Lawmakers introduce bill to notify public about election cyberattacks
The bill was unveiled by Democratic Rep Stephanie Murphy and Republican Michael Waltz, who the FBI briefed on the topic last week.
Under current federal regulations, the FBI is refusing to publicly identify the two counties that came under cyberattack.
In the proposed bill, which Murphy and Waltz plan to release next week, voters whose information is potentially accessed by hackers — as was the case with the residents of the two Florida counties — would be alerted of an intrusion within 30 days of it happening or 48 hours before an election, whichever comes sooner.
“It is unacceptable that the Russians know which systems were hacked and not the Americans affected,” Murphy said in a statement.
Last week Florida Gov. Ron DeSantis revealed that two counties in the state had been hacked by Russians in 2016. Last month special counsel Robert Mueller’s report on interference in the election said that “at least one” Florida county had been breached.
Republican Sen. Marco Rubio, the only Florida senator on the Senate Intelligence Committee at the time, told The New York Times last month the Russians were “in a position” to change voter roll data but did not appear to have acted on it.
DeSantis and a group of members of Congress from Florida were briefed by the FBI but the agency would not allow them to disclose the identities of the two counties.
DeSantis and a group of members of congress from Florida were briefed by the FBI but the agency would not allow them to disclose the identities of the two counties.
The FBI has defended its decision not to name the counties, saying guidelines prevent it from naming a victim of a cyberattack and that it has a responsibility to handle classified information carefully.
Two US officials told the newspaper that the database of Washington County in Florida, with a population of about 25,000 was hacked.
Washington County has declined to comment to CNN.
Some Florida county election officials aware that the identities of the counties could theoretically be identified by a process of elimination have refused to answer one way or another.
“I don’t want to start the precedent of throwing that information out there, or having some supervisors being put in a difficult position,” Leon County supervisor Mark Earley told CNN. Earley refused to comment on whether Leon County had been hacked.
“I’m putting myself right now in the position of not being responsive to those questions,” he said. “I’m going to try and side with the ones that are going to have to make the tough decisions here.”
‘You’re doing their work for them if you make an announcement’
Administration officials have justified the decision to keep the attacks secret as avoiding panic.
Former government officials said that dealing with the 2016 interference campaign was difficult, as the extent of Russia’s involvement was unclear in real time.
“We knew we had incomplete information, and the picture was changing almost literally day by day,” a former senior White House official involved in the 2016 discussions on how to respond to the Russian interference campaign told CNN. “What we didn’t want to do is the Russians’ job for them and leave the impression that election systems had been hacked when we didn’t know that.”
“That would be a difficult story to have out there and talk about, especially in the middle of the investigations. The decision we needed to focus on was ensuring Americans’ confidence in the electoral process, and doing everything we could to shore that up,” the official said.
“To the extent that that was some sort of psy-op (psychological operation), you’re doing their work for them if you make an announcement that this happened,” a former Department of Homeland Security official familiar with the Russian campaign told CNN.
“People aren’t going to go through the discussion. They’ll go, ‘Oh, my God, the election’s getting hacked.’ Nothing really came of it. Nothing got changed,” the official added.
Efforts to prevent a repeat of 2016
Since 2016, some federal agencies have increased their outreach to state and local election officials. The Office of the Director of National Intelligence holds occasional briefings with state election chiefs.
The Department of Homeland Security designated election systems as critical infrastructure in 2017 and has petitioned counties to join voluntary cybersecurity and information-sharing services.
“That’s not just a bureaucratic paperwork. That heightens the level of support, assistance, engagement, we can provide across these election officials,” DHS cybersecurity adviser Matt Masterson told CNN.
“We’ve literally gone from an environment in which DHS did know who to contact in each one of the states to let them know about activity or threats to their systems to not only having points of contact in all 50 states, but having regular information-sharing across 50 states and 1,400 jurisdictions,” Masterson said.
The DHS points to Florida as a success story, with all counties but Palm Beach using DHS sensors on their networks, which monitor for threats and share that information with the federal government and other counties. Palm Beach has said it will install the sensors soon.
But the job is still far from over, as Masterson is still traveling the country to brief local and county election officials about cybersecurity threats and lobby them to use DHS’s services. To date, fewer than half of states have agreed to DHS’s onsite cybersecurity assessments, and 13 haven’t signed up for the agency’s cyber-hygiene scans.