Ransomware Class Action Suit

The City of Los Angeles filed a class action lawsuit against Hodes Automation for damages related to the recent ransomware attack against the City’s traffic light control system. Harry R. Haldeman announced the lawsuit this morning along with district attorneys from 25 other Southern California cities. “Not only was Hodes negligent in the design of their system, but they published a list of their customers on their web site,” Haldeman told reporters; “That list provided the hackers easy targets for publicly available exploits.”

Dean Hodes, owner of Hodes Automation, had no comment, referring reporters to his lawyer, Eunice Rivers. Rivers’ office issued a statement this morning; “We are looking at the details of the filing by the District Attorney and cannot comment on the facts of the case at this time, but Mr. Haldeman is clearly overreaching in trying to collect expenses the city incurred in their recovery from an incident from my client.” Rivers noted that Hodes had published an updated version of their software two weeks before the vulnerability was announced by Robert Lightman, the researcher who discovered the vulnerability.

Lightman published his report two months ago on the security bypass vulnerability in the TL Control program used by Los Angels and thirty other municipalities in Southern California. “I discovered the vulnerability while doing some work for the city of Montecito,” Lightman told reporters; “And I worked closely with Hodes to help them correct the problem.” Lightman explained that he had a disclosure agreement with Hodes that allowed him to publish his research two weeks after Hodes made their update available on their web site.

The City of Los Angeles installed the TL Control system two years ago after the hack of the Robotron system that the City had been using was discovered. Doug Wilson, the Los Angeles City Manager told reporters this morning that the city had decided to work with a local vendor after having problems working with Robotron. “We felt that a local vendor would be more responsive to our needs,” Wilson said.

When asked when the city became aware of the vulnerability in the TL Control product, Wilson told reporters that he was not able to comment on ongoing litigation. “All questions about the lawsuit should be referred to Haldeman’s office,” Wilson said.

A technician working with the Traffic Department who was not authorized to talk to the press told me that the city never received notification about the vulnerability from Hodes. “We read about the vulnerability in a newspaper article about the ransomware attack,” she said.

The Hodes web site announced the availability of a new version of the TL Control product on December 2^nd. There was no mention of security vulnerability on the web site. The TL Control web page was taken down early this afternoon, after the lawsuit was announced.

The lawsuit is seeking $15 million in damages.

The City Traffic department announced a request for bids on a new traffic light control system. The bid request includes new requirements for cybersecurity notifications, including notifying the Department when vulnerabilities are reported to the vendor and reporting when the vendor has mitigation measures available for reported vulnerabilities.

CAUTIONARY NOTE: This is a future news story - 

Developer Arrested for Traffic System Hack

Harry R. Haldeman, the District Attorney for Los Angeles, announced the arrest of Doug Wilson for cyber attacks on the traffic control system for the County. Wilson was indicted yesterday after his accomplice outlined the two-year system intrusion for a grand jury. Wilson was released on $250,000 bail pending trial later this year.

Haldeman told reporters this morning that Wilson had hatched the scheme to modify data in the traffic control system to make it easier for people living in his new development in San Ferando Valley, Agrestic, to reach the business district in downtown Los Angeles. “A hacker in his employ modified the timing controls on traffic lights on the main route between Agrestic and downtown to reduce the average transit time;” he said, “This resulted in more delays and traffic congestion along routes that intersected the Agrestic traffic.”

Haldeman did not name the hacker, but people familiar with the grand jury testimony report that it was Silas Botwin that was responsible for the modifications to the Robotron Verkehrskontrolle system that the County installed three years ago. Sources close to the investigation say that Botwin modified data from sensors on and around the route which caused the system to run green lights longer along the Agrestic route, cutting transit times.

Francis C. Whelan, the attorney representing Wilson told reporters at a separate news conference, that Botwin was solely responsible for the attacks. “He had worked for Hodes Automation, the company that installed the Robotron system for the County,” Whelan said, “He was fired shortly after the installation was completed for drug related problems. These attacks were in part retribution for the firing and part helping his sister-in-law who lives in Agrestic and works downtown.”

Up until yesterday, the sales web site for the Agrestic development touted the short transit times to downtown Los Angeles.

CAUTIONARY NOTE: This is a future news story –