An attempt to illegally obtain absentee ballots in Florida last year is the first known case in the U.S. of a cyberattack against an online election system, according to computer scientists and lawyers working to safeguard voting security.

The case involved more than 2,500 “phantom requests” for absentee ballots, apparently sent to the Miami-Dade County elections website using a computer program, according to a grand jury report on problems in the Aug. 14 primary election. It is not clear whether the bogus requests were an attempt to influence a specific race, test the system or simply interfere with the voting. Because of the enormous number of requests – and the fact that most were sent from a small number of computer IP addresses in Ireland, England, India and other overseas locations – software used by the county flagged them and elections workers rejected them.

Computer experts say the case exposes the danger of putting states’ voting systems online – whether that’s allowing voters to register or actually vote.

---

“It’s the first documented attack I know of on an online U.S. election-related system that’s not (involving) a mock election,” said David Jefferson, a computer scientist at Lawrence Livermore National Laboratory who is on the board of directors of the Verified Voting Foundation and the California Voter Foundation.

Other experts contacted by NBC News agreed that the attempt to obtain the ballots is the first known case of a cyberattack on voting, though they noted that there are so many local elections systems in use that it's possible that a similar attempt has gone unnoticed.

There have been allegations of election system hacking before in the U.S., but investigations of irregularities have found only software glitches, voting machine failures, voter error or inconclusive evidence. Where there has been evidence of a computer security breach -- such as a 2006 incident in Sarasota, Fla., in which  a computer worm that had been around for years raised havoc with the county elections voter database -- it was unclear whether the worm's appearance was timed to interfere with the election.

In any case, experts say they’ve been warning about this sort of attack for years.

“This has been in the cards, it’s been foreseeable,” said law Professor Candice Hoke, founding director of the Center for Election Integrity at Cleveland State University.

The primary election in Miami-Dade County in August 2012 involved state and local races along with U.S. Senate and congressional contests (see a sample ballot here). The Miami Herald, which first reported the irregularities, said the fraudulent requests for ballots targeted Democratic voters in the 26th Congressional District and Republicans in Florida House districts 103 and 112. None of the races’ outcomes could have been altered by that number of phantom ballots, the Herald said.

Overseas “anonymizers” -- proxy servers that make Internet activity untraceable -- kept the originating computers’ location secret and prevented law enforcement from figuring out who was responsible, according to the grand jury report, issued in December. The state attorney’s office closed the case in January without being able to identify a suspect.

Read the Miami-Dade County grand jury report (PDF)

Then came the Herald report, which said that three IP addresses in the United States had been identified among those sending the requests and that there had been a delay in getting that information to investigators, which a Miami-Dade elections official confirmed to NBC News. Terry Chavez, spokeswoman for the state attorney’s office for Miami-Dade County, also confirmed to NBC News that the investigation was reopened to look into those IP addresses. Chavez said she could release no details on the investigation.

Rep. Joe Garcia won the Democratic primary in the 26th District and went on to win the general election. Jeff Garcia, his chief of staff and no relation, said last week that no state or federal investigators had contacted the congressman's office about the case.

State Rep. Jose Javier Rodriguez, a Democrat who won the District 112 seat, said Thursday that his office had not heard from investigators about the case either. A message left at the legislative office of state Rep. Manny Diaz Jr., the Republican who won the primary and the general election in District 103, was not immediately returned.

The Herald report said that as the requests began coming in, elections officials figured out that they were improper and started blocking the IP addresses. “I guess they finally gave up,” the newspaper quoted Bob Vinock, an assistant deputy elections supervisor for information systems, as saying. 

People who study election security say the fact that this attempt did not succeed should be of little comfort to election officials. They warn that attempts to attack voting systems are likely to increase.

“In this case the attack was not as sophisticated as it could have been, and it was easy for elections officials to spot and turn back,” said J. Alex Halderman, an assistant professor of computer science and engineering at the University of Michigan who studies the security of electronic voting. “An attack somewhat more sophisticated than the one in Florida, completely within the norm for computer fraud these days, would likely be able to circumvent the checks.”

Fraudulently obtaining absentee ballots is just one way elections might be subverted by digital means, experts say. Among the other methods and attack points:

•  Malware. Rogue software infects millions of home computers across the country. Jefferson said hackers could use malware to change votes or prevent them from being cast in an online election.
• Denial of service attacks. Jefferson said that hackers could use botnets to prevent election-system servers from working for hours, or perhaps longer. In fact, during an election in June 2012, a DOS attack hit the San Diego County Registrar of Voters' website, preventing voters from tracking the results.
• “Spoofing” of election websites. For example, Hoke said, legitimate requests for absentee ballots could be misdirected to another site. The data then could be misused, or the requests could hit a dead end, and voters would be left wondering where their ballots were.
• Exploiting software flaws in digital voting machines, known as DREs. The flaws could allow insertion of viruses or alteration of programming code that would change votes or delete them. (Read one description of hacking a voting machine.)
• Tampering with email return of marked ballots. Experts say email return is troublesome because of the multiple points for attack along the ballots’ electronic path. “The overwhelming consensus of the computer science community is don’t do it, it’s a bad idea,” said Jeremy Epstein, a senior computer scientist at SRI International. But in about half the states, email absentee ballot return is an option for members of the military and their families, along with some other U.S. citizens living overseas.
• Wholesale hijacking of an online voting system. In 2010, the District of Columbia Board of Elections and Ethics tested an Internet-based voting system for a week, asking computer experts to probe it for flaws. It took only 48 hours for a team led by Halderman to break in and take control of the site – even altering it so that the University of Michigan fight song played after a vote was cast.

