Ransomware: We Wish Some Things Weren't Bigger in Texas
Privacy Plus+
Privacy, Technology and Perspective
Ransomware: We Wish Some Things Weren’t Bigger in Texas – On the morning of Thursday, August 16th, over twenty (20) smaller local cities and agencies in Texas were struck in a coordinated ransomware attack.
The Texas Department of Information Resources (“TDIR”) has not published a list of the twenty-two odd towns, cities, and agencies that were affected, citing ongoing law enforcement investigations. It has been reported that those struck include Borger (pop. 13,250), in the Panhandle; Keene (pop. 6,100), outside Fort Worth; Wilmer (pop. 5,000), south of Dallas; and the Robertson County (pop. 16,600) Sheriff’s Department, in Central Texas east of Temple and Killeen. As of a few days ago, the TDIR says that “more than 25%” of the affected entities “have shifted from response and assessment to remediation and recovery with some returning to business as usual.” The latest update from TDIR does not say how the other 75% of the affected governmental entities have responded. A link to the TDIR’s update follows:
https://dir.texas.gov/View-About-DIR/Article-Detail.aspx?id=209
According to the update, this ransomware attack was coordinated by “one single threat actor.” NPR reports that the attackers demanded a collective ransom of $2.5 million. A link to the NPR’s post follows:
Otherwise, not many details are publicly available.
Whether driven by increasing attacks, or by lax data security and insufficient training and awareness, or by some combination of those factors, ransomware attacks on local government entities are sharply on the rise.
In March 2018, the City of Atlanta suffered a ransomware attack and took a principled stand by promptly publicly acknowledging the attack, disclosing that it might compromise sensitive data, and ultimately refusing to pay the against paying a $51,000 bitcoin demand – a stand which cost the City $7.2 million. More about the Atlanta ransomware attack can be found in the two links that follow:
https://www.theatlantavoice.com/articles/mayor-testifies-before-u-s-house-subcommittee/
Since then, attacks on local governments have occurred in nearly every state. Each has responded differently. What is clear is that many local and state governmental entities simply do not have the sophistication or budget to manage cyber-security risk appropriately.
In comparison, Australia has led a coordinated effort across its government and private sector to address cyber-risk by designating a national cybersecurity coordinator, the Australian Cyber Security Centre (“ACSC”). In addition to raising cyber-awareness, the ACSC is designed to bring together state, territory and Australian Government agencies in order to better coordinated the country’s defenses and encourage the prompt and full reporting of incidents to the public, along with a systematized response and investigation specific incidents and threats.
We would like to see more coordination, sophistication, security, transparency, enforcement/redress, and budget from governmental entities, rather than roughshod, opaque responses without recourse for compromised data.
Hosch & Morris, PLLC is a Dallas-based boutique law firm dedicated to data protection, privacy, the Internet and technology. Open the Future℠.