Riverside cops may lose state link

State might cut them off if they’re hit by another cyberattack.

Two cyberattacks on RIVERSIDE —

Riverside’s fire and police department servers have hamstrung law enforcement in ways previously unknown to the public, includ- ing the possibility Riverside could permanently lose access to one of the state’s police computer networks if attacked again, a Dayton Daily News investigation found.

The ransomware cyberattacks in April and May — which have cost the city tens of thousands of dollars — shut down the police department’s records management system used to create and store investigative reports.

The attacks forced Riverside police officers to use a backup system on the Ohio Law Enforcement Gateway, a statewide computer database operated by the Ohio Attorney General’s Bureau of Criminal Investigation for local police departments. But four days after the Dayton Daily News revealed the Maycyberattack hit the city, the AG’s office revoked the city’s access to the gateway to shield the network from damage and protect confidential infor- mation from exposure, a spokeswoman said.

TheDayton Daily News investigation found police not only lost the ability to access and print past reports — as acknowledged by police Chief Frank Robinson

in public statements — but at one point lost the abil- ity to make digital reports altogether. Losing the gate- way forced officers to hand write reports and type incident narratives into Micro- soft Word so that they could be scanned into the system once restored, an internal memo said.

By the time Robinson made his statement in July, the ability to make digital reports was resolved by getting the usual records system back up and running, he said. But the AG’s office had not then — and still has not now — fully restored access to the gateway network, meaning the department can’t fully use other gateway functions unmentioned by Robinson to the public.

T he gateway “is our backup reporting system, the system we use to create photo lineups for investigations, how we enter evidence that needs to be processed at the BCI lab and the quickest way to obtain crim- inal history on suspects,” Maj. Matt Sturgeon wrote in a May 24 email to the fire chief and assistant city manager. “This is really hampering (our) effectiveness.”

“This is vital!” Sturgeon wrote nearly a month later.

In a memo to the chief this week after the Dayton Daily News brought its findings to the department, Sturgeon told the chief that the gate- way’s loss has affected oper- ations, “but we have found the means to make due by other paths.”

Officers now use another computer program to create photo lineups. Instead of directly accessing criminal history on the gateway, offi- cers now radio dispatch and wait to obtain the informa- tion. And instead of using the gateway to make state crime lab requests and receive finished lab reports, the department had to make handwritten lab requests. Until last month, officers had to pick up the completed reports at the state crime lab in Madison County.

“The loss in no way leaves our citizens vulnerable when they call for police services,” Sturgeon wrote.

Robinson reiterated this in an interview Tuesday: “I think the main thing we want to make sure people understand is that we are doing exactly what we should be doing every day to make sure the public is as safe as possi- ble. There’s no slack in how we’re responding or prioritizing our calls or anything like that.”

The Dayton Daily News used Ohio’s public records laws to obtain more than 250 pages of internal city emails and memos. The newspa- per’s examination and subsequent interviews also found:

■ In order to protect the gateway, the AG’s office has a three-strike policy for agencies that fall victim to cyberattacks. The AG “does not have a remediation” to restore gateway access after a third strike. The attacks in April a nd May count as strikes No. 1 and No. 2, meaning if Riverside is hit again, the department will be “permanently blocked” from the gateway, unless the AG’s office is satisfied the issues are remedied.

■ Agencies that use the gateway are required to notify the AG’s office of security breaches, but an AG spokeswoman said the state was not contacted about either ransomware attack. City Manager Mark Carpenter this week said he was “surprised” by the spokeswoman’s statement, because city staff had internal discussions about the need to alert the state. Assistant City Manager Chris Lohr later acknowledged Riverside “may have overlooked notifying” the AG.

■ The AG’s office learned about the attacks through news reports and suspended Riverside’s gateway access on May 14 — four days after the Dayton Daily News revealed the second attack to the public and 10 days after Riverside’s computer network was compromised for the second time. Matthew Cur- tin, a Columbus-based cybersecurity expert, applauded the AG’s office for yanking access, calling it “a pretty good example of how a provider of sensitive informa- tion governs access to its information.”

■ Presently, one Riverside records clerk is authorized to access past reports on the gateway from computers in Huber Heights. The same day the Dayton Daily News reported the police department lost gateway access, the city manager emailed the police chief to “move quickly” to establish gateway access in Huber Heights. The limited access was granted a day later.

■ Riverside’s “data at rest” — essentially infor- mation stored on, but not in transit over, the police department’s network — uses “very basic controls with no encryption,” according to an email from Riverside’s IT contractor. Encryption uses a cipher, or code, to protect data and prohibit unauthorized parties from being able to read it.

Lohr, the assistant city manager, said the city is “consider i ng” e ncrypt- ing the data. He said paramedics transfer HIPAA-protected information over an encrypted connection to a web-based cloud program not hosted by the city.

Curtin, who founded Inter- hack Corp., called it a “bad practice” for any police department not to encrypt sensitive data.

“If you have sensitive information and you don’t protect it with anything more than a password, you are doing nothing to protect it from a number of attacks, including just stealing the thing,” said Curtin, a former Ohio State University computer science senior lecturer. “The fact that you have the password is irrelevant.”

City officials estimate gateway access could be fully restored in the next 30 to 90 days, once Riverside meets the stringent security guidelines dictated by the AG’s office.

“We have to take action, and we want to make sure we do it right,” Carpenter said this week.

“We’re looking to invest in some new equipment and building a more secure network,” Carpenter said. “In order to make the network secure, initial investment will be in the neighborhood of $50,000.”

Ransomware is a type of malware that encrypts, or locks, digital files and demands a ransom to release them, according to the FBI. Everyday users of computers can fall victim to malware, too.

“Readers should understand that cybersecurity is not an IT problem,” Curtin said. “The vast majority of the kind of problems we’re seeing right now come down to users being fooled into the wrong thing, including clicking on the wrong thing, going to websites that don’t make sense for them to go on, and generally doing things that are stupid.”