Ultimately 911 is critical infrastructure, “and that’s what makes it a possible target,” said Jay English, director of Communications Center and 911 Services at APCO International. While 911 has for years been a “closed loop,” virtually self-contained and therefore highly secure, “it is still public telephony, public switched networks, and we know there are potential vectors by which bad guys can get to those 911 trunks.”
The potential for damage is significant, Puff said. A hacker intercepting 911 calls could glean names and addresses, maybe personal data about police officers and judges. The location of emergency command centers or the activities of first responders could be disclosed, which could be used as compromising information, depending on the type of emergency.
Puff takes it back to Riggs’ double-punch scenario. “You could set off an explosive device and then if you know in advance where the command center is going to be set up, you can plant another device there and potentially do real harm to law enforcement,” he said.
How will the hackers get in?
There are the usual ways. Someone will leave a password taped inside a desk drawer or lose a laptop.
Ghosemajumder described the current preferred method as an “attack of opportunity.” There’s no flawless network out there, no seamless system. Today’s opportunists scan systems constantly — any systems — in search of the commonest gaps. Statistically, if they scan enough systems, they’ll eventually find one with a flaw.
Once they’re in, the sky’s the limit. An intruder can easily pilfer user names and passwords, opening up all the information contained in the system. Depending on the level of access the hacker has tapped into, he or she can issue commands as an administrator. Such access could give an attacker total control over the emergency apparatus.
It’s not all doom and gloom though. For many emergency managers, an ironic touch here will come in knowing that the perpetual budget shortfalls against which they’ve struggled for so long, now may be saving their bacon.
Vulnerability here comes via the Internet, and widespread Internet connectivity is only a product of the additional management tools and telephone systems. In many cases, the legacy systems you’ve been too broke to replace are probably far less susceptible to attack. Hardly a resounding win, but some comfort nonetheless.
Another safeguard: Don’t assume that connectivity is always a necessity. While it often helps to have an Internet backbone joining systems together, “you need to ensure that every system that doesn’t need to be connected to the Internet is not connected to the Internet,” Ghosemajumder said.
It helps to have redundancy (think of McBride’s ham radio operators) and training is essential. “People need to know not to use their Gmail password on mission-critical systems. If they’re not given proper training, the odds are that a lot of them will,” Ghosemajumder said.
In any case, there’s no one right way to safeguard emergency systems against cyberattack. “It has to be a holistic approach,” Puff said. “You can’t just say, ‘We will train people.’ And you can’t just say, ‘We will buy firewalls and great security services.’ Those things are all good, but you need to look at the big picture, rather than one specific thing or another.”
Whatever approach one takes, the prospect of a cyberattack on emergency management is one that must be faced. “If it hasn’t happened yet, it’s coming. It has to,” Puff said. “If there’s a data network, if there’s information that people will find valuable or useful, some attempt will clearly happen at some point. It’s just the law of averages.”