Read the University of Michigan researchers’ report on the DC hack (PDF)

In terms of illegally getting access to absentee ballots, Epstein said, the attacker or attackers who failed in Florida might have had an easier time with Washington state and Maryland.

He said that last summer he demonstrated to the FBI a method of changing individual voters’ addresses and other information online in those two states by predicting their driver’s license numbers.

First he used publicly available information to gain a voter’s full name and address. Then, he predicted the individual’s driver’s license number – which is based on a combination of the person’s name and numbers and letters -- and used the information to access their voter registration online. From there, he said, he could have changed their addresses and had absentee ballots sent out.

“Imagine if (attackers) changed the address for 2,500 votes. It could be completely automated, and they have the ballots sent to a post office box or whatever,” Epstein said. “Then the registered voters would have no idea until they tried to vote.”

In October, Halderman and other researchers sent letters warning elections officials in both states of the danger of staking system security on driver’s license numbers.

The letter to Washington officials (read it here in PDF) also said that other security features in the state’s MyVote system would be only a speed bump to a dedicated hacker.

“Although the MyVote system uses a CAPTCHA, an image of distorted text intended to deter simple automated attacks, this provides only minimal defense,” the letter says. “Attackers can use commercial services to defeat the CAPTCHA at a cost of less than $0.001 per voter.”

Shane Hamlin, assistant director of elections in the Washington Secretary of State's Office, told NBC News that state election officials have acted on the recommendations in the October letter and will require additional information to register to vote or change registration online.

Maryland election officials did not immediately return a call from NBC News seeking comment, but the Washington Post reported last month that Ross K. Goldstein, deputy administrator of the Maryland State Board of Elections, acknowledged the security hole and said the online voter registration system was being updated to address the issue.

“I believe technology can solve problems, and there are steps that we definitely can, and plan to, take to mitigate the risks,” the newspaper quoted him as saying.

While elections officials are attracted to the savings that online voting and registration systems promise, the cost of guarding online registration and voting systems is large, Hoke said. And that might negate the financial advantage of online balloting touted by some elections officials and vendors who want to sell electronic voting products.

“It’s cheap, if you don’t care whether elections are stolen,” she said.

That possibility -- of an election being stolen through digital means -- haunts researchers. For Jefferson, it’s a matter of national security.

“The legitimacy of government depends on it being impossible for single parties to change the results of elections,” he said.

More from Open Channel:

• ACLU beats CIA — a little — in court battle over drone documents
• US, Iran secretly discussed swap of al Qaeda detainees for Iranian dissidents
• ID thieves target hospital patients to steal tax refunds, investigators say

Follow Open Channel from NBCNews.com on Twitter and Facebook 

 

Pictures taken in February and March of 2012 show Alci Bonannee and Chante Mozley, two convicted identity thieves, withdrawing cash from several banks in Broward County.

The federal government says the money came from stolen tax refunds that belonged to people like Miami resident Joseph Szot.

“When I filed a return, the accountant told me you can’t file because somebody filed already,” Szot said.

More stories from NBCMiami.com

And just how did Bonannee and Mozley get Szot's tax refund? Federal authorities said it happened while he was a patient at South Miami Hospital.

The pair is accused of paying respiratory therapist Betty Cole for patients’ personal information including their Social Security number. Internal Revenue Service Special Agent in Charge of the Miami office, Tony Gonzalez said: “The bad guys that are able to get these Social Security numbers are buying them from employees that work at these hospitals and these medical centers which are sold up to $150 each.”

---

The breach at South Miami Hospital happened between June of 2011 and February 2012 and affected 834 patients.

In a statement, Baptist Health, which operates South Miami Hospital, said "the employee was terminated, and efforts are underway to prosecute this individual to the fullest extent possible."

NBC 6 reached out to that employee, Betty Cole, but she didn't want to talk to the Team 6 Investigators.

The south Miami case is the latest hospital ID theft to surface in South Florida. Since 2009, the Department of Health and Human Services has received reports that hundreds of thousands of patients have been affected by breaches at hospitals across South Florida. The hospitals with the largest breaches include Memorial Healthcare System with 111,650 patients affected, the University of Miami Health System with 66,065 people, Mount Sinai Medical Center with 2,600 patients and Jackson Health System with 2,062 patients.

Although many hospitals have had more breaches, a federal act called HITECH only requires that medical centers report breaches that affect more than 500 patients. Gonzalez said investigators have seen a case where a “gentleman who provided a service of taking elders home after being seen at a hospital, would cut their little tabs off their wristbands and with the patient number, walk into the hospital, look at the computer and get a Social Security number without ever being an employee of that hospital.”

In April of last year, Memorial Healthcare System in Hollywood notified about 9,500 patients that two employees were fired because they may have inappropriately accessed their personal information with the intent to process fraudulent tax returns. In a statement, Memorial said it “continues to enhance its security controls and monitoring systems, limit user access in all physicians’ offices, and has reinforced the importance of the privacy and confidentiality of patients’ information with its staff and affiliated physicians’ employees.”

