Suffolk's continued states of emergency getting pushback, months after cyberattack

Three months after declaring “Suffolk County is back online," Suffolk County Executive Steve Bellone has issued a ninth emergency declaration tied to the September ransomware attack, prompting legislative action to end the practice.

Bellone’s office on Tuesday confirmed it issued another emergency declaration on May 9, nine months after cyber hackers encrypted county networks and demanded a ransom of $2.5 million.

The state of emergency allows Bellone to issue no-bid contracts and hire personnel without the endorsement of the Suffolk County Legislature. 

Bellone, at a press briefing this year in which he declared most systems restored and the county's website back up, disclosed that the ransom had been reduced to $650,000 in a final offer by hackers in October. The county rejected the lower offer and spent months restoring infected systems.

On Tuesday, in response to Newsday questions, a Suffolk County spokeswoman blamed the continuing state of emergency on upgrades needed at the county clerk’s office, among others. The spokeswoman again singled out the clerk’s information technology director, Peter Schlussler, whom Bellone suspended with pay in December using emergency powers.

The union representing Schlussler pushed back at the adminstration’s blaming the IT director for the state of emergency.

"This is not the first time that a larger crisis has led to finger pointing and it certainly won't be the last,” Daniel Levler, president of the Suffolk AME, said in a statement. “It's irresponsible for anyone to jump to conclusions while an ongoing investigation just commenced to determine the facts in this matter. We fully support all of our members' rights to due process and that includes all of our IT professionals."

Schlussler has prepared a 157-page report largely refuting Bellone’s assertions during press briefings since December. Schlussler asserts Bellone’s IT department missed months of red-flag alerts of cyber intrusions, including one from the FBI warning of an active ransomware attack in Suffolk months before the attack.

Bellone's office said the clerk's IT director found "no issues with their systems" at the time. 

On Tuesday, Newsday reported that a scan of storage and network systems in district attorney and police department devices found more than 600 instances of malware that may have been on systems for years.

Schlussler on Wednesday declined to comment, saying he would await an analysis that former U.S. Attorney Richard Donoghue is conducting for a special legislative committee.

Schlussler has met voluntarily with Donoghue and is expected to be a witness at public hearings as soon as next month.

Schlussler and then-Suffolk County Clerk Judith Pascale, a Republican, had sent emails citing the urgent need for a hardware firewall for the clerk’s office.

The Suffolk information technology commissioner declined the requests, saying officials had “not demonstrated an appropriate justification to support this purchase.” Instead, the commissioner offered a less costly virtual firewall, which is in place. 

Bellone has said those requests would not have mattered because hackers had been in Suffolk's systems for months.

On Tuesday, Bellone spokeswoman Marykate Guilfoyle said in a statement that the emergency declaration "remains in place because certain functions, including remote public document searches, remain offline and require a complete overhaul due to the fact that the former clerk IT administrator failed to update these systems in decades." 

Guilfoyle said Suffolk County was "working closely with the new county clerk, Republican Vincent Puleo, whose leadership is moving the office in a positive direction" to implement the upgrades. Puleo's office didn't return a message seeking comment. 

Suffolk lawmakers are showing signs of impatience with the continued state of emergency.

On Tuesday, Legis. Anthony Piccirillo (R-Holbrook), who chairs a legislative committee investigating the Sept. 8 ransomware attack, introduced a resolution to immediately terminate the state of emergency, because there “no longer exists a necessity to suspend local procurement laws, rules and regulations.”

The resolution, which was sent to the government operations committee, cites the legislature’s authority to terminate emergency orders “at any time.”

"The emergency is over," Piccirillo said Wednesday, adding that he expects a vote by the full legislature in the next general session. "The legislature must act on its constitutional duty of oversight. Without checks and balances our government cannot function properly." 

Suffolk County Comptroller John M. Kennedy Jr., a Republican and a longtime critic of the Bellone administration's response to the cyberattack, said “the justification for continuing emergency declarations is long past.”

Kennedy continued: "We're now nine months into this, and I’ve yet to see anything substantive from the administration in terms of a detailed analysis, a justification for millions of dollars worth of procurements. There’s no validity to that statement any longer, that there’s still a state of emergency.”

Kennedy argued that no-bid contracts granted under the emergency order “undermine transparency and [fly] in the face of the most fundamental basic good-government practices." Millions of dollars of procurements have been awarded, he said, “with no bid whatsoever.”

Guilfoyle, in a written response, said: "Kennedy’s latest partisan rant is puzzling considering his statement in Newsday just weeks ago that the emergency is far from over.”

By Mark Harrington

mark.harrington@newsday.comMHarringtonNews

Mark Harrington, a Newsday reporter since 1999, covers energy, wineries, Indian affairs and fisheries.