On Consumerism: Would your town pay a ransom to hackers?

By ARTHUR VIDRO
By Arthur Vidro

Would your city pay a ransom to hackers? You might soon find out.

Pipelines and other vital pieces of our economy used to be safe from all attacks except those conducted in person. But now, thanks to “progress,” everything has become so computerized that anything with an internet presence is vulnerable to anonymous villains on other continents.

The Colonial Pipeline is our nation’s largest pipeline system for refined oil products. It can transport up to 3 million barrels of gasoline, diesel fuel, and jet fuel per day from Texas to New York.

But on May 7, the Colonial Pipeline was attacked. Not in person. But via computer. The company shut down its systems until it could regain full control. Operations were restored gradually, from May 12 through May 15. The disruption affected roughly 12,000 gas stations and nearly half of the East Coast fuel supply.

The shutdown led to fuel shortages in certain locations. The shortages spurred President Biden on May 9 to declare a state of emergency.

A portion of those shortages were caused by panic buying. Because so many people let their emotions dictate their actions, we will always have panic buying.

Oh, and the Colonial Pipeline paid a ransom just short of $5 million to the villains who attacked them. Within hours of the attack.

Cybercrime can be highly lucrative.

The pipeline’s first full year of operation was 1965. Before the internet age. Before it was vulnerable to such long-distance attacks.

It would be a mistake to think this attack was an oddball occurrence. No, it is part of a growing pattern that will reach further and further into our lives.

When cyberattacks occur with a demand for ransom, the recipient faces a dilemma. Pay up to restore operations? Or would that mark it as an easy target for more attacks? Or should one decline to pay and live with the consequences?

The FBI has warned that paying a ransom could encourage cybercriminals to launch more attacks.

Some entities proclaim publicly they will never give in to blackmail, yet simultaneously pay the ransom without publicity, to limit other attackers from joining the bandwagon.

Let’s look at a few other instances of hacking.

About three months ago, the computer system of the nation’s sixth-largest school district was hacked by a criminal gang that encrypted district data and demanded $40 million in ransom or it would erase the files and post online personal information of employees and the system’s 271,000 students (most likely including birth dates and Social Security numbers). The district refused to pay the ransom; when the demand was lowered to $10 million, the school district offered to pay $500,000 instead. The hackers refused and negotiations ended.

The school system, Broward County Public Schools in Florida, instead hired cybersecurity experts to fix the affected systems. There was a temporary shutdown of the district’s computer system, but classes were not disrupted.

At the start of December, school was shut down for more than 100,000 students in Baltimore County following a ransomware attack on the district’s network at a time they were taking classes entirely online.

September 8, 2020 was supposed to be the start of the school year in Hartford, Connecticut. But a cyberattack against the city forced officials to postpone the first day of school.

A suspected cyberattack prompted a shutdown of all city government computers in New Orleans on December 13, 2019.

Last year, Baltimore, Atlanta, and Greenville, North Carolina, found their public departments inoperable. Hackers had taken control of their systems and shut them down, demanding huge sums of money before they would agree to make them functional.

City officials in Baltimore decided to use $6 million in park and public facility funds to help pay for the recovery of a ransomware attack that crippled the city for weeks.

Would your town pay a ransom to regain control of its computerized processes? The answer is yes. Definitely. The only question is, how much? True, small towns won’t pay million-dollar ransoms. But if the price were $100,000 it would consider doing so. If the price were $10,000 it probably would pay up. If the price was $10, it definitely would. It’s no longer a question of principle; it’s just a question of how much the town would be willing to spend.

In early February, a hacker tried to poison the water supply of Oldsmar, Florida by (electronically) increasing the amount of sodium hydroxide in the city’s water treatment plant. The attempt failed only because an alert supervisor noticed the change in formulation as it was occurring.

Hackers also hit hospital systems. In Gillette, Wyoming, last year, an attack by hackers forced Campbell County Memorial Hospital to stop admitting patients, cancel some surgeries, and transfer some patients. The doctors, patients, and supplies were all ready, but the computers weren’t. Apparently, surgery can no longer be performed without the blessing of a computerized process.

But businesses will be the biggest targets of ransomware. Cities and states have taxpayers to report to; businesses can operate quietly, and often have trade secrets to protect.

Japanese conglomerate Toshiba says its European subsidiaries were hacked this month and a ransom requested. Toshiba says it did not pay the ransom.

Somehow, this avoided making the headlines.

That’s because hacks and demands for ransom are becoming like mass shootings – so common that it’s difficult to note or remember them all.

A wise consumer should remember that if the only way you access your money and monitor your financial well-being is through the internet – well, this is the same internet hackers use to steal or change your information.

Remember, if it’s connected to the internet, it can be hacked.

Arthur Vidro’s “EQMM Goes to College” appears in the May/June 2021 issue of Ellery Queen’s Mystery Magazine.