AN UPDATE NOW FROM THOSE TRYING
TO FIGHT THE THREATS.
>> POSSIBLE HOSTAGES.
>> POSSIBLE HOSTAGES.
>> Reporter: IT’S NOT QUITE AS
GLAMOROUS AS IN THE MOVIES WHEN
HOSTAGE NEGOTIATORS LIKE DENZEL
WASHINGTON RACE AGAINST THE
WASHINGTON RACE AGAINST THE
CLOCK TO SAVE LIVES.
>> JUST TELL ME WHAT IT IS YOU
REALLY WANT AND I’LL GET IT FOR
YOU.
>> Reporter: BUT IT CAN BE JUST
AS INTENSE AND JUST AS EXPENSIVE
WHEN A COMPANY OR GOVERNMENT IS
WHEN A COMPANY OR GOVERNMENT IS
HELD HOSTAGE, NEGOTIATING TO BE
ABLE TO OPERATE.
>> THERE IS NO SILVER BULLET
THAT PROTECTS YOU FROM
EVERYTHING.
EVERYTHING.
>> Reporter: IN DECEMBER, A
>> Reporter: IN DECEMBER, A
RANSOM AWARE FORCED EDD MARYLAND
DEPARTMENT OF HEALTH TO SHUT
DOWN ITS WEBSITE.
>> SYSTEMS STARTED MALFUNCTIONS,
WHICH IS HOW THIS WAS DETECTED.
>> Reporter: THE STATE’S CHIEF
>> Reporter: THE STATE’S CHIEF
INFORMATION SECURITY OFFICER
CHIP STEWART SAYS EMERGENCY
PLANS CHIPPED IN AND TOOK
PLANS CHIPPED IN AND TOOK
SERVERS OFFLINE TO PROTECT THE
NETWORK.
>> THE RANSOM TEAM IS PART OF
THE DISCUSSION.
FORTUNATELY BECAUSE OF THE WORK
FORTUNATELY BECAUSE OF THE WORK
WE HAVE DONE LEADING UP TO THIS,
WE HAVEN’T HAD TO CONSIDER THAT
AS A REAL POSSIBILITY AT THIS
POINT.
>> THE BEST THING TO DO IS NOT
TO PAY.
BUT THERE ARE CASES WHERE YOU
HAVE TO BECAUSE OTHERWISE, YOUR
HAVE TO BECAUSE OTHERWISE, YOUR
BUSINESS IS DONE.
YOU KNOW, IT CAN BE A REALLY,
REALLY TOUGH SITUATION.
REALLY TOUGH SITUATION.
>> JEN IS THE DIRECTOR OF THREAT
INTELLIGENCE FOR UNIT 42, A
SPECIALLY TRAINED TEAM OF CYBER
SECURITY EXPERTS WHO HELP YOU
NEGOTIATE WHEN YOU ARE ATTACKED
BY A RANSOMWARE GANG.
THEY’RE CONTINUING TO EXPAND
THEY’RE CONTINUING TO EXPAND
THEIR TACTICS IN WAYS THEY ARE
TRYING TO GET PAID.
>> Reporter: LIKE WHEN D.C.’S
>> Reporter: LIKE WHEN D.C.’S
POLICE DEPARTMENT GOT HACKED IN
APRIL.
NPD OFFERED $100,000 BUT ENDED
UP PAYING NOTHING.
AND FILES CONTAINING SENSITIVE
INFORMATION ON OFFICERS AND
SUSPECTED WERE POSTED ON THE
DARK WEB.
>> DEFINITELY A PLACE WHERE
CRIMINALS HANG OUT.
IT IS DEFINITELY A PLACE THAT,
IT IS DEFINITELY A PLACE THAT,
YOU KNOW, THESE THREAT ACTORS
ARE LEVERAGING TO STAND OUT.
>> Reporter: HIS JOB IS TO TRY
>> Reporter: HIS JOB IS TO TRY
TO STOP THEM.
HE’S A RA SOMENEGOTIATOR AND
SENIOR DIRECTOR OF INCIDENT
RESPONSE.
>> YOU NEED TO USE CONFIDENCE
AND BE ABLE TO NEGOTIATE.
YOU HAVE TO COME OFF CALM.
>> Reporter: WHICH CAN BE HARD
FOR A COMPANY EXECUTIVE TO DO
WHEN THEIR ENTIRE BUSINESS MIGHT
WHEN THEIR ENTIRE BUSINESS MIGHT
BE ON THE LINE.
BE ON THE LINE.
OTHERS STEAL AND ENCRYPT DATA
AND DEMAND MONEY.
BUT HE SAYS EVEN THEN THE
ATTACKERS SWITCH GEARS AND USE
DOUBLE EXPORTION, THREATENING TO
RELEASE THE INFO THEY HAVE
STOLEN PUBLICALLY.
>> IF THEY STEAL MY FILES, THEY
MIGHT REACH OUT TO ME ALSO?
>> WE HAVE SEEN THAT.
>> WE HAVE SEEN THAT.
SUFFERING FROM A RANSOMWARE
ATTACK IS DEFINITELY SOMETHING
THAT PEOPLE CAN FEEL THAT
IMPACT, NOT JUST THE BUSINESS.
