In 2014, Russian hackers nearly wreaked havoc on Ukraine's presidential elections. Their plan: Sneak into the country's election website to make it look like an ultra-right-winger had won with 37 percent of the vote, when in reality he'd received barely 1 percent. That plan was foiled at the last minute, but a similar disinformation campaign might be way too easy to pull off in Florida.
That's what a group of hacking experts discovered over the weekend. In fact, they found the website for Florida's Department of State was so insecure that an 11-year-old hacker needed only ten minutes to bust into a replica and make it look like the wrong candidate had won a presidential election.
“These things should not be easy enough for an 8-year-old kid to hack within 30 minutes," Nico Sell, one of the event's organizers, told PBS yesterday. "It’s negligent for us as a society.”
Florida's Department of State criticized the experiment, arguing the mock site hacked by the 11-year-old "likely had very few, if any, security measures in place."
"It is not a real-life scenario, and it offers a wholly inaccurate representation of the security of Florida’s elections websites, online databases, and voting systems that does not take into account the state-of-the-art security measures," says Sarah Revell, a spokesperson for the department.
Revell also notes that changing the winner on the website wouldn't affect real vote tallies. "The election-night reporting website is only used to publish preliminary, unofficial results for the public and the media," she says. "The sites are not connected to vote-counting equipment and could never change actual election results."
Of course, even altering the site could cause the kind of mass confusion that Russian hackers have tried to stir up to discredit democratic votes. That was their exact aim in Ukraine in 2014.
Plus, the new hacking concern comes on the heels of Sen. Bill Nelson's warning that Russians have already infiltrated some of the actual voting systems in Florida. The website-hacking experiment raises new questions about why Sen. Marco Rubio and his GOP colleagues recently voted to kill extra funding for voting security this fall.
The latest Florida election-security concerns came out of DEFCON 26, the biggest annual gathering of hackers in the world. At this year's convention in Las Vegas, a team set up replicas of state election-reporting websites from six major swing states, including Florida, and then let loose a group of kids between the ages of 8 and 16 to see what kind of trouble they could cause.
After a quick crash course in SQL — a technique regularly used by Russian state actors to access election systems — an 11-year-old named Audrey needed only ten minutes to change the site so it looked like libertarian Darrell Castle had won Florida's 2016 presidential race.Here’s the DefCon Voting Machine Hacking Village roundup of discoveries for the day! Day 1 / Part 1 pic.twitter.com/ovQs7uX7jK
— DEFCON VotingVillage (@VotingVillageDC) August 11, 2018
“It took maybe a minute or so, because I’m a fast typer,” the girl told BuzzFeed. “You can [subtract] points; you can do whatever you want.”
Organizers insist that the website the kids broke into was a close copy of the actual Florida Secretary of State's site and that even though such hacks wouldn't alter actual vote counts, they could create real problems.
"Although it’s not the real voting results, it’s the results that get released to the public, and that could cause complete chaos,” Sell told PBS. “The site may be a replica, but the vulnerabilities that these kids were exploiting were not replicas; they’re the real thing.”
The news comes as Florida is grappling with Nelson's claims about Russians accessing voting machines in the state.
“They have already penetrated certain counties in the state, and they now have free rein to move about,” the senator told the Tampa Bay Times last week.
Pushed for more details, Nelson said specifics were "classified." Gov. Rick Scott, who is running against Nelson for U.S. Senate this fall, demanded more information and said the state didn't know of any specific new threats against voting systems.
In a state known for hanging chads, illegally destroyed ballots, and regular Election Day chaos, the reassurances from the governor and state election officials aren't entirely convincing.