Last year, Jackson North had a breach that affected over 500 patients. Ed O’Dell, the spokesperson for Jackson Health system, says in that case it “was a volunteer in a patient care area and he was apparently taking pictures of patient information.”

Since then, Jackson has implemented new rules for volunteers prohibiting them from using smartphones in patient areas. Linda Quick, president of the South Florida Hospital and Healthcare Association, a trade association, said the industry is not immune to breaches. She told NBC 6: “Proportionate to the number of people who are seen in our member institutions it’s not pervasive in any way.”

Szot doesn't blame South Miami hospital. He said he believes companies in general should find a way to reduce the risk of security breaches.

“I think corporations use Social Security numbers too much for identifying you, putting the information out to too many people,” he said.

The IRS said hospitals have been cooperating with them to combat identity theft, a growing crime.

So how can you avoid becoming a victim at a hospital?

Quick said: “you do not have to provide your Social Security number, but you do have to provide enough information for you to be distinguishable from other people.”

A hospital may still require your Social Security number to verify coverage if your insurance provider only identifies you that way, but experts say you should ask questions before handing your number over.

Postal Inspector Blanca Alvarez said, “you don’t always have to give it, if they ask for it, make sure that there’s a valid reason to receive it but it doesn’t often have to be given.”

The IRS says identity theft affects many industries, not just hospitals. According to HHS reports, health insurance companies have had breaches affecting millions of Floridians.

Read more from Open Channel

• Authorities in US, Jamaica team up to tackle persistent phone scam
• Defying court's rules, anti-secrecy group posts tape of Bradley Manning statement
• Student accused of trying to rig college election with 'keystroke-logging'

 

Former Florida Gov. Jeb Bush soared to rock star status in the education world on the strength of a chart.

A simple graph, it tracked fourth-grade reading scores. In 1998, when Bush was elected governor, Florida kids scored far below the national average. By the end of his second term, in 2007, they were far ahead, with especially impressive gains for low-income and minority students.

Those results earned Bush bipartisan acclaim. As he convenes a star-studded policy summit this week in Washington, he is widely regarded as one of the most influential education reformers in the U.S. Elements of his agenda have been adopted in 36 states, from Maine to Mississippi, North Carolina to New Mexico.

Many of his admirers cite Bush's success in Florida as reason enough to get behind him.

But a close examination raises questions about the depth and durability of the gains in Florida. After the dramatic jump of the Bush years, Florida test scores edged up in 2009 and then dropped, with low-income students falling further behind. State data shows huge numbers of high school graduates still needing remedial help in math and reading.

---

And some of the policies Bush now pushes, such as vouchers and mandatory online classes, have no clear links to the test-score bump in Florida. Bush has been particularly vigorous about promoting online education, urging states to adopt policies written with input from companies that stand to profit from expanded cyber-schooling.

Many of those companies also donate to Bush's Foundation for Excellence in Education, which has raised $19 million in recent years to promote his agenda nationwide.

Sherman Dorn, a professor of education at the University of South Florida, says some of Bush's policies as governor, such as an intense focus on teaching reading, made a real difference to Florida students.

 "It's pretty clear Governor Bush should get credit for giving a damn," he said. But by teaming with for-profit corporations to push cyber-schools, which have produced dismally low test scores in many states, Bush is "throwing away whatever credibility he had coming out of Florida," Dorn said.

Bush's allies disagree. For them, the former governor -- widely considered a top contender for the 2016 Republican presidential nomination -- is a visionary striving to build on his record of success.

"I've been very impressed with the thoughtfulness of his policies," said Joel Klein, who ran New York City schools for eight years and now heads News Corp's education division, Amplify, which donates to the Bush foundation.

Klein and officials at several other education companies that support Bush's foundation say they do so not for their own financial interest but to promote a broad policy debate.

Any implication "that corporate donors give to us for us to advance their agenda" is simply false, said Patricia Levesque, the foundation's executive director.

The Florida formula
Bush, who declined to comment for this story, says often that he has one abiding goal: to give all students the chance to reach their "God-given potential."

His "Florida formula" rests on the principles of increasing accountability and expanding parental choice. Among its tenets:

* Grade schools on an A-to-F scale, based mostly on student scores and growth on standardized tests. Give students in poorly ranked schools vouchers to attend private and religious schools.

* Hold back 8-year-olds who can't pass a state reading test rather than promote them to fourth grade.

* Expand access to online classes and charter schools, which are publicly funded but privately managed, sometimes for profit.

In Florida, Bush paired his tough-love measures with generous support. Schools that improved their grade or got an "A" received extra funding. Teachers got bonuses for successes like getting more kids to pass Advanced Placement tests. And students required to repeat third grade got intensive help at free summer reading camps.

States adopting the policies now, in a time of austerity, tend to leave out the costly support systems. That has stirred protests from school superintendents, school board members, teachers unions and parents who see the policies as punitive, humiliating and too narrowly focused on a single test as a measure of success.

