Steve Bousquet, Tampa Bay Times: “Do you know what records the Russians are meddling around with in Florida?”
Bousquet: “Do you know which records the Russians are accessing?”
Nelson: “That’s classified.”
Kirby Wilson, Tampa Bay Times: “Do you mean right now, or were you referring to 2016?”
Nelson: “Right now. Senator Rubio and I have written a letter together to all 67 of the county supervisors of election. He is a member of the Intelligence Committee; I am the ranking member of the Cyber subcommittee of the Senate Armed Services Committee. We were requested by the chairman and vice chairman of the Intelligence Committee to let the supervisors of election in Florida know that the Russians are in their records. … Two senators — bipartisan — reached out to the election apparatus in Florida to let them know that the Russians are in the records, and all they have to do, if those election records are not protected, is to go in and start eliminating registered voters.”
“In June, the chairman of the Intelligence Committee, a Republican, and the vice chair of the committee, a Democrat, Senator Burr and Senator Warner, came to Marco Rubio and me and said: ‘We have a problem in Florida, that the Russians are in the records. We think the two of you should warn the election apparatus of Florida.’ ”
“It would be foolish to think that the Russians are not continuing to do what they did in Florida in 2016.”
This article has been updated with new developments on the 2016 incident.
This warning from Nelson — that Russia has breached election systems in Florida and may purge voters from the rolls — seems to confirm some of the worst fears about vulnerabilities in the U.S. election infrastructure.
Nelson and Sen. Marco Rubio (R-Fla.) sent a letter to Florida election officials July 2, reminding them that “Russian government actors targeted our election infrastructure during the 2016 elections” and urging them to seek resources from the Department of Homeland Security to boost security for the state’s upcoming primary and general elections.
But then Nelson, who is up for reelection in November, took things further in public comments. He has said repeatedly and unequivocally since Aug. 7 that Russia has access to election systems in Florida and could eliminate individual voters’ records. This is far more alarming and detailed than the warning in Nelson and Rubio’s joint letter.
“This is no fooling time. This is why two senators — bipartisan — reached out to the election apparatus in Florida to let them know that the Russians are in the records, and all they have to do, if those election records are not protected, is to go in and start eliminating registered voters,” Nelson told the Tampa Bay Times on Aug. 8.
“And you can imagine the chaos that would occur on Election Day when the voters get to the polls and they say, ‘I’m sorry, Mr. Smith. I’m sorry, Mr. Jones. You’re not registered.’ ‘Well, here’s my registration card.’ ‘Well, I’m sorry, you’re not in the registration records.’ Well, you can imagine. That’s exactly what the Russians want to do. They want to sow chaos in our democratic institutions. Every intelligence agency in the United States government has said that they are going to try to disrupt the 2018 elections, just like they did in 2016.”
We want to be clear here: This fact check is not about the U.S. intelligence community’s assessment and the bipartisan consensus that Russia plans to interfere in the 2018 elections, as it did in 2016. It is about Nelson’s specific claim that Russia has access to voter rolls in Florida.
The Department of Homeland Security, the top election official in Florida, and election officials in several of the most populous counties in the state have said they have no evidence that Russia has access to Florida election systems. Nelson said his information came from Sens. Richard Burr (R-N.C.) and Mark R. Warner (D-Va.), the chairman and vice chairman of the Senate Intelligence Committee. Neither senator has confirmed Nelson’s specific claim that Russia has access to Florida’s election system, though they have echoed his broader warning about the threat Russia poses to this year’s elections.
Nelson also has cited “classified” information. Although it’s possible that this information exists and proves his claim, it’s a tough proposition for The Fact Checker to accept, since the Department of Homeland Security has denied Nelson’s assertions, the FBI said as recently as Aug. 2 that there’s no sign of “efforts to specifically target election infrastructure,” and U.S. officials probably would have shared this classified information in some form with the state of Florida, where election officials have contradicted Nelson’s claims.
The CIA, FBI, National Security Agency and other intelligence services unanimously found that Russia interfered in the 2016 presidential election by hacking and releasing emails from Democrats, pushing propaganda online and attempting to breach election systems in many states, including Florida. Special counsel Robert S. Mueller III has filed an indictment against 12 Russian intelligence officers, including two who allegedly attempted to hack into state election systems. Officials in Florida have said the Russian attempt to access state voter records was not successful in 2016.
At a news briefing Aug. 2, FBI Director Christopher A. Wray said intelligence agencies had not detected this year the “same kinds of efforts to specifically target election infrastructure” that were seen in 2016, according to the Wall Street Journal. “Russia’s efforts so far have focused on ‘malign influence operations,’ which he called ‘information warfare,’ ” the Journal reported.
Nelson’s claim is problematic in several ways.
For starters, he keeps repeating it without evidence. He cites Burr and Warner as his sources, but neither senator has confirmed that Russia has access to Florida’s election infrastructure. Nelson said Aug. 7 that “classified” information supports his claim, but that’s hard to accept, considering the contradictory statements from DHS and the FBI.
