Lowell City Hall was hit by a cyberattack this week. From an outside-the-building perspective, Lowell’s IT Department deserves our congratulations and thanks for fending it off. The attack was detected early Monday morning, long before the building was to open for the day. It’s unclear whether ransomware was involved or if it was some other method of attack, but it seems that the city’s early warning systems worked and alerted the IT department to the attempted incursion.
While the attack may have been blocked, it’s essential to ensure that it was fully stopped which is why certain city tech systems were or continue to be offline. A sophisticated cyberattack could be designed to make the defending IT team think they had stopped it while it surreptitiously embedded itself deep in the IT system where it would lurk until it was later unleashed after the defenses had been relaxed. At least that’s how I interpret the public notices posted on city’s website under “Status of City Networks.”
Because of the importance of this issue, I’ve included the full text of both city notices below.
The first update came on Tuesday, April 25, 2023:
Prior to the start of business on Monday, April 24, the City of Lowell's Management Information Systems Department (MIS) became aware of a network disruption impacting a variety of systems. As the day progressed, MIS determined that the best course of action was to segment and isolate systems in order to help troubleshoot them further. Servers, networks, phones, and other systems throughout the City became inaccessible as MIS focused on protecting the City's technology and data assets. 911, Fire and emergency phones were not impacted.
MIS has come to the conclusion that the City of Lowell has been subject to a cyber-related incident which likely began early Monday morning. MIS is coordinating with law enforcement and actively investigating the scope and severity of the issue. At this time there is no reason to believe that any of the City's data has been compromised.
MIS is following industry best practices and developing a response plan to address the issue and, out of an abundance of caution, will keep all systems offline while working diligently to secure and restore services safely. The City Manager and his team are actively monitoring the situation and will provide updated information as it becomes available through a variety of channels including the City's official website:
https://www.lowellma.gov/
and Facebook and Twitter pages.
Payments for Real Estate, Personal Property, Motor Vehicle Excise, Water Utility, Vital Records, Burial Permits, Cemetery Lot purchases, and other services are still being accepted through the City's online Invoice Cloud payment system. However, payments may not be immediately reflected against payments due online.
In the meantime, the public should expect delays when interacting with the City as we work towards recovery. Thank you.
Then there was this update posted on Thursday, April 27, 2023:
As of today, MIS successfully enabled telephone services at City Hall, and continues to work on doing so at other City sites. This continues to be an ongoing investigation with multiple state and federal agencies involved, who are helping us with forensic assessment of the cyber-related incident.
As of yesterday, there were no further notices. Also, there is no City Council agenda or packet for this coming Tuesday’s meeting which City Manager Tom Golden had said would likely be the case.
Just a week before the Lowell attack, Point32Health, the parent company of the newly merged Harvard Pilgrim Health Care and Tufts Health Plan, also faced a cyberattack. Although it’s unclear how successful that attack was, it has caused a severe and ongoing disruption in Harvard Pilgrim’s network. According to a recent Boston Globe story, problems continue with payments to medical providers, authorizations for treatment, and many other routine but critical functions.
As more and more of our lives go online, cybercrime will continue to grow. Maintaining good IT hygiene is critical for individuals and organizations, but no defenses are foolproof, so how to recover from such an attack must become an important part of everyone’s standard operating procedures. But when an attack does occur, even if it’s stopped, we must be prepared for temporary outages and inconveniences. It’s the virtual equivalent of a blizzard or ice storm.
****
Regarding last Tuesday’s City Council meeting, two motions taken up early gave a dramatic reminder of the continued friction that exists within the city’s Cambodian community due to events in Cambodia.
The first was a joint motion by Mayor Sokhary Chau and Councilor Paul Yem requesting the City Manager “have the Law Department provide a report regarding the establishment of a sister city agreement between Lowell and Phnom Penh, Cambodia, referencing an MOU signed January 14, 2015.”
The second was a motion by Mayor Chau “requesting the City Manager or the appropriate department begin the process to establish a sister city agreement between Lowell and Battambang, Cambodia.”
Because several people had registered to speak on these motions, the Council, as it routinely does, suspended the rules to take up the two at the start of the meeting. However, after the rules were suspended but before either motion was officially “read” by the Mayor, Council Yem gained the floor and made a statement. He said that his objective on the Council has been to bring all residents together but based on feedback he had received since the filing of the Phnom Penh sister city motion, he realized that the motion would have the opposite effect. In response, he withdrew his support for the joint motion he and Mayor Chau had filed.
Yem’s action was important procedurally, because a jointly filed motion need not be seconded for it to proceed. That meant that the Phnom Penh motion, as well as the Battambang motion, which was filed by Mayor Chau individually, both had to be seconded before they could be considered by Councilors.
