Published on July 6th, 2019 📆 | 6426 Views ⚑
0Tulsi Gabbard exaggerates in saying a kid hacked into a replica of Florida’s election system
After President Donald Trump joked with Russian President Vladimir Putin about Russia meddling in U.S. elections, a talk show host asked Democratic presidential candidate Tulsi Gabbard to respond.
Appearing on HBOâs "Real Time with Bill Maher," Gabbard, a U.S. representative from Hawaii, told Maher:
"We have to take seriously the security of our elections because of the vulnerabilities that exist â still, now â that really have the ability to undermine our democracy. Thereâs a hacking conference thatâs held every year in Las Vegas, where I think a 14- or 15-year old-girl from Florida hacked into a replica of Floridaâs election system in less than 15 minutes."
What we found is some indication of vulnerability â even if itâs not a direct threat to the voting system itself. At least one kid did do some quick hacking.Â
But two points are problematic for Gabbardâs claim.
First, there wasnât hacking into a replica of the election system â but rather a website made to look like Floridaâs Secretary of State website that reports preliminary election results. In other words, not the system that receives and counts actual votes.
And second, what was hacked into was not even a replica â as in an exact copy of the website â because it did not contain the proprietary security features that the Secretary of State website has.
As the National Association of Secretaries of State said at the time:
"While it is undeniable websites are vulnerable to hackers, election-night reporting websites are only used to publish preliminary, unofficial results for the public and the media. The sites are not connected to vote counting equipment and could never change actual election results."
Russia hacking in Florida
Besides being a large swing state, Florida is important because Russian hackers gained access to at least one Florida countyâs election computer network during the 2016 presidential campaign, according to Special Counsel Robert Muellerâs report on Russian interference in that campaign. The county was not named.
Florida Gov. Ron DeSantis has said two local election offices were hacked ahead of the 2016 election, but that he is not allowed to name the counties.Â
The Republican governor has emphasized that while the counties had experienced "intrusion into the supervisor of election networks," no information was manipulated or changed, and that itâs possible they obtained voter information that was public record anyway.
Gabbardâs evidence
To support Gabbardâs statement, her campaign sent us two news articles about DEFCON 26, a hacking and cybersecurity event held in Las Vegas in August 2018. As part of the annual event, kids ages 8 to 16 could try to hack into what DEFCON described as replicas of election websites of 13 battleground states, including Florida.Â
One article said an 11-year-old boy hacked into the website that was made to look like the Florida Secretary of Stateâs website; and the other article said an 11-year-old girl hacked into one of the sites, but didnât indicate which state. Both were done in under 15 minutes. (The home states of the kids were not named.)
As DEFCON said, the purpose was not nefarious: "By exposing the cyber vulnerabilities of these websites, young contestants will compete for prizes in a number of categories, including proposing the best plan to defend the Secretary of State websites from cyber attacks."
But to be clear: While the websites might report election results and have other voting information, they are not used to receive or count actual votes.
One of the articles, from PBS Newshour, said an 11-year-old boy hacked into a version of the Florida state election website and changed voting results in under 10 minutes. And an 11-year-old girl tripled the number of votes on the same site in about 15 minutes.
In other words, hacking into a stateâs election website could cause confusion if results were manipulated. But that is not the same as hacking into an election system and actually changing votes.
And with regard to how closely the hacked websites matched the actual websites, ProPublica published an article shortly after the DEFCON convention emphasizing that the websites hacked by the kids were not actual replicas of the state election websites.Â
"Instead, students were working with look-alikes created for the event that had vulnerabilities they were coached to find," ProPublica said. "Organizers provided them with cheat sheets, and adults walked the students through the challenges they would encounter."
Josh Franklin, an elections expert formerly at the National Institute of Standards and Technology and a speaker at DEFCON, was quoted as saying the websites were "fake."
"When I learned that they were not using exact copies and pains hadnât been taken to more properly replicate the underlying infrastructure, I was definitely saddened," he said.
Similarly, Vice.com reported after Gabbardâs interview that DEFCON organizers had given the participants "clones" of state election websites "with vulnerabilities inserted by the organizers. In particular, the sites were designed to be vulnerable to SQL injection attacks, one of the most ancientâand yet still very commonâhacks ever."
Our ruling
Gabbard said, "Thereâs a hacking conference thatâs held every year in Las Vegas, where I think a 14- or 15-year old-girl from Florida hacked into a replica of Floridaâs election system in less than 15 minutes."
In less than 15 minutes, two 11-year-olds attending a 2018 hacking convention were able to hack into a website that was made to look similar to the website of the Florida Secretary of Stateâs Office that reports election results.
Despite news reports that used terms such as replica and facsimile, the hacked site was not a copy of the Florida site and did not contain the same security features. Moreover, the site that the hackers meant to target does not include the system that is used for receiving and tabulating actual votes.
Gabbardâs loose recollection could leave readers with the wrong impression about the vulnerability of Floridaâs election system. We rate her statement Mostly False.
Gloss