In the past eight months, three Florida Keys municipal and county entities have been hit by a computer ransomware virus that virtually shut down their systems for weeks.
Two of the computer virus attacks, on Key West City Hall and Florida Keys Mosquito Control District computer servers, occurred in the last 10 weeks. The first of these three systems hacks hit the Marathon city computer system on March 4 and Information Technology staff there have still not gotten all municipal servers up and running.
The computer ransomware virus that shut down the Key West City Hall computer system on Aug. 28 for over three weeks seems remarkably similar to the other two viruses that seized control of the in-house governmental computer servers, encrypting the stored data to make it unreadable and useless. In Key West and Marathon, ransom demands were received. At Mosquito Control, the district’s Chief Technical Officer, Tony Nunez, was able to shut down the system while the attack was ongoing, possibly stopping the infection process before it could become more embedded. Chad Huff, Mosquito Control Public Education and Information Officer, said Nunez was somehow alerted to the attack on the evening of Oct. 20.
“The next morning, all of our phones and computers were non-functional. All of our data was encrypted. He [Nunez] pulled the plug and kept it from getting worse,” Huff told The Key West Citizen this week.
Possibly as a result of that, Huff said, the county mosquito control office never received a ransom demand. But Key West and Marathon weren’t as lucky. Key West City Manager Greg Veliz said the ransom demand got as high as $1.1 million in return for the hackers removing the virus that encrypted the city’s municipal data. The U.S. Secret Service was involved in the negotiations, as was a ransomware expert team put in place by the city’s insurance company, he said.
“They put people in place right away. They were a team we met with pretty regularly,” Veliz said, adding that the team ultimately decided not to pay the ransom demand. “I’m not handing $1.1 million over to anybody. I’m not from St. Louis but you have to show me. I didn’t see enough.”
As a result, Key West City government went back to pre-computer days for more than three weeks. While 911 emergency call service was still operational, staff had no internal computer access for departmental records and operations and had only limited telephone service. They had to scramble to find work-arounds to keep the city functioning, including using personal cellphones and laptop computers. Multiple departments had to go into storage lockers to find paper records. Police officers had to fill out incident reports by hand. Emergency building permits were issued by paper carbon copies while handwritten requests for inspections were being given to inspectors. And since project plans were trapped inside the Building Department computers, inspectors had to depend on contractors to have hard copies of the plans on location to determine where an inspection was needed.
Veliz said that city officials were so tight-lipped at the time of the attack at the request of the Secret Service. In addition to shutting down the servers, the hackers said they had access to personal data for some city staff and residents that they would “dump” onto the Internet if they were not paid. Veliz said the Secret Service told him the more media attention given to the attack, the higher the ransom demand.
However, during the ransom negotiations, it did not appear the hackers had stolen much potentially damaging personal data from local residents.
“We [communicated] through email and they [hackers] showed us some of what they had,” Veliz said. “I didn’t see enough. We decided no.”
At this point, Veliz said there appears to be little risk of a resident data dump. There is a notification process in place, he said, that requires the city to let anyone know if their personal data may be compromised. But so far, the city has “not been made aware” that any resident has been exposed, he said.
Ransomware is a felony under the federal Computer Fraud and Abuse Act.
At the Mosquito Control District offices, Huff said their servers are about 95% restored. At no time during the system crash was the office unable to do its work, he said, including continuing truck and helicopter spray missions to control the mosquito population.
“We just were back in time to 20 years ago. Everything was on paper. Pencils replaced maps and computers,” Huff said.
In Marathon, former Mayor Steve Cook, who was mayor when the hack hit on March 4, attributed the attack to an unnamed European hacker group. He said the city had cyber insurance, which helped pay to hire computer technicians to restore the servers.
“We were completely shut down,” he said, adding that the hack took place 10 days before Monroe County shut itself down to visitors due to the coronavirus, adding to the difficulty of repairing the damage.
Cook said the ransom demand “was made from the very get-go.” He wouldn’t say what the demand amount was.
“Once we realized all of our on-site servers and off-site servers were compromised, we had to make a decision” on how to move ahead, Cook said. “We’re still getting some of our servers back online.”
Two years ago, the Monroe County School System was hit with a similar ransomware attack, shutting down its systems for about a week, although classes were not affected. No ransom demand was made; however, the virus was identified as a type of malware, “GandCrab,” that is typically a form of a so-called “Trojan Horse” virus that scrambles data into unreadable gibberish that can only be unlocked with software keys once the target pays the ransom demand.
And only two weeks ago, the FBI and two other federal agencies warned U.S. hospitals that cybercriminals were unleashing a new wave of data-scrambling extortion leading to “data theft and disruption of healthcare services.”
