Hawkins official claims no responsibility for impact of alleged hacking

HAWKINS — The former interim mayor of Hawkins claims he can’t be held responsible for the aftermath of the alleged hacking of the city’s computer system, even though he gave a man access to a city computer to perform a “cybersecurity audit” without the council’s approval.

And the man accused of the hacking, Shahaub Tafreshinejad, says he “absolutely did not commit” a crime and threatened a lawsuit against city officials.

Hawkins could lose about $55,000 in utility revenue next month if the computer system remains shut down following the April 1 cybersecurity incident, officials said Monday evening during a City Council meeting. The city isn’t able to send utility bills to residents, complicating its already strained financial status.

The Texas Rangers and the Texas Department of Public Safety’s internet crimes division are investigating whether a data breach occurred when Mayor Pro Tem Charles Richoz, who was serving as interim mayor, allowed Tafreshinejad, the son of Councilwoman Eleta Taylor, to install remote-access and network mapping software on a computer in Richoz’ office.

Officials shut down the city’s computer system because of concerns that a data breach could have occurred. They also implemented a spending freeze.

Monday’s meeting was the first public meeting since the April 1 incident, which has hampered city operations and created controversy in the small Wood County town.

Richoz told the audience that he performed a cybersecurity audit of the computer in the mayor’s office — and that the City Council didn’t tell him he couldn’t sign a contract with Tafreshinejad to perform cybersecurity work.

Meanwhile, Mayor Debbie Rushing — who has called for Richoz and Taylor to resign and face criminal charges along with Tafreshinejad — said those responsible for the incident will be held accountable.

“I know that a crime was committed,” Rushing told the crowd. “I’m doing what I need to do. And I’m honestly just trying to make sure y’all are safe.”

‘Good possibility’ breach occurred

Video footage captured by Mike Maberry, Hawkins utilities director, showed Tafreshinejad sitting at a desk in Richoz’ office on April 1 with three computer monitors in front of him while Maberry told him he had no right to use a city computer. Tafreshinejad replied that he was using his own computer. Footage also showed Richoz walking into the office, slamming the door in Maberry’s face and telling Maberry to leave him alone.

The ordeal took place hours before Rushing was sworn into office as mayor, replacing Richoz, who had filled the role since the January resignation of former Mayor Susan Hubbard. Rushing was the only candidate who filed to run for the office, and the council voted in March to allow her to assume office early.

After Rushing took office April 1, she contacted the city’s information technology expert, who determined the following day that remote-access and network mapping software had been installed on the computer in the mayor’s office — programs that would allow someone to access city computers from another location. Rushing contacted the Texas Municipal League, which provides insurance coverage to the city, and the organization directed the city to shut down its computer system.

Since then, Rushing has been in numerous meetings with attorneys, cybersecurity analysts and law enforcement officials. Rushing previously said there’s a “good possibility” that a data breach occurred, though what information was affected, if any, is unknown.

City Hall employees, meanwhile, have been working with pen and paper much like they would have in the pre-computer era. They’ve been unable to respond to city emails, continue working on grant funding applications to improve the city’s utility system or process payroll electronically. The city will have to open new bank accounts as a result of the incident.

Hawkins’ computer system will remain shut down while the investigation is underway, meaning the city won’t be able to bill customers for water usage or trash collection in early May.

The city will lose roughly $55,000 in service charges, the minimum rates collected for utility services, said City Utilities Clerk Cindy Douthitt. That figure doesn’t include revenue the city would collect for actual utility usage, which could be around $40,000, she said. The city likely will bill residents for that when computer systems are restored.

Douthitt said residents ultimately will pay less money in service charges as a result of the incident, though City Council members will have to decide how to handle other aspects of the billing situation.

Rushing told the News-Journal on Monday that the city could have a new computer in operation at City Hall as soon as Monday, though she said she couldn’t guarantee that. Getting the city’s utility billing systems back online will take longer, she added.

“It is going to be a race to the finish,” Rushing said.

The news that the city won’t be able to collect that revenue in May came as council members learned that the city’s police department has spent 63.8 percent of its budget for the fiscal year, which is roughly halfway over.

“The police department has serious financial issues,” Rushing said.

The council also voted Monday night to move forward with the purchase of a new fire engine, which will cost about $710,000. The city will use a $258,000 grant to help purchase the truck and will arrange to pay the remaining cost off over a years-long period.

The purchase of the truck has been discussed for years, and the city must use or forfeit the grant funding. The city won’t have to begin paying for the truck for at least two years, however, as it will take about as long to manufacture.

