A city outside San Francisco shut off its entire computer network on Friday and has been running its emergency dispatch through the county ever since, after malicious software got inside the systems that route 911 calls.

Suisun City’s council declared a state of emergency at a special meeting at 11 a.m. Saturday, after malicious software infected and compromised the city’s information technology systems at roughly 5:45 a.m. Friday, August 7. The declaration, made under California Government Code 8630, lets the city tap emergency support services quickly and recover the costs it incurs from the incident. The council vote was unanimous. The emergency remains in effect.

The attack hit critical public safety operations — 911 routing, police and fire dispatch, records and other city services. To contain the threat and preserve evidence for a federal investigation, the city took its entire network offline.

Police officers and firefighters have continued responding to emergencies throughout. Suisun City dispatchers are handling calls through the Solano County dispatch center, and officials said there is no imminent threat to the public. The city has about 30,000 residents and sits roughly 45 miles from San Francisco.

The city activated its Emergency Operations Center and is working with federal and state agencies, including the FBI and the Department of Homeland Security, on the investigation. California’s emergency services office is also involved in the investigation and in restoring the systems.

The pattern it fits

This is not an isolated incident, and the wider context is what should concern anyone running a business that depends on public infrastructure. Federal investigators were already on alert after water systems in at least 12 states were targeted. In some cases the attacks disrupted utilities’ ability to remotely monitor and control their systems, forcing operators to switch to manual control. Hackers also gained remote access to equipment including pumps, valves and water-pressure controls. Investigators suspect Iran-backed hackers may be responsible, though the U.S. government has not formally attributed the attacks.

That suspicion sits against the backdrop of a conflict that began in late February and has since spread well past the Persian Gulf. Municipal networks are a soft target by design — they were built for service delivery, not for defense, and the smallest jurisdictions have the thinnest security staffing.

Bipartisan lawmakers have been pressing for more funding and staff for the Cybersecurity and Infrastructure Security Agency, the federal body that coordinates between agencies, local governments and private operators of essential infrastructure, after cyber incidents affecting water utilities in at least seven states.

What it costs a business

For companies in an affected jurisdiction, the practical exposure runs in three directions.

The first is operational. A city that pulls its network offline stops issuing permits, processing payments, running inspections and answering business licensing questions. Construction schedules slip. Closings get delayed. There is rarely a published timeline for restoration, because the city itself does not know one until forensics finish.

The second is the emergency response itself. Suisun City’s fallback worked — the county absorbed the dispatch load and crews stayed on the street. Not every municipality has a neighboring dispatch center sized to take over. Any business with a physical location should know, in advance, whether its local 911 system has that kind of backup, and what the alternate contact procedure is if it does not. It is a ten-minute question to your local fire department and worth asking before you need the answer.

The third is the lesson from the response. Suisun City did the right thing and did it fast: shut the whole network down rather than trying to isolate the infected portion, and preserve the evidence rather than rushing to restore. That decision costs days of downtime and is almost always correct. Businesses that try to keep operating through an active intrusion routinely lose both the data and the ability to trace what happened.

The declaration mechanism is worth noting as well. California requires the emergency declaration in order for a city to access support services and recoup incident costs. Private companies have an analogous requirement in their cyber insurance policies — notification windows measured in hours, not days, and coverage that can be voided by delay. Most owners discover the terms during the incident. The time to read them is now.

The investigation is ongoing, and the city has released no information on who was behind the intrusion or what was taken. What is already clear is that a town of 30,000 people spent a weekend with its emergency communications running out of a neighboring county’s building — and that a growing number of American municipalities are one bad Friday morning away from the same position.

JBizNews Desk | Suisun City

© JBizNews.com All Rights Reserved. Reproduction or distribution without written permission is prohibited.