STUART, Fla. — At least six suspected drug dealers walked away free after Stuart prosecutors were forced to drop cases for lack of evidence. The problem? The evidence is currently sitting in computers at the Stuart Police Dept., but hackers have locked investigators out of the files which could have put the suspected drug dealers behind bars for years.
Hackers hit Stuart with ransomware in April 2019, but the police department took the brunt of the damage.
The cyberattack forced the State Attorney's Office to drop 11 narcotics cases because evidence was lost, Contact 5 has learned.
"In our case, we lost approximately on and half years of digital evidence," said Det. Sgt. Mike Gerwan with the Stuart Police Department. "Photos, videos; some of the cases had to be dropped," Gerwan told Contact 5 investigator Merris Badcock.
Those cases included 28 charges against six different defendants for crimes including possession of meth, possession of cocaine, selling, manufacturing, or delivering various narcotics, and illegal use of a two-way communication device.
But Contact 5 learned over the course of the investigation that losing data, or evidence in the case of the Stuart Police Dept., is highly common when an agency is hit by hackers. "I can't recall, in speaking to my federal partners, that there has been a case where data has not been lost," said Gerwan.
For example, in a recent ransomware attack against the St. Lucie County Sheriff's Office, Contact 5 reported that at least five days of agency emails were completely lost, along with any newly created digital documents from Dec. 8, 2019 to Dec. 13, 2019.
Investigators revealed the police department is still recovering from the hack, which started when a virus called 'Ryuk' infiltrated the system. "We determined how they got in was a spearfishing link," said Gerwan. "We also determined the virus was in our system for about two months before they revealed themselves with a ransom note."
The hackers demanded $300,000 in bitcoin, but the city of Stuart refused to pay the ransom.
SEE ALSO: HACK ATTACKS: Local law enforcement, cities targeted by cyber crooks | Security expert: Riviera Beach should have backed up data, minimizing cyberattack that cost $600K | 2016 ransomware attack against Palm Beach County Elections Office just now coming to light
For at least six weeks, the small-town police department, which employs 46 sworn law enforcement officers, was forced to revert to pen and paper reports. "We went home one day, and the next day...we're back in 1984. In 1984, if you wanted to look someone up you had to use a phone book," said Gerwan.
The hack also seriously impacted police responses. "It's very dangerous," recalled Gerwan. "We did not have access to the internet. We were sending our officers to calls blind."
The police department has changed the way they save and store evidence, and city officials are now aggressively training employees to identify phishing emails. "If you see another email from an employee that is suspicious, [you] better pick up the phone and call that employee before you click on the link," said Gerwan.
The FBI says victims of ransomware attacks should not pay the hackers. Gerwan learned, while investigating his own hack, that hackers will take one-third of the ransom and invest it in research and development.
As hackers continue to develop new tactics to scam and hurt taxpayers, Gerwan believes investigations into cybercrime will only continue to grow. "When I first got in law enforcement, most of the crimes [we investigated] were person crimes, a little bit of property crimes," Gerwan said. "I believe that at the end of this decade, cybercrimes are going to make up a major percentage of the types of crimes that we investigate."
