Late last week, Austinites were rocked by a bombshell report in The Intercept that cyber hackers with links to the Russian government had breached several of Austin’s critically important government computer systems. The consequences could endanger all Texans.
According to The Intercept, Berserk Bear—a hacker collective with ties to the Russian Federal Security Bureau (the KGB’s successor)— penetrated computer systems maintained by the City of Austin earlier this year.
While the extent of the breach is unknown, the report suggests sensitive information about municipal water and energy systems—and the Austin Police Department—may have been vulnerable or compromised.
Notably, it appears that Austin is the only municipal government to have been penetrated.
As The Intercept documents, the Austin City Council received a vague notice on October 9 that something was wrong, prompting them to hold multiple cryptic “executive sessions” the following week. On December 8, the council purchased a $2.4 million cyber liability insurance policy.
“It’s not surprising that hackers, when they find an unsecured server that is in the country that they’re targeting, use that as a jumping off point for lots of other things,” said John Scott-Railton, a senior researcher at Citizen Lab at the University of Toronto’s Munk School of Global Affairs and Public Policy. “It makes things a lot easier.”
Beyond geographic coincidence, there is no evidence at this time of a link between the City of Austin’s hack and a similar attack against local software company SolarWinds.
Unfortunately, this discovery has troubling implications for Texans outside the capital city, as The Intercept chillingly explains:
Cybersecurity experts warned that while the Berserk Bear hackers are not known for sabotage, they could rear up at any moment and wreak havoc in the United States, for example, by making cities go dark. “We should be cognizant of the level of information that they have,” said Vikram Thakur, a technical director at Symantec who has tracked the group for years. “Turning on valves or closing valves, things of that sort — they have the expertise to do it.”
Austin’s municipal energy utility, Austin Energy, shares systems with the Electric Reliability Council of Texas (ERCOT). If foreign hackers used Austin Energy to penetrate ERCOT, it could potentially compromise the entire state’s power grid. Likewise, the Austin Police Department shares systems with the Texas Department of Public Safety, which could have serious implications if compromised.
One potential solution is Senate Bill 182, a proposed law that would privatize abusive municipal utilities; the bill could easily be amended to cover foreign hacks. In addition, the state of Texas is already considering transferring the Austin Police Department to state jurisdiction.
Texans concerned about these issues can contact their state legislators.
