Washington County Transparency Problems Revealed by Cybersecurity Incident and Repeated Road Closures Near Water Treatment Plant

Cover Photo: Artist’s rendering of Washington County Government’s transparency efforts – obscure faceless workers in suits with a severe lack of communication.

This article was updated 7/18/2023 to provide additional information regarding the 7/12 Bottom Road incident, and to include that Washington County PR department cannot answer questions about the cybersecurity incident due to the ongoing investigation.

This article was updated 7/18/2023 to add information where the Indiana Information Sharing and Analysis Center has also classified the county cybersecurity incident as a “hack”.

HAGERSTOWN, MD News (7/17/2023) – For the second time in less than two weeks, Washington County Government will be temporarily closing Bottom Road (the location of the RC Wilson Water Treatment Plant) from Route 68 at the tannery to the railroad tracks at the quarry. Unfortunately, the county continues to remain silent regarding the details of the incident on Bottom Road to warrant multiple closures, as well as other topics related to the water treatment plant, including the November 2022 cybersecurity incident.

The last announcement regarding Bottom Road closing was on July 12th at 2 PM, announcing an immediate closure of the road. Radio Free Hub City immediately inquired for additional details, and while our email was opened by the PR department of the county, no answer was ever received. One of the most important questions asked was if this incident affected the RC Wilson Water Treatment Plant in any way, but this question and others remain unanswered.

A new announcement was released today, in that The road will be temporarily closed from Route 68 at the tannery to the railroad tracks at the quarry on Wednesday, July 19, 2023, from 8:00 a.m. to 5:00 p.m. to repair the guardrail.

There was no word originally released from the county if there were any injuries, or even the nature of the incident.

This is not the first time Bottom Road has been mysteriously closed without explanation.

Since 2019, Washington County has sent 13 notices regarding Bottom Road being closed, many without any explanation.

Email Date	Date(s) Closed	Reason
June 11, 2019	7:00 a.m. – 2:00 p.m. on June 13, 17, 18, 19, and 20	Mowing and debris removal
September 10, 2019	September 11, 2019 and Thursday, September 12, 2019, from 8:30 a.m. until 2:30 p.m.	Debris removal and pipe replacement
September 13, 2019	September 16, 2019, from 8:30 a.m. until 2:30 p.m.	Pipe replacement
June 25, 2020	June 29, 2020 through Wednesday, July 1, 2020 from 7:30 a.m. – 3:00 p.m.	No reason provided
April 23, 2021	April 26, 2021, from 8:30 a.m to 2:00 p.m	Mowing, trimming, and debris removal
October 29, 2021	November 1 through Thursday, November 4, 2021, from 8:00 a.m. – 2:00 p.m.	Debris removal
May 27, 2022	May 31, 2022, to Thursday, June 2, 2022 8:00 a.m. until 3:00 p.m	No reason provided
June 6, 2022	June 6, 2022, to Tuesday, June 7, 2022 8:00 a.m. until 3:00 p.m	No reason provided
June 8, 2022	June 9, 2022 8:00 a.m. until 3:00 p.m.	No reason provided
August 29, 2022	August 31, 2022 from 8:45 a.m. to 2:00 p.m.	No reason provided
June 22, 2023	June 26, 2023, to Thursday, June 29, 2023 7:00 a.m. to 3:00 p.m.	“To enhance the safety and quality of our road infrastructure”
July 12, 2023	July 12, 2023 (immediately)	Due to an incident*
July 17, 2023	July 19, 2023, from 8:00 a.m. to 5:00 p.m	Repair the guardrail

Out of 13 road closure notifications, no reason was provided for 5 of those notifications, and 2 additional closures were extremely vague in nature (June 22 and July 12). This means that the county has not included information about the reason for the closure in over 50% of their notifications for Bottom Road.

