Bellone To End State Of Emergency In Wake Of Cyberattack: Document

HAUPPAUGE, NY — Suffolk County Executive Steve Bellone has decided to end the State of Emergency enacted in the wake of the cyberattack on the government's web-based systems, according to a letter obtained by Patch.

The Sept. 8, 2022, attack disrupted county government's online operations, forcing some sections, like the police department, to revert to paper, something that had not been in place since the 90s.

After an examination of the cyberattack in December 2022, Bellone said the hackers got into the county's web-based operations by first breaching the clerk's office where a vulnerability in the Log4j system was exploited. He blamed the lack of a centralized Information Technology Department and much-needed security updates as contributing factors.

In Wednesday's letter to Presiding Officer Legis. Kevin McCaffrey and Minority Leader Legis. Jason Richberg, Bellone said that he is "pleased to report that after much hard work the clerk's office is finally integrated with the county and their critical systems are modernized and technologically secure."

"Now that the significant issues in the clerk's office have been remedied by [Department of Internet Technology] in collaboration with clerk IT staff, I have made the decision to terminate the State of Emergency upon the close of business on Friday, Dec. 15," he wrote.

The move comes on the heels of his reportedly filing misconduct charges against the clerk's office's former IT administrator, Peter Schlussler, who has been out on administrative leave since December of last year following the release of the cyberattack's examination.

Bellone told Patch that there were "serious instances of misconduct and incompetence," noting the clerk's office was part of the cyberattack, according to the forensic evidence, adding, "We really have to learn."

"We have to make sure there's accountability," he said. "We have to make sure that we learned the lessons — we've done that. The emergency response was incredibly successful. At the end of the day, just 1.6 percent of our systems were impacted. We were able to restore all of our backups and we paid no ransom."

Corporations and governments all over the U.S. have been impacted by cyberattacks and have paid ransom, he said, adding, "In the successful response to this attack, I think there are lessons for people to learn from."

In his letter, Bellone says there were "multiple and serious issues of misconduct and incompetence that merit termination."

"Once again, I urge the Legislature to take action because accountability is the only way that such conduct will effectively be prevented in the future," he wrote.

Since Schlussler's leave and declaration of the State of Emergency, the Department of Information Technology has managed the clerk's IT network, and "with the full support of the new county clerk Vincent Puleo and the assistance of the clerk IT staff, DoIT was able to do a full assessment and develop a remediation plan for the clerk's network," his letter read.

"Included in that plan were a significant number of systems upgrades that had been neglected by the former clerk IT administrator for years and even decades," it continues.

The State of Emergency has continued "due to the large number of upgrades needed to the clerk's systems and the complexities associated with performing these updates," Bellone said, adding that [Information Technology] has finally upgraded "all the required technology and securely integrate the clerk's IT environment within the county."

"The final step in this process was the implementation of recently purchased technology to properly secure remote access for external title search users within the clerk's environment," he said.

He goes on to ask that the lawmakers adopt the common sense security legislation under consideration that would establish "a standard cybersecurity policy across the entire network enforced by trained cybersecurity professionals."

The office of Chief Information Security Officer to oversee the county's web-based systems should also remain in place, he said.

In his letter, Bellone also calls for Schlussler's termination.

Patch has made attempts to reach Schlussler, a member of the Suffolk Association of Municipal Employees' union

In a statement, the union's president, Daniel Levler said, "Our members, like everyone else, are entitled to due process and AME is committed to ensuring Mr. Schlussler is afforded those rights, along with legal representation to defeat these charges."

Patch has reached out to McCaffrey for comment.

In a statement, Richberg thanked Bellone and the county's Department of Information Technology team "for navigating us through the State of Emergency while continuing to maintain county services."

He also thanked county staff from various departments "who stepped up above and beyond their duties to make sure that residents and businesses were able to access county services and ensure assistance was still being provided, all while we were rebuilding much of our IT infrastructure and starting down the path of securing our networks."

"It has been a long, arduous process but our task force has made some important progress and I'm confident that we are heading in the right direction," he said. "I look forward to working with our new County Executive Ed Romaine to continue on our path."