Hacked CCTV cameras in DC before inauguration leave unanswered questions

Threat actors hacked CCTV cameras in Washington, D.C., before the presidential inauguration, but questions remain about the intent of the attack and the overall impact.

D.C. police first noticed issues with four cameras on Jan. 12 -- eight days before the inauguration -- and reported the problem to the Office of the Chief Technology Officer (OCTO). Officials told The Washington Post that ransomware had shut down 123 cameras in the city's network of 187 CCTV recorders. The hacked CCTV cameras were unavailable until Jan. 15.

Archana Vemulapalli, CTO for Washington, D.C., said the city did not pay ransom. Instead, OCTO workers went to each site -- which held as many as four cameras each -- and remediated the issue by taking the devices offline, removing all software and restarting the systems.

Vemulapalli told The Washington Post the attack was confined to the CCTV system and Brian Ebert, a Secret Service official, said the safety of the public was never in jeopardy.

There are still key questions left unanswered about this ransomware attack. The hacked CCTV cameras were said to cover public spaces around D.C., but it is unclear whether those were cameras used for traffic monitoring or cameras used for other surveillance reasons. The purposes of the cameras involved could be important because it is also unclear if the recorded data from the hacked CCTV cameras was exfiltrated or lost when resetting the systems.

Officials have declined to state how attackers were able to introduce the ransomware or if the ransomware directly affected operation of the hacked CCTV cameras or the systems that controlled them. It is also unknown how the CCTV sites are networked. And, Vemulapalli has not offered any potential motive for the attacks.

OCTO, the U.S. Secret Service and the Washington, D.C., Police Department did not respond to requests for comment at the time of this post.