Parker County Judge Pat Deen described what is known about a cyber attack incident that occurred on Oct. 16, saying the county is doing everything it can to restore and put software in place for prevention.
The virus hit the county’s system on Aug. 23 but didn’t activate until Oct. 16, which caused a complete shutdown, Deen said.
“It was in our system and we didn’t know it. The origin as I understand, they think they isolated it to the [Justice of the Peace] courts office but there’s no certainty in that now from what I’m hearing,” he said. “When the FBI was involved and they were doing the investigation with [Texas Department of Information Resources], they were looking at any internal maliciousness or any internal crime, and there wasn’t, so they left and that’s all that matters to me.”
The cyber attack did not affect the county elections systems but Deen said all other departments have been impacted in some way.
Processes and software will now be put in place to help prevent this type of attack from occurring again, Deen said.
“Nobody maliciously clicked on the link and said, ‘We’ll just corrupt the system.’ I think the focus is education, putting the right pieces in place to identify if something is happening to hopefully isolate this from happening again,” he said. “There will be an investment made so we will do whatever it takes.”
A special called meeting of the commissioners court was held on Oct. 30 to approve the use of the Texas Department of Information Resources’ managed security services and review and execute a contract between the county and Presage Solutions.
“There is an interlocal agreement that we signed with DIR for these types of services in November of 2018 when we contracted with DIR to do a security assessment for the elections department,” Parker County Purchasing Agent Kim Rivas said. “DIR would be the vendor that we make payment to, but it will be for cyber defense services.”
Rivas added that DIR is part of the Texas Comptroller’s office.
Deen said the attack put a ransom on the county retaining its information that doubled each day.
“At one point I think it was $15 million, but it was never an option and was never considered because we brought in the best and right people to do this,” Deen said. “Paying the ransom, they give you a bunch of encryption codes, you lose about 20% of the work you’ve done and then you go back to work and that’s what they do and that was never going to happen here. As I understand, this is a new strand of virus that DIR has not seen before.”
Presage Solutions, which was founded by Jay Hamilton of Brock in 2000, offers IT support relating to hardware and business applications and had upgraded the county’s email system three weeks prior to the security breach.
“[We] upgraded your email system to take you from an on-premise server email system to a hybrid in the cloud Microsoft solution. It took us three months,” Hamilton told commissioners last week. “If your email server had been on the premise and not migrated to the cloud, your entire email would be down — completely down.”
Hamilton said there are two parts to this work: Recovering from the attack and coming up with an IT strategy.
“We’re in the middle of a disaster that we’re recovering from. Part of that disaster is that we’re rebuilding this network from the ground up and in the end, it will be a brand new network that wasn’t here before,” Hamilton said. “We need to paint a picture, an IT strategy of what this should look like a year from now to keep this same thing from happening. That’s what I do, that’s what I’m good at. I don’t think that’s been happening in the past, so I just want to be a part of the success of this new network and help build it.”
On Oct. 30, Hamilton said the recovery from the cyber attack would be about two weeks and to rebuild the network would take about a year. Deen said it’s tricky to put an exact timeline on the recovery process because the county wants it done right, but two to three weeks was a good estimate.
The commissioners expressed concern about not having a definite cost associated with the work and said they were hesitant to give anybody a “blank check.”
“We need some idea as things progress of the cost, not billing afterward,” Precinct 3 Commissioner Larry Walden said. “I know that’s not in your timeframe right now because we need to get things fixed as quickly as we can, but after that, we want to have an idea of the cost.”
Precinct 4 Commissioner Steve Dugan also expressed concern about Presage Solutions being the only vendor considered for the job. However, Hamilton responded by saying no one will know the network better once he’s finished.
“I got a call at 6 on Saturday morning to come help out and I didn’t hesitate and I’ve been working since Saturday [Oct. 17] nonstop,” Hamilton said. “There’s the commitment we made with no contract in place and decided to help this county out. I don’t want to be crass about it, but I wasn’t expecting to do any work other than the email project for Parker County.”
The court unanimously approved entering into a contract with the company to cover the current crisis.
Deen said the potential cost could be up to $200,000.
“It happened, it’s going to cost a lot of money to fix and the goal is to put us in a position where this will really minimize this from happening to the scale that it happened at,” Deen said. “We’ll get it taken care of, it’s taxpayer money and we’re going to do it right and spend wisely in making sure this doesn’t happen again.”