AN UPDATE NOW FROM THOSE TRYING
TO FIGHT THE THREATS. >> POSSIBLE HOSTAGES.
>> Reporter: IT’S NOT QUITE AS
GLAMOROUS AS IN THE MOVIES WHEN
HOSTAGE NEGOTIATORS LIKE DENZEL WASHINGTON RACE AGAINST THE
CLOCK TO SAVE LIVES.
>> JUST TELL ME WHAT IT IS YOU
REALLY WANT AND I’LL GET IT FOR
YOU.
>> Reporter: BUT IT CAN BE JUST
AS INTENSE AND JUST AS EXPENSIVE WHEN A COMPANY OR GOVERNMENT IS
HELD HOSTAGE, NEGOTIATING TO BE
ABLE TO OPERATE.
>> THERE IS NO SILVER BULLET
THAT PROTECTS YOU FROM EVERYTHING.
>> Reporter: IN DECEMBER, A
RANSOM AWARE FORCED EDD MARYLAND
DEPARTMENT OF HEALTH TO SHUT
DOWN ITS WEBSITE.
>> SYSTEMS STARTED MALFUNCTIONS,
WHICH IS HOW THIS WAS DETECTED. >> Reporter: THE STATE’S CHIEF
INFORMATION SECURITY OFFICER
CHIP STEWART SAYS EMERGENCY PLANS CHIPPED IN AND TOOK
SERVERS OFFLINE TO PROTECT THE
NETWORK.
>> THE RANSOM TEAM IS PART OF
THE DISCUSSION. FORTUNATELY BECAUSE OF THE WORK
WE HAVE DONE LEADING UP TO THIS,
WE HAVEN’T HAD TO CONSIDER THAT
AS A REAL POSSIBILITY AT THIS
POINT.
>> THE BEST THING TO DO IS NOT
TO PAY.
BUT THERE ARE CASES WHERE YOU HAVE TO BECAUSE OTHERWISE, YOUR
BUSINESS IS DONE.
YOU KNOW, IT CAN BE A REALLY, REALLY TOUGH SITUATION.
>> JEN IS THE DIRECTOR OF THREAT
INTELLIGENCE FOR UNIT 42, A
SPECIALLY TRAINED TEAM OF CYBER
SECURITY EXPERTS WHO HELP YOU
NEGOTIATE WHEN YOU ARE ATTACKED
BY A RANSOMWARE GANG. THEY’RE CONTINUING TO EXPAND
THEIR TACTICS IN WAYS THEY ARE
TRYING TO GET PAID. >> Reporter: LIKE WHEN D.C.’S
POLICE DEPARTMENT GOT HACKED IN
APRIL.
NPD OFFERED $100,000 BUT ENDED
UP PAYING NOTHING.
AND FILES CONTAINING SENSITIVE
INFORMATION ON OFFICERS AND
SUSPECTED WERE POSTED ON THE
DARK WEB.
>> DEFINITELY A PLACE WHERE
CRIMINALS HANG OUT. IT IS DEFINITELY A PLACE THAT,
YOU KNOW, THESE THREAT ACTORS
ARE LEVERAGING TO STAND OUT. >> Reporter: HIS JOB IS TO TRY
TO STOP THEM.
HE’S A RA SOMENEGOTIATOR AND
SENIOR DIRECTOR OF INCIDENT
RESPONSE.
>> YOU NEED TO USE CONFIDENCE
AND BE ABLE TO NEGOTIATE.
YOU HAVE TO COME OFF CALM.
>> Reporter: WHICH CAN BE HARD
FOR A COMPANY EXECUTIVE TO DO WHEN THEIR ENTIRE BUSINESS MIGHT
BE ON THE LINE.
OTHERS STEAL AND ENCRYPT DATA
AND DEMAND MONEY.
BUT HE SAYS EVEN THEN THE
ATTACKERS SWITCH GEARS AND USE
DOUBLE EXPORTION, THREATENING TO
RELEASE THE INFO THEY HAVE
STOLEN PUBLICALLY.
>> IF THEY STEAL MY FILES, THEY
MIGHT REACH OUT TO ME ALSO? >> WE HAVE SEEN THAT.
SUFFERING FROM A RANSOMWARE
ATTACK IS DEFINITELY SOMETHING
THAT PEOPLE CAN FEEL THAT
IMPACT, NOT JUST THE BUSINESS.