With future threats possibly on the horizon and with all three of the municipal and county hack victims forced to rebuild their computer systems from the ground up, additional virus protections are being added. At Mosquito Control, Huff said “maximum” firewalls have been put in place for short term and additional, longer-term safeguards are being installed. In Key West, Veliz said IT technicians have “gone the extra mile.”
“If it’s available to protect,” he said, “we’ve got it.”
The list of coronavirus special event victims keeps growing.
Key West has canceled all special events on public property through Dec. 31 to help slow the soaring number of COVID-19 cases in both the city and Monroe County. In addition to the previously announced cancellation of the holiday parade and the in-person public Christmas tree and menorah lightings — both of which will be shown virtually — all concerts at the Coffee Butler Amphitheater going forward through the end of December are canceled, including a Dec. 11 concert by the band 38 Special.
The Dec. 2 Wesley House Lighted Bike Ride fundraiser has also been cancelled. And the Key West Artisan Market, which was scheduled to start its winter season on Sunday, Nov. 22, in its new location in the parking lot of the Wildlife Bird Sanctuary, has been canceled until further notice.
“We are devastated for our artists, vendors and mom-and-pop businesses who have worked hard to beef up inventory to meet the demands of this popular market,” said market organizer Sean Krikorian. “Many of them have had very limited opportunity to make any income during the seven months of being shut down. But at the same time, we stand behind the city’s decision to keep our community safe and appreciate all they are doing to move Key West in a better direction.”
Unclear, however, is what may happen on New Year’s Eve. Several local bars hold midnight “drops” of large conch shells, a giant champaign bottle, a pirate wench, margarita limes into a massive cocktail glass and, the most famous, Sushi the drag queen in a stiletto shoe. Some of the drops are on private property; however, the crowds fill public sidewalks and streets. City commissioners said they wanted to reach out to bar owners asking the drops be canceled this year but nothing has been announced yet.
The Key West Truman Waterfront Farmers Market will be allowed to continue operating because it is considered an essential service by the state of Florida. With Thanksgiving on Thursday, Nov. 26, the farmers market will move to Friday and operate from 10 am to 6 p.m. Market organizers hope to move to Wednesday the week of Christmas and New Year to avoid conflicting with Christmas and New Year’s eves.
“Safety for our guests and participants at all the Markets is our highest priority,” Krikorian said. “We will continue to work with the City to develop protocols that hopefully will allow us to continue operating the Farmers Market and open the Artisan Market soon.”
The public will have its first chance on Saturday, Nov. 21, to tour a model tiny home the Monroe County government has set up as part of a pilot program to test the interest in such types of homes.
The public is welcome to view Monroe County’s first model code compliant tiny home at one of three planned open houses, according to county spokeswoman Kristen Livengood.
The house, which is located at 41 Judy Place in Key Largo, will be open from noon to 3 p.m. on Saturday, Nov. 21, Saturday, Dec. 5, and Saturday, Dec. 12.
At the open house, COVID-19 safety measures will be in place. Visitors will be required to wear facial coverings, socially distance from others, and only one family group will be allowed in the house at a time. Also, note there is limited parking in the neighborhood.
The Key Largo tiny home is one in a pilot project the Monroe County Board of County Commissioners approved in December 2018. The commissioners wanted to be creative in finding products that are wind- and flood-resistant for homeowners to consider as replacements following the devastation throughout the Keys from Hurricane Irma in September 2017.
The Cornerstone Tiny Homes prototype in Key Largo is a hurricane-rated structure that can be used as an alternative replacement of a mobile home after a disaster.
The model home is one bedroom and one bathroom with a porch, a little less than 400 square feet, and starts at $85,000, for the home without the land.
Eventually the model will be rented out to a county employee, but no employee has been selected to live in the Key Largo home, as the county plans to use it to show citizens what a code complaint tiny home is like.
In the wake of Hurricane Irma, Monroe County embarked on several strategies to find a way to replace the roughly 4,000 homes destroyed or substantially damaged.
However, it has been no easy task finding a cost-effective way to build safe affordable and workforce housing in one of the most expensive counties in the state that has seen more hurricane strikes than nearly any other county in Florida.
The county initially embarked on a pilot program to build four different prototypes of tiny homes on three separate islands, but some of the locations and plans did not work out and the county is now looking at two locations, Key Largo and Big Pine Key, Deputy County Administrator Christine Hurley said.
The county currently has a request for proposals to build a tiny home and place it at 252 Sands Road in Big Pine Key, Hurley said.
Hurley is hoping developers and property owners will see value in the tiny home idea and want to pursue it for future projects in the Florida Keys, where there is an affordable housing crisis and not a lot of land, Hurley said.
For information on Cornerstone Tiny Homes, visit http://www.cornerstonetinyhomes.com.