14 minute read
CYBERSECURITY
Will Russia sic its hackers on New York?
State and local leaders are bolstering cybersecurity defenses at key agencies against potential threats.
Advertisement
By Annie McDonough
Westchester County Executive George Latimer also announced a cybersecurity task force recently. G EORGE LATIMER IS pretty sure that Westchester County’s critical infrastructure isn’t at the top of the Kremlin’s list of targets for cyberwarfare. But as cybersecurity experts and federal leaders warned of an increased threat of cyberattacks on Western targets – including local governments – following Russian President Vladimir Putin’s invasion of Ukraine, the Westchester County executive isn’t taking any chances.
“The Ukrainian situation has, I think, raised the stakes in people’s minds,” Latimer told City & State. “Do I think they’re going to pick Westchester County out of the crowd? I don’t know. But you can’t assume anything. I think we’re heading into a period of time of greater jeopardy, greater vigilance.”
Following Russia’s provocations and now invasion of Ukraine, local and state officials have talked about bolstering the defenses of critical infrastructure and other high-interest targets, including transportation networks, power grids and financial institutions. “Pretty much anything that they can do that will cause disruption and perhaps damage,” said Justin Cappos, a professor in the computer science and engineering department at New York University, when asked what kinds of systems attackers would want to target. “Imagine dropping a bomb on something as part of a war, the kinds of things you’d want to target for that – water treatment facilities and power dams and other systems like that.”
The U.S. Cybersecurity and Infrastructure Security Agency issued guidance imploring public and private institutions to be on high alert. “While there are no specific or credible cyber threats to the U.S. homeland at this time, Russia’s unprovoked attack on Ukraine, which has involved cyber-attacks on Ukrainian government and critical infrastructure organizations, may impact organizations both within and beyond the region, particularly in the wake of sanctions imposed by the United States and our Allies,” according to the agency’s website. “Every organization – large and small – must be prepared to respond to disruptive cyber activity.”
On Feb. 22, Gov. Kathy Hochul, New York City Mayor Eric Adams and several other local mayors announced a new joint cybersecurity command center that will pool resources and coordinate responses to threats between the state and local governments. A day later, Latimer held a press conference announcing a new cybersecurity task force
Gov. Kathy Hochul and New York City Mayor Eric Adams announced the creation of the Joint Security Operations Center on Feb. 22.
that will facilitate civilian and private sector involvement with the county’s cyberdefense efforts. Both initiatives were in the works before Russia’s invasion of Ukraine, but dedicating more money and attention to cybersecurity was something experts have told governments they can never do enough of, even outside of the threat of a revived Cold War. And both initiatives build on existing cybersecurity defenses. But like Latimer, Hochul pointed to the state’s new joint defense center as particularly timely given the heightened cyberthreat landscape.
“Given the increasingly volatile geopolitical circumstances with Russia and Ukraine … we can no longer act independently,” Hochul said on Feb. 22. The governor outlined the vast landscape of targets that foreign actors seeking both money and political disruption would want to target, including the New York Power Authority, the Metropolitan Transportation Authority and the Port Authority of New York and New Jersey. “You think about all your transactions. You know, how you access money, how you pay your bills, how you make purchases and medical records,” she said. “They’re all vulnerable to cyberattacks if we don’t take precautionary measures.”
Those targets were already vulnerable to cyberattacks, and some have already been victims. From major pipelines to local schools, bad actors can profit from all sorts of organizations by holding their data ransom or disrupting their operations. The MTA’s computer systems were breached last year by a group thought to have links to the Chinese government; The New York Times reported at the time that no employee or customer information was compromised and vital operations weren’t disrupted.
And on Feb. 25, New York’s public eth-
– Justin Cappos, New York University professor, on the state’s new operations center and investments
Protesters took to Times Square on Feb. 24 to oppose Russia’s invasion of Ukraine.
ics agency – the state Joint Commission on Public Ethics – reported a cyberattack that it dubbed “malicious” and forced the agency’s disclosure filing systems to be taken offline as a precaution. “We do not have any information at this time about who may have been behind the cyberattack, and although we do not know yet if there was an actual breach of user or other agency information, we will be working with law enforcement, including the New York State Police and the Office of the Attorney General, as well as the Department of State’s Consumer Protection Division, to further investigate this incident and meet all legal obligations triggered when a system breach occurs,” the agency said in a statement.
New York City is on alert too. “Russia’s invasion of Ukraine raises the threat of cyberattacks on New York City, our country’s most-populated city and capital of finance, media, and culture,” Robin Levine, a spokesperson for the city Office of Technology and Innovation, said in an emailed statement. “We are closely monitoring developing events in Ukraine and working closely with public and private partners to identify and mitigate any cyber threats to our city’s critical infrastructure and essential services.”
