Emergency declared as Hayward cyberattack impedes dispatch

HAYWARD — The Hayward City Council declared a local emergency Thursday over an ongoing cyberattack, in an effort to more quickly acquire resources to respond to what officials have described as intruders trying to hold municipal computer systems and networks hostage.

The attack has gripped the city since it was discovered Sunday — affecting an array of services from emergency dispatching to electronic payments to library check-out systems — and left officials without an answer for when the disruption will be fully resolved.

“We’re still trying to assess that at this point,” Hayward City Manager Kelly McAdoo told the council, adding that some services such as the city website have been restored while others remain offline. “Our priority is ensuring public safety services are restored to the extent that those need to be.”

McAdoo said the city’s 911 dispatch center has “had to pivot the most in this emergency” while it continues to answer calls and help police officers and firefighters respond in a timely manner.

The city manager declined to elaborate on how the center was affected, but the city’s mayor, Mark Salinas, suggested at the meeting that emergency dispatch communications had been knocked down to an “old-school” mode of operation in which public safety personnel kept track of calls for service and location and other information using “pen and paper.”

Hayward will remain under a local emergency indefinitely. Officials said the designation allows the city to respond more flexibly to the cyber crisis by suspending certain rules and regulations to obtain equipment and protect city staff, residents and property.

In what’s become a familiar refrain this week, Chuck Finnie, a city spokesperson, said no evidence has yet been found of a breach or theft of confidential or private personal information of current or former city employees, residents or other members of the public. If such evidence is found, the city will contact those affected directly, he said.

The cyberattack was detected before sunrise Sunday, Finnie said, adding that intruders managed to penetrate city defenses “but weren’t in there for very long.” He said the city continues to evaluate the ransomware “infection.”

“We assume that they don’t just get in, get caught and go away,” Finnie said.

He declined to comment on the people who may be responsible for the attack or whether hackers have presented any demands for payment to the city.

The attack has also caused disruptions to the city’s electronic permitting and payment services. The online portal to submit permit applications for development projects, pay fees and schedule inspections remained offline Friday; the permit center at City Hall has temporarily expanded its hours in the meantime. And Finnie said public-facing electronic payment systems have also been interrupted, such as the city’s bill-payment kiosks at City Hall. Finnie said grace periods are being offered to those burdened by system disruptions.

Hayward is the latest East Bay city to be hit by a ransomware attack this year, following a February attack against Oakland that resulted in the exposure of sensitive personal data stored by the city and a class-action lawsuit by employees. And experts say local governments can be particularly vulnerable to attacks.

Local governments “don’t pay enough attention to security,” said Levent Ertaul, a Cal State East Bay professor who specializes in cybersecurity issues and chairs the computer science department, speaking generally. “Their systems are not up to date, and they don’t have, maybe, enough budget to update the systems.”

In Hayward, the attack shows emergency dispatch systems can be disrupted, potentially exposing police officers, firefighters and the public to added risk. Salinas, the city’s mayor, said in an interview some emergency communication systems were compromised amid the cyber intrusion.

A review of police and fire dispatch transmissions by Bay Area News Group showed disruptions being reported by emergency personnel in the early morning hours Sunday, including the failure of the city’s computer-aided dispatch system, or CAD; problems with officers’ mobile car computers; and the inability to run vehicle license plates for associated information.

“All systems have gone down,” a dispatcher alerted city firefighters sometime between 5:30 and 6 a.m. Sunday, according to transmissions archived by Broadcastify.

The full scope of the disruption on dispatching services has remained unclear. City officials have repeatedly declined to comment on police and fire operations in the wake of the cyberattack, only stressing that 911 dispatching services and police and firefighter response times have been maintained.

Scott Zuschin, a private investigator who served as a law enforcement officer in California for 20 years before retiring from the Chico Police Department in 2018, said CAD systems can automate many call-taking tasks, keep track of officers in the field using GPS and serve as an electronic filing cabinet for such information as address history and warrant information. CAD systems can also be used to access DMV records and the National Crime Information Center, a federal index that stores information about a person’s criminal record history, stolen property, missing people and fugitives.