By: Jonah Haseley

On November 4^th, 2024, cybercriminals orchestrated an attack against Washington’s Administrative Office of the Courts (AOC) which resulted in the Washington Courts website being unavailable to the public for two weeks. The AOC develops budgets for the courts, runs its computer systems, and performs policy research. The cyberattack was substantial enough that the State Supreme Court issued an emergency order temporarily altering court rules across the state to cope with the outage. The order changed filing deadlines for civil cases, as well as core criminal rules for issues such as arraignment, speedy trial, and sentencing. Dozens of local courts issued corresponding emergency orders. The attack affected different Washington courts differently. It impacted those which rely on the state’s network the most. Others, like King County Superior Court, proceed more normally with their separate case management systems still functioning.

While the cyberattack the website remained down, the state found temporary substitutes to maintain contact with the public. Washington Courts posted updates on its Facebook page and collaborated with the State Bar Association. It also set up email inboxes to substitute for certain electronic filings.

The outage impacted many people in addition to court employees and litigants, including prospective gun owners. Washington presumptively requires background checks for firearm purchases, and the cyberattack disabled this capability. According to Washington State Patrol, although the AOC fixed the system, the attack caused a significant backlog which may result in delays. One gun rights group has publicly threatened to sue, but this seems unlikely now that AOC has resolved the issue. The attack touched other state agencies, like the Washington Department of Children, Youth and Families, which relies on the state’s system to perform background checks for foster families. However, the agency did still have access to related nationwide services. Additionally, the attack delayed the approval process for state gambling licenses.

Although two weeks is a substantial amount of time for state services to be unavailable, evidence suggests that the impact on public services could have been much worse. The AOC stated in a press release that quick action staved off any data breach or ransomware. Other government entities in Washington have not been so lucky. Last May, cybercriminals attacked the Seattle Public Library, and the library was not able to recover fully until September. The attack also leaked personal data for some of its employees.

After the AOC cyberattack court systems like King County Superior Court did not lose access to their operational networks because they had a separate system from the state. At the same time, having many different systems reduces the resources available to each. Fewer resources means fewer defenses, which makes libraries appealing targets. Important public services are more likely to be attacked because they are important. Hackers believe government agencies will pay a ransom to resume service to the public as quickly as possible.

Washington does have a State Office of Cyber Security which receives federal funding from the Department of Homeland Security through the Infrastructure Investment and Jobs Act. The federal funding is not without strings attached – the recipient is required to contribute its own money to cybersecurity projects to get additional federal support. Washington’s legislature has fortunately matched approximately 9 million in federal funds, saving its local jurisdictions from that financial burden. However, the federal government has agreed to contribute 14 million, and how the remaining 5 million will be matched remains unclear. Bob Ferguson will take office in January as Washington’s new governor. He will replace Jay Inslee, the outgoing three-term governor. To protect our public services, he should commit to matching the remaining federal money so that local jurisdictions do not have to decide between fiscal and cybersecurity.