Security, expense, convenience: Northfield examines tradeoffs in cybersecurity

NORTHFIELD — As town leaders ponder a contract that would allow the police department to upload its files into a cloud-based storage system, one selectboard member remains skeptical of allowing a private company to handle confidential information.

Town Administrator Ken Robichaud asked Leif Martinson, a Tilton resident who serves as a business systems analyst for the state of New Hampshire, to answer the selectboard’s questions at their Jan. 3 meeting.

Martinson said the Barracuda cloud-storage backup system the town is contemplating is similar to other cloud-storage systems in use across the state and around the country.

Martinson was responsible for implementing body and cruiser cameras for the New Hampshire State Police, and he said, “Nobody’s single video that’s been taken by any of the state troopers is ever on a storage facility inside the state of New Hampshire, unless a copy has been made to give to a prosecutor or a defense attorney. All of it is automatically out in the cloud, real-time. As soon as a trooper takes a video, gets back to their car, and goes to the gas pump the next time they gas up, that data is connected to a Wi-Fi box and it’s in the cloud 10 minutes later.”

“My big concern was — and you mentioned the state is already doing it, which is amazing — putting this stuff on the cloud. Meaning putting it out to a private company, to their servers, I mean, this is people’s personal information,” Selectboard Chair Mark Hubbell said.

Martinson said there is a difference between the “public cloud” offered to users by Microsoft, Google, and Apple, and the “government cloud,” which provides stricter control over access.

“The cloud is nothing more than a big data center somewhere with a bunch of servers that have a bunch of storage that they can parse out to whoever’s buying it from them,” Martinson said. A public cloud, he said, “has a certain level of security around it because it’s information used by the public.”

The government cloud uses a separate set of data centers with different protocols to meet federal, state, and local standards, “and every other standard around protecting that data against breach and against the wrong people,” Martinson explained.

“The other difference with the government cloud is none of that data is stored outside of the continental U.S.”

In weighing whether to store all data on local servers or put it on the cloud, Martinson said, “It’s much cheaper and a lot easier to allow another company to manage that for you than to hire IT professionals to do it internally on hardware that’s obsolete two months after you buy it. It costs you a lot more in the long run to continue to buy servers and have somebody maintain those servers and remember to back up those servers.”

With a cloud-based system, an officer can access the information from a cruiser at the side of the road using Wi-Fi.

“They don’t have to go back to the home office,” Martinson said.

“They don’t have it stored locally on their laptop. Thinking about emergency management, if all of your data is at the PD and you can’t access the PD or like what happened here 30-40 years ago, the PD burns down, you’re out of luck.”

Selectboard member Jason Durgin said he had moved all of his own business transactions to the cloud.

“I can access it from my phone, from my tablet, from anybody else’s computer,” Durgin said.

“I could sit down in a customer’s house and write the bill from their computer.”

Having the town’s own servers would require special power sources, air conditioning, backup servers, and staying on top of security updates, Durgin said.

“The world we live in now, everybody expects to be able to access their systems 24 hours a day,” Martinson said.

“The only way to do that is to have a massively overbuilt data center that never goes down and has power backup, all kinds of redundant systems in place, and there’s a huge expense to that. When you go to the cloud, you’re getting the benefit of thousands of companies participating in that expense, which makes it relatively inexpensive.”

Hubbell raised concerns about hackers from overseas, asking, “What’s the chances of one of those hackers deciding to come after the town of Northfield versus going after the company that they know stores all this information from multiple sources all over the United States?”

Martinson’s response was, “If there are too many breaches, they’re going to go out of business. Most of the breaches you hear about, though, are credit card breaches. You very rarely, if ever, hear of a local police agency’s cloud getting hacked because they’re in the government cloud, which has many, many more layers of protection built into it.”

Northfield’s discussion comes at a time when President Joe Biden is discussing increased regulation of information systems, especially those dealing with infrastructure. Biden said that, “While voluntary approaches to critical infrastructure cybersecurity have produced meaningful improvements, the lack of mandatory requirements has too often resulted in inconsistent and, in many cases, inadequate outcomes.”

The nation’s greater focus on cybersecurity came in the wake of high-profile hacks such as that of the Colonial Pipeline, and it raised awareness of how fragile the nation’s fuel, electric and water systems are.

Biden’s plan calls for shifting the liability for cyber attacks “onto those entities that fail to take reasonable precautions to secure their software.”

The insurance industry also is backing away from blanket coverage for cyber breaches.

However, the government also recognizes that even the most advanced software security programs cannot prevent all vulnerabilities.