Key Florida Elections Office Endured Cyberattack Ahead of 2016 Election

The elections office of Florida's third-most populous county was breached by a crippling cyberattack in the weeks leading up to the 2016 election, NPR confirmed on Thursday.

There is no indication that the ransomware attack was connected to Russian interference efforts leading up to the last presidential race, but the revelation about it now shows how election officials are preparing for this year's election without knowing all the details of what happened before.

The attack on Palm Beach County came to light during a Palm Beach Post editorial board interview with county elections supervisor Wendy Sartory Link.

"Have we been hacked in Palm Beach County? Yeah, we have," Link told the paper.

A spokesperson for the elections office also confirmed the attack to NPR.

"It was in 2016, and as soon as Wendy found out about it, we went and did the necessary precautions to make sure that we were going to be 100% secure and safe," said Judy Lamey, an assistant public information officer for the elections office.

"They didn't know about it"

Many details remain unclear about the attack, including how much data the attackers were able to access and lock up, and whether money was paid to unlock it.

Link, the elections supervisor, only learned of the attack after a change of leadership within the county election office's information technology department.

Longtime IT manager Jeffrey Darter was fired in November of last year after he was arrested on child pornography charges. His acting replacement, Ed Sacerio, mentioned the hack to Link.

Sacario told The Post that Darter dealt with the issue himself so he didn't know many details, but that he didn't think it affected voting information or election results.

Darter called Sacario at one point and screamed at him to "shut down all the servers!" Sacario told The Post.

According to Link, details of the attack were kept secret even from law enforcement and state government officials.

Link told The Post that she "called the state, they didn't know about it. FBI didn't know about it. Homeland (Security) didn't know about it."

According to the Tampa Bay Times, the office was infected with a type of ransomware known as a zepto virus.

The Department of Homeland Security began a campaign last year to warn state and local election officials about the dangers of ransomware to their systems, and how to recover in the case of a successful breach.

"Recent history has shown that state and county governments and those who support them are targets for ransomware attacks," said Chris Krebs, the director of the Cybersecurity and Infrastructure Security Agency within DHS, when the program was announced.

"A successful ransomware attack at a critical point before an election could limit access to information and has the potential to undermine public confidence in the election itself."

"Drips and drabs"

It's not the first detail about an elections cyber breach in 2016 to come out belatedly.

Members of Congress, the public, and even Florida's governor learned that two counties in Florida were breached by Russian attackers only from reading special counsel Robert Mueller's report last year.

"This chaotic dribs and drabs of information that's coming out is doing more harm to our constituents' faith in the electoral system than just coming out and providing some information," said Rep. Stephanie Murphy, a Democrat who represents Florida's 7th District, at the time.

Link told the The Post that she thinks the ransomware attack on the Palm Beach County elections office was separate from the attacks mentioned in the Mueller report.

There are no federal disclosure requirements for localities when they are breached. So the possibility remains that even more local election offices across the country have dealt with similar breaches, or even ransomware, that the public doesn't know about.

At a press briefing last year about the Mueller report news, Rep. Michael Waltz, a Republican who represents Florida's 6th District, was asked if he thought there were more U.S. counties breached in 2016 that the public still doesn't know about.

"It's possible," he said.

Copyright 2020 NPR. To see more, visit https://www.npr.org.