‘I cannot be held responsible’

The April 1 cybersecurity incident followed weeks of discussion about another alleged cybersecurity incident involving the city — which the council in March considered hiring Tafreshinejad to address.

Sign Up for Newsletters

Email*

Select Newsletters to Sign Up For

News Updates

Breaking News

Sports Digest

Obituaries and Death Notices

Submit

Rumors began to swirl among city leaders earlier this year that Hawkins’ surveillance system had been hacked. Hawkins resident Todd Eddington, who operates a Facebook page called “The Crooked Wood County ‘Justice’ System Part III,” posted a photo showing Hubbard, Richoz and Place 2 Alderwoman Clara Kay leaving the mayor’s office on Jan. 5. Eddington claims that photo shows the trio conducted an illegal meeting.

Eddington got the photo from Maberry, who watched the security camera footage, took a picture of it and sent the picture to Eddington, Eddington and Maberry said. The glare of a ceiling light is visible in the photo Maberry sent Eddington, but some officials perpetuated a rumor that Eddington hacked into the City Hall camera system to get it, Eddington said.

In March, Tafreshinejad spoke to the council about that alleged hacking incident, saying someone had gained unauthorized access to the system — the same allegation that Rushing and other city officials now level against him.

The council in March considered paying $36,000 to Tafreshinejad to perform cybersecurity work for the city.

Rushing, who wasn’t on the council at the time, questioned Taylor about voting to hire her son to do the work, as Texas law prohibits officials from hiring their relatives to receive compensation by working for the municipality the official serves.

Taylor replied: “My relationship with the person that is the expert has no bearing because I have nothing to do with his business. So keep my child out of it.”

The council ultimately tabled the matter, voting to interview other candidates for the work first. But on March 26, Richoz signed the contract with Tafreshinejad and his company, Spica Secure Solutions, anyway. The contract, which Rushing provided to the News-Journal, said the company would provide cybersecurity work at no cost and no risk to the city.

Richoz claimed Monday evening that the council didn’t tell him not to sign a contract with Tafreshinejad.

“The contract that was tabled was different from the contract for no charge to the city that we did,” he said.

Richoz said that, although he performed a “cybersecurity audit” of the computer in his office, he wasn’t responsible for the shutdown of the city’s computer system or the impact it has had on city operations.

“I cannot be held responsible for any of these things,” Richoz said. “The reaction is not something that we anticipated or are responsible for.”

Minutes later, he said: “If I’m responsible, I’ll be happy to say I’m responsible, but I don’t think I am.”

Rushing said Richoz lacked the authority to sign a contract with Tafreshinejad.

“There is no way the mayor has that much power to ignore what the city council wants and just go do what I want to do,” Rushing said.

‘Whose idea was this?’

Some verbal exchanges during the meeting were heated. After Rushing said a crime had occurred, Tafreshinejad — seated in the back right corner of the room — asked: “Who committed this crime?” Rushing replied: “You did, Shahaub. And you gained access using a city councilman.”

Later in the meeting, Hawkins resident Glyndia Lane pointed at Tafreshinejad and said: “Whose idea was this to bring this man in here and screw up our city?”

Tafreshinejad shook his head and replied: “I’m not afraid of you.”

Rushing banged her gavel on the table and called for the meeting to return to order.

After the meeting, Tafreshinejad said the allegations that he hacked into the computer have harmed his reputation and his business.

“I absolutely did not commit any damn crime,” he said. “I am a cyber security professional with extensive experience. I know what I’m doing. If you go back and check out my LinkedIn — you should — you should really look at all of the accolades and awards and certifications that I have. I followed [National Institute of Standards and Technology] guidelines. And it’s unfortunate that people that have no cybersecurity experience whatsoever is making these blatant accusations.”

Tafreshinejad said he’s “going to get counsel and sue these people.”

Other residents who spoke at the meeting expressed frustration with the situation. Jeff Carrizales, who works in the health care information industry, said the cybersecurity incident violated residents’ privacy rights. People who have unauthorized access to city records could steal credit card information and more, he said.

“There’s all kinds of things that were violated,” Carrizales said.

Rushing is doing “the correct thing” to protect residents, he said.

Norma Hallmark, the city library director, said there was “no reason” for the cybersecurity incident and that she’s tired of the political drama that has engulfed the small town.

“People responsible for any of these incidences — they should be ashamed of themselves, and they should pay,” she said.