‘WannaCry’ Ransomware Attack Raises Alarm Bells for Cities, States

by Jenni Bengal for The Pew Charitable Trust

The massive cyberattack that has infected computers in at least 150 countries this past week hasn’t had a major impact on the federal government. But it has struck at least one county and several universities and prompted some state and local agencies to scramble to beef up their protections against the virus.

In the Chicago area, the virus showed up on computers in some Cook County government offices. MIT and several other universities reported that some of their computers also had been compromised. In Connecticut, the state court system briefly shut down some of its computers to update anti-virus software. And in Michigan, state officials quickly began installing extra protection on servers, work stations and public kiosks.

State IT officials say they often don’t have enough money to effectively fight sophisticated cyber threats. And the scale of this one has made them even more concerned.

“This is a big wake-up call because it is cyber disruption,” said Doug Robinson, executive director of the National Association of State Chief Information Officers (NASCIO). “States and local government need to address this because it’s a serious threat. We have urged states to take action immediately.”

Cybercriminals launched the fast-moving virus, dubbed “WannaCry,” last Friday. So far, it has infected more than 300,000 machines in countries from Russia to Brazil. Its victims have included Britain’s National Health Service, universities in China and Germany’s train system.

The attackers used “ransomware,” malicious software that hijacks computer systems, encrypts data and locks machines, holding them hostage until victims pay a ransom or restore the data on their own. Hackers demanded $300 to $600 in payments in bitcoin, digital currency that is transferred all over the internet, which makes payments difficult to trace.

WannaCry spread across computers that run on Microsoft’s Windows operating systems. While Microsoft issued a patch, or security update, in March to protect against the virus, many systems that used older versions the company no longer supported remained vulnerable. Microsoft released special patches for the older versions after the cyberattack.

Cybersecurity experts say they’re not sure why more computer systems in the U.S. haven’t been infected. But they caution that state and local governments still could be affected.

“We’ve been getting a lot of emails from them wanting to know what they should do,” said Brian Calkin, a vice president of the Multi-State Information Sharing and Analysis Center, a federally funded group that tracks cybersecurity issues for states and local governments. “Our advice is to apply patches and keep your antivirus software up to date. Who knows what will happen?”

A Growing Threat

Hackers using ransomware increasingly have been attacking local governments, hospitals and police departments across the U.S. City and county governments, along with local school districts, have seen an “exponential rise” in threats in the last two years, said Srini Subramanian, a state cybersecurity specialist at the consulting firm Deloitte & Touche LLP. Victims have ranged from small police departments in Maine to a large hospital in Los Angeles.

Even if government officials decide to pay hundreds or thousands of dollars in ransom, their computer networks and communications are often crippled for a day or more by the viruses. And if they don’t pay, it can sometimes take days or even weeks to get their systems back up and running. In the meantime, public services for residents, schoolchildren and even hospital patients may be affected.

While federal officials say the WannaCry ransomware attack apparently has only raised about $70,000 in ransom and the infection rate has been lower in the U.S. than in many other parts of the world, they caution that the crisis may not be over, as the malware morphs into other forms that could threaten more networks.

Some state and local officials say they aren’t taking any chances.

In Connecticut, the judicial branch this week performed “preventive maintenance” on its computer system at courthouses statewide, said spokeswoman Rhonda Stearley-Hebert. She said some parts of the system had to be shut down briefly, including at New Haven Superior Court, where cases were delayed for two hours Monday as staffers installed a software update.

In Auburn, Massachusetts, Information Technology Director Mike Marino said his office installed anti-ransomware software this week on every computer on the network, including those at the municipal building, senior center, library and fire stations.

Auburn’s school department was hit by a ransomware attack about a year and a half ago, and Marino said he doesn’t want town offices to go through that kind of situation. “Just the work required to get things back up and running is so time intensive,” he said. “Plus, any files that aren’t able to be backed up are just lost.”

Michigan took emergency steps to upgrade its network with the latest patch as soon as officials learned of the global cyberattack, said Rajiv Das, the state’s chief security officer. As of Thursday, all the work was completed other than at some employees’ desktops and kiosks used by the public.