The county’s silence on this topic is concerning, especially after seeing on Senator Van Hollen’s Senate website a request for $200,000 to upgrade the SCADA systems for Washington County’s water and wastewater pump station, another topic which the county has not issued any comment on publicly. In this request, the cybersecurity incident is in fact referred to as a “cyber breach”, indicating that attackers did indeed gain access to Washington County Government computer systems. Why this was not clearly relayed to Washington County residents by their own county government is currently unknown.

The unanswered questions regarding the road closure and water treatment plant are unfortunately in line with the unanswered questions regarding the November 2022 Washington County Government cybersecurity incident. Radio Free Hub City filed a Maryland Public Information Act (MPIA) request with the county regarding the incident, attempting to obtain details as to how the attack occurred, what the impact was, and if county residents’ personal information had been compromised. That request was denied by the county for, among other reasons, “attorney client privilege”, which is typically only invoked in court to prevent an attorney from being compelled to testify against his/her client. This denial reason in itself raises significant questions regarding the nature and impact of the cybersecurity incident, or as referred to on Senator Van Hollen’s website, the cyber breach.

Of course, while RFHC is entitled to judicial review of this denial, we do not have the funds to do so, and no further action on our MPIA request will be possible.

We were however provided information through unofficial channels by a county official regarding the effects of the cybersecurity incident on the county water and wastewater facilities. In that message, we were informed that “the computer systems that control the wastewater and water treatment facilities are not connected to the County’s computer system; thus, they weren’t affected by the cyber incident.” The county official went on to inform us that the SCADA system only performs monitoring and does not control the wastewater pump stations. What was affected was the ability to modify the monitoring system configuration, meaning that alarms would still be received, but no modifications could be made to the alarm settings. The ability to modify these alarms was partially restored in late April. Since this message was communicated to us outside of official channels, we are currently withholding that official’s name unless we receive explicit permission from the individual to release it.

Through further digging, we were able to find additional details regarding the county cybersecurity incident through Fitch Ratings, an American credit rating agency.

The county experienced a county-wide network outage due to a cyber security incident at the end of November 2022. The county emergency management and information technology staff worked in tandem with the Sheriff’s office and County’s insurance provider to perform an investigation and restore services to the affected administrative functions within a few days. Costs were covered by the county’s Cyber Security and Crime Coverage insurance policies. The county has now transferred their systems to cloud-based environments and implemented early detection software.

Fitch Ratings, April 5, 2023

Sadly, the Washington County credit rating profile provides more information about what actually happened regarding the cybersecurity incident than Washington County is willing to provide to its own taxpayers. In fact, the Fitch Ratings credit profile includes information which was originally denied in our own Public Information Act request, including what steps the county has taken to help prevent future incidents.

Additionally, the state of Indiana’s Information Sharing and Analysis Center, an organization dedicated to multi-state cybersecurity information sharing, has also labeled the Thanksgiving Day incident as a “hack”.

A holiday cyber attack threw one Western Maryland county for a loop, altering some police operations, slowing down the office of the state’s attorney, and preventing online payments. Other jurisdictions in the state could learn lessons from the holiday hack of Washington County.

State of Indiana Information Sharing and Analysis Center Event, Monday, July 17, 2023 7:51am

When contacted by phone regarding the cybersecurity incident, a representative from the county’s PR department politely informed us that due to the ongoing investigation, she is unable to answer questions relating to the incident.

Unfortunately, until the Washington County Government becomes more forthcoming regarding the details of events happening in our county, residents will continue to remain in the dark what is truly going on in our county, and the systemic failure by the county to provide important details about what’s going on in our county is an extreme disservice to its taxpayers. Journalists and private citizens should not have to resort to unofficial backchannels with public officials and internet searches of county credit ratings to get honest answers about what’s going on, and Washington County has a severe transparency problem it needs to address immediately through upfront, clear communication.

We will be happy to update this article (or write new ones) with additional details if the county ever releases them.

On 7/18/2023 RFHC confirmed with Washington County Government over the phone that the “incident” on 7/12/2023 was a single-car accident into the guard rail.

Article by multiple RFHC contributors.