CHICAGO — Cyberattacks that recently crippled nearly two dozen Texas cities have put other local governments on guard, offering the latest evidence that hackers can halt routine operations by locking up computers and public records and demanding steep ransoms.
Government agencies that fail to keep reliable backups of their data could be forced to choose between paying ransoms or spending even more to rebuild lost systems. Officials are increasingly turning to cybersecurity insurance to help curb the growing threat.
“I think we’re entering an epidemic stage,” said Alan Shark, executive director of the Public Technology Institute, which provides training and other support for local government technology employees. “The bad actors have been emboldened.”
The attacks, which have been happening for years, can set governments back decades. Libraries can’t use electronic checkout systems. Police can’t access electronic records, and utility bills must be paid with paper checks rather than online.
Protection is expensive, particularly for smaller cities whose employees may not be trained on the latest ransomware, which often spreads through emails containing malicious links or attachments. Hackers can also entice users to visit a compromised website and then encrypt files stored on a computer or network until a payment is made.
In Keene, a community of about 6,000 people about 45 miles (72 kilometers) southwest of Dallas, problems began Friday when computers used by its roughly 50 employees locked up and prevented any credit card payments, officials said.
Three other cities identified themselves as victims. A spokeswoman for the city of Borger declined to comment on security efforts or costs, and messages for officials in Wilmer and Kaufman were not returned.
The Department of Homeland Security and the FBI are working with the affected cities but declined to release the names of all 22 governments or provide any detail about how the hackers gained access to their systems.
Cities of all sizes have been targeted in recent years, including Atlanta, Baltimore, Newark, New Jersey and Savannah, Georgia.
After a 2018 malware attack, Savannah officials canceled traffic court for weeks. Everything from 311 call center requests to city permits and licenses were halted or delayed. Information Technology Director Mark Revenew remained reluctant to discuss details more than a year later, including how investigators believe the city’s systems were compromised.
“These guys are like bank robbers,” Revenew said. “They look at what attacks work and then they replicate it.”
Baltimore officials refused a demand for about $76,000 in bitcoin to restore access to the city’s network. Federal prosecutors last year indicted two Iranian men for ransomware attacks on more than 200 victims, including Atlanta and Newark. The attacks netted more than $6 million and cost the affected governments and companies more than $30 million.
According to the FBI, more than 1,400 ransomware attacks were reported last year, and victims reported paying $3.6 million to hackers.
The FBI does not say how many of those reports came from state or local governments, but other research suggests they are a growing target for hackers. Intelligence analyst Allan Liska recorded 62 ransomware attacks yet this year on government entities, already exceeding last year’s total of 54 based on local media reports.
Liska said his review has found government entities are less likely to pay a ransom than private companies or individuals. Attacks on government generate more attention, though, and hackers seem to be seeking infamy along with a payout.
Governments are among a growing number of clients shopping for cybersecurity insurance. Some customers get the coverage as part of a larger package while others buy a stand-alone cyber policy. Insurers reported taking in more than $2 billion in premiums for cyber coverage last year, according to the insurance brokerage firm Aon’s June report .
In June, several Florida cities decided to pay hackers hundreds of thousands of dollars for a key to decrypt captive data, but officials told residents that they were only on the hook for a deductible. Most of the cost was to be covered by insurers.
The FBI and most professional cybersecurity associations oppose such payouts because they help attackers continue to target other victims. But some officials desperate to get their systems back see it as a better option than paying millions to recreate thousands of lost government records.
Shark said he’s heard of governments paying as much as $20,000 for cyber insurance but considers that an investment against a system rebuild that could cost millions.
Cybersecurity experts caution that the policies are no replacement for basic cyber “hygiene,” including backing up systems and data, training employees on the risks of clicking unknown links and regularly installing updates to hardware and software.
Insurers typically require cyber clients to complete those steps before issuing a policy and failing to do so risks a denied claim after an attack, said Dan Lohrmann of Security Mentor Inc., a training company.
“Elected officials are getting the message that this is not just a technology issue or a security issue but a government competence issue,” he said.