When Mayor Chau formally read the first motion and asked for it to be seconded, no Councilor did, so in procedural parlance, the motion died for lack of a second. The same thing happened with the second motion. Consequently, neither motion could be acted upon or even discussed by the Council.
However, Councilor Vesna Nuon gained the floor and moved that the rules be suspended to give people who had registered to speak on these two motions an opportunity to be heard since they had come to City Hall and were in attendance. The Council assented to that request.
Ten individuals, including current School Committee member Susie Chhoun and former City Councilor Rithy Uong, spoke very passionately in opposition to any type of Sister City relationship with Cambodia. Their basic message was that the current regime in Cambodia is corrupt and anti-democratic and that any expression of cordial relations between Lowell and any cities in Cambodia at this point would ratify the behavior of the government and would be used to discredit the opposition.
Among the speakers was Yun-Ju Choi, the executive director of the Coalition for a Better Acre. She explained that she had been part of a delegation from Lowell that had visited Cambodia in 2015. At the time, she was excited about the opportunity to learn more about the county of origin of so many Lowell residents, but in retrospect she realized that the official visit by the Lowell delegation was a propaganda coup for the Cambodian regime and that she regretted having gone. She said that she had just spoken with current State Representative Rodney Elliott, who as Mayor of Lowell in 2015, had led that trip. Elliott said that he was tied up at the State House so could not attend the Council meeting but authorized Yun-Ju to convey that he also regretted making that visit. (Councilor Rita Mercier who was also part of that delegation spoke up in disagreement saying they had helped free some women activists from prison and for that reason did not regret going).
This reference to a 2015 visit to Cambodia by a Lowell delegation gave some context to the Chau/Yem motion’s mention of memorandum of understanding (MOU) signed on January 14, 2015.
If you Google “Lowell Phnom Penh MOU 2015” the first thing that appears is a story dated January 15, 2015, on the website of The Cambodia Daily titled “Phnom Penh, Lowell Enter ‘Sister City’ Relationship.” The story was illustrated with a photo of Mayor Elliott and Phnom Penh governor Pa Socheatvong who said the Sister City agreement would boost tourism to Phnom Penh and would improve cooperation on commercial and economic matters between the two cities. The story went on to say that Mayor Elliott had met with Kem Sokha, the vice president of the opposition Cambodia National Rescue Party and was scheduled to meet with King Norodom Sihamoni and Prime Minister Hun Sen before returning to Lowell.
To update that 2015 story, it’s my understanding that The Cambodia Daily was an English-language newspaper based in Phnom Penh that was founded in 1993 with the goal of promoting democracy and press freedom in Cambodia. The pursuit of that mission caused the paper to run afoul of those in power and in 2017, two years after the Lowell delegation’s visit, the government accused the newspaper of owing substantial back taxes which the newspaper denied. Nevertheless, the government forced The Cambodia Daily to close.
It’s also my understanding that two years after the Lowell delegation met with opposition leader Kem Sokha, he was arrested and imprisoned by the Cambodian government for treason. More than a year later, he was released on bail, placed under house arrest, and was/is prohibited from leaving the country or engaging in politics.
As for Hun Sen, he continues to be Prime Minister of Cambodia, an office he has held since 1998. Back in March 2016, his son, Hun Manet, a general in the Cambodian Army, had been invited by then Mayor Ed Kennedy to visit Lowell. This set off a furor within the Cambodian community in Lowell and resulted in one of the more memorable City Council meetings in my memory. That meeting occurred on March 29, 2016. Back then, I was transcribing council meetings in real time. My report on that meeting is available online with the portion about Hun Manet beginning in the fourth paragraph. (After nearly two dozen people spoke in opposition, the City Council revoked the invite.)
To put some of what was said that evening in context, a few days later I wrote a blog post on the history of Cambodia. I’ve reposted that essay this weekend.
Getting back to Tuesday night, several Councilors also spoke. Kim Scott suggested the city develop protocols that would prevent the establishment of any sister city relationship with “any country that does not respect the rule of law and hold free and fair elections.” (Not to be snarky, but to millions of Americans, that would exclude sister city relations with any city in the United States, but that’s another matter.)
Councilor Vesna Nuon also spoke. He said that the remarks by some of the speakers touched him deeply, saying about his own escape from the Killing Fields, “even though it happened 40 years ago, it doesn’t go away.” He added that he hoped one day Lowell could have a sister city relationship with cities in Cambodia, “but not now in view of the current situation.”
Mayor Chau had the last word. He was dignified but unapologetic. He said he had envisioned bringing young people from Cambodia to Lowell to study in our schools so that they would return to Cambodia and help create positive change from the bottom up. He obliquely suggested that some who opposed this were not from Lowell and said many Cambodians in Lowell supported this proposal. Nevertheless, he did not want to be divisive and accepted the City Council’s handling of the motions.