Voters have spoken loudly, too. In this month's election, overwhelmingly Republican electorates overturned Bush-style reforms in Idaho and South Dakota and ousted the Indiana state schools chief, who had enacted much of the Florida formula.

In Florida, meanwhile, the durability of the Bush-era gains has come into question.

NBC News' Education Nation case studies

High school graduation rates rose during Bush's tenure but remain substantially lower than in other large and diverse states, including California, New York and Ohio, according to new federal data. Students' average score on the ACT college entrance exam has not improved and remains well below states such as Missouri and Ohio, where a comparable percentage of students take the test.

Florida's scores on the National Assessment of Educational Progress, widely considered the most reliable metric, dropped on all four key tests last year --  fourth- and eighth-grade reading and math. On all four tests, low-income students fell further behind their wealthier peers.

Jaryn Emhof, a spokeswoman for the Bush foundation, said the slipping scores are an indication that "schools were getting complacent" and need to be pushed with higher standards.

Opponents contend Bush's reforms never deserved much credit for the gains in the first place.

Other factors were at play, they argue. Florida voters passed a constitutional amendment to limit class size in 2002, for instance. And Bush's tenure coincided with soaring property tax receipts, thanks to the housing boom, which led to more local funding for schools. Per-pupil spending in Florida jumped 22 percent from 2001 to 2007, after accounting for inflation. It has since fallen sharply.

"There's this single-minded notion that only the program has supported yield improvements," said Ruth Melton, director of legislative relations for the Florida School Boards Association. "There's more to this than meets the eye."

Some recent research has cast doubt on the long-term effectiveness of the Bush policies.

A Harvard education research group reported this summer that Florida students who were held back in third grade notched a big boost in test scores initially, but the effects faded to insignificance before they entered high school. And annual studies commissioned by the state have found no evidence that low-income students who receive vouchers to attend private schools do any better at reading or math than their peers.

As for Florida's charter schools, a recent report found their students consistently outscore kids in traditional schools on state tests. The charters, however, serve fewer poor and special-needs students and fewer students still learning English.

Meanwhile, researchers have found that other states, such as Massachusetts, have boosted achievement without Florida-style reforms, using more old-fashioned remedies such as increasing spending and imposing rigorous curricular standards.

After an exhaustive study of state-by-state academic gains, the Harvard researchers concluded in a July report that "the connection between reforms and gains ... thus far is only anecdotal, not definitive."

Emhof, the Bush foundation spokeswoman, said that while "there is no silver bullet" to improve schools, the Florida formula "is the path with the most proven results." The state's size and diversity mean "if something works in Florida, it can work anywhere," she said.

Meet and greet
Indeed, the Bush foundation touts the Florida test gains as "perhaps the greatest public policy success story of the past decade" and aggressively presses its formula on other states.

Hundreds of emails obtained under a public records request by the nonprofit advocacy group In the Public Interest, which opposes privatization of schools, show the foundation working closely with allies in Maine, New Mexico, Florida and elsewhere to craft public policy.

Foundation employees write legislation and edit proposed bills line by line, then send in experts to testify on their behalf, the emails show.

The Bush foundation also funds trips and events to introduce Bush's donors to policy makers. At last year's national summit in San Francisco, the foundation set aside two hours for several state superintendents of education, dubbed "Chiefs for Change," to meet the foundation's sponsors.

In an email forwarded to Executive Director Levesque, an official from Apple Inc. also requested access to the chiefs to tout the company's products.

"This is a great opportunity. ... But there are a dozen other companies that want access," Levesque responded. She couldn't accommodate Apple, she wrote, unless the chiefs first found time to meet with "all the other companies including those actually funding" the Chiefs for Change network.

Apple declined to comment.

Bush foundation donors include family philanthropies, such as those established by Microsoft founder Bill Gates and New York City Mayor Michael Bloomberg. Corporate donors include Connections Education, a division of global publishing giant Pearson; Amplify, the education division of Rupert Murdoch's News Corp.; and K12, a publicly traded company that runs online schools.

Many of these donors sit on a Digital Learning Council that helped draft the Bush foundation's policy agenda. Key planks call for states to require online course work in high school and to lift restrictions that hinder cyber-school growth, such as limits on class size.

Studies in several states including Pennsylvania and Colorado have found that online students fare far worse than their peers in reading and math. Bush has said bad programs should be shut down, but he believes online schools have great potential to offer personalized, self-paced education.

"This is not about our commercial success," said Sari Factor, chief executive officer of E2020 Inc., which develops online curricula and recently signed up as a foundation sponsor. "We're focused on what's right for kids."

Still, Factor acknowledged that E2020 has "absolutely" benefited from Bush's advocacy.

In particular, Bush often talks up an Arizona charter school called Carpe Diem, which uses the E2020 online curriculum, employing just four teachers for 225 students because the kids do so much work online. Bush has flown policy makers from across the country to admire the school's innovation and cost cutting. That has brought more clients to E2020, Factor said.

Arizona data shows Carpe Diem test scores have fallen sharply over the past two years, a drop founder Rick Ogston attributes to a new curriculum and the sudden death of the principal.

That has not slowed its momentum; after visiting Carpe Diem on a trip paid for by the Bush foundation, Indiana officials urged Ogston to apply to open a branch there. The head of the state charter school board, Claire Fiddian-Green, says the school's "fairly strong track record" impressed her despite the recent slip in test scores. The new Carpe Diem campus in Indianapolis opened this fall.