In the northern suburbs of Chicago, seven communities banded together in 2014 to share the cost of contracting with a cybersecurity firm for added technical support and training. Amy Ahner, the director of administrative services for one of the members, said she advocated for the village of Glenview’s purchase of cyber insurance. She saw it as secondary to security efforts.
“I have insurance on my car,” she said. “But what matters most is how I drive it every day.”
Follow Kathleen Foody on Twitter at https://twitter.com/katiefoody
The man accused of killing 10-year-old Kayla Gomez-Orozco in November 2016 has been sentenced to life in prison without parole.
Gustavo Zavala-Garcia, 27, pleaded guilty to capital murder under a plea deal reached between his attorneys and Smith County District Attorney Jacob Putman.
Judge Jack Skeen, of the 241st District Court, signed off on the plea deal Thursday morning during a pretrial hearing after assuring Zavala-Garcia understood it.
Zavala-Garcia will be placed in the custody of the Texas Department of Correctional Institutions Division. He has requested a prompt transfer from the Smith County Jail, where he has been held for nearly three years.
The deal was a reversal from the longstanding effort from the District Attorney’s Office to seek the death penalty in the high-profile capital murder case that has captivated the Tyler area’s attention.
Putman said the reversal came after the defense contended that Zavala-Garcia had an intellectual disability, so the prosecution brought in their own expert who also found Zavala-Garcia intellectually disabled.
Putman said it would be virtually impossible to sentence Zavala-Garcia to death because of longstanding U.S. Supreme Court precedent on executing intellectually disabled people, and that life without parole was the highest possible sentence.
Moore v. Texas
The U.S. Supreme Court ruled on the case in question, Moore v. Texas, in March 2017, about four months after Zavala-Garcia was arrested in Kayla’s death.
The decision said the person in that case, Bobby Moore, was intellectually disabled from a medical perspective and therefore ineligible for the death penalty under precedent dating back to 2002.
The March 2017 Supreme Court decision reversed a finding from the Texas Court of Criminal Appeals, which had found that Moore was not intellectually disabled and therefore could be sentenced to death.
The Supreme Court also criticized Texas for using intellectual disability determination guidelines that “had no grounding in prevailing medical practice” that invited “lay perceptions of intellectual disability.”
In February 2019, following an updated decision from the Texas Court of Criminal Appeals, the U.S. Supreme Court reiterated its opinion about Moore’s intellectual disability and the medical standards.
Chief Justice John Roberts wrote in February that although he believes this area of law lacks clarity, the appeals court substantively relied on the same factors for determining intellectual disability and that the new decision didn’t “pass muster.”
“In Moore v. Texas, the Supreme Court prohibited the common-sense approach adopted by the Texas Courts,” Putman said in a news conference after Zavala-Garcia’s sentencing. “The Supreme Court ruled that the determination of whether a capital murder defendant is intellectually disabled should be left to mental health experts.”
“Additionally, the Supreme Court ruled that a person cannot be executed regardless of their degree of intellectual disability,” Putman said. “Even if a capital murder defendant is a highly functioning individual with an intellectual disability, the Supreme Court says that the state may not execute the defendant.”
Putman said the defense brought up the issue of intellectual disability, so he brought in an expert psychologist who has been used in capital murder cases across Texas who also determined Zavala-Garcia is intellectually disabled.
Zavala-Garcia had a below-average IQ and adaptive deficits in the conceptual area that could affect learning, Putman said. He said that while he does not believe Zavala-Garcia has a severe mental disability, he is not a psychologist.
Putman said he consulted with other district attorneys, capital murder prosecutors, and the Texas Attorney General’s Office who agreed that the death penalty was not possible. He said the maximum punishment therefore was life without parole.
“I do not believe that the standard set forth by the U.S. Supreme Court results in justice for Kayla’s family or our community,” Putman said. “If there were any legal way to ensure that Mr. Zavala-Garcia would face the death penalty I would persist.
“However, I took an oath to uphold the rule of law,” he said.
Facts of Texas v. Zavala-Garcia
Zavala-Garcia was related to Kayla by marriage and was among the last people to see her before she went missing Nov. 1, 2016, from the foyer of Bullard First Assembly on U.S. Highway 69.
