City & State investigates: How local governments are handling a threat they can’t even see

In 2018, an Allentown city employee took a city laptop with him on a work trip. During that trip, he opened a phishing email that ultimately cost the city more than $1 million in repairs to its digital infrastructure. Hackers, based in Ukraine, hit the Lehigh Valley city with malware known as Emotet – which the federal Cybersecurity & Infrastructure Security Agency ominously describes as “an advanced Trojan primarily spread via phishing email attachments and links that, once clicked, launch the payload” – that began to self-replicate, steal credentials and work its way across their computer systems. 

“A colleague came down the hall and said, ‘Hey, my account’s locked’ – and I went to sign in and found that my account was locked” as well, Matthew Leibert, Allentown’s longtime chief information officer, recalled of the moment he knew something was seriously wrong – a realization that hit him physically as well. “I definitely felt sick,” he added.

Four years – and millions of dollars of sunk costs later – his staff still struggles to keep up with the monitoring and maintenance required to keep their systems safe for this city of more than 120,000 residents.

Leibert is a member of a group no one wants to be part of, but whose ranks grow daily. Ransomware and other forms of cyberattacks have hit various sectors over the years, including health care and law enforcement. The threat to government at all levels, which has only increased over time, continues to loom large over budget considerations both for preventing such attacks and paying premiums to insure a quick return to normalcy following a ransomware event. 

Ransomware statistics in the commonwealth have fluctuated in recent years, according to the FBI. In 2020, the FBI reported 116 cybersecurity complaints and $5.25 million in losses. While the number of complaints increased in 2021, with 136 total, dollar losses went down, coming in at about $1.2 million. So far in 2022, there have been 39 complaints and nearly $2 million in losses. 

“Emotet is a polymorphic virus that can deliver ransomware, but it was actually designed to steal credentials and that’s exactly what it did here,” Leibert told City & State. “It was able to lift some privileged credentials that allowed it to laterally move across our systems and infect them.” The attack was similar to the ransomware that cost the City of Baltimore an estimated $18 million in 2019. 

This type of malware can act as a Trojan horse, disguising itself as a corrupted file being sent as an email attachment. Its “polymorphic” ability, as Leibert described, allows it to get in through a business email compromise and spread across systems. 

Leibert said the bulk of the funds in Allentown’s repairs went toward more security and monitoring tools, as well as architecture adjustments to segment off systems from one another in case of future attacks. 

Payouts from local governments aren’t always for repairs, however. Dollar losses from cyberattacks also take into account any ransoms to be paid out to perpetrators. These specific types of attacks utilize malware to encrypt a system’s data or credentials, which is then ransomed in exchange for a decryption key. 

Jonathan Holmes, a supervisory special agent with the FBI in Pittsburgh, warned against paying cyberattackers, emphasizing that doing so doesn’t guarantee any information or data will be returned. 

“By paying (ransoms) we’re only emboldening bad actors,” Holmes said. He added that bad actors aren’t searching for specific systems or municipalities to target, but paint with a broad brush to find any vulnerabilities they can take advantage of. 

“I think the vast majority of the time the subjects – ‘the bad guys’ – they’re going after targets of opportunities,” Holmes said. “I don’t think they’re sitting around saying, ‘Let’s go after X municipality in Pennsylvania.’ They have computers that they have access to through a lot of different means. And then based upon that, they’re going to try and choose whatever illegal activity is going to make them the most money.”

Holmes said that most ransomware attacks originate in Russia or Eastern Europe and are financially motivated – but the FBI has also caught perpetrators based in the U.S., Canada and other countries. 

In the face of what can seem like an entire ecosystem bent on devouring their resources, local governments are still trying mightily to protect systems, particularly essential services. 

“If (government) computer systems are handling billing for water or power or other municipal services and people can’t pay their bills, clearly, that can be impacted,” Holmes said. “We’ve seen 911 systems go down.”

Similar to emergency management methods in the case of natural disasters, cybersecurity measures for local governments must be proactive to mitigate the worst, most expensive outcomes if they are attacked – and part of this prophylactic approach involves some form of liability and cybersecurity insurance. 

