“It is unacceptable the FBI won't declassify the names of the counties hacked by Russia in 2016,” said Rep. Michael Waltz of Florida. | Gregg Newton/AGP/Getty Images cybersecurity Hacked Florida counties could disclose their identities — if they wanted to

Local election officials in the two unnamed Florida counties where Russian agents hacked voter rolls in 2016 are able to publicly disclose whether they had been attacked.

But the bureaucrats are clamming up instead.


And voters in those counties have no right to know that information, according to the FBI.

Nor is the state’s governor or its congressional delegation allowed to tell the public the names of those counties.

That’s because the FBI made the governor sign a non-disclosure agreement in order to receive a classified briefing about the hack, along with the members of Congress. Some lawmakers are outraged at what they see as bizarre reasoning from the agency.

For now, the information about the two counties is being kept officially secret — even though the identity of one of the hacking “victims,” Washington County’s election office, has leaked out.

Morning Cybersecurity A daily briefing on politics and cybersecurity — weekday mornings, in your inbox. Email Sign Up By signing up you agree to receive email newsletters or alerts from POLITICO. You can unsubscribe at any time. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

The FBI’s posture has put the agency yet again in the crosshairs amid the three-year saga of the Russia hacking investigation and its fallout.

This time, the agency is facing bipartisan criticism from federal and state lawmakers, who say the agency is over-classifying information, misapplying its own rules concerning victims and unwittingly playing into the hands of Russian hackers three years later because the agency’s cloak-and-dagger secrecy is fueling conspiracy theories about stolen elections.

“It is unacceptable the FBI won't declassify the names of the counties hacked by Russia in 2016,” said Rep. Michael Waltz (R-Fla.), who was briefed with other congressional members Thursday about the counties’ identities.

The FBI says it defines the counties themselves — as opposed to the actual voters within them — as the victims of the hack. Therefore, it’s up to the counties involved to disclose their own identities. And in Washington County, locally elected election supervisor Carol Rudd has declined to return reporters’ calls to comment.

Until the counties admit their voter rolls were hacked, the public won’t have official confirmation.

“We value the privacy of the victims that we work with in both the public and the private sector before and throughout the investigative process,” FBI spokeswoman Jillian B. Stickels explained to POLITICO. “We have a responsibility, especially when working with victims, to safeguard sensitive and classified information.”

Asked whether the counties were allowed to disclose that they had been victims of the Russia hack, the spokeswoman declined to comment.

Waltz said the agency doesn’t understand its own classification rules.

“Basically, what they’re classifying as the ‘victim’ — which is the elections official — is a mischaracterization in and of itself,” the Republican congressman said. “The victim is the voter.”

The FBI does not prohibit hacking victims from speaking out publicly. When Yahoo was hacked in 2017, for instance, the agency did not notify the public. It left that up to the company, which disclosed the information to its millions of customers.

Stickels said the FBI classified the names of the two counties amid an ongoing investigation.

Stacy Arruda, a veteran FBI agent who worked on cybercrime before leaving the bureau in 2018, said that sometimes “victims don’t necessarily want to talk about how they were victimized. it shows a weakness in their network. but there is nothing to preclude them from disclosing that information.”

"Ultimately, it is up to the counties whether or not to disclose that they were victims of this,” said Arruda, who now serves as executive director of the Florida Information Sharing and Analysis Organization.

Arruda also noted that the counties likely got a far less in-depth briefing than Gov. Ron DeSantis did when he signed his NDA. They would've been told their networks were affected so that they could fix the problem but probably not much more.

But DeSantis and others briefed on the attack say they can’t understand the justification for keeping the identities of the counties secret.

When he told reporters Thursday that the FBI had briefed him and made him sign an unprecedented NDA for a Florida governor, DeSantis said the affected counties had been hacked by a basic “spearphishing” attack in which unwitting workers in the counties mistakenly clicked a link on an email and downloaded the malicious software to allow the Russian agents to gain access to the voter rolls in those counties.

"I was told that it was not out of the realm of possibility that a reasonable person could think this was legit," DeSantis said Wednesday. "I mean, it wasn't like Nigerian gold — you know, 'We're going to give you a million dollars from Nigeria.' That's not what this was."

Since the public already knows the nature of the spearphishing attacks, there would be no additional harm to FBI investigative techniques or processes simply by disclosing the names of the counties, lawmakers said.

“It’s over-classified,” DeSantis told POLITICO Thursday.

The spearfishing emails were sent to numerous counties, but only the two affected got snared.

The governor and the FBI said no vote tabulation systems were hacked and no vote tallies were changed in 2016. According to the FBI, no voter registration data was changed. Altering voter-registration information can pose a problem for people on Election Day if poll workers determine that the people casting their ballots aren’t lawfully registered to vote.

While it was known that Russians hackers targeted Florida ahead of the 2016 election, the first confirmation that the effort was successful came in March, when special counsel Robert Mueller issued a report on Russian interference. The news jolted Florida officials, who had insisted that the effort three years ago was unsuccessful.

One election supervisor, Lake County’s Alan Hays, fretted that the secrecy “undermine[s] the confidence of the public in our system. And that’s just playing into the hands of the perpetrators of the whole scheme.”

The decision to classify the names of the counties puzzled voting experts as well.

Dan Smith, University of Florida political science professor and Florida voter roll expert, said nothing seemed out of the ordinary with Washington County’s voting in 2016.

Washington County backed Trump with 77 percent of the more than 11,000 votes cast in 2016. With roughly 25,000 residents, the county sits in the middle of the Panhandle, where Hurricane Michael made landfall last year.

“Little evidence of any Russian success hacking Washington County, but they likely mobilized low propensity voters on Election Day in Florida, perhaps as a result of GOTV efforts on @facebook. Trump crushed Clinton on Election Day in Florida, and other states,” Smith said on Twitter.

Natasha Bertrand contributed to this report.