5.2.1 Attacks, Incidents, and Breaches

With these definitions in mind, the survey asked if local governments catalogued or counted attacks, incidents, and breaches. Fewer than half (47 percent) said that they catalogued or counted attacks; followed by 58 percent that catalogued or counted incidents; and 60 percent that did so for breaches (Table 5.1). In terms of the method of cataloguing or counting, only 33 percent of local governments employed a formal system, while 41 percent used an informal system and 38 percent used no system at all (Table 5.2).

Next, the survey inquired about the frequency of attacks, incidents, and breaches (Table 5.3). Attacks occurred the most frequently: hourly or more – 28 percent; at least daily – 19 percent; less than daily – 24 percent. However, 29 percent said that they did not know how frequently their system was attacked. Earlier research found that local governments are under constant or near constant attack (Norris et al., 2018). It is possible, even likely that the 24 percent who responded that attacks occurred less than daily were not well informed of the frequency of attacks against their systems.

Findings from the 2020 survey suggest that attacks have become more frequent. More than half of the local governments reported that attacks were constant: 29 percent said hourly, and 14 percent said daily. None responded that they did not know how frequently they were being attacked.

As expected, the local governments in the 2016 survey reported that incidents occurred less frequently than attacks, and breaches occurred less frequently than incidents. Just over one-third of responding local governments did not know how frequently incidents occurred, and nearly two-thirds did not know how often their systems were breached. These data suggest that in 2016, at least, sizeable numbers of local government were guilty of cybersecurity malpractice. Not knowing if a government’s IT system has experienced an incident or breach is fundamental to proper cybersecurity.

All but one of the governments in the 2020 survey reported that they had experienced incidents. Only 7 percent said no incidents; 21 percent had experienced one incident; 14 percent – two incidents; 29 percent – four; and 21 percent more than five. Regarding breaches, half reported no breaches; 29 percent reported one breach; 7 percent reported having been breached twice; and 7 percent said more than three times.

The data, especially the “did not knows,” in the 2016 survey strongly suggest that at least some local governments were not practicing cybersecurity well. The situation improved in the 2020 survey, although the number of governments in that survey reporting multiple breaches in the past year is troublesome. The 2016 data also suggest that, despite providing a definition of the term breach in the instrument, some respondents apparently did not understand what constituted breach because nearly 8 percent said that their governments were breached at least daily.

When asked whether the frequency of attacks, incidents, and breaches had changed over the 12 months prior to the survey (Table 5.4), one-third of local governments reported that attacks remained about the same, four in ten said the same about incidents as did nearly half about breaches. Much smaller percentages said they had experienced fewer attacks – 7 percent; incidents – 13 percent; and breaches – 13 percent. One-third of respondents said that attacks had increased; fewer than one in five (18 percent) said incidents had increased; and very few (6 percent) said breaches had increased. Again, however, the number of local governments that did not know was not trivial: 25 percent for attacks; 27 percent for incidents; and 35 percent for breaches.

The responses in 2020, however, were clear that the frequency of attacks had increased in the past year with almost 93 percent saying so. Only 7 percent of local governments said that the frequency of attacks had remained about the same.

Next, the survey asked if respondents could determine the types of attackers during the previous year and the attackers’ motives. A clear majority said that they could not determine the types of attackers (Table 5.5). Of those who were able to determine the types of attackers, 50 percent said attackers included external actors-organizations, 43 percent said they included external actors-individuals, 21 percent said state actors, and 9 percent said malicious insiders (Table 5.6). By contrast, nearly two-thirds of respondents to the 2020 survey said that they could identify their attackers. When asked, respondents to the 2016 survey said that the top reasons for the attacks were: ransom, mischief, sensitive information, hacktivism, and theft of money (Table 5.7) These findings are consistent with the 2020 survey in which ransom, theft of money, and theft of PII were the top three attack purposes, and with a report by PNC released in 2018 (Kozlik, 2018).

5.2.2 Preparedness

To better understand how well local governments can defend their IT assets, the 2016 survey asked how prepared these governments felt they were to detect, prevent, and recover from several potential events that could adversely affect their systems, including incident and attack detection and recovery (Table 5.8). Only small percentages of local governments reported having a very good or excellent ability to do so, ranging from 48 percent with a very good or excellent ability to recover from ransomware attacks to 21 percent with a similar ability to detect exfiltration. As seen in Table 5.8, responses to the remainder of this question do not inspire confidence in these governments’ ability to withstand attacks, incidents, and breaches or to recover from them. Consistent with findings thus far in this chapter, once again it appears that local governments were not practicing high levels of cybersecurity.

