Cities and counties all over Indiana are putting together budgets, but one topic that may get more attention than in past years is cyber security. Ransomware attacks hit the headlines earlier this year when hackers shut down an oil pipeline that runs up the east coast. That was followed with computer attacks that hit the nation’s largest meat supplier, JBS. But increasingly those attacks are impacting local governments. One of the biggest came in north Texas where a dozen communities lost the ability to use their computers to do police work, operate utilities and about anything else you do at town hall.
“This used to kind of be in the back of everyone’s mind,” said Washington City Clerk-Treasurer Beth McGookey. “Now it is moving to the front.”
For the city of Washington, keeping the computers safe is important.
“Cyber security is a big topic,” said Washington Mayor Dave Rhoads. “I would like to think we are secure, but you can never be 100% secure. We have an information technology director (Michael Folsom). I know he is always working on ways to make us more secure. We have firewalls and software that looks for malicious emails or other attacks. We also have a lot of off-site storage so that we can restore things in the event of an attack. I know we have done a lot to protect our network.”
For Washington, the protection is not just for the city, but also for the utilities. With electric, water, sewer and storm water utilities a hacker could, at the minimum, disrupt billing and at the worst impact operations.
“Mike is constantly watching our systems and working with department heads to try and keep everything secure,” said Rhoads.
While a larger community like Washington may be able to beef up computer operations to make them safer, some smaller communities may not have access to the same computer expertise.
“I don’t think we are any more exposed than the normal household, but I don’t know what we have in terms of security for our systems,” said Montgomery Town Board President Mike Healy. “Until a couple of years ago it really wasn’t anything to think about, now it is.”
Healy says at one time he was on a board with a Lawrence County official. That official issued a warning to other government agencies after experiencing a hack.
“They wound up paying a ransom to get their systems back,” said Healy. “He said it took a long time to get everything re-established and operating properly. That should have served as our warning. Now I think we need to get this on the agenda of our next town board meeting.”
Like Montgomery, Odon also has some reasons to worry about cyber-security.
“We do have some new software, but I don’t know for certain how secure it is,” said Odon Town Board vice-president B.J. Sanders. “That is something I would have to look into. I know we do have back-ups that we could use in the event of an attack. We could just wipe everything and then update with the back-ups.”
Sanders says that the town’s utilities are not operated online so they would not be vulnerable to an attack.
“It’s scary to think of all of the damage they can do,” said Sanders. “This is beginning to look like a major issue for everyone.”
Daviess County has been paying attention to cyber security for a long time. It was one of the first counties in the area to hire their own IT manager.
“Dale (Quakenbush) has been with us for quite a while, and I know that is something he works on all the time,” said President of the Daviess County Commissioners Michael Taylor. “I know he has installed firewalls and software and off-site storage to get us back up and running if we do get hacked.”
The county’s systems went through a significant upgrade when the new county annex opened. But before that it did get hit with an attempt to hijack the Daviess County systems.
“We had it four years ago,” said Quakenbush. “We had an employee who opened an email and that triggered a malware virus. The virus shut down that one person, but it did keep it isolated into the one user. They wanted a $500 ransom for a key. Instead, I shut it down and wiped that computer’s information for one day and then restored it. We didn’t pay anything.”
But he calls the fight to keep the county’s servers secure an endless battle.
“There is always someone trying to get through our firewalls,” said Quakenbush. “Even while I am sitting here talking to you, I can see more people trying to figure out a way to get in. We find our best defense is strong local controls. We are very careful about who gets access to our system and what they can access. We have done a lot to make certain even if someone does get in that we can return the system to operation.”
Most of the computer mischief is not coming from local people. It is coming from eastern Europe, Russia, China, Korea, Japan, Africa and Israel. And even if a local government can trace down one of those hackers there is no punishment. Many of those countries see beating Americans out of their money as no crime at all.
“It just goes on all day, every day,” said Quakenbush. “What I have been noticing most recently on our services is more phishing attacks. They are trying to get our peoples’ information so that they can get at bank accounts and other information. If our firewall wasn’t sound, we would be dealing with ransomware all the time.”
One reason the county has the level of security it has is because of the support of the commissioners and county council.
“Since 2009 I never even been questioned when I made a request to upgrade our security,” said Quakenbush. “They never batted an eye. Some of these systems are expensive and cost some money, but if you are on the internet you have to have it because someone out there is coming after you.”
Local officials declined to get too specific about their defenses to cyber-attacks. Keeping the specifics secret is part of the defense.
“Mystery is part of the solution to security,” said Quakenbush. “I can tell you that all of our eggs are in a lot of different baskets. Still, those bad guys are always working on it and that is why we have to keep working on it.”
And if absolutely everything fails the city and county do have one more thing.
“Insurance is our last line of defense,” said Taylor. “If all else fails we can use it to pay the ransom.”
Daviess County has a $1 million policy. The city of Washington is insured for $3 million.
“Given what we have seen this year, I wonder if we should think about expanding that coverage,” said McGookey.