Florida Wrestles with Election Cybersecurity

AP Photo/John Raoux

Last May, Florida's Secretary of State Ken Dentzer declined a $20 million share of federal cybersecurity money, until Governor Rick Scott, pictured here speaking with Supporters in Orlando, forced him to accept it. 

This article appears in the Fall 2018 issue of The American Prospect magazine. Subscribe here

Ever since the infamous election of 2000, Florida has been ground zero in the struggle to improve the technology and security of voting. Unfortunately, those critical issues have been conflated with deliberate political efforts to suppress voting and undermine confidence in voting systems, and 2018 is no exception.

The reforms instituted since the 2000 debacle, such as early voting, served to make voting more convenient and restored confidence that all votes would be counted accurately. Even Republican Governor Rick Scott, no fan of convenience or expanding the franchise, finally went along with online voter registration last year. Thanks to the work of county election officials and civic reform groups, as well as good-faith efforts by Scott’s Republican predecessor, Charlie Crist, Florida had already made significant strides on election administration and had extended voting rights to certain disenfranchised former felons as well.

Paper ballots that were once on their way to extinction have become the bulwark of election security as concerns about cyber attacks dominate the waking hours of the 67 county supervisors who run elections in the state. “It’s night and day to what it was,” says Susan MacManus, a Florida political analyst and University of South Florida professor emerita of government and international affairs. “But the ghost of 2000 is always on the minds of every supervisor.”

According to Dan McCrea, a Florida consultant for Verified Voting, a nonpartisan watchdog group, after 2000, many counties adopted paperless touchscreens that they used until 2008 when paper ballots were required for all voters. All jurisdictions use paper ballots that voters can mark with pens and then feed through the scanners. (Paperless touchscreens are still in use for voters with disabilities in some places like Miami-Dade County and will be eventually phased out.)

But since 2012, Scott and his secretary of state, Ken Detzner, have worked hard to reverse that progress. Scott came into office on the Tea Party wave. Both houses of the Florida legislature had long been dominated by Republicans who proved more than receptive to his efforts to restrict the franchise. The secretary of state is appointed by the governor, which opens up election administration decision-making to partisan meddling.

Scott restored automatic voting rights for some former felons, but the 11th Circuit Court of Appeals tossed out a lower-court ruling ordering the state to develop a new process for ex-offenders to regain those rights. A proposed constitutional amendment will appear on the November ballot.

State lawmakers rolled back popular measures like early voting, widely used by students, service workers, and African Americans. “Souls to the Polls” Sunday was especially popular among black voters, when churches offer transportation to polling sites after services.

When lawmakers made the cuts in early voting prior to the 2012 election, they miscalculated just how popular it had become. The massive public backlash about long lines on Election Day forced Scott and state lawmakers to reinstate early voting in 2013.

State elections officials next went after early-voting sites for college students, prohibiting the siting of polling places on college campuses. This past summer, U.S. District Judge Mark Walker found that prohibition unconstitutional, a violation of students’ First, 14th, and 26th Amendment rights.

Detzner, Scott’s blunt instrument for these suppression moves, has been a regular fixture in federal court, often appearing before Walker, who occasionally sprinkles his opinions with film references. In the campus polling locations case he remarked on the distances that some students had to travel to get to off-campus polling sites, noting that the University of Florida has the same prohibitions against “apparating on-campus—or instantaneous teleportation” as Hogwarts, the school for wizards in the Harry Potter books and films.

Walker summed up his view of the state’s efforts this way: “This court can conceive of fewer ham-handed efforts to abridge the youth vote than the Defendants’ affirmative prohibition of on-campus early voting.”

 

ONE OF THE STRANGEST moves by Detzner was his attempt to refuse federal money made available this past March to help county voting officials resist cyber attacks. After federal intelligence officials confirmed that Russia had unsuccessfully hacked into voter systems in five Florida counties and 20 other states in 2016, President Trump signed an appropriations bill March 23 that included $380 million for state cybersecurity efforts. (In August, Republicans in the Senate rebuffed Democrats who tried to come up with additional funding.) A week later, the federal ElectionAssistance Commission announced the immediate availability of the funds, and urged states to apply.

