SEPTEMBER 12, 2022
CITY COUNCIL REGULAR MEETING
ITEM 5.4
Grand Jury Report
Response
Summary
On June 20, 2022, the San Joaquin County Civil
Grand Jury published their 2021-2022 report
entitled “Cybersecurity: Local Defense Against a
Global Threat.”
The San Joaquin County Civil Grand Jury requests
the City of Lathrop City Council respond to the
Findings and Recommendations detailed in the
Report.
POSSIBLE RESPONSES TO GRAND JURY FINDINGS:
California Penal Code Section 933.05 requires City Council issue a response in writing to the Presiding Judge of the San Joaquin County Superior Court indicating whether the Council:
Option 1. Agrees; or
Option 2. Disagrees wholly or partially with the findings of the Grand Jury.
POSSIBLE RESPONSES TO GRAND JURY RECOMMENDATIONS:
California Penal Code Section 933.05 also requires City Council to respond to all recommendations contained in the Grand Jury report with one of the following:
Option 1. The recommendations have been implemented, with a summary regarding the implemented action.
Option 2. The recommendations have not yet been implemented, but will be implemented in the future, with a timeframe for implementation.
Option 3. The recommendations require further analysis, with an explanation and the scope and parameters of an analysis or study, and a timeframe for the matter to be prepared for discussion by the officer or head of the agency or department being investigated or reviewed, including the governing body of the public agency when applicable.
Option 4. The recommendations will not be implemented because it is not warranted or is not reasonable, with an explanation therefor.
Grand Jury Finding F3.1:
“The City of Lathrop does not employ multi-factor authentication universally, leaving City systems more vulnerable to the activities of bad actors.” Grand Jury Recommendation R3.1:
“By November 1, 2022, the Lathrop City Council, in conjunction with the City’s IT department, develop, adopt and implement a procedure for universal multi-factor authentication for access to City data.”
Proposed Council Response:
The City of Lathrop City Council agrees with Grand Jury Finding F3.1 and Recommendation R3.1 and multi-factor authentication security has been implemented and in effect since June of 2022.
Grand Jury Finding F3.2:
“The City of Lathrop provides an unsecured public Wi-Fi network. Misuse of this unsecured network could expose the City to liability risks.” Grand Jury Recommendation R3.2:
“By November 1, 2022, the Lathrop City Council, in conjunction with the City’s IT department, provide a secure public Wi-Fi network.”
Proposed Council Response:
The City of Lathrop City Council disagrees with Grand Jury Finding F3.2 and Recommend R3.2 because by definition, publicly available Wi-Fi is inherently “unsecured”, although this designation is a misnomer because it eludes to an idea that publicly available Wi-Fi can either be secured or unsecured, and that unsecured is less “safe” or more “risky” than secured. Neither are the case. An “unsecured network” only means that such Wi-Fi is publicly available for anyone to use. Wi-Fi networks, either secured or unsecured, cannot merge end-users between those networks. Secured and unsecured networks, and the end-users utilizing either, remain completely isolated from one another; it would be unfeasible for someone with access to only an unsecured Wi-Fi network to also have the ability to gain access to a separate, secured Wi-Fi network.
The commonly perpetuated idea of “risk” associated with the use of an unsecured Wi-Fi network incorrectly shapes such “risk” as something that happens upon an end-user regardless of their use of the unsecured Wi-Fi network, when in reality, risk can develop and potentially increases the more limited an end-user’s understanding of how their digital presence on the internet affects their vulnerability and security. End-users should be encouraged to utilize personal checks and balances to verify the Wi-Fi networks they choose to connect to are verifiable and reputable, that their presence on the internet is not made easily available to be tracked by others, and that they are visiting legitimate websites, in order to further maintain security of their personal data and information. (Proposed Council Response Continued):
Publicly available Wi-Fi is a critical asset to cities around the country. Publicly available Wi-Fi provides the public the opportunity to connect to critical and important information equitably and provides a consistent source of access to such information, promoting economic inclusion within the community. The City of Lathrop currently hosts an unsecured public Wi-Fi network entitled “City of Lathrop Guest Cloud 1” and endusers who connect to this network to access the internet must agree to the terms and conditions of its use, and which the public is only able to remain connected to for time increments of thirty (30) minute, between 7am and 7pm, seven (7) days per week.
Grand Jury Finding F3.3:
“The City of Lathrop does not have an approved Business Continuity Plan, rendering the City relatively unprepared to restore essential services in a disruptive event.” Grand Jury Recommendation R3.3:
“By January 1, 2023, the Lathrop City Council, in conjunction with the City’s IT department, develop, adopt and implement a Business Continuity Plan.” Proposed Council Response:
The City of Lathrop has an unwritten Business Continuity Plan but not a written one. The City of Lathrop City Council agrees with Grand Jury Finding F3.3 and Recommendation R3.3 and documentation is anticipated to be complete by January of 2023.
Grand Jury Finding F3.4:
“The City of Lathrop does not have a formal internal policy or procedure to address ransomware attacks. This absence of policy could cause confusion, delay and greater loss of security in the event of such an attack.” Grand Jury Recommendation R3.4:
“By November 1, 2022, the Lathrop City Council, in conjunction with the City’s IT department, develop, adopt and implement a formal internal policy and procedure for a ransomware attack.”
Proposed Council Response:
The City of Lathrop has an unwritten, internal procedure to address ransomware attacks and, in addition to such, has hired a consultant whom will assist the City in development and implementation of a formal written policy for procedures to address ransomware attacks. The City of Lathrop City Council agrees with Grand Jury Finding F3.4 and Recommendation R3.4 and anticipates documentation will be complete by January of 2023.
Grand Jury Finding F3.5:
“The City of Lathrop does not have an insurance policy covering financial losses from a cyberattack, possibly exposing City financial resources.” Grand Jury Recommendation R3.5:
“By January 1, 2023, the Lathrop City Council, in conjunction with the City’s IT department, obtain an insurance policy to mitigate fiscal impact resulting from cyberattack or other critical information system loss.” Proposed Council Response:
The City of Lathrop City Council partially agrees with Grand Jury Finding 3.5 and Recommendation 3.5 and would like to further clarify that staff confirmed that the City of Lathrop does in fact have Cybersecurity insurance coverage, and is currently in discussions with Risk Management to enhance said coverage.
Recommendation
Staff recommends City Council consider
acceptance of the Grand Jury Report and direct
the City Attorney to submit responses to the
Presiding Judge of the San Joaquin County
Superior Court to the Findings and the
Recommendations outlined in the Grand Jury
Report.