Paul Cornell, insurance services director of the Pennsylvania Municipal League, said that with the increase in attacks and ransomware, PML had to break out the cybersecurity insurance it provides into a separate policy because it was becoming too expensive to lump together for all municipalities. 

“Cyber insurance has become very expensive and limits have been significantly reduced (compared) to what they were years ago,” Cornell told City & State. “And the reason being is obviously what is occurring on the internet. Ransomware has become a big business … that is now franchised to other hackers, where they work together as groups.”

Cornell said while liability insurance could come with a cap of $1 million to $2 million, local governments would be “lucky to get a couple hundred thousand dollars” in cyber coverage – and if a municipality opts to pay a ransom, that won’t be covered by insurance. 

“You’ve got to reach into your own pocket and reduce your operating budget or reduce your reserves in order to pay that,” Cornell said. Cyber insurance provides resources to help systems get back online and be repaired, much like AAA does for vehicles, Cornell said. Insurance companies provide discussions on preventative measures beforehand, and after the fact, they provide a list of preferred vendors that can help remediate an attack. 

With such a tall task, particularly for smaller municipalities and counties, the state and federal governments are looking to develop a more streamlined approach to cybersecurity. 

The federal Infrastructure Investment and Jobs Act allocated $1 billion for cybersecurity-related state and local government technology improvements over the next few years. President Joe Biden also recently signed the State and Local Government Cybersecurity Act of 2021, which seeks to strengthen the relationship between federal, state and local cybersecurity authorities and provide for better information sharing. 

On the surface, the funding looks to provide serious relief to cash-strapped local governments. However, federal funding must make its way down from the state level to counties and smaller municipalities. 

Michael Sage, chief information officer for the County Commissioners Association of Pennsylvania, said the state and its 67 counties must work together to provide the most bang for the buck for local governments. 

“Some counties can afford the fancy tools to automate patching and management and things like that. Other counties can’t afford that, so they do it more manually,” Sage told City & State. “When you look at all local governments across Pennsylvania, not just counties, those dollars start getting very thin. So what we’re doing is trying to say, where’s the best use of those dollars?”

Sage said that CCAP has worked with the commonwealth to identify products or services for procurement that multiple counties could utilize for cost savings, rather than having each county pay for individual procurements. At the same time, Cornell pointed out that many municipalities will still be forced to pay out of pocket to maintain employee training and implement proper security measures. 

According to the 2021 National Survey of Local Government Cybersecurity Programs and Cloud Initiatives, 58% of local government IT executives say their organization’s budgets can’t adequately support security and cloud initiatives. 

Leibert also said it’s difficult to make IT a priority during budget negotiations considering all the other costs local governments are facing and the labor shortage that’s hitting the tech sector as well. 

“How do I make an argument before the City Council that they should spend more after they did spend the money? They think they spent a million bucks and the problem’s fixed,” he said. “That problem is fixed, but there have been a couple other kinds of scenarios that have happened since 2018.”

In conjunction with the Department of Homeland Security, the commonwealth and its emergency management agency are seeking to create an information network that can share updates on infrastructure, new attacks and more in order to ensure more consistency across local governments’ networks. Some states, such as Wisconsin, have formed their own task forces to directly address the issue. 

Wisconsin “had a pretty big program, where they had teams of incident response people from the state as well as private industry,” Holmes said. “If there was an incident at a municipality or any state office, teams would respond and do remediation for an index.”

Pennsylvania doesn’t have anything similar in place at the moment, but the General Assembly has taken steps recently to address issues related to cybersecurity. 

Most notably, legislation like House Bill 2412 would allow the commonwealth to mobilize its National Guard in the event of a cyberattack on a vital computer system. The bill was signed into law on July 8 along with the state budget. 

When it comes to having the right measures in place, those in the cybersecurity space agree that every system is as vulnerable as its weakest link. For local governments lacking the resources to keep up with the constant changes in both infrastructure and malware tactics, state and federal partners will be crucial in ensuring their systems check all the necessary boxes. 

Lisa Schaefer, executive director of CCAP, emphasized the importance of collaboration between levels of government. 

“Like everything else we do in the intergovernmental world,” she said, “having that framework that we can all work within (allows) some cohesion across the state level but also ensures that flexibility for local governments to be able to identify their own unique needs and make those investments with their dollars.”