Nelson has said that Burr, Rubio and Warner reaffirmed his claim about Florida after he first made it Aug. 7, but none of them has. Nelson on Tuesday said that he didn’t know which Florida counties’ election systems Russia had infiltrated because U.S. intelligence agencies “don’t want to tip off the Russians that we know; otherwise, they’ll figure out how we got that information.” But the FBI took steps before the November 2016 election to warn local election officials — including in Florida — about cyber-intrusion attempts it had detected. Such attempts have not been detected this year, according to Wray.
Finally, Nelson and Rubio wrote in their July 2 letter that DHS “depends on states and localities self-reporting suspicious activity,” but election officials in Florida have not reported any.
Representatives for Nelson did not respond to our questions. That’s also fishy.
Florida’s top election official, Secretary of State Ken Detzner (R), wrote in a letter to Burr on Aug. 9 that state voters are casting mail-in ballots for the Aug. 28 primary and that Nelson’s comments “only serve to erode public trust in our elections at a critical time.” Gov. Rick Scott, who is seeking the Republican nomination to challenge Nelson in November, appointed Detzner.
“Immediately upon hearing Senator Nelson’s comments, DOS [the Florida Department of State] contacted the U.S. Department of Homeland Security, the Federal Bureau of Investigation (FBI) and the Florida Department of Law Enforcement to request an immediate briefing on any information that pertained to Senator Nelson’s comments,” Detzner wrote. “DOS was advised by all partners that they have no information that corroborates Senator Nelson’s statement. Additionally, DOS has no evidence to support these claims.”
The Tampa Bay Times reported Aug. 9, “A number of large counties, including Pinellas, Pasco, Seminole, Broward and Miami-Dade, have issued statements saying they are not aware of any breaches.”
Representatives for Burr did not respond to a request for comment. But Burr wrote in a letter to Detzner on Aug. 10: “While I understand your questions regarding Senator Nelson’s recent public comments, I respectfully advise you to continue engaging directly with those Federal agencies responsible for notifying you of and mitigating any potential intrusions — specifically, the Department of Homeland Security and the Federal Bureau of Investigation. Any briefings or notifications about ongoing threats would, rightfully, come from those agencies.”
A statement from Warner neither confirms nor denies Nelson’s claim that Russia has access to Florida’s election systems. “Sens. Nelson and Rubio are right to warn their state’s election officials about this very serious and ongoing threat to our democracy,” Warner said. “This is not about politics. I urge officials at all levels of government to heed the warning and work with DHS and the FBI to address the threat.” Notice how he refers to the July 2 letter, not Nelson’s further-reaching comments in August.
Likewise, a statement from Rubio, who sits on the Senate Intelligence Committee, neither confirms nor denies Nelson’s claim. “Given the importance of Florida in our national politics, our state’s election systems have been and will remain a potentially attractive target for attacks by foreign actors,” Rubio said. “While I firmly believe states should remain in the lead on conducting elections, the federal government should stand ready to assist as needed in confronting actual or potential attacks from determined foreign adversaries.”
The FBI did not respond to our questions. The Department of Homeland Security said it has not seen “any new compromises by Russian actors of election infrastructure.”
“We know that in 2016 Russian government cyber actors sought access to U.S. election infrastructure as part of a multifaceted operation directed at the U.S. elections,” said DHS spokeswoman Sara Sendek. “We continue to assess Russian actors were not able to access vote tallying systems, though we consider all 50 states to have been potential targets.
“While we are aware of Senator Nelson’s recent statements, we have not seen any new compromises by Russian actors of election infrastructure. That said, we don’t need to wait for a specific threat to be ready. DHS and Florida state and county officials have partnered on a number of initiatives to secure their election systems, including sharing threat information between the federal, state and local governments, conducting training for county election supervisors, and providing technical assistance to counties — as we are with other jurisdictions across the country.”
We don’t want to minimize the threat that Russia could attempt to hack into state election systems this year, whether in Florida or other states.
According to Mueller’s indictment, two of the 12 Russian intelligence officers, Anatoliy Sergeyevich Kovalev and Aleksandr Vladimirovich Osadchuk, gained access to state or local election systems in the United States in 2016. Mueller alleged they “conspired with each other and with persons, known and unknown to the Grand Jury, to hack into the computers of U.S. persons and entities responsible for the administration of 2016 U.S. elections, such as state boards of elections, secretaries of state, and U.S. companies that supplied software and other technology related to the administration of U.S. elections.” Their goal was to “steal voter data and other information stored on those computers,” the indictment says.
In one instance, the Russian officers “hacked the website of a state board of elections” in the United States “and stole information related to approximately 500,000 voters, including names, addresses, partial social security numbers, dates of birth, and driver’s license numbers,” the indictment alleges. The Illinois Board of Elections believes it was the target of this cyberattack, which was discovered in July 2016.
