Fired former data scientist Rebekah Jones arrested, tests positive for COVID-19
Florida police have arrested former state data scientist Rebekah Jones, accusing her of breaking state laws prohibiting accessing computer systems without authorization.
Jones on Saturday disclosed the arrest warrant herself, writing in a series of tweets that she and her lawyer had arranged with Florida police for her to present herself to law enforcement in Tallahassee on Sunday evening. (Jones and her family currently live in the Maryland suburbs of Washington, DC.) Jones was released from jail Monday after posting $2,500 bail and reportedly testing positive for COVID-19 while in police custody.
The warrant alleges that Jones gained unauthorized access to state Department of Health systems in November to send an unauthorized message to employees and to download a list of contact information for approximately 19,000 people.
Jones built and managed Florida’s COVID-19 data dashboard from its launch in March until May 5, at which point she and her team were removed from the project. Later that month, Jones said publicly that she was not only removed from the dashboard project but also fired from her job because she refused to alter or manipulate COVID-19 data to support the state’s plan to rapidly reopen restaurants and other businesses. After she and the Sunshine State parted ways, Jones launched her own independent COVID data-reporting platform.
On November 10, an unknown person sent an “unauthorized message” to roughly 1,750 members of a Florida Department of Health emergency response team. That message urged recipients to “speak up before another 17,000 people are dead,” adding, “You know this is wrong. You don’t have to be a part of this. Be a hero. Speak out before it’s too late.”
“They pointed guns at my kids”
Investigators probed the unauthorized message and, by early December, determined Jones was their suspect. State police raided her home in the first week of December to seize some, but reportedly not all, of the electronic devices in her house.
“They pointed a gun in my face. They pointed guns at my kids,” Jones said in a Twitter thread at the time. “They took my phone and the computer I use every day to post the case numbers in Florida, and school cases for the entire country. They took evidence of corruption at the state level.” She explicitly accused the administration of Florida Gov. Ron DeSantis of using the police action to try to intimidate and silence her, adding, “This was DeSantis. He sent the gestapo… this is DeSantis’ Florida.” The DeSantis administration at the time denied having anything to do with the incident.
The statute Jones was accused of violating in the arrest warrant prohibits anyone from “willfully, knowingly, and without authorization or exceeding authorization accesses or causes to be accessed any computer, computer system, computer network, or electronic device with knowledge that such access is unauthorized or the manner of use exceeds authorization.”
As Ars reported at the time, however, not only do thousands of state employees share the same username and password for accessing the system Jones allegedly breached, but also the credentials for accessing that system were publicly available on the Internet for anyone to find and use. Court records show that the Florida DOH added a two-factor authentication requirement to its systems after the unauthorized message was sent in November.
Jones vehemently denies having anything to do with the message. “[Florida police] found no evidence of a message sent last Nov. to DOH staff telling them to ‘speak out’ on any of the devices they took–the entire basis for the raid on my home in Dec.,” she wrote on Twitter. “The raid was based on a lie Still, the state has issued a warrant for my arrest—even though the ‘crime’ is not related to the warrant, the scope of the warrant, and they didn’t wait for a third party to review confidential information on my computers.”