Russians hacked voter systems in 2 Florida counties, but which ones?

At a news conference in Tallahassee, DeSantis, a Republican, said that officials from the FBI and the Department of Homeland Security had asked him to sign a nondisclosure agreement pledging not to identify the two counties that fell victim to a “spearphishing” attempt by Russian hackers.

That the Russians breached security protocols in not one but two counties was previously unknown. Last month, the Mueller report confirmed that the FBI believed that the Russian military intelligence unit known as the GRU breached “at least one Florida county government.” Elections officials said that if the intrusion came through a spearphishing email, as it apparently did, it would put hackers in a position to potentially alter registration data, though not the tabulation of ballots.

DeSantis said Tuesday that the intrusion was limited to getting a glimpse of the voter rolls, which are public information in Florida.

“Two Florida counties experienced intrusion in the supervisor of election networks,” DeSantis said. “It did not affect any voting or anything like that.”

DeSantis, who took office in January, had insisted on being briefed on the hacking after the release last month of the report by Robert Mueller, the special counsel. Upon reading the report, the governor expressed frustration at the FBI for not informing the state of its findings earlier and vowed to make the details public if they were not classified.

“They won’t tell us which county it was. Are you kidding me?” he told reporters in Miami. “Why would you not have said something immediately?”

Yet in bewildering fashion, DeSantis found himself unable to publicly name the counties Tuesday, citing federal officials’ concern that doing so could somehow tip off the Russians.

“I think they think that if we name the counties, then that may reveal information to the perpetrators that we know kind of what they did,” DeSantis said.

Sen. Marco Rubio, a Republican, has said that the authorities decided to get around those concerns by issuing a general notice to all counties that an intrusion had occurred.

“I think they should be named,” DeSantis said.

That the governor was asked to sign a nondisclosure agreement to receive classified information is not unusual. The FBI makes similar requests of police chiefs when discussing cases involving classified terrorism threats, for example. Typically, the FBI does not release the names of hacking victims for privacy reasons.

Less clear is why information, the gist of which has already been made public in the Mueller report, would be deemed too sensitive for public disclosure. There was an immediate flood of questions on social media, with many wondering how the public could feel confident that the voter rolls had not been tampered with and that local elections supervisors had taken the necessary steps to prevent a similar hack in the future — without knowing which counties had been breached.

“This is not acceptable, to keep secret attacks on the most public of our political processes: our elections,” said Ion Sancho, a Democrat and the former elections supervisor of Leon County, which includes the state capital, Tallahassee.

On Sept. 30, 2016, while still in office, Sancho took part in a conference call among Florida elections supervisors in which, he said, the FBI told local officials that no Russian hacking had taken place. The FBI had asked elections supervisors to keep the content of the call confidential, but Sancho spoke about it at the time anyway.

“I’m not a member of a law enforcement agency — I’m a member of the elections profession,” he said Tuesday. “I did talk about it because it seemed to me we needed that kind of impetus if we’re going to prepare and ensure we’re going to protect our election system, which we still have not done.”

Not one of Florida’s 67 counties has admitted to being one of the hacking victims. The intrusion was first made public last year by former Sen. Bill Nelson, a Democrat, who came under stinging criticism from his re-election opponent, former Gov. Rick Scott, who dismissed his claim as unfounded. The state, he said, had not been informed about any Russian hacking. Nelson said then that he had come across the information as a member of the Senate Select Committee on Intelligence — but like DeSantis now, could not reveal more.

In a statement Tuesday, the FBI said it had provided information to DeSantis “involving the attempted intrusion into Supervisor of Elections networks throughout the state.”

“The FBI also provided assurance that investigators did not detect any adversary activity that impacted vote counts or disrupted electoral processes during the 2016 or 2018 elections,” the statement said. “The FBI and DHS continues to work with elections officials and our local, state and federal partners to proactively share information in a concerted effort to protect elections networks in Florida, and across the country, from adversary activity.”

The bureau was scheduled to hold additional confidential briefings with members of Florida’s congressional delegation later this week.

DeSantis said that identifying the two counties was important in order for the Florida secretary of state to work with those elections supervisors to determine whether they needed additional cybersecurity resources.

“The two counties at issue here, the FBI was working with them in 2016, to identify and to take whatever action,” DeSantis said. “This stuff is really very, very significant.”

This article originally appeared in The New York Times.