Advertisement - Click to support our sponsors.

Legislature
learns costly Web
security lesson

The holiday weekend Web site
infiltration triggered a
$7,000 security upgrade

By Leila Fujimori
Star-Bulletin

The state Legislature's Web site was up and running yesterday afternoon, the first time since hackers caused state programmers to shut it down Memorial Day weekend.

But now, a protective firewall has been installed.

"They had no Web security," Detective Chris Duque said.

The Legislature's in-house computer technicians installed six new hard drives at a cost of $7,000.

The six old hard drives must be turned over to police for investigation.

"The damaged hard drive is really our evidence," Duque said. "Without that, we don't have a case."

Duque said he will examine the hard drives, which must remain untouched, to determine the source of attack and how the hackers gained entry, as well as the extent of damage to data.

'They had no Web security.'
Chris Duque
DETECTIVE

The hackers' attack altered the Web site's home page with profanity, and hackers left the logo of a Romanian hacking group called Pentaguard.

The Legislature may shut down its Web site on the Fourth of July weekend to foil any attack plans would-be hackers may have.

"Law enforcement had suggested it because cyber attacks tend to occur on long weekends," said House Clerk Patricia Mau-Shimizu.

She said the Senate president and House speaker will make the decision.

The measure is one of several being considered to protect the site, used by the public to research bill status, state statutes and obtaining the text of bills, said Senate Assistant Clerk Carol Taniguchi.

Getting the Web site up was also delayed with the installation of a new internal computer system, which is keeping the computer staff busy.

The new system developed by KPMG LLP, which replaces one installed in 1988, will be ready by the 2000 session, Mau-Shimizu said.

Duque says a lot of people are going through a learning phase. They often assume they won't get hit.

"It's not a matter of if, it's a matter of when," he says.

Duque shares the following precautions to take: "As soon as your system gets attacked, take the system down and preserve the data.

Sometimes systems administrators are told to get the system back up and running. But a lot of times, companies don't have resources to run a back-up system."

Although no statutes define hacking as criminal, Duque says the only remedy the victims have is to take the matter to civil court.

"The downside is if the person has no money or is outside the jurisdiction," he said.

State Legislature Web Site