TALLAHASSEE — Florida’s law enforcement chief and state officials with the Department of Health said their internal emergency communication system was “hacked” on Nov. 10, conjuring images of a nefarious digital break-in.
But court records show officials suspect Rebekah Jones, a former Department of Health employee, simply used old login credentials to gain “unauthorized access” to an employee messaging platform and send a group text. The message: “Speak up” about COVID-19 — and criticize how Gov. Ron DeSantis has handled the pandemic.
“It is a hacking statute that they’re invoking here, but this is about as much hacking as using an expired ID to get back into the place where you used to work is breaking in,” said Stewart Baker, former general counsel for the National Security Agency.
And cybersecurity experts say the state’s messaging platform was so insecure — with employees all using the same username and password to gain access — that a breach was almost certain to happen. Still, unauthorized access — even with a password — could potentially be charged as a felony, Baker said.
Investigators at the Florida Department of Law Enforcement say they traced the breach back to Jones, who filed a whistle-blower complaint against the state after she was fired as a data manager for Department of Health in May.
With a search warrant in hand and guns drawn, police raided Jones’ Tallahassee home on Monday morning, seizing her computers and cell phone. An affidavit filed with the warrant cited a state law that says it is a third-degree felony to access a computer system without authorization punishable for up to five years in prison.
Congressman Charlie Crist, a St. Petersburg Democrat, criticized the appearance of the raid.
“Unless we get more information showing otherwise, it looks like an act of retaliation or an attempt to silence Ms. Jones for her critiques of the state’s COVID-19 response,” Crist said in a Tuesday statement.
Ron Filipkowski, a Marine veteran, former state and federal prosecutor, and a lifelong Republican who was appointed to the 12th Circuit Judicial Nominating Commission by DeSantis, resigned Tuesday morning after reviewing the search warrant affidavit the state used to seize computers and phones from Jones.
“The recent events regarding public access to truthful data on the pandemic, and the specific treatment of Rebekah Jones has made the issue a legal one rather than just medical,’' Filipkowski, 52, wrote in a letter to the governor’s general counsel. “I no longer wish to serve the current government of Florida in any capacity.”
Jones has not been charged and denies sending the message, saying she doesn’t have the technical skills to be a “hacker.”
“Hacking is used as a pejorative and over-inclusive term for any unauthorized access,” said Mark Rasch, a professor at George Washington University Law School and former federal computer crime prosecutor. “The problem is as you start trying to portray Rebekah Jones as somebody evil — an evil hacker — you’re going to overstate your case.”
Jones says the latest allegations are retaliation for accusing DeSantis’ administration of manipulating COVID-19 data, a claim the governor’s spokesman called “absurd.”
Experts including Rasch and Baker say the state’s case against Jones is weak, based on their initial reading of the search warrant affidavit. (The actual warrant is still under seal, and the investigation is ongoing.)
The case, however, has already turned political as Democrats quickly criticized how state police treated a persistent critic of DeSantis during the raid. The uproar came after Jones posted a 30-second video of the raid on Twitter, where she has more than 300,000 followers.
Jones has not released her full video of the raid, though state officials say a camera appeared to be recording the entire time state agents were inside her residence.
The investigation, a ‘weak’ case
Jones’ legal troubles focused on her alleged unauthorized access to a system that she may have had access to while she was a former state employee.
Although “hacking” is generally understood to mean writing a computer program to break into a secure network, according to Baker, the law does not make a distinction between that and using one’s own password to enter the site for unauthorized purposes.
“The statutes tend to be ambiguous and tend to allow for abuse,” Baker said. “It is a controversial topic, and it depends on having prosecutors and employers who don’t overreact and don’t overcharge for violations that are not serious enough to be called felonies.”
Second Circuit Court Judge Joshua Hawkes, who was appointed by DeSantis in September, signed the search warrant.
State investigators subpoenaed Comcast to find the IP address — essentially a digital fingerprint — used to send the unauthorized message, FDLE spokeswoman Gretl Plessinger said. The IP address led them to Jones’ Tallahassee home. But this is not a smoking gun, according to Rasch.
The production of the IP address associated with sending the message by state IT staff is enough to get a warrant, but human error or other irregularities are possible.
“We don’t know how accurate the logs are or what the Department of Health did to validate them,” said Rasch. “There’s also something called IP spoofing. I can log into a website using someone else’s IP address. We don’t know what kind of security was around those logs.”
Although Jones has denied that she sent the message, Baker said it’s unlikely that the IP address information was incorrect.
“It’s not impossible [to be wrong],” he said. “But usually the ISP [Internet service provider] has pretty good records of who had what IP address at what times even if the address changes. Based on what we know so far —which is not very much — it [saying the IP information was wrong] is not a compelling defense.”
Still, until investigators find a similar finger print on one of Jones’ machines, there is no concrete proof she sent the message despite the probable cause used to obtain the warrant.
Jones said she is worried investigators might use the opportunity to obtain information on her data sources. “The fact that I promised them I would never tell anybody who they were, or where they worked and I have failed to protect them, really f-----g pissed me off,” she said. But experts consulted by the Times/Herald said it would be outside of the scope of the warrant to search for anything beyond the message sent on Nov. 10.
