Just Say No to Hackers

Last month, the U.S. Conference of Mayors passed a resolution (scroll down) discouraging cities from paying ransoms to hackers that have taken their systems captive. The underlying logic is pretty straightforward: if bad actors realize that there's no longer any cash waiting for them at the end of the rainbow, they'll eventually pack up their ball and go home.

Still, talk is cheap and the infrastructure that cities need to deploy in order to prevent their systems from being held hostage in the first place is not. Without a substantive investment in talent and security solutions, a pact such as the one announced by the Conference of Mayors might not endure the slew of challenges it's sure to face.

“I think in the short term it might actually increase the attacks,” says Mickey Bresman, CEO of the enterprise protection company Semperis. “It will get much more attention in the media so it just might be that if there is a criminal organization out there that still has not thought about going after local governments, now they might.”

To be sure, many cyberattackers have gone after local governments already. Just prior to Memorial Day, the city of Philadelphia had to shut down the court's website after experiencing “virus intrusions.” Not to be outdone, government computer and email systems in the town of Riviera Beach, FL, were put under siege in June.

According to Michael Waters, a shareholder at Polsinelli, cities have historically been prime targets for hackers due to their reliance on dated IT systems and insufficient backups.

“Unless that changes I think that they will continue to be a target of hackers,” Waters says.

Not every municipality responds to the target on its back the same way. Last May, government employees in Baltimore were locked out of their computers and email addresses by a ransomware attack, but the city refused to pay the ransom. Riviera Beach, however, agreed to pay the hackers $600,000 in bitcoin to get their systems back online.

Which was the right approach? The answer depends largely on how vital the impacted systems are to day-to-day operations, which could spell trouble for the blanket “just say no” approach favored by the Conference of Mayors resolution.

“If you have your town or city's health care shut down or water waste shut down … what is there for you to do? Just restart everything from scratch?” says Jarno Vanto, a partner at Crowell & Moring.

In addition to the more immediate consequences of refusing to pay a ransom, there could also be potential legal ramifications as well if third-party data is being held hostage. Waters used the hypothetical example of a city or county hospital that falls subject to a ransomware attack that prevents patients from accessing their medical records.

A resulting class action lawsuit against the city would not be out of the realm of possibility.

“If you're a city or a county faced with that kind of lawsuit I don't know that your standing up to hackers on principle is ultimately going to be successful in court,” Waters says.

To be sure, no one actually wants to pay hackers a ransom. Bresman thinks that the statement being sent by the Conference of Mayors is an important one, but absent a serious commitment to improving cybersecurity standards within local governments, it's mostly just talk.

There's still strength in numbers, even if it isn't in the shape of a pledge.

“If you can share knowledge among the community in terms of what is it that other municipalities are doing, how are they being prepared for the ransomware, what are the steps that they are taking, what are the threats that they are seeing. … Basically sharing knowledge in that regard,” Bresman says.

*****

Frank Ready is a reporter on the tech desk at ALM Media. He can be reached at [email protected].