Will ransomware attacks force government institutions to HODL Bitcoin?

Last year, the city of Atlanta fell victim to one of the most ruinous ransomware attacks in a US jurisdiction. The attack, which was staged in March 2018, left much of the city’s agencies offline, bringing services to a standstill. The justice system stalled because court case scheduling is managed online. Years of official documents and communications were lost, never to be recovered. Moreover, private citizens and public institutions alike experienced serious logistical issues as utility bills could not be paid as the online payment portals were inaccessible.

Ransomware attacks are mooning

Due to its severity, Atlanta’s SamSam ransomware attack was the focus of mainstream media as the city struggled to regain its footing. The central government ordered a Department of Justice investigation, which resulted in the indictment of a duo of Iranian hackers in connection with the event, while simultaneously calling for increased security measures in local governments. Recovery estimates following the attack were put in the $17 million dollar range, a significant amount.

Unfortunately, the devastating Atlanta event did little to inspire increased security efforts and measures by local governments across the US. A little over a year later, a number of cities are falling victim to ransomware attacks. For instance, the city of Baltimore was infected by a ruinous ransomware attack in May 2019.

The malicious software infected government computers in the middle of the busy real estate season, bringing things to a halt. Unfortunately for Baltimore, unlike Atlanta, it did not have insurance in place and opted against paying the attackers the 13 Bitcoin (BTC) demanded as ransom. The city is still recovering from the attack, with recovery costs and other losses estimated at $18 million.

The state of Florida paid over $1.1 million to malicious actors in the month of June. Riviera Beach, a Florida municipality fell victim to an email phishing attack when an employee in the City Police Department opened an infected email. The hackers acted quickly, contacting the city’s insurance agent to demand 65 BTC in exchange for decryption keys. The situation was dire as entire city operations were offline, with emails and payment unavailable. More seriously, emergency services were also affected. The city acquiesced the attackers and paid $600,000 in Bitcoin as ransom.

In the same month, another Florida municipality, Lake City was attacked in a similar fashion. The event followed a familiar modus operandi, down to the hackers’ contact with the insurance agent retained by lake City. The city eventually paid 42 bitcoin (around $500,000 at the time) as a ransom to the attackers. Speaking to local media about the crippling attack, Lake City mayor said, "I would have never dreamed this could have happened, especially in a small town like this."

These attacks are not isolated events. Greenville, North Carolina, Imperial County, California, Stuart, Florida, Cleveland, Ohio, Augusta, Maine, Lynn, Massachusetts, and Cartersville, Georgia have all experienced ransomware attacks in 2019 only. Moreover, new reports emerge daily of new vulnerabilities that can be explored by malicious actors as well as new and sophisticated classes of ransomware, stoking fears of more attacks in the future.

The Bitcoin Connection

While the parties behind the attacks are believed to be separate entities, the one thing these attacks have in common is the fact that ransom is typically demanded in Bitcoin. Moreover, a number of the affected state governments have opted to pay the ransom demanded by the hackers, citing either expert advice or the need to access essential public services.

Unfortunately, statistics show that even when the victims pay the ransom, access to files and computer networks is not guaranteed. In a Q1 2019 report, the Coveware cybersecurity company revealed that 96% of the parties who acquiesced and paid a ransom eventually acquired a functional decryption tool. However, the recovery success rate varied depending on the type of ransomware used within the attack.

Despite the statistic many local governments are increasingly choosing to pay the ransom. Some experts believe that doing so will embolden malicious actors. Speaking to the BBC, cyber-security expert Kevin Beaumont explained, "Ransomware is the canary in the coal mine. Organizations are financing their attackers to be better than them – and sooner or later that situation may snowball for everybody else trying to defend their networks."

Nonetheless, the fact remains that hackers are demanding to be paid in bitcoin, and under-resourced local governments are easy-targets for sophisticated hackers. While the private sector is able to keep investing in upgraded security measures, the public sector tends to fall behind.

Speaking to Vice, cybersecurity expert and former San Diego chief information security officer, Gary Hayslip, stated, “The government knows it needs to change, but they move slowly compared to how quickly private business can pivot to manage their exposure to a new threat. Until it is mandated that cities, counties, and states meet a specific level of security and have to periodically demonstrate it as is done in business for compliance, government entities will continue to be low-hanging fruit and cybercriminals don’t mind eating them for lunch.”