Russian hackers breached the election systems of two Florida counties back in 2016, the state’s governor, Ron DeSantis, told reporters at a press conference Tuesday. As for which counties, he wouldn’t, or couldn’t, say.
“I’m not allowed to name the counties. I signed a [non]disclosure agreement,” he said.
DeSantis received confirmation of the intrusions during a meeting last Friday with FBI and U.S. Department of Homeland Security officials. That meeting followed a reference to Russian hackers targeting Florida made public by the Mueller report. According to the report, Special Counsel Robert Mueller’s investigative team understood that the FBI believed Russian intelligence had gained access in 2016 “to the network of at least one Florida county government.”
“Two Florida counties experienced intrusion into the supervisor of election networks,” DeSantis confirmed on Tuesday. As has become typical of these types of disclosures, he emphasised heavily that the election results were in no way affected.
(Hilariously, the Washington Post gave Sen. Bill Nelson, Democrat of Florida, four “Pinocchios” after he claimed Russia had hacked his state’s election systems. Sure seems like someone owes Bill an apology.)
The use of a non-disclosure agreement (NDA) in this case naturally raised a few eyebrows. NDAs are commonly thought of as a device used by corporations to set boundaries regarding what information an employee can discuss outside the workplace. Ostensibly, the purpose is to protect trade secrets and other proprietary or confidential information. Violators may face stiff penalties if an employer decides to pursue damages in court.
Despite the impression that NDAs are a tool of the corporate world, the federal government uses them as often as any major company. It is, after all, the country’s largest employer. Nearly all government contractors sign them. State law enforcement agencies sign them when they take possession of certain technologies closely guarded by the feds (see: Stingray device.) And anyone who has access to classified information has signed Standard Form 312, a nondisclosure agreement, the breaking of which can lead to charges under numerous sections of Title 18, the federal criminal code, up to and including espionage.
In DeSantis’ case, the most likely explanation for why he signed an NDA is that the briefing he received contained classified information. Prior to being briefed, he was forced to contractually agree not to disclose what he learned (beyond the fact that it was two counties, not one, that got breached).
Last month, DeSantis said he intended to make the name of the hacked country public (at the time, he still thought it was one) unless “somehow it’s classified.”
As for why the names are classified, to begin with, DeSantis didn’t seem to know. He did offer an explanation, but he was clearly guessing. “I think they think if we name the counties, that may reveal information to the perpetrator that we know what they did, but you’d have to ask them,” he told reporters. “I think it should be named.”
Whether the NDA between DeSantis and, presumably, the FBI, is enforceable is another matter. If the names of the two counties are, for some reason, classified, that’s one thing. If they’re not, it’s likely that the FBI’s attempt to keep it under wraps won’t last long.
Broadly speaking, the federal government can only keep secret information if (a) its classified pursuant to an Executive order; (b) it’s exempt from disclosure under Section 552(b) of the Freedom of Information Act; or (c) it’s classified in the interest of national defence or foreign policy. What’s more, state government officials are not necessarily bound by any of these regulations—hence the NDA.
If recorded physically or transmitted electronically by DeSantis or one of his staff, the information he received could be obtained under Florida’s Public Records Act. As Barbara Peterson, president of the First Amendment Foundation, told the Tampa Bay Times, a promise of confidentially between the governor and the federal government may mean precisely zip to a Florida judge.
Gizmodo has reached out to DeSantis’ office, the FBI, and Homeland Security for comment. We’ll update if we hear back.