Columbus city departments were authorized to send employees home to work this week amid an ongoing technology outage caused by a cybersecurity incident , which has been persistent since last Thursday.
The city has authorized directors of departments to allow employees to work from home this week on a "case-by-case" basis, Melanie Crabill, spokesperson for Mayor Andrew Ginther, said. She said that the mayor's office is not tracking the number of employees not working in the office and they are not receiving daily updates if human resources is tracking that data.
"It's not as efficient as we'd like," Crabill said of the challenges caused by the outage.
Employees who are sent home to work will be paid, Crabill said.
Christopher Moses, director of city human services, said that employees are working from home "intermittently," with some city employees coming into to this office in the morning and leaving in the afternoon, or vice versa, depending on their responsibilities at work.
Since the city offices are without internet, workers in office are relying on Wi-Fi hotspots to work, which has posed challenges. He said the decisions are happening on a job-by-job basis depending on what they need to do.
"If they have to go home, then we're allowing that flexibility to get the job done," Moses said.
The city work from home policy is that office employees need to be in the offices five times a week. Moses said the city HR department isn't tracking how many people are working from home because it anticipates the problem to be short-term.
The Dispatch observed employees appearing to leave the city office complex located along Broad and Front Streets with their belongings early Friday morning.
The Dispatch has contacted directors of departments to as whether they were sending employees home to work. The auditor's office said office employees had not been sent home. The Recreation and Parks department spokesperson said she wasn't aware of any employees asked to go home.
Scott Messer, director of the Building and Zoning Department, said all employees were working from the office and that they had access to the system used to process permits, and the system is available on site. However, he said "director-by-director for their department," it may be easier for employees to access systems remotely due to the ongoing technology problems.
"I think if I had any systems whereby it was better for access, for people to work remotely, I would authorize that," Messer said.
City, services hobbled by outage caused by cybersecurity incident
The city of Columbus continues to grapple with a cyber service outage caused by a cybersecurity incident July 18, which forced the city to sever its internet connection, The Dispatch previously reported. The city has so far declined to say if the cybersecurity incident was a ransomware attack.
More: A week into cyber woes, Columbus mayor says city aims to get fully operational ASAP
Some city services have remained hindered throughout the week, including the 311 computer system and some web services — the city email system was still not functioning as of Friday, The Dispatch previously reported. Crabill said the city was hopeful email function could be restored as soon as Monday.
Residents can still call 911, the nonemergency police line and 311, although some reports may need to be taken by hand.
Ginther said Thursday that the city is prioritizing restoring its public safety, public health and public utility departments in the coming days.
On July 18, the city's Department of Technology "identified an abnormality" in its systems, The Dispatch previously reported. The department took "swift action" to "significantly" limit potential exposure by severing internet connectivity, Mayor Andrew Ginther said in a statement released Monday.
Ginther said in the statement that the city's cybersecurity woes may have been caused by a city employee opening a malicious email.
Cybersecurity expert: Outage could be result of ransomware attack
Alex Hamerstone, a cybersecurity expert at TrustedSec, an "ethical hacking" firm, told The Dispatch that while he doesn't have all of the evidence, guessing that this could be a ransomware attack on the city would be a smart bet.
"If you go outside, and you get wet, there's a few things that could be — but there's a 99% chance it's raining," Hamerstone said.
He said that malicious hackers target institutions like cities because they are sometimes easy targets and hold on to a large amount of customer data that can be used or sold.
"Thieves are going to go where they feel like they have easy access," Hamerstone said. "And oftentimes, cities just don't have the budget staff to kind of build out security programs."
If it were to be a ransomware attack, Hamerstone said, the city might not know yet or they may be being advised by legal counsel or law enforcement not to disclose that information to the public yet.
"They may be getting advice … to kind of keep their cards close to the vest, or they may just not know right now," Hamerstone said.
Cbehrens@dispatch.com
@Colebehr_report
This article originally appeared on The Columbus Dispatch: Columbus OKs sending city workers to work from home as cybersecurity outage persists
Local News