>> Reporter: MARK WEATHERFORD
OVERSAW CYBER SECURITY FOR THE
OVERSAW CYBER SECURITY FOR THE
DEPARTMENT OF HOMELAND SECURE
DEPARTMENT OF HOMELAND SECURE
AND NOW WORKS AS CHIEF STRATEGY
SECURITY.
DOES THE AVERAGE AMERICAN
REALIZE HOW BIG A DEAL
RANSOMWARE IS RIGHT NOW?
RANSOMWARE IS RIGHT NOW?
>> NO CLUE.
90% OF THE PEOPLE CAN’T EVEN
EXPLAIN WHAT RANSOMWARE IS.
>> Reporter: HE SAYS IT’S A
PROBLEM THE U.S. CAN’T SOLVE ON
ITS OWN BECAUSE THE BAD ACTORS
ARE MAINLY OPERATES OVERSEAS.
>> AT FIRST IT WAS LIKE THEY
WOULD JUST FIND ANY RANDOM
COMPANY THAT THEY RAN ACROSS AND
THEY WOULD CONDUCT ATTACKS.
THEY WOULD CONDUCT ATTACKS.
BUT THERE IS A LOT MORE
RECONNAISSANCE AND INTELLIGENCE
GATHERING HAPPENING NOW.
GATHERING HAPPENING NOW.
>> Reporter: HE SAYS THAT MEANS
THEY ARE MORE FREQUENTLY HITTING
ENTITIES THAT CAN’T AFFORD NOT
TO PAY, LIKE HOSPITALS THAT
MIGHT HAVE ACCESS TO HOSPITAL
RECORDS, COMMUNICATION SYSTEMS.
OR GOVERNMENTS.
A 911 CENTER OR A CITY’S WATER
SYSTEM CAN’T JUST SHUT DOWN FOR
SYSTEM CAN’T JUST SHUT DOWN FOR
A FEW DAYS.
>> LOCAL GOVERNMENTS ARE ALWAYS
A BIT BEHIND THE PRIVATE SECTOR
A BIT BEHIND THE PRIVATE SECTOR
SIMPLY BECAUSE, WELL, CERTAINLY
FUNDING.
AND THEY JUST -- THEY MOVE AT A
SLOW PLACE.
>> Reporter: SURVEYED 200 STATE
>> Reporter: SURVEYED 200 STATE
AND LOCAL GOVERNMENT LEADERS FOR
THE I-TEAM AND FOUND BUDGETS
HAVE GENERALLY INCREASED.
HAVE GENERALLY INCREASED.
BUT MANY WERE NOT PROTECTED
ENOUGH.
LESS THAN HALF OF THOSE
RESPONDED SAID THEIR
ORGANIZATION HAD A RANSOMWARE
INCIDENT RESPONSE PLAN.
TWO MONTHS LATER, MARYLAND IS
TWO MONTHS LATER, MARYLAND IS
STILL WORKING TO FULLY RESTORE
ALL OF THE HEALTH DEPARTMENT’S
SYSTEMS FROM BACKED UP FILES.
>> I THINK EVEN WORSE THAN
>> I THINK EVEN WORSE THAN
RESTORING SLOWLY IS RESTORING
INACCURATELY AND HAVING PEOPLE
INACCURATELY AND HAVING PEOPLE
MAKE DECISIONS BASED ON THAT
DATA.
>> Reporter: HE HASN’T DISCLOSED
HOW THE HACKERS GOT IN.
>> I CAN’T EXPLAIN TO THE
DETAILS OF THAT BECAUSE THAT
INVESTIGATION IS STILL ACTIVE.
>> Reporter: BUT HE FOUND NO
MARYLANDER’S HEALTH INFORMATION
MARYLANDER’S HEALTH INFORMATION
TO BE COMPROMISED AND NOTHING
RESTORED THUS FAR.
>> YOU HAVE TO REALIZE IT IS
GOING TO HAPPEN.
GOING TO HAPPEN.
WHAT MATTERS IS YOU ARE PREPARED
TO RESPOND WHEN IT DOES.
>> Reporter: HE SAYS SOME
>> Reporter: HE SAYS SOME
SYSTEMS ARE BACK ONLINE WITH
WORK-AROUNDS IN PLACE.
HE EXPECTS THE AGENCY’S SECURITY
WILL BE STRONGER FROM THIS IN
THE FUTURE.
NEWS 4 I-TEAM.
>>> SOME STATES LIKE
PENNSYLVANIA AND NEW YORK HAVE
INTRODUCED LEGISLATION TO BAN
RANSOMWARE PAYMENTS BY STATE AND
RANSOMWARE PAYMENTS BY STATE AND
LOCAL GOVERNMENTS.
WE HAVE NOT SEEN THAT IN OUR
REGION.
THAT WOULD MAKE THEM LESS OF A
THAT WOULD MAKE THEM LESS OF A
TARGET SINCE THEY WOULDN’T BE
ALLOWED TO PAY.
BUT SOME EXPERTS SAY IT COULD
CREATE A PROBLEM IN A CRITICAL
INSTANCE WHERE THEY HAVE TO.
INSTANCE WHERE THEY HAVE TO.
FOR MORE ON THIS STORY, VISIT