Ogston said he and other charter and online school operators count on Bush's foundation to remove obstacles to their growth, such as state laws that require students to put in time in a physical classroom.

"We come to them to say, 'These policies are in the way, and it would be great if you could change them,'" Ogston said. "That's what they do better than anyone." 

More from Open Channel:

• As fighting raged in Syria, Russia sent tons of cash to Damascus, records show
• One email exposes millions to ID theft risk in South Carolina cyberattack
• Study finds breast cancer risk for women in auto plastics factories
• Jill Kelley email: Petraeus, Allen sought help hushing 'Bubba the Love Sponge'
• Broadwell, Kelley both were repeat White House visitors, official says
• New cartel drug smuggling trend: teenage couriers
• Feds fail to fight Medicaid fraud in home health-care services, report finds
• As their secret dissolved, Petraeus, Broadwell chatted at awards dinner
• Email to Gen. Allen warning about Kelley among those she gave to the FBI

 

Follow Open Channel from NBCNews.com on Twitter and Facebook

 

The prescription painkiller business was booming in 2009, making millionaires of Chris and Jeff George, twin brothers who operated several pain clinics in South Florida. Unfortunately for them, their customers had a tendency to die, and not always in a subtle fashion.

In November of that year, three customers were on their way to a George brothers’ clinic when the driver tried to weave her Toyota Camry through the lowered arms of a train crossing. The car was struck by commuter train going 79 mph. The driver and a passenger were ejected from the vehicle and died at the scene. The third occupant died six months later. 

An associate of the Georges who read about the accident in the paper called Chris George to break the news. “Did it say they were pain clinic people?” George asked. 

It didn’t, but the Roxicodone scattered through the backseat of the crumpled car, and on both sides of the train tracks, made it obvious to investigators that this threesome from Tennessee didn’t come to Fort Lauderdale to get tans. (Roxicodone is a brand name for one of the prescription painkillers that contain oxycodone, the opioid that has a chemical structure like heroin, with roughly the same addictive qualities.)

---

Chris George worried that the accident would bring police scrutiny to the family’s pain clinics. To avoid situations like this, he and his workers coached their customers in keeping a low profile. “You’ve got to be an idiot to get hit by a train,” he complained.  

 

 

What George didn’t know is that federal and local investigators had already targeted him and his brother – after oxycodone distributed at George clinics was found near the dead bodies of dozens who overdosed -- and were listening to that very phone call.

Two years later the conversation would appear in a federal indictment charging the Georges with racketeering and drug trafficking for operating what federal officials say was the largest, most sophisticated painkiller trafficking organization in the country. 

Chris and Jeff George, both of whom have pleaded guilty to some of the charges against them and reported to prison last month to begin serving long sentences, declined to comment for this series, citing concerns that their remarks would add to their legal difficulties. Federal agents and prosecutors also refused interview requests, due to related cases that remain open. The information in these articles was gleaned from court records, interviews with associates of the Georges and informants, many of whom spoke on condition of anonymity. 

Fueling an oxy epidemic
South Florida -- and the Georges, in particular -- were the vanguard of what the Centers for Disease Control and Prevention calls an “epidemic” of oxycodone addiction and death -- one that had attacked America more suddenly than any drug has before. 

In 2008, prescription painkiller overdoses killed 14,800 Americans. In 2009, when the George clinics were at their peak, opioid abuse propelled a ghastly rise in the number of drug-related deaths nationwide. That year, 37,485 Americans died from narcotics overdoses -- a figure that for the first time surpassed the number of deaths from car accidents. 

“The toll our nation’s prescription drug abuse epidemic has taken in communities nationwide is devastating, and Florida is ground zero,” said Obama drug czar Gil Kerlikowske, speaking at a press conference last year. 

In 2009, Florida was one of 15 states that lacked a prescription drug tracking system, which enabled buyers to fill overlapping prescriptions without being flagged as drug abusers. That made the state susceptible to abuse on a grand scale.  

The Georges were not rags-to-riches drug dealers. They were born to a wealthy home builder named John George and grew up in Wellington, an ultra-affluent community known for its polo grounds and celebrity residents, including Bruce Springsteen. 

Watch the Top Videos on msnbc.com

South Florida was one of the first regions to be struck by the bursting of the housing bubble. By 2006, when the George family’s Majestic Homes was the featured builder on an episode of “Extreme Makeover: Home Edition,” the business was already in a tailspin. John George said that buyers were breaking their contracts because the homes were depreciating so rapidly, causing construction delays. Other buyers then complained, he said, earning Majestic an “F” from the Better Business Bureau. 

To cut costs, George closed the Majestic Homes office on Florida’s west coast run by Chris George, who moved back east across Alligator Alley to his native Palm Beach County. When he arrived, he soon learned that his brother, Jeff, had found an enterprise more lucrative than home building.

Jeff George, who has the broad shoulders and bull neck of an avid weightlifter, was selling steroids online. A physician wrote prescriptions to the buyers without having conducted a physical examination, according to a criminal indictment. That made the practice illegal.  

