IACP 2014 – Cyber threats and attacks facing law enforcement agencies
In November 2013, the Swansea Police Department of Massachusetts was the target of a cyber attack. The organization’s entire network was down after “CyptoLock” malware had infected their systems. Officers were able to determine that an anonymous attacker from Eastern Europe had penetrated their network and would only “unlock” the system after a ransom had been paid.
After working with IT, the Massachusetts Attorney General’s office and others, they were advised not to pay the ransom. But upon speaking with data security experts, the chief and his team learned that in order to get years of departmental data back, they would have to pay.
“We did not have proper back-up, and we were exposed,” George Arruda, chief of the Swansea Police Department, said. “But the goal was to get the data back.”
Security experts have argued the decision to pay the ransom at great length, but it underscores a central problem that some law enforcement organizations face – they are simply unprepared, and the indiscriminate nature of cyber threats mean everyone is at risk.
“We live by information, and everything we do is with information,” said Mark Gage, deputy director of the National White Collar Crime Center. Law enforcement has been good with physical security, but he challenged attendees to be equally as good with electronic security.
Captain Stephen Sambar with the Los Angeles Police Department noted that cyber threats need to be regarded with the same level of preparedness as natural disasters, noting the path to preparedness begins with educating officers, establishing a recovery plan and testing the plan on a regular basis.
Of course, when it comes to the cyber world, there are some things you cannot prepare for, and social media is often the biggest obstacle.
Gage noted that the challenge is to train personnel how to use, understand and take a unified approach to social media. As he described, a chief wouldn’t let an officer take a cruiser home to fix the transmission, so law enforcement shouldn’t let officers engage technology without guidance or uniformity either.
“People are the weakest link in your network,” Gage said. “Policies and procedures must be appropriate and realistic in order for you to be prepared.”
Gage cited the expense that comes with engaging technology is worth it, and that public-private partnerships and coordination with local, state and federal law enforcement are key elements.
