Just Say No to Hackers

To be sure, many cyberattackers have gone after local governments already. Just prior to Memorial Day, the city of Philadelphia had to shut down the court's website after experiencing “virus intrusions.” Not to be outdone, government computer and email systems in the town of Riviera Beach, FL, were put under siege in June.

According to Michael Waters, a shareholder at Polsinelli, cities have historically been prime targets for hackers due to their reliance on dated IT systems and insufficient backups.

“Unless that changes I think that they will continue to be a target of hackers,” Waters says.

Not every municipality responds to the target on its back the same way. Last May, government employees in Baltimore were locked out of their computers and email addresses by a ransomware attack, but the city refused to pay the ransom. Riviera Beach, however, agreed to pay the hackers $600,000 in bitcoin to get their systems back online.

Which was the right approach? The answer depends largely on how vital the impacted systems are to day-to-day operations, which could spell trouble for the blanket “just say no” approach favored by the Conference of Mayors resolution.

“If you have your town or city's health care shut down or water waste shut down … what is there for you to do? Just restart everything from scratch?” says Jarno Vanto, a partner at Crowell & Moring.

In addition to the more immediate consequences of refusing to pay a ransom, there could also be potential legal ramifications as well if third-party data is being held hostage. Waters used the hypothetical example of a city or county hospital that falls subject to a ransomware attack that prevents patients from accessing their medical records.

A resulting class action lawsuit against the city would not be out of the realm of possibility.

“If you're a city or a county faced with that kind of lawsuit I don't know that your standing up to hackers on principle is ultimately going to be successful in court,” Waters says.

To be sure, no one actually wants to pay hackers a ransom. Bresman thinks that the statement being sent by the Conference of Mayors is an important one, but absent a serious commitment to improving cybersecurity standards within local governments, it's mostly just talk.

There's still strength in numbers, even if it isn't in the shape of a pledge.

“If you can share knowledge among the community in terms of what is it that other municipalities are doing, how are they being prepared for the ransomware, what are the steps that they are taking, what are the threats that they are seeing. … Basically sharing knowledge in that regard,” Bresman says.

*****

Frank Ready is a reporter on the tech desk at ALM Media. He can be reached at [email protected].