“Right now, we are watching very carefully. This is definitely not the end,” Das said. “If you ask me, I’m worried. That’s why my team is on guard.”

In Cook County, WannaCry was discovered on “a small number of systems,” according to spokesman Frank Shuftan. He said as of Thursday, almost everything had been restored and staffers were making additional security improvements, but he would not give any more details, citing security reasons.

Cybersecurity Challenges

For IT chiefs at the state and local government level, the failure to protect computers is often a matter of dollars or indifference, said Dan Lohrmann, chief security officer for Security Mentor, a national security training firm that works with states.

“Some agencies may have the funding to do updates; some may not. Some may be interested in doing it; some may not,” he said. “In many cases, it’s very decentralized. So it’s more like herding cats.”

While cybersecurity has become the top priority for state IT officials, funding is often inadequate, according to a 2016 survey of top IT security officers from 48 states by NASCIO and Deloitte. The report found that in most states, spending on cybersecurity was only a fraction of the overall IT budget, ranging from zero to 2 percent.

And while most elected and appointed state officials said they are very or extremely confident that IT security officials are well-prepared for cyber threats, the report found that only about a quarter of the security officials responsible for dealing with the threats were very or extremely confident that adequate measures are in place to protect the data.

NASCIO’s Robinson said a global, organized cyber threat like WannaCry shows how important it is for those measures to be in place.

“I don’t think it’s over. There’s the chance they will regroup and do another targeted attack,” he said. “States need to patch their operating systems when the patches are released. They need to work to strengthen their firewalls and back up their computers. They need to be ready.”

By Susan Stamper Brown

Since Adam’s fall in Eden, we humans find it easy to fall for lies. Especially in the absence of a moral filter which helps us differentiate between and navigate around what is right and wrong.

Apparently, moral filters were in short supply in Germany in the 1930s when Nazism was on the rise. Adolf Hitler and his minister of propaganda, Joseph Goebbels, launched an insidious campaign against the Jews. They spread their evil telling despicable lies blaming Jews for every malady on the planet.

Hitler’s “big lie” campaign included the idea that if a big lie is repeated frequently enough, it will be believed.

Concentration camps, gas chambers and mass graves across Germany spoke to how effectively their “big lie” propaganda technique worked. That presumably preventable and disturbingly dark stain etched on the annals of history should give all thoughtful humans reason for pause.

America, it seems, has recently become home for, as Rush Limbaugh puts it, “a special kind of stupid.” Democrats and their media cohorts understand their lies will eventually be considered “truth” if they hammer away at it long enough.

Their goal is to normalize abnormality to the point our brains begin convincing us that the Star Wars Cantina scene is as regular and ordinary as a Mayberry R.F.D.soda shop. Switch on your flat screen to hear the cacophony of wild accusations, zany insinuations, and hare-brained inferences of untruth- tellers, thrashing in the throes of post-election temper tantrums.

Donald Trump is an illegitimate president, just like George W. Bush who “stole the election” they incessantly regurgitate. The only difference in their rhetoric now is that hanging chads have become Russian hackers.

In 2000, recounts reflected Bush won, even in the four Florida counties Al Gore cherry-picked for recount because they leaned heavily Democrat. Gore was such a pathetic loser, he couldn’t win his home state of Tennessee. Even so, Bush stole the election.In its majority opinion, the U.S. Supreme Court described the cheating by Democrat Party counters who continuously changed the counting rules during recounts to rig the election in favor of Al Gore.

The one thing I know with certainty: There is a God…and he rescued us from what would have been sure and certain disaster if Gore was president on September 11, 2001.

Nevertheless, Bush was illegitimate…illegitimate…illegitimate…just like Donald Trump, they ceaselessly reiterate.

Although the fresh air of truth floats just above their noses, they remain content hog-scratching through the mud piles of innuendoes, overtones and implications in search of a mouthwatering morsel of mistruth they can twist into something else. The Devil deals in counterfeits, you know.

On May 11 during a meeting of the Judiciary Committee which had nothing to do with Russia, Senate Judiciary Committee Chairman Chuck Grassley and Ranking Member Democrat Dianne Feinstein addressed the subject of Russia. Grassley said both he and Feinstein were briefed by former FBI director Comey regarding the individuals the current FBI investigation targeted.

