The City Of Baltimore Blew Off A $76,000 Ransomware Demand Only To Find Out A Bunch Of Its Data Had Never Been Backed Up

from the nice-work-if-you-can-get-paid-to-do-it-and-then-not-do-it dept

The City of Baltimore was hit with a ransomware attack in May of this year. Criminals using remodeled and rebranded NSA exploits (EternalBlue) knocked out a "majority" of the city's servers and crippled many of its applications. More details didn't surface until September when the city's government began reshuffling the budget to cover the expenses of recovering from the attack.

The person in charge of the city's systems was Frank Johnson, who went on leave (presumably permanently) after a post-attack audit found the IT director hadn't done much IT directing.

Johnson, who also serves as the city's chief digital officer, received significant criticism from local authorities for the response to the May 7 attack. City council members alleged a lack of transparency and communication in the wake of the incident, as well as an inability to maintain a functional organization "during an emergency event." He also also never drafted a continuity of operations plan for an IT attack of the kind that occurred.

It looks like the list of stuff Johnson was being paid to do that he never did. Hence the catastrophic outcome when the city refused to pay the $76,000 ransom. Given the fact that $6 million has already been pulled from parks and public utilities funds to "harden" city systems, the $76,000 demand now seems like a bargain.

City residents should be asking WTF their tax dollars are being spent on. The city's audit of its compromised system rolls on, delivering even more embarrassing details about the city's IT skill set. (via Ars Technica)

A new audit of Baltimore’s information technology department says the agency lost key data during May’s ransomware attack because some in the agency used an outdated method for storing files: the hard drives on their individual computers.

[...]

“Performance measures data were saved electronically in responsible personnel’s hard drives,” [Baltimore City Auditor Josh] Pasch reported. “One of the responsible personnel’s hard drive was confiscated and the other responsible personnel’s selected files were removed due to the May 2019 ransomware incident."

Bureaucracies are prone to understatement and the assessment of the ghastly state of affairs by Pasch was no exception. According to Pasch, the permanently-missing data resulted in a "loss of confidence" in the city's IT department's ability to do its job.

This understatement brought the hearing to a halt as council members expressed their disbelief that city data was not being backed up. Their comments were less understated.

Hearing that, City Councilman Eric T. Costello, a former government IT auditor himself, stopped the hearing.

“That can’t be right? That’s real?” Costello asked.

It's apparently real. City data needed for an audit cannot be recovered because the IT department never made an effort to express the dangers of storing the only copy of data locally. It also apparently never made a push to create cloud backups of important files. When the ransomware struck, the stuff locked up was -- in far too many cases -- to only copy of that stuff.

The tragically hilarious postscript to this is the city's response to Ars Technica's request for info on the city's cyberattack recovery plans.

Ars has requested information from the city regarding the contracting details for the recovery, but the city has thus far provided no data. Requests for data on the status of patches and disaster recovery plans were refused because the documents do not exist as a result of the ransomware attack.

It's easy to mock governments for their inability to properly handle the massive amounts of data they collect, create, and retain. And so we shall. The city figures it will cost $18 million to recover from a rejected $76,000 ransom demand. I guess if you're going to play chicken with extortionists, you might want to make sure your backup plans at least meet min spec.

Filed Under: backups, baltimore, frank johnson, ransomware


Reader Comments

Subscribe: RSS

View by: Time | Thread


  1. icon
    tracker1 (profile), 17 Oct 2019 @ 2:14pm

    Generally poorly staffed govt IT.

    Given the relatively low pay (compared to business/corporate work, usually < 75% of the pay) and the high friction (incredibly lengthy interview/background processes) to get into a government job. It doesn't come close to optimizing for skilled, competent, go-getter types at all.

    The above is why I generally (some military and police exceptions) don't trust people who worked in government for more than a couple years in terms of hiring/interviews. They're horrible systems to work in at times and it's often better to work for adjacent consulting companies in the space than the agencies. Not that it's always the case, some states/counties/cities are better than others.

    In the end, it doesn't surprise me at all. Generally I don't consider something backed up unless it's on 3 different mediums/devices in at least two distinct geographic locations. Beyond this, it's better to drop to a relatively secure location, and have your backup infrastructure pull from that drop location into the backup system. This is a better separation than push, which a compromise like this could effect backups as well.

    Disclaimer, I do work in a company that provides services/hardware/software for govt work. My opinions are my own and do not reflect the company I work for.


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here



Subscribe to the Techdirt Daily newsletter




Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Follow Techdirt
Techdirt Gear
Shop Now: Techdirt Logo Gear
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.