Along with unveiling the state’s new Joint Security Operations Center, Hochul announced funding to help the state and local governments prevent and respond to attacks, including any carried out by Russia or other foreign actors. The state will invest $62 million in cybersecurity, hiring 70 new cybersecurity professionals, along with a plan to put together another $30 million to help local governments invest in cybersecurity, she said.
“The best time to have done this would have been about five years ago,” Cappos said of the state’s new operations center and investments, noting that a plan to hire new cybersecurity staffers won’t necessarily prevent an attack from striking tomorrow. “But in some sense, it’s better late than never.”
As mounting tensions between Russia and Ukraine came to a head, Russia continued to wage its yearslong cyberoffensive against Ukraine. In addition to misinformation campaigns, Ukraine’s government and financial institutions have been targeted with denial-of-service attacks and data-destroying “wiper” attacks. The immediate damage of those attacks was in Ukraine, but attacks linked to Russia have targeted the United States before. The SolarWinds and Colonial Pipeline cyberattacks were two of the more prominent ones in recent history. And the devastating 2017 attack known as NotPetya targeted Ukraine computer systems but caused spillover financial damage in the United States and elsewhere; the United States later attributed that attack to the Russian government.
Some cybersecurity experts warned that the United States and Ukraine’s other allies should be on the lookout for new offensives if the Kremlin lashes out in response to sanctions the West placed on Russia.
James Lewis, a former diplomat and now director of the Strategic Technologies Program at the Center for Strategic and International Studies, said attacks originating from Russia have typically been carried out not directly by the Russian government but by hackers working with the government’s tacit approval. “It’s independent actors, but it’s independent actors who are operating with the blessing of the Kremlin,” Lewis said.
For these cybercriminals, the main motive for launching these kinds of attacks has been money, Lewis said. Last year, the federal government reported an increase of sophisticated ransomware attacks against a range of critical infrastructure sectors. But cyberattacks can also cause political and economic disruption that the Russian government has a shared interest in seeing. “If the sanctions start to hurt Putin, he’ll be tempted to do that,” Lewis said, when asked whether we might see the Kremlin more directly carry out cyberattacks on U.S. critical infrastructure and other targets, or direct independent actors to do so. Three of the state authorities that Hochul mentioned as potential targets – the MTA, the New York Power Authority and the Port Authority – either did not respond to emails from City & State or declined to comment when asked about what would make them vulnerable to Russian attacks. Neither public nor private institutions have much to gain from sharing details about their own vulnerabilities when it comes to cybercrime.
But what makes those assets attractive targets is clear. “They’re trying to target and hack things that will cause the maximum amount of disruption,” Cappos said of Russian hackers. Latimer, the Westchester County executive, said the risk of damage still exists at the local level. “Every government has certain assets that provide essential services, and if those essential services go down, it creates a major problem. The county runs an airport. The county runs a sewage treatment system. We’re not the only one that does,” Latimer said. “If a bad actor can figure out how to shut down one of those services or get into our financial system, they can cause tremendous havoc.”
Governments, private companies and other organizations wanting to bolster their defenses in the wake of warnings about increased threats can look to the federal government’s guidance, which included confirming incident response protocols, ensuring the use of tools like multifactor authentication and keeping software up to date. ■
New Yorkers are still facing the impacts of the pandemic on many fronts. 1.3 million New Yorkers are currently behind on payments for essential services like heat and electricity, collectively owing over $1.7 billion in overdue utility bills. And with the state’s pandemic-related moratorium on service terminations expiring, these New Yorkers face potential service termination. At the same time, New Yorkers are seeing their utility bills increase even higher, potentially exacerbating the problem. Join us for a City and State legislative forum sponsored by AARP New York where we will be speaking with state lawmakers about the utility arrears crisis, potential legislative solutions, and other important issues.
Join Us! March 11, 2022 10:00 AM - 11:00 AM
Scan Code to Register For Event
Lifting the lamp
New York is home to the largest Ukrainian population in the U.S., and the state is now preparing for the arrival of Ukrainians fleeing war.
By Sara Dorn
AMID THE RUSSIAN invasion of Ukraine, hundreds of thousands of people have fled in a matter of days for nearby European countries, and they’re expected to fan out around the globe if the crisis is not resolved. Ukrainian citizens who were in the U.S. temporarily on special visas when the invasion began on Feb. 24 are seeking an extension of their statuses to stay here longer.
It will likely be weeks, or even months, before Ukrainian refugees seek shelter in the U.S., experts said, but already local and state government leaders, along with a coalition of refugee aid organizations, are preparing for their arrival in New York.
