WASHINGTON — Sen. Bill Nelson, a Florida Democrat, has reaped the political whirlwind in the 10 days since he proclaimed that Russian hackers had "penetrated" some of his state's county voting systems.
The governor of Florida, Rick Scott, a Republican who is running against Nelson for his U.S. Senate seat this fall, has blasted his claim as irresponsible. The top Florida elections official, also a Republican, said he had seen no indication it's true. And The Washington Post weighed in Friday with a 2,717-word fact check that all but accused Nelson — without evidence — of making it up.
However, three people familiar with the intelligence tell NBC News that there is a classified basis for Nelson's assertion, which he made at a public event after being given information from the leaders of the Senate Intelligence Committee. The extent and seriousness of the threat remains unclear, shrouded for reasons of national security.
The episode illustrates the extent to which secrecy, politics and state-federal rivalries can stand in the way of a unified response to the threat from Russian attacks on a diffuse U.S. election system run by state and local officials. Through a spokesman, Nelson declined to comment.
At a, Aug. 7 campaign event in Florida's capital, Nelson said Intelligence Committee leaders asked that he "let supervisors of elections in Florida know that Russians are inside our records." He added that Russian hackers "have already penetrated certain counties in the state and they now have free rein to move about."
"Either Bill Nelson knows of crucial information the federal government is withholding from Florida election officials, or he is simply making things up," said Scott, who is seeking to take Nelson's Senate seat, which the senator has held since 2001.
But Scott, who as governor has a security clearance, has not actually disputed Nelson's assertion. His spokesman said the governor had not personally called anyone at the Department of Homeland Security to seek a classified briefing to get to the bottom of the matter. The governor's appointee to supervise elections in Florida, Secretary of State Ken Detzner, was reaching out to federal officials for clarity, spokesman McKinley Lewis told NBC News.
Detzner faced criticism this year for delaying an application for federal funds to improve Florida election security, only to be overruled by the governor.
A February report by the left-leaning Center for American Progress gave Florida an "F" grade for election security, one of only five states that received a failing grade. Florida was one of 21 states notified by DHS that it had been targeted by hackers in the 2016 election.
NBC's sources declined to provide the exact details of what Nelson was attempting to describe, because they remain classified. They said Nelson was talking about intelligence related to ongoing repercussions stemming from a 2016 hack of a Florida elections vendor, VR Systems, based in Tallahassee. They said the intelligence had been described to Nelson by Sens. Richard Burr, R-N.C., the chairman of the Senate intelligence committee, and Mark Warner of Virginia, the ranking Democrat.
A Top Secret National Security Agency document leaked last year to the Intercept website said that VR Systems had been penetrated in August 2016 by hackers working for Russian military intelligence, and that the hackers "likely used data obtained from that operation to … launch a voter registration-themed spear-phishing campaign targeting U.S. local government organizations."
The NSA report didn't name the company but it described some of its products, making clear which company was being referenced, the Intercept reported. VR Systems Chief Operating Officer Ben Martin did not respond to a request for comment.
The report described a scheme in which Russian hackers tricked local government voter systems officials into clicking on bogus links that would allow the hackers to access credentials for voting systems.
The report said it was unknown to what extent the campaign had been successful, and what data on "election-related hardware and software applications" may have been obtained.
"The threat from that breach seems to be ongoing," a cybersecurity expert briefed on the matter told NBC News.
In addition to Florida, VR Systems has contracts in California, Illinois and Indiana, its website says.
The sources say Nelson was not supposed to speak publicly about the matter, and he erred by suggesting that the information was new. Still, Nelson and Florida's other senator, Republican Marco Rubio, were asked to warn local officials about the ongoing threat to election systems by Russian state-sponsored hackers, two sources told NBC News. Rubio alluded to the matter with county officials in private, according to The Tampa Bay Times, which cited two sources who were in the room.
None of the senators on the intelligence committee would confirm Nelson's assertions. Nor would they deny it.
"While I understand your questions regarding Senator Nelson's recent public comments, I respectfully advise you to continue engaging directly with those federal agencies responsible for notifying you of and mitigating any potential intrusions," Burr said in a letter to Florida's top election official.
The Department of Homeland Security also declined to confirm or deny Nelson's comments.
Sara Sendek, a spokeswoman for the Department of Homeland Security, said in a statement: "While we are aware of Senator Nelson's recent statements, we have not seen any new compromises by Russian actors of election infrastructure. That said, we don't need to wait for a specific threat to be ready."
Nelson's remarks came after he and Rubio sent a letter to Florida officials urging them to take seriously the threat of Russian election intervention.
"We encourage you in the strongest terms to take advantage" of help from federal officials, the letter said.
Warner said in a statement that "Russian activities continue to pose a threat to the security of our elections, as Senators Nelson and Rubio rightly pointed out in their letter. … I hope all state and local elections officials, including Florida's, will take this issue seriously."
Rubio, who serves on the intelligence committee and has frequently expressed concerns about discussing classified information, declined to address Nelson's assertion directly.
"Given the importance of Florida in our national politics, our state's election systems have been and will remain a potentially attractive target for attacks by foreign actors," the Republican senator said in a statement.
Nelson, who had served in the past on the intelligence committee, has been unable to fully respond to the criticism of his comments, presumably because he spoke out of turn about classified information.
When he made the remarks Aug. 7, he was asked, "Do you know which records the Russians are accessing?"
He replied, "That's classified."