USA TODAY International Edition
Bombing exposes security weakness
AT& T pressed for ways to protect networks
NASHVILLE, Tenn. – Four days after the bombing downtown on Christmas Day crippled cell service, internet and even tools for law enforcement across a multistate region, residents in White County struggled to get through to the emergency communication center.
Though the center’s landlines worked and officials pushed out a nonemergency number via social media, the rural county’s 911 Emergency Director Suzi Haston said she was shocked wireless services were still out after the bombing damaged an AT& T building more than 90 miles away.
Even farther away, in Alabama, the bombing forced first responders to use two- way radio and text messaging systems after the state’s primary com
munication network for public safety workers, FirstNet, was disrupted.
The vulnerability of the telecommunication system across the Southeast became clear Christmas Day. Federal, state, and local officials demand answers from AT& T, asking how such a nightmare happened and how to ensure it can’t happen again.
The AT& T building in Nashville that was damaged houses connection points for regional internet and wireless communication. Although authorities have not said what motivated the suspected bomber, the blast from an RV laden with explosives brought communication from Georgia to Kentucky to a halt.
It affected 911 call centers, hospitals, the Nashville airport, government offices and individual mobile users. Patients were left unable to contact pharmacies, issues with credit card devices hamstrung businesses big and small.
There are similar facilities and data centers across the nation – some within blocks of government buildings.
As news of the bombing spread, officials in Mississippi sought to fortify communication systems, scrambling to ensure the security of critical infrastructure sites, such as ports along the Gulf Coast and oil and gas refineries. The New York Police Department ramped up security at communication facilities.
The bombing raises questions about potential vulnerabilities elsewhere in the USA, said Colin Clarke, a senior fellow at the Soufan Center, a nonpartisan organization focused on global security issues. Beyond the big utilities, how does the nation protect these “pedestrian places” that few people know exist, he said.
“You’d walk right past that place on the street. You have to kind of know it was there if you wanted to target it. Hence, there’s no need for massive security,” said Clarke, who teaches at Carnegie Mellon University. “But now we’re starting to rethink that. ... How do you harden these soft targets and make sure that this doesn’t happen again?”
The Cybersecurity and Infrastructure Security Agency at the Department of Homeland Security said officials are working with partners in the region to assess what happened.
Tennessee Gov. Bill Lee, who toured the crime scene a day after the blast, said he expects AT& T to “strengthen that infrastructure” over the next month.
“Anytime you have a situation like this, you can look at the aftermath and see where your weaknesses were,” he said. “There’s a lot to learn.”
Sen. Rob Portman, R- Ohio, who will serve as the top Republican on the Senate Homeland Security and Governmental Affairs Committee in the new Congress, said the bombing underscores the “significance of infrastructure security and how important that is to our economy and the safety of our communities.”
Sen. Marsha Blackburn, R- Tenn., said she hopes to work with her colleagues to advance a bill she introduced in 2020 that aims to “enhance our domestic networks by making them more resilient, redundant and interconnected.”
“The bombing in Nashville illustrates the continued danger posed by bad actors to disrupt telecommunications networks critical to the American economy,” Blackburn said. “Preventing potentially more serious future attacks on our homeland requires deeper partnerships with the private sector.”
Protecting public safety
One concern for lawmakers is the impact the blast had on emergency communications, including disruptions to AT& T’s public safety network, which prioritizes traffic for first responders, FirstNet.
In 2012, following recommendations in the aftermath of 9/ 11, Congress passed legislation creating the First Responder Network Authority ( FirstNet), authorizing it to enter into a public- private partnership to build a nationwide public safety broadband network.
In 2017, FirstNet awarded a 25- year, $ 6.5 billion contract to AT& T to build and maintain the network, according to a Congressional Research Service report.
As of April 2019, FirstNet reported to Congress that more than 7,000 public safety agencies were using the network, and Verizon has a similar program that competes for contracts nationwide.
Communities across the Southeast experienced FirstNet outages after the Nashville bombing.
Experts had pointed to the potential danger of such an incident.
“Cellular networks tend to collapse exactly when they’re needed most – in the aftermath of a disaster,” Johnathan Tal, chief executive officer of Tal Global, an international security consulting firm, wrote in 2018 in industry publication SecurityInfoWatch.com.
Even an incidental interruption, he said, can easily “mushroom into a colossal disruption of life and commerce.”
“Of course, network designers and security experts are aware of these vulnerabilities and have developed mechanisms and procedures to contain and
abate cyber and physical interferences with smooth operations, but the situation is far from secure,” Tal wrote.
In 2018, all 50 states and six U. S. territories accepted the FirstNet/ AT& T plan to deploy the network in their state, but some opted in reluctantly, according to the Congressional Research Service report.
By the Monday after the Nashville bombing, AT& T reported the majority of services had been restored through a combination of fixes, including generator repairs and a temporary network set up at Nissan Stadium near the central office facility.
Jim Greer, assistant vice president of corporate communications for AT& T, declined to comment on the company’s security procedures after the bombing. He cited CEO Jeff McElfresh’s letter to customers on prioritizing security.
“Our buildings have been damaged, but our determination to serve you and our community is undeterred. You have my commitment that we’ll continue to work around the clock until service is restored. And we will continue to prioritize the security of all our facilities that serve customers across the nation,” McElfresh wrote Dec. 29.
Greer said Thursday that emergency responders on the scene of the bombing had access to FirstNet, which “stayed up for the hours afterward.”
Only after the loss of power from the explosion and damage to backup generators due to water and fire were FirstNet customers affected, he said.
“Within hours dedicated FirstNet portable cell sites were on air in Nashville. Despite the magnitude of the event, our team had nearly all services restored in about 48 hours,” Greer said in an email.
What happened on Christmas Day illustrates the interdependence of the nation’s critical infrastructure, from communications to electricity to natural gas, said Tim Conway, an industrial control systems security specialist with the SANS Institute, a cybersecurity company.
“Our critical infrastructure kind of leans on each other like dominoes,” said Conway, who previously oversaw operations technology for a Northern Indiana natural gas and electric company.
“How well that environment is managed and maintained will stop it from spreading across multistates and taking down a global network,” Conway said. “So the impact that they had, being kind of where it was contained, is a sign of how well architected their network was and how well prepared they were.”
James Yacone, chief of mission at the SANS Institute and former assistant director of the FBI for critical incident response, praised AT& T’s quick response.
“I can tell you from 30 years of responding to critical incidents, they don’t generally fit into a nice silo, and so we’re seeing two critical infrastructures affected here, really, depending on how it cascaded out,” he said. “Are there other vulnerabilities like this? Absolutely, there are ... But I do think that AT& T responded to it and got control of it pretty quickly, given the cascading effect of what they were dealing with.”
Disruptions worrisome
White County in Tennessee doesn’t use AT& T for its landline phone service, which allowed the 911 communication center to accept some calls while wireless service was down.
“I do hope that AT& T can explain what the problem ( was),” Haston said. She and other 911 directors in Tennessee’s Cumberland region haven’t gotten “satisfactory answers from AT& T.”
White County’s communications were back up Wednesday after the bombing.
Haston said she doesn’t think dispatchers missed a serious emergency while lines were down. But, she said, there is no way to really tell.