Man cleared of wrongdoing in alleged hacking of East Texas city’s computer system

Published 5:45 am Friday, December 6, 2024

A Hawkins man accused of hacking into the city’s computer system in April has been cleared of wrongdoing.

A Texas Rangers investigation found that Shahaub Tafreshinejad, a cybersecurity professional and son of Hawkins Place 4 Alderwoman Eleta Taylor, did not commit a crime when he attempted to perform cybersecurity work April 1 for the city.

Mayor Deb Rushing, who took office that day, had accused Tafreshinejad of hacking into the computer system and committing criminal acts, saying he gained unauthorized access to it.

“I know that I didn’t do anything wrong. I stood by it from Day 1, and the city still hasn’t apologized,” Tafreshinejad told the News-Journal. “I’m still in the process of obtaining counsel to file a lawsuit and hold them accountable.”

Texas Department of Public Safety Sgt. Adam Albritton confirmed Wednesday that the investigation was closed and no offenses were committed.

The news brings to an end a months-long controversy in the small Wood County town.

On April 1, Tafreshinejad and former interim Mayor Chuck Richoz entered Hawkins City Hall, where Tafreshinejad performed a cybersecurity audit of the city’s computer system. He installed remote-access software and network mapping software on a computer in the mayor’s office.

Rushing was sworn in as mayor later that day, and city officials shut down the city’s computer system, fearing that a cybersecurity breach had taken place and that data had been compromised. Rushing also said she wanted Taylor, Richoz and Tafreshinejad to face criminal charges relating to the incident.

But no data was stolen, and no cybersecurity breach occurred. Tafreshinejad now is speaking out about the “false allegations and accusations hurled” at him.

Through his company — Spica Secure Solutions, Inc. — Tafreshinejad signed a contract with Richoz stating that he would perform $20,000 worth of cybersecurity work for the city for free. City Hall employees, however, insisted that Tafreshinejad had no right to work on the computer system, as the City Council in March tabled a vote to hire him to conduct the work.

Tafreshinejad said his goal in performing the cybersecurity audit was to help the city come into compliance with state laws requiring cities to have adequate cybersecurity protection — which Hawkins lacked, he said.

He also said he believes city officials only resisted his efforts because they believed he’d expose wrongdoing on their part.

Tafreshinejad previously had requested documentation from city officials to determine whether the city had adequate cybersecurity software, which employees said they did, Tafreshinejad said. However, after an open records request battle in which the Texas Attorney General’s Office intervened, city employees ultimately told Tafreshinejad they had no documentation to provide him with — confirming his suspicion that the city lacked required software, he said.

Tafreshinejad previously had spoken to the City Council and urged members to take action to improve the city’s cybersecurity measures, but the council tabled the vote on whether to hire him.

Tafreshinejad signed the contract with Richoz to perform the audit days before Rushing took office. He said it was only a coincidence that he attempted to perform the audit the same day that she would be sworn in. Tafreshinejad, however, accused Rushing of making the situation appear as if he acted “under a cloak of darkness.”

A Hawkins police officer responded to City Hall during the April 1 incident and spoke with Tafreshinejad. Tafreshinejad explained what he was doing, and the officer left without asking him to leave. Tafreshinejad said he followed government standards to conduct the audit.

Tafreshinejad installed the software on the computer in the mayor’s office to determine how it would respond to potentially suspicious activity — a step in determining whether a computer is vulnerable to hacking. However, because he didn’t have access to the city’s wireless network, he was never able to connect his computer to the city’s network to complete the audit.

He also installed software on the city computer called a Wazuh agent that would report the computer’s activity to a third-party cloud-based server, which would detail data such as login information. When he returned to his home later in the day, he was able to connect his own computer to the server to see what activity on the mayor’s computer had been logged, he said.

That’s when he discovered that a former Hawkins mayor’s credentials were being used to log into the computer in the mayor’s office. Tafreshinejad said he was concerned that people’s credentials hadn’t been removed after leaving office.

Tafreshinejad said the software he installed on the computer was necessary for the cybersecurity audit, but Rushing made a “whole stink” about it, he said.

“When you got people that don’t know what the hell they’re talking about, it makes it seem like there’s all this nefarious thing going on,” Tafreshinejad said.

Rushing refused to hand over the computer to Hawkins police, Tafreshinejad said. She ultimately handed it over to the Texas Rangers, which are part of the DPS.

Days after the incident, Tafreshinejad gave a roughly two-hour statement to Hawkins police, explaining in detail what he was doing, and he created a report at the department’s request showing how the city lacks adequate cybersecurity protection.

Law enforcement agreed with Tafreshinejad that he didn’t commit a crime, but Rushing nevertheless insisted that charges be filed against him, he said.

“All she did successfully was be the first one to hurl the accusation,” Tafreshinejad said.

Rushing told the News-Journal on Nov. 19 that she is still seeking to have the computer further examined by the Texas Municipal League’s cybersecurity forensics team.

Rushing’s allegations “trashed” Tafreshinejad’s reputation and career, he said.

Tafreshinejad also said the ordeal destroyed what he wanted to do to help the community. Though he wasn’t paid for the cybersecurity audit, he did want to receive about $5,000 monthly to conduct monitoring services. (His work for the city would pose a conflict of interest, as his mother is on the City Council. She said she would resign if anyone ever questioned Tafreshinejad’s work.)

Those fees are rock-bottom prices and far less than other cybersecurity professionals would charge, Tafreshinejad said. Nevertheless, he said he would take those fees and invest them into a nonprofit organization he would create called the Shooting Stars of Hawkins to help local youth pay the cost of obtaining college degrees in technology-related fields and, eventually, give them jobs.

“I was trying to help the city out so much, but you know … they didn’t want somebody snooping around what they were doing,” he said.