****
Another motion taken up early in the meeting was by Councilor Corey Robinson that asked for a “report on the feasibility of implementing a No Overnight Camping, Sleeping, or Loitering ordinance in our business districts, as well as in the Summer Street, Gallagher Terminal, and South Common area.”
Most of those who spoke opposed this proposal, saying in essence that the people who were sleeping outside had enough problems so the city shouldn’t add to their hardships by depriving them of a place to sleep.
Among the members of the public who spoke were the owners of the Purple Carrot and of Warp & Weft, two downtown eating establishments. From other contexts, I’m confident stating that both people are (1) passionate about Lowell and (2) progressive in their politics and philosophies of life. That said, both clearly indicated that the actions of certain individuals who frequent the downtown are so disruptive to their businesses that their continued survival as businesses is at risk. Both emphasized that this is not a homelessness issue, but a vagrancy issue that the law, as it stands now, cannot deal with.
Maura Fitzpatrick the city’s Director of Homeless Initiatives said, “the system is broken.” She explained that people with drug or mental health issues are taken to the emergency room where they are triaged and treated and then discharged to the street where the same problematic behavior immediately resumes. She described how they just cycle through the system because the rules, procedures, and resources currently in place are inadequate to address the problem.
Societally, we lack a clear strategy for how to deal with this issue. Sure, there are already rules against being in a city park overnight and yes, the police can arrest people who violate that, but what happens next? They get brought to court on charges that are not jailable offenses, so defendants are immediately released back to the street. The courts and the correctional system are certainly part of the solution, but they are not THE solution, and those with a “just lock them up” mentality ignore decades of abusive policies targeting the poor and minorities. I do think more housing targeted at those most in need is a big part of the solution. But it will take much more than that.
In the end, I believe the Council referred the motion to the Law Department for a report on the current state of the law regarding what type of measures addressing vagrancy are permitted.
****
Besides the three motions that were taken up early, the Council got through most of its agenda including 16 motion responses before 10 pm arrived. Because of the continued remediation efforts resulting from the cyberattack, City Manager Tom Golden said it was doubtful that a “motion packet” could be created by Friday afternoon in time for next Tuesday’s Council meeting. Implied in that was a suggestion that Councilors not file any new motions right now because of the ongoing technical difficulties. Picking up on that, Councilors decided to continue the seven motions not reached last Tuesday to the next meeting since the agenda for that evening would be light because of the cyberattack.
****
Shifting to Beacon Hill, Governor Maura Healey made news this week when, in keeping with the tradition that the new governor install a portrait of a predecessor in the Governor’s office, Healey unveiled a blank picture frame. To help her make a choice, Healey had invited students from across the state to submit essays with their suggestions. A collaborative essay by two high school students from western Massachusetts argued that an empty frame would represent all of those “not represented or heard or reflected in the halls of power.” This resonated with Healey who implemented it.
While some traditionalists may have grumbled, Healey’s selection passed without much notice in marked contrast to what happened in Lowell nine years ago when outgoing Mayor Patrick Murphy chose an unconventional pose for his traditional mayoral portrait.
Since the city received its charter in 1836, mayors have posed for a portrait in the traditional head and shoulders facing the viewer pose. The daring ones dipped down to the waist or even mid-thigh for the bottom edge of the image, but all were attired in traditional business dress. Most of the portraits are paintings although some color photographs worked their way into the procession.
Murphy departed from the norm by selecting a black and white color photograph of him and his spouse with their young child between them, all holding hands, and all with their backs to the camera. The setting was a leafy path in South Lowell, where Murphy resided.
The furor this set off among reactionaries in Lowell could have been measured on the Richter scale. Councilors asked their Rules Subcommittee to establish guidelines for Mayoral portraits. Here’s my report on the January 28, 2014, City Council meeting at which the portrait matter was discussed, and here’s a letter that Murphy sent to his colleagues explaining why he posed for his portrait as he did.
The portrait itself can be seen here.
As for Governor Healey’s rationale for the blank picture frame, I agree with it wholeheartedly. It is past time for us to highlight those who history has tried so hard to erase.
****
If you’re reading this early on Sunday, you can still make today’s tour of Lowell Cemetery which begins at 10am at the Lawrence Street Gate. The tour will last 90 minutes and will take place in light to moderate rain, but not if there’s a downpour or thunder. Yesterday’s tour drew 216 people. Thanks to all who attended.
Thanks for this excellent and very through report. And congratulations on yesterday's fine turnout for the Lowell Cemetery Tour. I might add that Paul Marion gave a very engaging poetry reading yesterday at the Pollard Memorial Library as part of the Moses Greeley Parker speaker series. A good Saturday in Lowell.