Former Iowa AMBER Alert Coordinator Todd Misel helped set up the statewide child abduction alert system in 2003. He has been involved with every AMBER Alert in the state or been given a heads up an alert was about to go out. At least that was the case until 8:18 a.m., November 27, 2010, when he and everyone who had signed up for Iowa AMBER Alerts by e-mail received this message: “The AMBER Alert status has been set to IN PROGRESS!”
“I got the e-mail message, and no one had contacted me. I thought, ‘What’s up with that?'” said Misel, who is also a Captain with the Iowa Department of Public Safety’s State Patrol Division.
The message directed recipients to a website that still had information on a February AMBER Alert for a teenage girl that had been cancelled because she had been safely recovered.
It was the first time a hacker had broken into the newly automated Iowa AMBER Alert Plan website. It also may have been the first time in the nation that a hacker issued an AMBER Alert. Five minutes later, Misel received another e-mail that the hacker also apparently sent: “The AMBER Alert has ended.”
Iowa’s notification system was set up nearly four years ago; Iowa uses the original National Crime Information Center (NCIC) missing child entry as the trigger for its AMBER Plan. AMBER Alert information entered into the IOWA system/NCIC automatically posts to the Iowa Website and triggers e-mail notifications to thousands of people who registered to receive the alerts. The system was automated to avoid human error, but the Website proved to be vulnerable to someone intent on hacking into the system.
“We were embarrassed,” said Misel. “It is like having someone break into your home. You feel violated, not only as an individual, but for the sanctity of the AMBER Alert system.”
The good news is the AMBER Alert did not go out through the other means of notification. The Emergency Alert System was not activated, highway signs did not post the alerts, and the Iowa Lottery did not issue lottery tickets with the alerts. The media reported on the breach but did not broadcast an AMBER Alert.
Two days later, the Iowa Department of Public Safety launched a criminal investigation to find the hacker and solicited help from the FBI and the Internet Crimes Against Children (ICAC) Task Force. ICAC investigators were involved because of their computer investigative skills, and the crime directly affected the safety of Iowa children.
Iowa’s AMBER Alert partners also went back to find out what went wrong with the Website and take steps to ensure it would not happen again. The Iowa Department of Public Safety and the Iowa Department of Administrative Services Information Technology Enterprise, which oversees the Website, quickly instituted new safety measures to prevent another breach. They also put together a list of lessons learned for others with automated AMBER Alert plans:
- Document training and practice the AMBER Alert notification procedure.
- Develop a backup plan so the AMBER Alert will go out even if the website is down.
- Clarify ownership and responsibilities of the website application with the service provider through a Service Level Agreement.
- Have a process in place to build security into the website application from the beginning to end.
- Scan the application and review the source code prior to deployment and during production.
- Develop and implement regular monthly or quarterly security scans of the application.
- Have a communications plan in place. One spokesperson should be available to speak with the media and all state agencies and partners.
- Have a script prepared for individuals who the media may contact that directs them to the single point of contact.
- Hold a daily internal briefing or conference call to discuss any issues so you can control the message and keep information consistent.
“Automation of the AMBER Alert Website is great, but make sure there are checks and balances in place,” added Misel. “There is an expectation from the public that you will be able to continue AMBER Alert operations, even when your internal systems are compromised.”