While moving through this black market, Jeff George made the acquaintance of a physician named William Overstreet. Versed in the nuances of Florida’s health care regulations, Overstreet suggested to George that the real money was in oxycodone, court records indicate.  

Overstreet was an authority on this subject. Based on his generosity dispensing pain pills, local cops nicknamed him the “Candy Man,” according to the criminal indictment of the Georges.  

With Overstreet’s coaching, Jeff George opened South Florida Pain Center in early 2008 in a small shopping plaza north of Fort Lauderdale. Brother Chris soon joined the business, according to court records. 

Recruiting physicians on Craigslist
To find physicians, the Georges posted Craigslist ads that promised generous pay. Job interviews were straightforward: the Georges wanted to know whether the physician was licensed by the state and registered with the DEA to prescribe controlled substances. Most important, according to the indictment, that physician had to be willing to prescribe with a heavy hand – including a drug “cocktail” of oxycodone and the anti-anxiety drug Xanax. Users often take oxy and Xanax simultaneously – a combination that killed actor Heath Ledger in 2008. 

The doctors who collaborated with the Georges had financial incentives to risk their licenses.  

Dr. Patrick Graham, for instance, maintained a successful plastic surgery practice in Boca Raton for decades, until he discovered that an office manager had been embezzling the clinic’s profits, according to friends who wrote letters to the court on his behalf. By the time he found out, it was too late to save the practice. Without enough savings to retire comfortably, and too proud to ask his professionally accomplished siblings for help, the 64-year-old Graham began working at a George clinic in July 2009. 

Cuban brothers arrested in biggest pharmaceutical theft

He had misgivings. In one recorded call detailed in court records, Graham was asked by Chris George to turn over some of the oxycodone he had ordered, presumably so that George could sell it to street dealers. Said Graham: “I think the idea is that I’ll do this one time, but I don’t like playing around with this stuff. This is just not something that you (do) in a medical setting.” (Graham, who was sentenced to four years in prison for his role in the Georges’ operation, declined to comment for this article.)

Skeptical physicians were assured that pain clinic practice had been vetted by attorneys and was entirely legal. Each clinic was structured to insulate the workers from prosecution and to maximize the flow of painkillers, according to the indictment. 

The Georges’ pain clinic customers were directed first to a mobile MRI unit, parked behind a West Palm Beach strip club. Since every individual’s spinal column has differences in alignment, the scans were used to support diagnoses that “irregularities” were causing the patient’s pain, a claim too subjective to dispute, according to the indictment. 

Patients were required to submit urine samples to demonstrate that they weren’t abusers. But the George clinics looked the other way when patients swapped clean urine, a practice that was so common that the clinic toilets would often become clogged after patients tried to flush condoms and containers they’d smuggled into the restroom, according to the indictment. Even when the urinalysis showed the presence of narcotics, lab technicians (many of whom were friends of the Georges) waved the patients through, directing them to other clinics run by the Georges for a physician’s exam, it said. 

Although “exam” may not be the best word. It was more like a physician’s glance. Undercover investigators said pain clinic doctors devoted an average of three minutes to each patient, ignoring the results of the MRIs, failing to inquire about the patient’s medical history and neglecting to ask the questions necessary to make an objective diagnosis, according to testimony by agents in DEA hearings.  

To save physicians’ hands from cramping, they were given stamps with which to “sign” prescriptions.  

Said Michael Aruta, one of the fastest-moving physicians: “These hillbillies don’t give a s--- about their health.” Powerful painkillers, he added, are “all they’re here for,” the indictment said. (Aruta, who was sentenced to six years in prison, declined to comment for this article.) 

Having received their scripts, customers were guided to pharmacies controlled by the George family. Chris George’s wife, Dianna, volunteered to help dispense the drugs. Given the dangers of mixing a deadly dose of medication, pharmacists are trained to take specific safety measures. Dianna’s previous job was dancing at a strip club. 

Efficiency becomes a problem
The efficiency of the George clinics soon became a problem. Shortly after the South Florida Pain Center opened in 2008, the brothers outgrew it. Jeff George opened East Coast Pain in West Palm Beach and Hallandale Pain in the South Broward County city of Hallandale Beach. In summer 2008 Chris George opened a clinic he called American Pain in Boca Raton. But the voracious appetites of his pill mill customers made it necessary to find an even bigger location, which is what led him in 2009 to launch the new American Pain in a 20,000 square-foot building in Lake Worth, near a mostly immigrant neighborhood. Immigrants don’t call cops, George said during a recorded phone call. 

American Pain was the biggest single clinic in the country, a Super Wal-Mart of addiction. Investigators say that the five most generous script-writing doctors saw 500 patients per day and, at up to $100 per patient, earned nearly $2 million in a year’s time. 

Said Dr. Graham during a recorded conversation with Chris George: “You make a lot more money doing this than doing plastic surgery.” Indeed, George was heard bragging that physicians who worked for him made an average of $35,000 per week.  

The parking lot and surrounding streets were lined with cars bearing plates from Kentucky and Tennessee, hotbeds for painkiller abuse. To make it less conspicuous, the clinic instructed patients to park in lots several blocks away, where they’d be picked up by a shuttle van and delivered to the clinic’s front door. 