The indictment also says Russian officials “hacked into the computers of a U.S. vendor … that supplied software used to verify voter registration information for the 2016 U.S. elections.” They sent more than 100 phishing emails to “organizations and personnel involved in administering elections in numerous Florida counties,” using Word documents that displayed the hacked vendor’s logo. The Intercept reported that the business described in the indictment is a match with an e-voting vendor based in Florida that denies it was hacked.
The Senate Intelligence Committee has said more evidence of “Russian attempts to infiltrate state election infrastructure” emerged since the U.S. intelligence community released its January 2017 assessment of Russia’s election interference, but it’s not clear when or where this happened, and there’s no indication it was in Florida.
Update (May 15, 2019): The special counsel’s report on Russian interference in the 2016 election has more information about the GRU’s hacking efforts than Mueller included in the indictment.
The report details what Mueller already had disclosed in the 2018 indictment: “In August 2016, GRU officers targeted employees a voting technology company that developed software used by numerous U.S. to manage voter rolls, and installed malware on the company network. Similarly, in November 2016, the GRU sent spearphishing emails to over 120 email accounts used by Florida county officials responsible for administering the 2016 U.S. election. The spearphishing emails contained an attached Word document coded with malicious software (commonly referred to as a Trojan) that permitted the GRU to access the infected computer.”
What’s new is the following part: “The FBI was separately responsible for this investigation. We understand the FBI believes that this operation enabled the GRU to gain access to the network of at least one Florida county government. The Office did not independently verify that belief and, as explained above, did not undertake the investigative steps that would have been necessary to do so.”
Although Mueller said he did not verify this claim, Nelson in a statement to The Cybersecurity 202 said, “The Mueller report makes clear why we had to take that important step” -- referring to the letter he and Rubio sent to election officials -- "as well as my verbal warnings thereafter.”
On April 20, The Washington Post reported that “according to five current and former U.S. cyber officials, the breach was not serious. Nonetheless, the FBI notified the county in question, which opted not to disclose the breach, officials said.”
After being briefed by the FBI, Gov. Ron DeSantis (R-Fla.) held a news conference on May 14 and said that Russian hackers gained access to voter databases in two Florida counties prior to the 2016 election but that they did not manipulate data or compromise election results. He did not name the counties.
Nelson was a candidate in the 2018 election, not in 2016. His warnings about Russian hackers being able to manipulate Florida voter registration records were made as the 2018 election approached. They were not retrospective or in reference to 2016. (“Do you mean right now, or were you referring to 2016?” a reporter asked Nelson on Aug. 8, 2018. “Right now,” he responded.)
We included details from Mueller’s indictment about the GRU’s efforts to gain “access to state or local election systems in the United States in 2016” and about the spearphising emails sent to “organizations and personnel involved in administering elections in numerous Florida counties.” What is now known is that two Florida counties were breached in 2016. No information has yet emerged to confirm Nelson’s claim about 2018.
The Pinocchio Test
Nelson and Rubio warned Florida election officials to be on high alert for Russian cyber-intrusions. We take no issue with their July 2 letter.
Nelson, however, went on to make a specific and alarming claim several times: that Russia currently has access to Florida’s election systems and could purge voters from the rolls. Not a single speck of evidence backs him up, and we have serious doubts whether the classified information he cited even exists.
In his letter to Burr, Florida’s top election official said the state asked DHS and the FBI whether Russia had access to Florida’s election systems and was told “they have no information that corroborates Senator Nelson’s statement.” Burr replied that “any briefings or notifications about ongoing threats would, rightfully, come from those agencies,” meaning DHS and the FBI. Reading between the lines, Burr seems to be contradicting Nelson’s claim.
He wouldn’t be the only one. DHS contradicted Nelson’s claim. Wray’s comments from Aug. 2 contradict Nelson’s claim. Local election officials in Florida contradict Nelson’s claim. Neither Rubio nor Warner confirmed what he said.
Making matters worse, Nelson misquoted his own letter from July 2 several times (it made no mention of an ongoing breach) and inaccurately said Burr, Rubio and Warner reaffirmed his assertion that Russia has access to Florida voters' records.
Without minimizing the threat of Russian interference in this year’s elections, we give Nelson’s claim Four Pinocchios.
Update (May 15, 2019): The Mueller report and DeSantis’s disclosures (described in the update above) do not change our analysis or the Pinocchio rating on Nelson’s claim that the Russians had access to Florida’s systems in the weeks leading up to the 2018 election. On Aug. 2, 2018, weeks before the fact check was published, FBI Director Christopher A. Wray said there were no signs of Russians attempting to gain access to U.S. election infrastructure in 2018. On Aug. 20, 2018, days after the fact check, Wray and DHS Secretary Kirstjen Nielsen said there were no “new or ongoing” compromises of state or local election infrastructure in Florida.
Send us facts to check by filling out this form