Grassley said, “Mr. Comey testified before the Judiciary Committee last week… Shortly after Director Comey briefed us, I tweeted that he should be transparent. I said he should tell the public what he told Sen. Feinstein and me about whether the FBI is or is not investigating the president. On Tuesday, the president’s letter said that Director Comey told him he was not under investigation. Sen. Feinstein and I heard nothing that contradicted the president’s statement.”

Grassley also said the FBI should “confirm to the public whether it is or is not investigating the president. Because it has failed to make this clear, speculation has run rampant” tempering “some of the unsubstantiated statements that have been made.”

Later, Grassley told Fox News’ Neil Cavuto: “There’s no evidence whatsoever now that they [Russia] changed one vote, but that suspicion is out there.”

Sure is. Ask the hog-scratchers.

State Agrees To Pay Family $25M To Settle DCS Case

Indiana will pay $25 million to conclude a northern Indiana family’s decade-long legal fight to clear their names after the Department of Child Services falsely prosecuted them for their daughter’s death.

Roman and Lynnette Finnegan and their three children – Johnathon Abair, Tabitha Abair, and Katelynn Salyer – will share in the settlement confirmed Wednesday by their Indianapolis attorney, Ron Waicukauski of Price Waicukauski Joven & Catlin, LLC.

“It’s fair to say we’re very pleased this is finally resolved after so many years,” Waicukauski said. “The family has received a significant measure of justice,” he said, from “parties who were responsible for causing enormous suffering.”

A federal jury in 2015 awarded the Finnegans $31.3 million against Pulaski County DCS agents and an Indiana State Police detective. The verdict included $12 million for conduct by state actors that jurors found shocked the conscience. Last year, the state appealed the verdictto the 7th Circuit Court of Appeals. The case was dismissed Wednesday after parties filed a joint motion noting settlement had been reached. The Chicago appeals court earlier this year ordered mediation in the long-running matter.

A spokesman for the Indiana Department of Child Services did not immediately respond to a message seeking comment.

The Indiana Attorney General’s Office, which represented DCS in the litigation, released a copy of the settlement agreement Thursday afternoon.

Among the settlement terms, Chief Counsel of Appeals Stephen Creason said in a statement, “The parties agree and understand that in reaching this agreement, the state defendants have denied and continue to deny any fault, wrongdoing or liability on their respective parts with respect to all of the claims made against them and as part of this lawsuit. This settlement has been reached solely to avoid the uncertainties of litigation and the expenses, which have been and will be incurred in the prosecution and/or defense of this matter.”

According to the settlement, the $25 million will be paid from the Indiana Tort Claims Fund.

The jury’s verdict came after a 15-day trial before District Judge Rudy Lozano in the District Court for the Northern District of Indiana. Lozano later affirmed the jury verdict after the state petitioned that it be reduced, ruling there was no reason to conclude it was excessive or unreasonable. The state subsequently appealed.

The Finnegans’ daughter, Jessica, died in the family’s Francesville home in 2005, and DCS investigators suspected abuse. But even after an investigation showed the girl died due to prescribed medication that caused a fatal drug interaction with another medication she took to treat a lifelong heart condition, DCS continued to pursue false neglect substantiations against the parents.

A Pulaski County judge found investigators had falsified official records to justify the false substantiations that he ruled were arbitrary and capricious. DCS’ intervention also resulted in the removal of the Finnegans’ other children, who were placed in foster care.

The jury awarded compensatory damages on 22 violations of First, Fourth and 14th Amendment violations involving the Finnegans and their children. In nearly each of those, the jury found former Pulaski County DCS director Laurel Myers most liable.

Jurors awarded lesser damages against Regina McAninch, a former DCS investigator and caseworker; Reba James, a regional DCS director under former director James Payne; and Jennifer McDonald, an Indiana State Police detective.

Waicukauski said the $25 million settlement includes legal fees but declined to say how much of the sum will be paid to attorneys who’ve handled the matter. In 2016, four lawyers petitioned the Northern District for fees of $2.8 million. Lozano stayed the petition until the case was resolved on appeal.