To keep the painkillers coming by the truckload, the Georges also needed to deceive the pharmaceutical suppliers. Investigators recorded a conversation where George told an employee, “Remember, we’re lying about how many (clinic customers) are out of state. If you give them our real dispensing log it’s going to show that everybody’s from out of state.” 

For drug dealers in states like Kentucky or Tennessee, the 1,000-mile trek to South Florida paid for itself, and it became common for them to fill a van with people willing to pose as patients with chronic pain. On average, clinic patrons (or their sponsors) paid about $5 per 30-mg dose of oxycodone, which they could sell in Appalachia for $30. Just one of the George brothers pharmacies could dole out over 10,000 doses of 30-mg oxy in a single day. 

In addition to the millions of oxy doses the clinics administered over the counter, thousands more were diverted by George employees to street traffickers, who paid cash, according to investigators’ filings. 

The grip of oxy addiction guaranteed a loyal customer base. The more patients the clinics served, the more customers lusted for another fix. According to a DEA agent’s testimony in an administrative hearing, it was common to see 30 patrons in a queue before American Pain opened at 7 a.m., many of them itching compulsively, dressed in ragged clothing and chain-smoking cigarettes. The most woebegone addicts had track marks on their arms and appeared to be under the influence of drugs, the agent said. 

Security workers cruised the clinic grounds in golf carts, steering customers to the clinic door and punishing those inclined to loiter. At Jeff George’s clinics, a friend, Derik Nolan, became an enforcer, delivering beatings to patrons who did anything that could attract police, such as snorting the drugs outside the clinics or handing them to a dealer. Proud of his role, Nolan was heard on the wire boasting, “I’m like the f----ing underboss here. I’m the one who knows all (Jeff’s) dirty little secrets and the f----ing one that gets called when s--- needs to get done.” 

Nolan who pleaded guilty to his role in managing the pill mills and was sentenced in December to 14 years in prison, referred questions to his attorney, who declined to comment. 

As patients jumped ahead of others in line, fights broke out. It was also common for patients to have drug-induced overdoses and seizures. On the day after the train killed the group from Tennessee, another clinic customer was found dead on the side of a South Florida highway. 

John George, father of the two brothers, says that the clinics were operating within the law and that any illegal activity that occurred there was the fault of rogue physicians. He did not have a role in the clinics and was not charged with any wrongdoing in connection with the case. 

Burning dollar bills in barrels
The deluge of cash became a problem. Employees could be heard on the wiretaps complaining about cash drawers being stuffed to the top. It wasn’t worth keeping dollar bills, so those were separated and then burned by the barrel. Bigger bills were stuffed into garbage bags, then hauled to a bank. Chris George’s wife, Dianna, accepted the chore of making these rather suspicious deposits, although not without grousing that she’d become her husband’s “money mule.”  

Other cash-filled bags went to the home of the Georges’ mother, Denice Haggerty, who stacked it in safes in her attic. At one point, says a friend of the Georges, there were 14 safes in the attic, each containing $1 million. Haggerty, who divorced John George in 1988, pleaded guilty to conspiracy to commit wire fraud and was sentenced to 30 months in prison. 

The cash piled up despite the brothers’ free-spending ways. Jeff George bought a monster truck, multiple Lamborghinis and a Mercedes Saks 5th Avenue Edition. There were only five of those cars made, and George liked his so much that when he totaled it, he bought himself another, according to a friend.  

Jeff George assembled a small navy, including a 36-foot racing vessel, a 39-foot sports boat and two yachts, 38 and 55 feet in length. He also bought the shopping plaza housing his favorite strip club. The purchases were a convenient way to launder money, according to the indictment. 

As the Georges’ painkiller empire grew, it attracted enemies, both from within and without. The indictment cites recorded phone calls in which Chris George and Derik Nolan threatened violence against other pain clinic operators they perceived to be encroaching on the Georges’ turf. 

The Georges learned to suspect treachery even from their friends. A roommate of Jeff George named Robert Eddy was thought to have stolen some $500,000 in clinic funds. According to federal filings and testimony in pre-trial hearings, the brothers had Eddy handcuffed then brought to a vacant home owned by Jeff George. To intimidate Eddy, Jeff George allegedly fired a gun just inches from Eddy’s head, according to the indictment. Eventually, he was released unharmed. Chris George allegedly gave Eddy $10,000 to keep quiet about the incident, although court filings indicate the brothers remained dubious about Eddy’s loyalty. 

The incident may have made Jeff George paranoid about his other friends and clinic associates. According to the indictment, he put employees through lie detector tests. Chris George had his clinic regularly swept for listening devices. 

They even had doubts about whether they could trust the man who introduced them to the painkiller business, Dr. William Overstreet. Multiple sources with knowledge of the investigation say that the Georges had a dispute with the so-called “Candy Man” over money.  

Overstreet left the pain clinic business around 2009, moving to Panama. Shortly thereafter, Overstreet’s car reportedly flew off a cliff, killing him. The U.S. Consulate confirmed the death of an American by that name, though it refused to give a date or the manner of death, citing privacy rules.  

Jeff George made multiple trips to Panama and Costa Rica while the pain clinics were in business, but there’s no evidence he was there at the time of Overstreet’s death, and there are no filings in the drug trafficking case to suggest that he had any role in it. 

