discussion V1

Another City in Florida Pays a Ransom to Computer Hackers Mazzei, Patricia . New York Times , Late Edition (East Coast); New York, N.Y. [New York, N.Y]. 28 June

2019: A.17.

ProQuest document link

FULL TEXT MIAMI -- Even the phones went down in the government of Lake City, Fla., after hackers launched a cyberattack

that disabled the city's computer systems.

For several days after computer systems were paralyzed by a ransomware attack, the staff of the small North

Florida town worked with the F.B.I. and an outside security consultant to restore phone lines, email and online

utility payments. But in the end, city leaders called an emergency meeting this week and reluctantly approved

paying the hackers the ransom they demanded: 42 Bitcoin, or about $460,000.

It was the second city to agree to a large ransom in two weeks. Riviera Beach, in Florida's Palm Beach County,

signed off on an extraordinary $600,000 payment last week, also in Bitcoin, a cybercurrency that is difficult to

trace.

As in Riviera Beach, the brunt of Lake City's ransom will be paid by insurance. Only $10,000 will come out of the

city's coffers.

"With your heart, you really don't want to pay these guys," Mayor Stephen Witt said. "But, dollars and cents,

representing the citizens, that was the right thing to do."

The F.B.I., as it typically does, recommended against agreeing to the hackers' demands. But Mr. Witt said a

prolonged recovery would have cost taxpayers more. Though there was no guarantee that the attackers would

release the city's data, Mr. Witt said information technology staff had already been making strides since the

ransom had been paid.

On Thursday, a third Florida city, Key Biscayne, said it too had been the victim of a cyberattack that began on

Sunday. It was not clear if the attackers demanded a ransom, but the city said it had brought most networks back

up by Wednesday night.

Ransomware has become a digital epidemic for the public sector, which often manages large, tangled webs of

computer networks, running older software, with limited budgets to defend them. Police departments in Illinois,

Maine, Massachusetts and Tennessee have all opted to pay the ransom demands to get back their data. The

difference in Florida is that the attackers are now emboldened, raising their ransom demands by a factor of 10 or

more.

City officials in Baltimore, a much larger city that has been fighting a massive ransomware attack for the past two

months, have spent $18 million on recovery. Hackers there had demanded a ransom of $80,000. A slew of other

governments, including the city of Atlanta, have faced similarly crippling breaches.

The Lake City attack began on June 10 when an employee clicked on a malicious email and infected the city's

computers with ransomware, according to the mayor. The program, which the city identified as malware known as

"Triple Threat," affected everything but Lake City's police and fire departments, which are on a separate server.

"As a result, all Emergency services remain intact," the city said when it disclosed the attack.

Several days went by before the hackers demanded a ransom. At first, the city, which is about 65 miles west of

Jacksonville, at the point where Interstate 10 and Interstate 75 meet, had some luck restoring its systems on its

own. But then it ran into trouble, so city leaders decided instead to negotiate with its insurance carrier, the Florida

League of Cities, to make the ransom payment.

"Any I.T. professional will tell you they're fending off attacks all the time," said Eric Hartwell, deputy general counsel

and insurance counsel for the Florida league, which began offering cyberattack liability coverage to its hundreds of

members a few years ago. "It's not necessarily a new thing -- I just think for whatever reason, the news cycle is now

showing municipalities are no different from private corporations."

There is a chance Lake City could have decrypted the ransomware on its own. A spokesman for the city said the

ransomware was a variant of a malware strain called "Ryuk." Security experts have successfully unscrambled Ryuk

ransomware in 3 to 5 percent of cases, according to Emsisoft, a security firm. Part of the problem, said Brett

Callow, a spokesman at Emsisoft, is that security experts need better communication channels with victims. His

firm created ID Ransomware, a free website that allows victims to upload strains of ransomware so that security

experts can help them to decrypt it.

In Europe, similar projects have proved successful. Security experts, law enforcement and local officials are

partnering on the No More Ransom Project to share information about attacks in real time, share decryption

techniques, and point law enforcement toward attackers' command and control servers. In Poland last year, the

Polish police, Belgian Federal Police and Europol arrested a Polish national suspected of having infected several

thousand computers with ransomware. Security experts said they have had similar success working with the

Dutch National Police, but have had a harder time connecting with the F.B.I. because the agency has stricter

communication protocols.

Mr. Witt said Lake City fired an employee who it deemed had not done enough to protect the computer systems

from an intrusion. That employee was not the same person who clicked on the malicious email, he said.

"We're developing a system with a backup that hopefully won't be vulnerable," Mr. Witt said, imploring other small-

town mayors to do the same. "Every other town needs to look at their system -- today."

"I have been in office 14 years," he added. "We've had tornadoes. We've had hurricanes. We've had fires that they

told me were going to maybe reach the city limits. But this was unusual. This was different."

Credit: By PATRICIA MAZZEI; Nicole Perlroth contributed reporting from San Francisco. DETAILS

Subject: Law enforcement; Digital currencies; Malware; Liability insurance; Hackers

Location: Baltimore Maryland; Massachusetts; Maine; Key Biscayne; Illinois; Tennessee;

Poland; Florida; San Francisco California; Europe; Atlanta Georgia

People: Witt, Stephen

Company / organization: Name: Europol; NAICS: 922120

URL: https://www.nytimes.com/2019/06/27/us/lake-city-florida-ransom-cyberattack.html

Publication title: New York Times, Late Edition (East Coast); New York, N.Y.

Pages: A.17

Publication year: 2019

Publication date: Jun 28, 2019

LINKS Check FindIt for availability.

Database copyright  2022 ProQuest LLC. All rights reserved. Terms and Conditions Contact ProQuest

Section: A

Publisher: New York Times Company

Place of publication: New York, N.Y.

Country of publication: United States, New York, N.Y.

Publication subject: General Interest Periodicals--United States

ISSN: 03624331

Source type: Newspaper

Language of publication: English

Document type: News

ProQuest document ID: 2248107897

Document URL: http://ezproxy.umgc.edu/login?url=https://www.proquest.com/newspapers/another

-city-florida-pays-ransom-computer-hackers/docview/2248107897/se-

2?accountid=14580

Copyright: Copyright New York Times Company Jun 28, 2019

Last updated: 2019-09-18

Database: New York Times