Her body was found four days later in a well on the property where Zavala-Garcia lived, in the 22100 block of Farm-to-Market Road 2493 (Old Jacksonville Highway) in Bullard.
It is unclear what caused her death, and at the time the indictment was released, then-District Attorney Matt Bingham declined to comment, citing a restrictive and protective order in the case.
In the indictment, prosecutors contended Zavala-Garcia kidnapped Kayla and either sexually assaulted or attempted to sexually assault her. Prosecutors also contended he struck Kayla with and against a blunt object, asphyxiated her and drowned her.
During the course of the case, the defense had attempted to have the trial moved outside of Smith County, sought to preclude the death penalty, and complained of an inadequate statement of his right to have a lawyer prior to questioning.
Putman, the DA, filed evidence accompanying the plea deal that was not made available to the public on Thursday. However, the DA’s office said they were working to prepare the documents for release.
Family members did not issue victim statements, and one declined to comment after the sentencing hearing.
TWITTER and INSTAGRAM:
Four local organizations received a combined $725,000 in grants from the Texas Veterans Commission’s Fund for Veterans’ Assistance for providing services to over 500 Tyler area veterans.
Texas Veterans Commission Commissioner Kimberlee Shaneyfelt ceremonially presented the checks to representatives from the organizations on Wednesday at the Habitat for Humanity ReStore facility on Front Street.
These grants support a wide range of services for veterans such as housing, food, financial aid, clinical counseling and job skills training, according to a commission news release.
The grant recipients and their services include:
Funding for these grants is generated primarily by the Texas Lottery Commission’s games designated for veteran support, according to the news release.
The Mineola Independent School District board of trustees stunned community members Thursday night at a specially called meeting to approve a release and separation agreement with Superintendent Dr. Kim Tunnell.
The board posted the meeting’s agenda Monday night, but would not respond to questions from community members asking for public input or information about who had requested the meeting.
Parent Angie Ruffin was asked to leave the meeting for interrupting after pressing the board for answers on what was behind the district’s decision.
Board President Dr. John Abbott would not comment on whether the board had asked Tunnell to submit her resignation, after reading a letter to the board dated Thursday.
In the letter, Tunnell offered her resignation effective January 2020 or upon being offered a position in another school district. She was not present at the meeting.
The board voted to accept her resignation, with the exception of Kyle Gully, who was not present, and Jill Quiambao who voted against accepting.
After tearfully raising her hand in dissent, the room exploded in applause for Quiambao. Community members later thanked her for standing her ground.
Quiambao said she could not comment on the agreement. Abbott said information related to the resignation would be available Friday.
Ruffin, who told the board their actions were shameful as she was asked to leave, later said that the community was in shock and did not know why the board made the decision to separate with Tunnell.
While some community members speculated the decision could be due to poor performance in accountability ratings, they were left without an explanation from the board,
“If you ask any parent (in Mineola) they’re going to say we’re a lot more about relationships than a stupid test,” Ruffin said. “I think the board members should be ashamed, frankly.”
Ruffin said she learned of the meeting when leaving the district’s regularly called monthly board meeting on Monday. After posting a photo of the agenda on Facebook, more than 30 community members packed the small board room, with some standing in the lobby outside for lack of space.
“I don’t really know why they would want her to go. Dr. Tunnell has been an incredible asset to Mineola,” Ruffin said. “The parents love her, the teachers love her. The students love her. It’s going to be a huge loss for Mineola”
Mineola Foundation director Warren Brown was also disappointed with the board’s decision.
Brown said he wishes the board would look at the public reaction and reconsider their decision.
The Mineola Foundation has been working closely with Tunnell to expand career and technology education, he said. He also expressed concern for how the district’s relationships with entities like Tyler Junior College would be affected, due to the work Tunnell has done to improve pathways in the community.
“It’s time for the community to wake up and started getting involved in the schools and with their kids,” Brown said. “It’s time for parents to wake up and get involved”
More than thirty minutes after the meeting, community members were still in the parking lot of the district’s administration building discussing what had happened.
The Tyler Paper has requested more information from the board, reached out to the district for further comment and will continue to follow developments with this story.