Cyberattacks on State Databases Escalate

This story originally appeared on Stateline, an initiative of the Pew Charitable Trusts.

NASHVILLE, Tenn. – State governments are facing a daily barrage of cyberattacks from increasingly sophisticated computer hackers. The hackers’ rapidly changing tactics threaten the exposure of personal information of millions of citizens and can cost taxpayers millions of dollars to fix.

“We see attacks on Texas’ system to the tune of millions a month,” said Karen Robinson, Texas’ state chief information officer.

Although breaches of Texas’ state computers are rare, Robinson said, the risks are high. They can result in the theft of citizens’ Social Security numbers, dates of birth, driver’s license numbers and even personal and business financial information.

All states are facing a growing number of wide-ranging, quickly evolving attacks, according to a new report released here Wednesday at the start of National Cybersecurity Awareness Month, sponsored by the U.S. Department of Homeland Security and backed by the states.

Despite the threat, the report found, state legislators often don’t give their technology and security officials enough money to combat it, and states struggle to retain technologically savvy cybersecurity personnel.

The report, from the National Association of State Chief Information Officers and the consulting firm Deloitte & Touche LLP, said the dangers of insufficient cybersecurity are high—not only for citizens whose personal information can be compromised, but for taxpayers and the public’s trust in government.

“These incidents have cost states millions of dollars in clean-up costs, as well as a loss of both revenues and public trust,” the report said. “The problem is not likely to go away any time soon, as cybercriminals continue to be drawn to the wealth of data residing in each state.”

Valuable Data

State computers hold a treasure trove of personal information. Motor vehicle agencies have citizens’ dates of birth and driver’s license numbers. Health agencies have people’s birth certificates and Social Security numbers. Tax records contain what banks people and businesses have accounts with. States also have credit card numbers from people who have made payments to state agencies.

“You can get pretty much everything on someone out of state computers,” said Srini Subramanian, a state cybersecurity specialist with Deloitte who co-authored the report. “It makes them a very attractive target to cybercriminals.”

Recent breaches point up the dangers and the costs:

• Montana notified 1.3 million people in June that their personal data was possibly exposed to hackers in a breach of state Department of Public Health and Human Services computers a year earlier. The state said there was no evidence personal information was stolen but offered free credit monitoring and insurance for a year to those they notified.

• Washington state’s court system was hacked in February, exposing up to 160,000 Social Security numbers and a million driver’s license numbers. The courts’ administration office said some numbers in its computers had definitely been accessed.

• California’s Department of Technology reported 7,345 data breaches at state departments and agencies from the beginning of 2013 through early November last year, KNTV television reported. The state had to notify 23,379 individuals that their personal information may have been compromised and spent at least $5 million to fix the breaches.

Although not every state database has been badly breached, the threat is a daily one. Six out of 10 of the state chief information and security officers from 49 states pointed to greater sophistication in the attacks, the report said. That’s an increase from two years ago, when a similar report found roughly half saw more sophisticated tactics.

“Everybody is getting hit daily,” said Michael Cockrill, chief information officer for the state of Washington, home to high-tech computer software giant Microsoft and to a large number of computer hackers.

Cockrill, who recently came to his new job from the private high-tech sector, said he’s seen reports that as many as 40 percent of cyberattacks launched in the U.S. originate from inside his state.

Looming Threats

Thieves want the personal information stored by states because it helps enable identity theft that opens greater doors of financial opportunity, the information officers said. That’s more valuable than just credit card information, which can be damaging enough.

“Health records are valuable because they have so much information,” Cockrill said of the dates of birth and Social Security numbers they can contain. “Health records are worth $10 on the black market, credit cards a dollar.”

Although the report’s survey said the security officials’ biggest fear is the placement of malicious software code in state computers, other threats are on the rise that can compromise citizens’ personal information.

Eight out 10 of the officers predict an increase in “phishing” and “pharming” for personal or business information, and 72 percent predict more “social engineering” of people—manipulating them into divulging personal information or tricking them into schemes to defraud them.

Phishing attacks usually involve fraudulent e-mail messages that guide victims to a fake website that looks legitimate, but which is designed to obtain personal information such as passwords to their financial accounts.

Pharming redirects people from a legitimate website that’s been tampered with to another site that is fake, although it looks like the legitimate site.

“It’s the user who can be the window into the system,” Texas’ Robinson said.

That means state employees, as well as citizens, must be vigilant and wary—and informed about the latest tactics. In Texas, 336,000 state employees have to be trained to be careful, Robinson said.

Also on the rise is “hacktivism,” the hacking into government computers to make a social statement, cause mayhem or provide a platform for activist groups to gain exposure.

“They aren’t after financial gains,” Deloitte’s Subramanian said. “They want to make a statement. And what’s a better place to make a statement than on a state government site.”

One example, he said, is Ferguson, Missouri, where police computers and those of police unions were attacked by activists seeking the identity of the officer involved in the racially charged shooting this summer that set off nights of civil unrest.

Unprepared

Only 24.5 percent of the information and security officers said they were “very confident” they could protect against cyber threats, the report found. That’s little different from two years ago, when 24 percent said the same thing.

In contrast, 60 percent of officials in the state departments and agencies that the information technology officers serve say they are very confident in their states’ abilities to protect them.

That disconnection between the information technology people on the front lines and other state officials helps explain why states aren’t putting as much money into cybersecurity as they should, Subramanian said.

About half the states allocate only 1 percent to 2 percent of their information technology budgets to security, the report said. The federal government, by contrast, allocates about 11 percent, Cockrill said.

States rely in large part on outside security software companies to help protect and police their computer systems. And despite their increased sophistication in surveillance, protection and response, most state officers said they are only somewhat confident in their cybersecurity.

States also have trouble getting and hanging onto trained cybersecurity personnel.

Fifty-nine percent of the officers surveyed for the report said they are short on trained people. That’s up from the 46 percent who said so two years ago.

The officers say states simply cannot pay as much as the private sector. That’s especially true in high-tech Washington.

“We’ve been hiring people from Eastern Europe to provide security,” Cockrill said. “We’re a training ground for the private sector. They come, they get trained and get paid twice as much or more in the private sector.”

To recruit new security analysts, Cockrill is turning to military veterans. With some grant money, he’s seeking to give them computer skills to supplement the security and threat analysis experience they have from their military service. To retain them, he said, he’ll have to appeal to their sense of duty, because he can’t pay salaries nearly as high as what is available in the private sector.

(Image via Artco/Shutterstock.com)