Despite the internal conflicts, the brothers’ clinics were thriving like never before in early 2010, having made nearly $1 million in a single week in late February. But on the morning of March 3, they were awakened by urgent phone calls: The clinics were being raided by a DEA task force. 

Even as masked agents emptied file cabinets and hauled off boxes of pills, clinic customers walked past them to the front desk, demanding new prescriptions. At the same time, agents were swarming through the George brothers’ homes and counting the millions of dollars squirreled away in their mother’s attic. 

'I'll take the fall'
Jeff George managed to keep a stiff upper lip. When a reporter for the Palm Beach Post called, he said, “It’s unfortunate for the patients that they have nowhere to go now. They are the ones that are really going to be affected the hardest by this.” 

Meanwhile, Chris George, who spent the morning driving in his SUV between clinics, was panicking. The feds were listening on the wire when he told his wife, Dianna, “I’m f----ed.” He added, “Babe, I don’t know. Maybe I should just kill myself.”  

Said Dianna George, “I’ll take the fall for everything, OK?”  

But perhaps there was another way out. With investigators needing months to sift through the medical records they collected at the George clinics, it would take time before the Georges were formally charged with crimes. 

In pretrial hearings, prosecutors alleged that Chris George discussed with an informant named Zack the murder of Robert Eddy, the former friend who had been handcuffed and threatened after it was believed he stole $500,000. Nothing came of the alleged plot, and Chris George was not charged with attempted murder. 

But he may have deployed another strategy for deterring witnesses. In October 2010, Chris George got a tattoo on his lower leg: a rat, its lifeless body hanging from a noose. A friend took a picture of the tattoo, then texted it to a witness in the case. 

Prosecutors moved swiftly, hauling George into court and citing the rat tattoo as evidence that the clinic kingpin was a threat to government witnesses and should be jailed without bond. A federal judge agreed. 

Having apparently exhausted all other ideas, in 2011 the George brothers finally agreed to testify against the doctors they hired at the clinics. That, as well as guilty pleas to racketeering charges, would spare them from going to trial and risking a sentence that would put them in prison for the rest of their lives.

Jeff George came to his January sentencing hearing dressed in a double-breasted suit, hands clasped contritely in front of him. His hair, frosted at the tips when he began the clinic business, was now streaked with gray. “I realize what I did was 100 percent wrong,” he told the judge. “I take 100 percent responsibility.” 

The judge sentenced him to 15 1/2 years. George has also pleaded guilty to a state case of murder in the case of a patient named Joey Bartolucci, who died by overdosing on oxycodone he received at East Coast Pain clinic. The sentence in that case may bring George’s total prison stay to 20 years. 

Chris George, who also pleaded guilty to racketeering, was sentenced to 17 1/2 years. In all, 26 of the brothers’ associates will serve time, including Chris George’s wife Dianna and the Georges’ mother, Denice Haggerty, both for more than a year. Of the nine doctors indicted in the federal case, seven have entered guilty pleas -- the first time that doctors have been convicted in a “pill mill” racketeering case. The remaining two appear likely to go to trial, currently set for August. 

20 million pills in three years
During the nearly three years that Georges’ four primary clinics operated, investigators estimated that they churned out roughly 20 million doses of oxycodone. 

Based on what they learned from listening to wiretaps, federal prosecutors believe that the Georges made at least $40 million through the pain clinic and other fraudulent enterprises. In the raid, the government seized about $5 million in cash and property worth $9 million. The rest of the money is still unaccounted for. 

It’s much harder for the government to calculate the human casualties of the George clinics. By cross-referencing files from the Florida Medical Examiners Commission, investigators found that the George’s drugs had a role in 53 overdose deaths in Florida alone. Considering that 80 percent to 90 percent of the patients came from out of state, the number of deaths that occurred outside of Florida must be far greater. As a federal prosecutor noted at one hearing, “We don’t know how many kids died behind barns in Tennessee, Ohio, Kentucky and West Virginia” -- the Appalachian states home to the Georges’ most loyal customers.  

The brothers may have known that their drug-dealing in Florida wasn’t going to last. Thanks to new state laws regulating the amount of oxycodone a single doctor can purchase, sales of the drug declined 97 percent from 2010 to 2011, according to figures cited by Obama drug czar Kerlikowske at a congressional hearing on March 1.  

In the Georges’ former base of Palm Beach County, the number of pain clinics likewise plummeted by 65 percent in the past year, according to Sheriff Ric Bradshaw, who said that the remaining clinics are either under investigation or are legitimate practices. 

These developments may have played a role in the Georges’ interest in taking their enterprise national. At the time they were raided, the brothers had recently launched a clinic in Kennesaw, Ga. and were scouting locations in Texas and St. Louis. 

Considering that the Georges’ physicians ranked among the nation’s biggest oxycodone purchasers, the bust of their South Florida clinics played a major role in reversing both local and national trends of rapidly increasing painkiller abuse. 

Despite the hard fall taken by his sons, who began serving their prison sentences on April 27, real estate developer John George still maintains that they were victims of physicians who broke the law. “We had every indication that what (the clinics) were doing was perfectly legal,” he said. “My sons aren’t doctors. They counted on the doctors and their staff to do their work correctly, but they didn’t.”