth "Sea Turtle" Drayer; (Courtesy of Drayer)]
    We might learn a great deal about a key election in Tampa Bay.
  9. iPhone x Pano of fans outside of Amalie Arena in Tampa for game one of the Eastern Conference NHL Playoffs of the Tampa Bay Lightning and the New Jersey Devils. LUIS SANTANA   |   Times [LUIS SANTANA  |  TIMES]
    Rep. Bryan Avila, R-Miami Springs, wants to repeal sales tax money earmarked for stadiums such as Amalie Arena and Raymond James Stadium and the Trop.
  10. Rep. Anthony Sabatini presents his bill to create school board term limits to the Florida House PreK-12 Innovation subcommittee on Jan. 21, 2020. [The Florida Channel]
    The idea would require a three-fifths vote in each chamber before it could appear on the ballot.