OK, this might be nothing. Might be something. But it’s, at least, a little odd. Details of a hacked Pennsylvania Department of Health website are being closely held by the Wolf administration and raising questions at a time of worldwide jitters over cybersecurity.
Republican lawmakers have asked the state attorney general to investigate. And the incident has stirred ongoing concerns over backlogs in meeting citizen requests for birth and death certificates.
A mixed bag, I know. What the hack’s going on?
Well, the Associated Press reports that somebody got into the Health Department’s vital statistics website, prompting a six-day shutdown last month to search for data breaches.
State says none were found. “No records were viewed, altered, created or deleted,” according to Office of Administration spokesperson Dan Egan.
What caught my eye in the AP reporting was the state’s initial response to questions about potential hacking: the system had merely been taken offline for “emergency maintenance due to performance issues.”
But the next day came an admission that law enforcement was involved because of an unauthorized entry to the site. Someone made “cosmetic modifications.”
Eagan declined to discuss details with me other than to say, “We’re working with law enforcement;” and later, by email, “The activity was traced to a computer in India.”
Great, so now it’s an international case? Or we were pranked by a bored call-center worker?
At any rate, turns out the “cosmetic” modification was the type of modification unruly juveniles used to make to a neighbor’s front stoop with a flaming bag of dog poop. Not pretty, definitely jejune and more than a bit embarrassing.
“My understanding is the phrase `Department of Health’ was changed to something else,” State Rep. John Lawrence (R., Chester), told WHYY, “I don’t think you can print the word.”
Separate sources familiar with the event say “Department of Health” was changed to “Department of A—holes.” The intruder did not use dashes.
Now, many of us, at some point, likely feel the need to refer to some government agency as some version of that. But you can see how state officials might object to having it on a government website.
And just the fact that a hack took place riled GOP lawmakers. Republican heads of four House committees that oversee programs often dealing with vital statistics – Health, Commerce, Labor and Industry, and Transportation – fired off a letter to state Attorney General Josh Shapiro seeking a “full independent investigation to ensure there was not a breach of Pennsylvanians’ vital personal information.”
Again, the administration claims there was not.
But House GOP spokesperson Stephen Miskin says the administration never informed the public of the hack, told two versions of its system shutdown (first maintenance, then unauthorized entry), “and now wants us all to believe them when they say nothing nefarious happened.”
Philadelphia Republican Rep. John Taylor, Transportation Committee chair, one of the Shapiro letter-signers, says, “If there’s something going on there we should know about it.”
A statement from Shapiro’s office says talks with the administration are underway “to determine what occurred and to determine appropriate next steps.”
This all swirls amid angst over long delays in getting copies of birth and death certificates due to chronic backlogs, an issue of growing concern since federally-required REAL ID is to take effect October 2020.
(Taylor teases that whoever was tech-savvy enough to rename the agency should maybe be tasked with ending its backlog.)
The legislature and the department are pressing for improvements. The House recently passed legislation sponsored by Rep. Lawrence to overhaul the process of issuing birth certificates. The bill sits in the Senate.
So, even if the hack is no big deal (disgruntled employee or contractor?), it comes at a time the department doesn’t need distractions.
REAL ID driver’s licenses will be necessary for most people to fly commercially or enter a secure federal facility. One requirement to get such a license is an original or certified copy of a birth certificate.
And if the Health Department isn’t cranking those babies out as needed, it might just earn “cosmetic modifications” to its name – on a lot more websites than its own.