County legislators convened at the William H. Rogers Legislature Building in Hauppauge on Monday, Dec. 5, announcing the formation of a bipartisan special committee to investigate the recent cyberattack against the county government.

A confirmed ransomware event was first reported in early September. [See story, “Suffolk County cyberattack offers a window into the dangers of the digital age,” Nov. 17, TBR News Media website.] The attack crippled the county’s IT infrastructure, shutting down the system for over a month, with systems slowly coming back online.

The county press release relating to the new committee indicated that, “Information regarding the effects of the attack continues to be made public, including the admission that the personal information of as many as 470,000 residents and 26,000 past and current employees has been stolen by the hackers.” 

Kevin McCaffrey (R-Lindenhurst), presiding officer of the county Legislature, announced the appointment of Legislator Anthony Piccirillo (R-Holtsville) as chair of the newly formed special committee. With these two legislators, the rest of the committee will comprise Minority Leader Jason Richberg (D-West Babylon), and Legislators Sarah Anker (D-Mount Sinai), Jim Mazzarella (R-Moriches) and Rob Trotta (R-Fort Salonga).

“The purpose of this committee is to do one thing and one thing only, and that is to find out what happened and how we can prevent that from happening again,” McCaffrey said.

The presiding officer described the impact felt by county officials and residents alike due to the cyber event. He stated that sensitive information of county employees was likely accessed, with many details still unknown.

“There’s been an impact on each and every one of our residents,” he said, adding, “Employees, including myself, have now found out that our Social Security numbers have been compromised. We need to make sure that this doesn’t happen again.”

‘The best disinfectant is sunlight, so we’re going to open the windows and let the sun in.’

— Anthony Piccirillo

Piccirillo outlined his priorities and intended goals as chair. He regarded the Legislature as a coequal branch of the county government with a constitutional obligation to conduct oversight activities. 

“We’re going to execute our constitutional duty of oversight,” he said. “We passed a procedural motion that we now have subpoena power to call witnesses under oath and bring them in if they refuse to come in.”

The committee chairman added, “I do expect full cooperation from anyone that we ask to come in, but we do have that tool in our toolbox, where if people start to refuse to speak to the Legislature then we can have them here under subpoena.”

Piccirillo maintained that openness and transparency would be necessary to restore government operations and public trust.

“The best disinfectant is sunlight, so we’re going to open the windows and let the sun in here to shine and make sure that we get the truth,” he said. “We’re going to follow the facts and conduct the thorough investigation that the residents of Suffolk County deserve.”

Richberg detailed the collective shock and disbelief experienced by county officials when reports first circulated of the cybersecurity breach. He said a proper diagnosis of the problems leading up to the attack would help thwart a similar scenario from unfolding.

“I think understanding and diagnosing the problem from the beginning and having a bipartisan approach to asking the questions in the sunlight … is really important,” the minority leader said. “Most importantly, we need full structures for us to move forward, so this doesn’t happen again and that we are appropriately protected from anything that could happen to us in the future.”

In an interview, Anker discussed the gravity of the moment and the importance of the government coordinating its response correctly. “I know we’re spending up to $12 million to address this, if not more,” she said. “We need to get all the experts in the field to address what we’re dealing with and how to best deal with it.”

Anker also addressed the criminal nature of this cyber intrusion and the need to grasp cybercrime trends and criminal culture online.

“The dark web, that’s where all of this stuff is happening,” the county legislator said. “It’s the Wild, Wild West of our times, and if we don’t address that in a more aggressive way, it’s going to ripple throughout our country.”

While the committee’s work is just getting underway, McCaffrey said the process will culminate in a report detailing its findings. “We expect to be able to roll this out and tell a good story about what happened from beginning to end,” he said.