>> Reporter: MARK WEATHERFORD OVERSAW CYBER SECURITY FOR THE
DEPARTMENT OF HOMELAND SECURE
AND NOW WORKS AS CHIEF STRATEGY
SECURITY.
DOES THE AVERAGE AMERICAN
REALIZE HOW BIG A DEAL RANSOMWARE IS RIGHT NOW?
>> NO CLUE.
90% OF THE PEOPLE CAN’T EVEN
EXPLAIN WHAT RANSOMWARE IS.
>> Reporter: HE SAYS IT’S A
PROBLEM THE U.S. CAN’T SOLVE ON
ITS OWN BECAUSE THE BAD ACTORS
ARE MAINLY OPERATES OVERSEAS.
>> AT FIRST IT WAS LIKE THEY
WOULD JUST FIND ANY RANDOM
COMPANY THAT THEY RAN ACROSS AND THEY WOULD CONDUCT ATTACKS.
BUT THERE IS A LOT MORE
RECONNAISSANCE AND INTELLIGENCE GATHERING HAPPENING NOW.
>> Reporter: HE SAYS THAT MEANS
THEY ARE MORE FREQUENTLY HITTING
ENTITIES THAT CAN’T AFFORD NOT
TO PAY, LIKE HOSPITALS THAT
MIGHT HAVE ACCESS TO HOSPITAL
RECORDS, COMMUNICATION SYSTEMS.
OR GOVERNMENTS.
A 911 CENTER OR A CITY’S WATER SYSTEM CAN’T JUST SHUT DOWN FOR
A FEW DAYS.
>> LOCAL GOVERNMENTS ARE ALWAYS A BIT BEHIND THE PRIVATE SECTOR
SIMPLY BECAUSE, WELL, CERTAINLY
FUNDING.
AND THEY JUST -- THEY MOVE AT A
SLOW PLACE. >> Reporter: SURVEYED 200 STATE
AND LOCAL GOVERNMENT LEADERS FOR
THE I-TEAM AND FOUND BUDGETS HAVE GENERALLY INCREASED.
BUT MANY WERE NOT PROTECTED
ENOUGH.
LESS THAN HALF OF THOSE
RESPONDED SAID THEIR
ORGANIZATION HAD A RANSOMWARE
INCIDENT RESPONSE PLAN. TWO MONTHS LATER, MARYLAND IS
STILL WORKING TO FULLY RESTORE
ALL OF THE HEALTH DEPARTMENT’S
SYSTEMS FROM BACKED UP FILES. >> I THINK EVEN WORSE THAN
RESTORING SLOWLY IS RESTORING INACCURATELY AND HAVING PEOPLE
MAKE DECISIONS BASED ON THAT
DATA.
>> Reporter: HE HASN’T DISCLOSED
HOW THE HACKERS GOT IN.
>> I CAN’T EXPLAIN TO THE
DETAILS OF THAT BECAUSE THAT
INVESTIGATION IS STILL ACTIVE.
>> Reporter: BUT HE FOUND NO MARYLANDER’S HEALTH INFORMATION
TO BE COMPROMISED AND NOTHING
RESTORED THUS FAR.
>> YOU HAVE TO REALIZE IT IS GOING TO HAPPEN.
WHAT MATTERS IS YOU ARE PREPARED
TO RESPOND WHEN IT DOES. >> Reporter: HE SAYS SOME
SYSTEMS ARE BACK ONLINE WITH
WORK-AROUNDS IN PLACE.
HE EXPECTS THE AGENCY’S SECURITY
WILL BE STRONGER FROM THIS IN
THE FUTURE.
NEWS 4 I-TEAM.
>>> SOME STATES LIKE
PENNSYLVANIA AND NEW YORK HAVE
INTRODUCED LEGISLATION TO BAN RANSOMWARE PAYMENTS BY STATE AND
LOCAL GOVERNMENTS.
WE HAVE NOT SEEN THAT IN OUR
REGION. THAT WOULD MAKE THEM LESS OF A
TARGET SINCE THEY WOULDN’T BE
ALLOWED TO PAY.
BUT SOME EXPERTS SAY IT COULD
CREATE A PROBLEM IN A CRITICAL INSTANCE WHERE THEY HAVE TO.
FOR MORE ON THIS STORY, VISIT