The 2020 Survey

The 2020 survey was conducted to provide data for an exploratory study that employed a combination of convenience and expert sampling. A convenience sample is a method of sampling that includes participants because they were easily reached by the researchers (Battaglia, 2014). By contrast, an expert sample involves the selection if participants who are knowledgeable experts in the field of the survey, in this case local government cybersecurity (Patton, 2018). To gather data for this study, the author surveyed top IT and cybersecurity officials in 11 cities and three counties in the US (Table 5.A.3). Respondents to this survey included 11 CISOs, one CIO, and two ITDs. These officials, or key informants, all had considerable expertise, experience in and knowledge of the cybersecurity of their local governments, including their governments’ cybersecurity management, practices, risks, strengths, limitations, and problems. The use of knowledgeable key informants who are trained, experienced practitioner experts working as the top cybersecurity or IT officials for their local governments should mean that the data from the survey is both valid and reliable.

Second, the survey’s authors are confident of these results because the great majority of respondents (83.9 percent) were experienced, local government IT and cyber professionals, mostly CIOs, ITDs, and CISOs (Table 5.A.2). Thus, the men and women who responded to this survey were knowledgeable, expert local government practitioners who “knew their stuff.”

The principal strengths and limitations of this method are that it is simpler, easier, and less expensive than probability sampling, and therefore useful for studies like this. It also produces information from knowledgeable key informants, so the data should be both valid and reliable. The principal limitations of this type of research include that the results are not representative of a broader population and, therefore, cannot be generalized to that population. It is also prone to contain bias and sampling error. For exploratory studies, the strengths appear to outweigh the limitations of this research method.

The survey was conducted between mid-April and late August 2020. The initial plan was to conduct a combination of face-to-face and telephone interviews. However, because of the COVID-19 pandemic, conducting face-to-face interviews was unsafe. It was also clear that telephone interviews would not be feasible because of the difficulty finding the telephone numbers of IT and cybersecurity officials on many local government websites, the time pressure under which cybersecurity and IT officials across the nation were working during the pandemic, and a reluctance among such officials to respond to surveys (Norris et al., 2019). Hence, we used email only (see Norris et al., 2019).

Initially, emails were directed only to the then approximately 17 members of the Coalition of City CISOs (https://cityciso.org) that was established in the spring of 2019, and we are especially grateful for the coalition’s support for this survey. Indeed, most of the local governments that participated (at least nine) are members of the coalition. Two anonymous colleagues who were familiar with this research, one in a city government and one in a local government membership organization, volunteered to solicit responses from other local governments, and we thank them for their assistance as well. These efforts produced only five additional responses for a total of 14 responses, of which nine were from coalition members. See Table 5.A.4 for participating jurisdictions.

Population data from the 2019 Census estimates for counties and for cities and towns. Please note that the authors received explicit permission from the ten listed local governments to identify them by name.

Perhaps the most prominent reason for low response rates in this type of research is the concern among CISOs and other officials that revealing anything about their cybersecurity might put the local government at risk. Revealing too much might also be embarrassing. In this and previous research, more than one official has essentially replied: “Our policy is not to respond to such surveys.”

The refusal of local government cybersecurity and IT officials to participate in surveys and other types of research into their cybersecurity is unfortunate for at least three reasons. First, it deprives local governments across the nation of reliable information about the state of cybersecurity management and practice among their peers, which knowledge can benefit all local governments. Second, it deprives these governments with evidence-based recommendations to improve their management and practice of cybersecurity. And the third reason involves cybersecurity researchers, whose job it is to gather and make sense of the data that can influence local government cybersecurity management and practice. If researchers cannot gather the data, they cannot analyze it and provide results to local governments to help in their cybersecurity planning or to other scholars conducting similar research.

Beyond gathering and analyzing data and providing results to local governments, these scholars can also begin theorizing about aspects of local government cybersecurity management and practice, such as what are the factors or conditions that produce certain cybersecurity outcomes among local governments and why? However, without data from studies of various kinds about local government cybersecurity, such theorizing is not likely to occur.

Respondents were promised anonymity and confidentiality for their participation in the survey because they are essential elements for the conduct of research into sensitive topics. However, it is clear from this and other cybersecurity surveys, that this promise was not sufficient to produce higher response rates. For example, the 2016 survey achieved only an 11.9 percent response rate after several mailings and personal contact by telephone (Norris et al., 2019). In their 2018 nationwide survey of municipal government cybersecurity (based in part on Norris et al., 2019), Hatcher et al. achieved only a 7 percent response rate (2020).