Tempting target: state computer systems face nearly constant cyber attacks.

• Author: Weiss, Suzanne

[ILLUSTRATION OMITTED]

On the morning of April 30, 2009, state officials in Virginia were greeted with a nasty surprise: A ransom demand, posted on the website of the Department of Health Professions, for the return of more than 8 million patient records that included addresses, Social Security numbers and prescription drug information.

Hackers had broken into the website, bundled the data into an encrypted file and then deleted the original records. The ransom note demanded $10 million in exchange for the encrypted file and the password to unlock it.

State officials were tight-lipped about the incident, except to say that they wouldn't pay the ransom, the thieves hadn't managed to steal backup files and the FBI had been called in to investigate.

The breach was a particularly shocking reminder of the vulnerability of state governments to cyber attacks ranging from website defacement and interruption of online services to theft, extortion and terrorism.

"States hold the most comprehensive collection of personal information about individuals, spanning from birth to death," notes a recent report by the National Association of State Chief Information Officers. "They know where you work, what you earn, where you live, the taxes you pay, your date of birth, your Social Security number, your medical conditions."

And the collection, storage, sharing and use of people's personal information is certain to increase as states rely more and more on the Internet to better serve constituents and improve efficiency, the report said.

MILLIONS OF ATTACKS

The magnitude, frequency and sophistication of attacks on state government information systems are mind-boggling.

"There are millions of automated network probes every day, looking for cracks in the dam," says Doug Robinson, executive director of the chief information officers group.

In Michigan, for example, more than 75 percent of the 120 million e-mail messages the state received last year were either spam or viruses, said Dan Lohrmann, the state's chief technology officer.

"On an average day, we see probably 20,000 or 30,000 different entities scanning our networks, trying to break in," Lohrmann says. "These attacks are happening on a daily basis, and we have to constantly be ready for them."

Many computer hackers are motivated solely by a desire to make mischief, acquire restricted information or cripple certain sites. But many others are fulltime professionals, motivated by profit and increasingly connected to organized crime or government-bankrolled hacking rings in countries such as Russia, China, Brazil and Estonia. Profit-motivated attacks typically don't...