College students will train Piscataquis County to survive a cyber attack

Piscataquis County will work with a team of University of Maine student researchers in Augusta and Presque Isle to become a victim of a cyberattack — on purpose.

Maine Cyber Range — established at the Augusta campus in 2019 to provide an immersive training and simulation center for cyber education — is using more than $407,000 in grant funding to help organizations better understand their systems and identify weaknesses, provide training that simulates attacks and pinpoint solutions.

Piscataquis County is one of six partners across the state that the Maine Cyber Range team has taken on as research subjects for the project that began in May 2021, with the ultimate goal of making them less vulnerable.

In a world where the threat of cybersecurity attacks has grown, recognizing when something goes wrong and responding quickly is crucial. Many municipalities and organizations in Maine, like Piscataquis County, are limited in their funding, resources and information technology. That leaves their security systems vulnerable to attacks, with personal information and important data and records at risk.

For Piscataquis, which repeatedly deals with internet and computer issues likely due to old infrastructure, the project is a major opportunity — one the county couldn’t afford on its own, Piscataquis County Emergency Management Agency Director Jaeme Duggan said.

“People in the state think that we do not experience cyberattacks because we’re just Maine,” said Henry Felch, director of the Maine Cyber Range and Maine Cybersecurity Center. “We’re just a small community in Maine, a small wastewater treatment plant or a small sheriff’s office. 

“Well, if I’m an attacker, guess where I would like to practice. Do we get hit a lot? Yes. And lots of times, nobody really knows.”

Piscataquis is eager to participate because being proactive is one of the most important steps the county can take, Duggan said. To participate in studies where the county’s network is assessed and mapped, then offered solutions for improvement, is priceless, she said. 

The emergency management agency got in touch with university officials after hearing about the project at the recent Maine Partners in Emergency Preparedness Conference in Augusta. 

“Everything is connected,” Duggan said. “EMA is connected to the jail to the sheriff’s office, even  one computer in the DA’s [district attorney’s] office to the clerk’s payroll. A vulnerability on one of those can take us all down.”

Maine Cyber Range has also partnered with the cities of Bath and Presque Isle, the Greater Augusta Utility District, L.L. Bean and Kennebec Savings Bank for the project. The university wanted to find partners in various industries to generate generic models that can be used to train students without going into a specific network, Felch said.

Eleven students from the University of Maine at Augusta and five from the University of Maine at Presque Isle are doing the research together. The students, from undergraduate and graduate programs, will evaluate the security systems, including taking inventory of devices and software, and replicate them in a simulation lab, Felch said. 

While this process unfolds, other extensive research is being done. For example, students study if the partners — and towns or organizations of similar size — have experienced previous cyberattacks, he said. 

A key part of the project is training, where attacks are simulated and the partners learn how to recognize when one is happening in their network. The training, which can be done on campus, at the partner’s site or remotely, also allows them to test a response plan, Felch said.

“A small town in Aroostook County cannot hire a $100,000 cybersecurity person,” he said. “But every member in that municipality can essentially be like that [once trained]. They can identify things and see things.”

In June 2021, unidentified ransomware hackers published sensitive data from the Presque Isle Police Department — one of many global data hacks on municipalities, schools and businesses at the time.

While the primary goal of the project is to assist the partners, Felch said, students also gain experience that prepares them for the workforce.

Piscataquis County offices consistently encounter computer slowdowns and trouble getting online, and it’s unclear why exactly, Duggan said. Infrastructure is old and has been pieced together over the years. The network also isn’t mapped, so it’s unclear where the cables are, she said.

Piscataquis — which lacks an in-house IT department and instead contracts with Penobscot County — has also dealt with phishing attacks, which are getting more intricate and tricking even experienced users, Duggan said. At one point, Piscataquis got its domain on a blacklist, which has been resolved, she said.

The county should be preparing for cyberattacks and ransomware like it prepares for natural hazards and emergencies such as the gun threatening incident at the town’s fireworks show this summer, she said. Important information, such as jail records, registry of deeds and probate court documents, the payroll system and more, is at risk, she said.

If Piscataquis County’s departments can’t access their computers, they can’t communicate. That’s a major issue for emergency personnel, where the cyber world meets the physical, Felch said.

The university received more than $257,000 from the Maine Emergency Management Agency and $150,000 from the university system’s Maine Economic Improvement Fund Small Campus Initiative to pay for the project.

A congressional earmark for about half a million dollars was submitted to continue this research, Felch said. The project is less about preventing attacks and more about how organizations can identify them quickly, limit what happens in their network and recover, he said.

“Hopefully we can get enough funding to extend this to everybody in the state,” he said.