‘Real Crisis’: New York Officials Announce Cybersecurity Defense Program

Call them the Cyber Avengers. On Tuesday afternoon, Gov. Kathy Hochul, New York City Mayor Eric Adams and the mayors of Albany, Yonkers and Syracuse jointly announced a new statewide cybersecurity operations center, headquartered in Brooklyn. 

“Since I’ve been governor, my number one priority has been protecting New Yorkers,” Hochul said on Tuesday. “I also want to protect the health of our institutions and our governments and our critical infrastructure. And they’re vulnerable right now.” All kinds of infrastructure, from the Metropolitan Transportation Authority to the New York Power Authority, are vulnerable to threats, she added. 

The new statewide Joint Security Operations Center, in part modeled on the Joint Terrorism Task Forces formed after 9/11, will bring together cybersecurity experts, technology professionals and local and state officials to share data, combat common threats and fortify critical systems. “This is going to be the nerve center for our cyber operation,” Hochul said. 

Though the plan has been in the works for months, both Hochul and Adams noted that they’re paying particular attention to threats right now, during the ongoing conflict between Russia and Ukraine. Russia has been accused of carrying out cyberattacks on Ukrainian systems in the past, and Hochul has been in contact with the White House and told to be on notice of heightened threats. “I thought it was serious enough that I convened members of my cabinet on Sunday, asking all of them to come together and tell me what steps they've taken and where there may be any shortcomings in our statewide operations, as well as our critical infrastructure,” Hochul said.

Calling previous funding for cybersecurity in the state “lacking,” Hochul also announced that the state will invest a record $62 million in cybersecurity, hiring 70 new cybersecurity professionals in the state, along with a plan to put together another $30 million to help local governments invest in cybersecurity. “We can’t expect cities and counties to go it alone.” Both Albany Mayor Kathy Sheehan and Yonkers Mayor Mike Spano noted on Tuesday that their own cities have been targeted by cyberattacks, though both have avoided paying ransom. 

Adams also announced that he signed a new executive order that puts New York City Cyber Command – the city’s cybersecurity office – under the direction of the newly created Office of Technology and Innovation, and requires each city agency to have a cyber command liaison, working with both that office and in communication with the Joint Security Operations Center.

Cyber criminals have already targeted cities and towns across the state with ransomware and other kinds of attacks. Schools, local governments and hospitals are among the particularly vulnerable as institutions with troves of valuable data and often insufficient funding dedicated to cybersecurity.

Ransomware attacks were popular before the COVID-19 pandemic. An offensive against the city of Albany’s computer system in 2019 didn’t result in the payment of any ransom, but caused the city to spend around $300,000 updating its system and restoring stolen data. That same year, the New York City Police Department’s fingerprinting database was temporarily shut down after a ransomware attack. 

But ransomware seemed to pick up during the pandemic, possibly due in part to employees working from home and using less secure personal computers. Last year, the New York City Law Department suffered a hack that was facilitated by a single stolen email password. While New York City requires city agencies to use multifactor authentication – an extra, but easy security measure for logging into computer systems or email accounts – the Law Department breach was reportedly the result of a failure to implement that step. While implementing best cybersecurity practices often requires funding, it also requires enforcement. Asked by City & State about enforcement, Adams pointed to the new cybersecurity liaisons within city agencies as a new approach that will help ensure better enforcement.

Cyberattacks have caused damage on a grander scale, too. In the spring of 2021, hackers breached the Colonial Pipeline’s computer system through a stolen email password, disrupting fuel supply lines. In addition to ransom demands, disruptions to crucial systems are what keep cybersecurity experts and government leaders up at night. Last month, at a press conference announcing a reorganization of the city’s technology agencies, Adams said that former Mayor Bill de Blasio highlighted cybersecurity as an important issue to focus on before he took office. “I don’t want to go into any specifics, because some of this stuff is sensitive, but he was very clear, ‘Eric, Day One, you have to get cybersecurity under control,’” Adams recalled when asked about the conversation with de Blasio. Recalling that conversation again on Tuesday, Adams said that the former mayor told him that cybersecurity would be his “real crisis.”

Additional reporting by Rebecca C. Lewis.