“Just as the Statue of Liberty stands tall in our harbor, New York stands ready to welcome Ukrainian refugees,” Gov. Kathy Hochul said on Feb. 24. “We remain engaged with the Biden administration and we will be prepared to accept and support those who seek shelter in our state.”
New York City Mayor Eric Adams also called on the Biden administration to “use every tool at their disposal” to protect Ukrainians who are currently in the U.S., including DACA recipients and students, and aid Ukrainians abroad who seek refuge here.
New York City is home to the largest Ukrainian community in the U.S., with more than 150,000 Ukrainians living here. Ukrainian American community organizations, including nonprofit and religious leaders, have been fielding panicked calls from Ukrainians in the U.S. in recent days who are seeking information about how they can get their family members overseas safely to New York.
“As soon as the bombs started happening, we went right into our pre-planning notes about what to do during this time, and that was to immediately call for some kind of Temporary Protection Status for people who are here in this country,” Andrij Dobriansky, spokesperson for the Ukrainian Congress Committee of
– Andrij Dobriansky, Ukrainian Congress Committee of America spokesperson
Refugees wait for trains to Poland in Lviv, a city in western Ukraine.
America, told City & State.
New York City Council Member Inna Vernikov, who emigrated from Ukraine to the U.S. in 1996 at the age of 12, has also been working as an informational liaison for Ukrainians in New York who are concerned about their relatives overseas. She has been coordinating with refugee camps in Moldova and Chernivtsi, Ukraine, her hometown near the Romanian border, which she said has been spared of attacks. Refugee coordinators are “working 24/7, very hard to resettle (people), to get them food, shelter and medicine, or to get people to hospitals who need medical care,” she said.
Historically, New York takes in more refugees than most other states. As of March 2, 2,297 of the 76,000 Afghan refugees evacuated to the U.S. since troops withdrew in August have resettled in New York, according to the state Office of Temporary and Disability Assistance, which houses the New York State Enhanced Services to Refugees Program. The program was created in 2017 as a stopgap to federal funding cuts for refugee services made by then-President Donald Trump’s administration.
The agency coordinates with refugee assistance organizations that provide entrants with social services upon their arrival, including the International Institute of Buffalo. The institute coordinates resettlements with the U.S. State Department and connects refugees with services, such as English language learning and job placement as well as helping families navigate the school system and find housing.
“From a humanitarian perspective, I am very hopeful we won’t have a Ukrainian refugee population coming to the United States ... you want to hope a refugee population can return home. That’s always the ultimate hope,” Jenny Rizzo-Choi, interim executive director of the International Institute of Buffalo, told City & State, adding that she does not expect to see Ukrainian refugees in Buffalo “immediately” because evacuation efforts require extensive coordination with the United Nations. “Camps have to be set up for processing people. It usually takes one or two years for a population that has left its homeland to be processed and screened and ready for resettlement.”
Afghan refugees were evacuated and resettled much quicker in the U.S. due to the abruptness of the U.S. military exit and the unique responsibility the U.S. had to protect Afghan asylum-seekers who had been aiding U.S. military efforts for years and came under immediate threat from the Taliban when troops left. Many Afghans who came to the U.S. as part of Operation Allies Welcome are under temporary “parole” status that allows noncitizens under threat to come here immediately. Concerns have been raised that the U.S. is not approving enough applications for Afghan asylum-seekers. Among those whose applications have been approved, some have received employment authorization documents from the U.S. government that contain errors, delaying their delivery.
Hochul’s hometown of Buffalo, and other municipalities upstate, are a hub for refugee communities in New York, with significant populations of Congolese and Syrian refugees, in addition to Afghan refugees. Buffalo has taken in 497 Afghan refugees, second to Syracuse, where 522 Afghan refugees have resettled, officials said.
Anticipating the influx of Afghan refugees last year, Hochul increased the state’s refugee services budget from $3 million to $5 million in December. But funding was cut back to $2 million in this year’s proposed 2022-2023 budget, introduced by Hochul in January, and lawmakers and advocates who were pushing for an increase to the refugee funding before the Russian invasion said the war gave new significance to their request.
Assembly Member Jonathan Rivera was one of dozens of lawmakers who wrote to state Senate Majority Leader Andrea Stewart-Cousins and Assembly Speaker Carl Heastie on Feb. 17, urging an additional $4 million for refugee services. He said the war in Ukraine was “a moment to truly see in real time, on a planetwide stage, that there are people desperately in need. And what we can do in New York state to help them is this,” Rivera told City & State.
A spokesperson for Hochul said this year marked the first time the governor’s executive budget had included funding for the “enhanced services to refugees program,” adding that the Legislature “has the ability to add spending to the budget for this purpose, as they did in FY 2022, and we look forward to a discussion about this and other priorities in the days ahead,” Hochul spokesperson Avi Small said in a statement to City & State. ■
