Could an 11-Year-Old Really Hack an Election in 10 Minutes?

An 11-year-old boy apparently needed less than 10 minutes to hack into a replica of Florida’s election website last week and change election results.

The boy was attending DEFCON 26, an annual hackers’ conference in Las Vegas. PBS reports:

The boy, who was identified by DEFCON officials as Emmett Brewer, accessed a replica of the Florida secretary of state’s website. He was one of about 50 children between the ages of 8 and 16 who were taking part in the so-called “DEFCON Voting Machine Hacking Village,” a portion of which allowed kids the chance to manipulate party names, candidate names and vote count totals.

He wasn’t the only young person to have such an easy time with the election website replica. An 11-year-old girl named Audrey was able to accomplish a similar feat in about 15 minutes.

Both 11-year-olds pointed out that the websites they hacked weren’t all that well protected. “Basically what you’re doing is you’re taking advantage of it being not secure,” Audrey tells BuzzFeed News. She was able to make it look like Constitution Party candidate Darrell Castle had won Florida in the 2016 presidential election.

“It’s actually kind of scary,” Brewer tells TechCrunch. “People can easily hack in to websites like these and they can probably do way more harmful things to these types of websites.”

Nico Sell, CEO of the secure communications firm Wickr, thinks the U.S. isn’t taking election security seriously enough. “By showing this with 8-year-old kids we can call attention to the problem in such a way that we can fix the system so our democracy isn’t ruined,” Sell tells TechCrunch.

But while state elections websites are definitely hackable, it’s a bit alarmist to suggest that 11-year-olds can change actual results in a matter of minutes.

For one thing, replica websites aren’t the real thing. As the National Association of Secretaries of State (NASS) notes in a statement, “many states utilize unique networks and custom-built databases with new and updated security protocols.” Thus, “it would be extremely difficult to replicate these system.” Sell might claim the sites the young hackers used are “very accurate replicas.” But unless you’ve actually tried to hack the real thing, you can’t know for sure.

Plus, state election websites are not repositories of actual vote counts. Instead, they’re merely unofficial election night tallies. “[E]lection night reporting websites are only used to publish preliminary, unofficial results for the public and the media,” the NASS says. “The sites are not connected to vote counting equipment and could never change actual election results.”

Americans should be worried about election security, particularly when it comes to Russian agents hacking our voting systems. But are we so vulnerable that an 11-year-old can change results so quickly? Probably not.