Baker said the broad collection of all of Jones’ computers and phones is not unusual in cases of alleged computer crime. He also said that if analysts come across any other unauthorized information or data on her computers while looking for evidence that Jones sent the message, they could use it as evidence of other potential crimes.
The copy of the affidavit shows that investigators had permission to take any and all computer equipment used to “collect, analyze, create, display, convert, store, conceal, or transmit electronic, magnetic, optical, or similar computer impulses of data” as well as “correspondence or other documents” related to computer crime offenses.
Even if Jones did use prior credentials to access the system and send the message, law enforcement officials say the state would have had to prove she knew that she was not supposed to access the platform and prove she did so intentionally, anyway.
Robert Drago, a retired lieutenant colonel at the Broward Sheriff’s Office, described the affidavit as a “little weak,” saying he was surprised the document did not contain evidence of Department of Health formally telling Jones that she was not allowed to access the system after her termination.
“I think they might have a tough case here,” he said.
Prosecutors would also have to overcome a defense about the system itself, which was easily accessible by many employees who all use the same credentials.
“If you really want a secure forum. That is insane,” Baker said. “They had designed this system that made this kind of abuse extraordinarily likely.”
Rasch described the possible defense as equivalent to using a restaurant’s unsecured WiFi network without buying any food, in violation of the use agreement. It’s technically against the use agreement, but access is so easy, who would challenge the use?
“Even if she did all of this, what did she actually do? She sent a warning message to state employees. She didn’t break anything. She didn’t hack anything. She sent a message,” Rasch said.
Rasch said Jones could make a legal case of necessity, where breaking one law was necessary to save human life — like jaywalking to pull someone from a burning car.
“This is a public health emergency and a crisis and this was necessary,” he said. “And even if that defense doesn’t work, do you think 12 Floridians will unanimously agree that what she did was a crime?”
The political fallout
Jones’ attorney, Lawrence Walters, said the state’s raid “could be retaliation” for Jones’ public defiance against her former employer and said the state’s seizure of her computers could be an attempt to undermine her lawsuit.
But, DeSantis’ spokesman, Fred Piccolo, said it is “absurd” to claim that retaliation motivated the search of Jones’ home.
“The Governor had no involvement in the investigation or any judicial proceeding attendant to any such investigation,” Piccolo said. “The Department of Health alerted the FDLE to an unauthorized intrusion into a government information systems component. The FDLE investigated for weeks, culminating in the identification of the residence of the individual(s) involved. Only at that time would it have been known to be Ms. Jones’ home.”
Agriculture Commissioner Nikki Fried, a former prosecutor, said she has had clients who were arrested for “more egregious crimes” and given gentler treatment, but DeSantis “has taken it to an extreme that just rocks the foundation of democracy.”
Instead of sending police into her home, Fried said that she would have advised her team to have a conversation with her, tell her they “would not press charges but this was not acceptable.”
“But to go after her is such a drastic process is just unheard of from a governor in this state and nation,’' she said. “I don’t think people care if she is innocent or guilty of this crime. The underlying issue is we are in this situation because the governor has failed to provide transparency to the people of this state.”
Since being fired, Jones has become a social media celebrity and frequently appears on cable news. She raised more than $246,000 through GoFundMe and, after announcing her home had been raided Monday, had raised more than $150,000 as of early Tuesday evening.
“Looks like I need a new computer and a hell of a good lawyer,” she wrote in her fundraising pitch.
FDLE agents showed up at Jones’ Tallahassee house Monday morning with a search warrant.
In a statement, FDLE said agents could see someone moving in the house but no one answered the door. A supervisor then called Jones’ cell phone and explained why agents were there. Jones hung up, according to the agency, and did not respond to seven subsequent phone calls. After 23 minutes, she let the agents in.
Jones claimed on Twitter that the agents “pointed a gun in my face. They pointed guns at my kids.” She posted a short video showing agents entering her home with guns drawn. They did not appear to point their guns at anyone in the house. “This was DeSantis,” she said on Twitter. “He sent the Gestapo.”
Philip Sweeting, former deputy chief of police in Boca Raton, said the video offered no evidence that agents acted inappropriately, and that having guns drawn was often standard procedure for executing search warrants.
“Even for a white collar search warrant, this behavior is appropriate,” Sweeting said. “The agents were rather calm.”
However, Sweeting said the video may not have captured everything that happened, and he understands why Jones was upset.
“The one deputy has his gun raised up in the air because you don’t want to be pointing your gun at somebody … but if the kids are upstairs and his gun was to go off inadvertently, he could shoot somebody,” he said. “Her perception could be that they were pointing it at her kids. She’s [standing] outside.”
FDLE said at no point did agents point their guns at anyone.
“Agents were aware that children were possibly present at the residence and adjusted their tactics for entry,” the agency said. “Agents exercised tremendous restraint throughout the execution of the search warrant yesterday, especially considering the significant delay they faced in gaining entry and what that could represent to officer safety.”
Drago, the retired lieutenant colonel at the Broward Sheriff’s Office, agreed that “as far as the entry, the agents were within normal police protocol.” He said that Jones’ delay in opening the door could have led officers to believe someone in the house was loading a weapon.
But Drago questioned why FDLE was pursuing what struck him as an insignificant case.
“FDLE can take a long time to get moving, but they seem to have acted pretty quickly here,” he said.
Times/Herald Tallahassee Bureau staff writer Mary Ellen Klas contributed to this story.