But in late May, after dragging his heels for two months, Detzner stunned voting-rights advocates and county voting officials of both parties by announcing that Florida would not accept its nearly $20 million share of cybersecurity funds. After an outcry from the supervisors of elections, Scott ordered Detzner to take the money. But the delay cost local officials dearly, leaving elections more vulnerable to hacking by both the Russians and freelance hackers.

One area of concern in the security framework is voter-registration databases, which are connected to the internet and susceptible to hacking: Eligible voters can be removed accidentally or on purpose.

Bill Cowles, the Orange County supervisor of elections, invested in a variety of measures including physical security precautions like surveillance cameras and 24/7 security guards to work during the election period. He really wanted to use the money for new electronic pollbooks to replace the county’s aging devices. But the delays and red tape meant that he did not have enough time to purchase the number of pollbooks he needed county-wide for November, much less do the testing or training on the devices for Orlando and the other municipalities in his Central Florida area. Instead, he spent what he could and ended up leaving a few hundred thousand dollars on the table.

That’s because even after Scott ordered Detzner to take the federal money, his approval decision came with onerous restrictions, including requiring funds to be spent by November of this year instead of by September 2023 as specified by the Election Assistance Commission. Detzner also prohibited counties from hiring their own cybersecurity experts, reasoning that the state had already spent funds to hire five specialists whom he could put at the counties’ disposal. Many Republican and Democratic county election officials expressed bewilderment, while Florida voting-rights advocates speculated that the only purpose of the rigid framework was to reduce confidence in the accuracy of balloting and in turn depress voting should a cyber attack occur.

“Ken is very concerned about security for protection of voter registration rolls and voting in Florida, which is good,” says Pamela Goodman, president of Ruth’s List Florida, a progressive group that recruits Democratic women to run for state and local office. Recalling his negative views about online voter registration, Goodman, a former League of Women Voters president, adds, “However, he is so concerned about it—there’s a fine line [where] it can cross over into voter disenfranchisement.”

Detzner declined an interview request through a spokeswoman.

Recent election security studies by the Center for American Progress (CAP), a progressive Washington think tank, and by the Democratic members of the Committee on House Administration have both found Florida’s election administration seriously deficient in areas like its less-than-rigorous post-election audits. CAP gave Florida an “F.” Audits in Florida are electronically tabulated and vulnerable to hacking. But they are very weak and nearly ineffective, as the state conducts post-election audits afterelection results have been certified.

American intelligence officials have warned that one of the aims of the state-sponsored cyber attacks is to sow discord in the United States by shredding confidence in democracy. What is easier than attacking the privileges of citizenship that the vast majority of Americans take for granted: elections and voting?

Putting obstacles in the way of fortifying election security ensures that local officials will be unprepared to deal with intrusions and other crises when they occur, as they inevitably will. Florida is a tempting election target as a purple state. The two main November contests are already polarized: the bitter U.S. Senate race between Scott and Senator Bill Nelson and the gubernatorial showdown between Tallahassee Mayor Andrew Gillum, a progressive Democrat, and conservative former Republican Representative Ron DeSantis, a Donald Trump acolyte. The governor’s contest has already degenerated into nasty race-baiting—offering a fertile breeding ground for cyber machinations.

By initially refusing federal funding and making it difficult for localities to use the allocations that the state finally parceled out, Florida has cracked open another chapter in its long and ignominious election history.

 

WHILE ELECTION OFFICIALS can thwart would-be intruders with sophisticated firewalls, two-factor authentication, intrusion detection software, and other state-of-the-art tools, no system is hack-proof. Threats evolve and attackers adapt.

“It’s similar to a thief coming into your neighborhood and rattling doorknobs,” says Goodman. “If it’s locked, he’ll go on to the next house and the next and the next until he finds a door that is not locked.” 

Florida’s August primary appears to have gone well, since there were no reports of significant problems. But vulnerabilities remain. That may be dumb luck, or it may be because hackers are waiting for the far more consequential general election. This November, Florida’s election may go off well—or it may be impaired by cyber attacks. If Floridians do dodge this bullet, it will be no thanks to Republicans in Congress or the current governor and secretary of state. 

You may also like

Advertisement