The El Dorado City Council agreed to move forward with a proposed expenditure to upgrade the cyber-security system in City Hall following a breach that targeted Mayor Veronica Smith-Creer.
During a regular council meeting April 22, council members learned that Carey Tissue — chief information officer of El Dorado Printing, the city’s commercial information technology service provider — said he believes that Smith-Creer was a victim of spoofing, a cyber-attack in which an email appears to come from a trusted or known source to spam or phish the recipient.
The mayor explained that her name and photo were used to create a new Instagram page, adding that neither her Facebook nor Instagram accounts had been infiltrated.
Smith-Creer also said she did not know which of her email accounts was targeted, noting that the spoof came through a Gmail account.
Gmail is a free email service that is provided by Google.
“I don’t have Gmail here. The email that was associated with my name was not my particular email address,” she said.
Council Member Dianne Hammond said that when she heard about the incident, she reached out to Tissue to gauge the efficacy of City Hall’s cyber-security system.
“I asked him what kind of security that we have here at City Hall. We’ve got security at (the El Dorado Water Utilities) and we have at the (El Dorado Police Department),” Hammond said. “As far as what we have here, it’s not adequate for what we should have.”
Tissue said City Hall has a basic firewall protection system but the system is not professional grade.
The need to address vulnerabilities in computer network systems has become more pressing due to an uptick in cyber-security attacks and scams, particularly during the coronavirus (COVID-19) pandemic when more people are working remotely, Tissue told council members.
Last year, El Dorado Printing performed a similar upgrade for the EPD, whose computer network was attacked a year ago by a CryptoLocker virus.
Capt. Michael Leveritt explained then that the system was hit by RobinHood malware, a bug that encrypts existing files and holds them for “ransom”, as hackers demand to be paid through Bitcoin in order to “release” the files.
No data was breached as a result of the cyber-attack, Leveritt and Police Chief Kenny Hickman said at the time.
The officers learned from the FBI, who launched an investigation into the incident, that RobinHood was the latest variant of the years-old CryptoLocker malware and that it had struck other large computer networks, including law enforcement agencies and other municipal government offices and private businesses, across the country.
For City Hall, Tissue proposed cyber-security upgrades at a cost of about $4,500 — $4,220, plus sales tax.
On April 22, Hammond made a motion to expend the funds, suggesting that the money be taken from the city’s budget for capital improvements.
She later withdrew the motion upon a suggestion from Smith-Creer and Council Member Vance Williamson, who noted that the city is still operating from its 2020 budget as local accounting firm Emrich and Scroggins works to sort out the city’s financial records.
The council resumed the discussion during a Finance Committee meeting on April 28.
Williamson said he was not sure how to deal with the expenditure when Hammond proposed it, but he had since spoken with Stacy Scroggins, of Emrich and Scroggins, about the matter.
Williamson said Scroggins agreed the money should come from the capital improvements budget; however, the budget total for 2020 is going to differ from that of 2021.
The council is awaiting a final report from E&S about the state of the city’s finances before setting a 2021 budget.
“The only good thing, if there’s a good thing about not having a 2021 budget, is at this time, we’ll know an exact amount and when Stacy gets ready to do that, we’ll plug an exact number into that — into that capital account,” Williamson said.
He asked Hammond if she would like to re-enter her motion and she obliged, drawing a unanimous vote from the council to proceed with the expenditure.
Referring to statements Tissue made during the council meeting on April 22, Council Member Willie McGhee asked for a confirmation on how long the work would take to complete.
Hammond said the job will take about a week for the equipment to be shipped.
Added Council Member Paul Choate, “If he can get it, he can (install) it in a day.”
Council Member Billy Blann expressed appreciation to Williamson for speaking with Scroggins about the matter and finding a solution in light of the city’s budgetary issues in order to move forward with fortifying City Hall’s computer network.
Blann said other cities around the country are dealing with similar cyber-security attacks, which have resulted in repairs and losses totaling the billions of dollars.
A business owner who operates four business websites, Blann said he is familiar with such issues, including cyber protections that are necessary to comply with regulations to conduct e-commerce.
“It’s not so much the hack as it is the ransomware. It can gut you,” Choate said.