My town hall went back to pen and paper
Last Friday I went to my local town hall, in La Laguna, to do some paperwork. The person at the desk could not do anything for me. They wrote my name and my contact details on a sheet of paper, and told me someone would call me when the system was back.
The system was down. A couple of weeks ago, the town hall was hit by a ransomware attack. The mayor confirmed it: the attackers asked for 5 million US dollars to unlock the data, and the town hall did not pay. As I write this, the website is still down.
Almost everything the town hall does runs on the same computers, so almost everything stopped. Nothing can be filed or processed, and every deadline for paperwork is on hold. A payment that was due last week can wait, but anyone waiting for a permit, a licence or a grant has no date at all.
Even the public library can’t lend a book. Nobody attacked the library, but its systems are tied to the town hall’s, so it went down with them. Lending a book is one of the simplest things a town does: a list of books, a list of members, and a note of who has what. Libraries did this with paper cards for a very long time.
According to Libertad Digital, the town hall received 85,249.75 euros from the Spanish government in 2022 to improve its cybersecurity, and in 2024 it approved another 72,500 euros to join a security program run by the island government and Spain’s National Cryptologic Centre. It was attacked anyway.
In 2017 I worked at a cybersecurity company, and we presented a prototype to stop ransomware (and other kinds of malware) at Web Summit in Lisbon. I posted about it at the time.
I joined Xojo in 2022, and today I maintain its web framework. I work on new controls and performance, but also on security: I keep going through the framework and its libraries to make them as hard to attack as I can. This year we had a security bug of our own. In April, a user reported that a malformed query string in a URL could crash Xojo web apps, with no login needed. We shipped a fix five days later, and I wrote about it on the Xojo blog.
I think anything connected to a network will be broken into at some point. In October, attackers took control of the refrigerators in hundreds of supermarkets and shops across France, Belgium and the Netherlands. On November 2 it happened again, this time in Sweden, Belgium, Luxembourg, Ireland, Italy, Estonia and Greece. Instead of keeping food cold, the units were set to heat it: one Swedish supermarket found its fridges set to 50 °C. The result, as AP reported, was tons of spoiled food and losses of millions of euros.
Many of those fridges were connected directly to the internet, still had their default passwords, and ran old control modules that no longer receive security updates. A refrigerator does not need the internet to keep food cold.
If I were rebuilding the town hall’s systems, I would plan for an attack that succeeds: what keeps working, and how fast the rest comes back. I would want a copy of the data that the network can’t reach, because ransomware often goes after backups too. And I would want the library to run on its own.
I try to think the same way about my own photos. I keep them in iCloud, because it’s convenient. They are on my phone, my computer and anywhere else I need them, without me doing anything. Could Apple be hacked one day, and could someone see all my pictures? Maybe. I would not like it, but I accept that risk in exchange for the convenience.
What I don’t accept is losing them. So I also print them.
The paper photos are my backup for a digital disaster. If my account is gone, or encrypted, or deleted by mistake, the prints are still in a box at home, and no attacker can reach them. And iCloud is my backup for the paper: if there is a fire or a flood at home, the photos are still online.
Neither copy is perfect, but they fail in different ways.
Somewhere in the town hall there is still a sheet of paper with my name on it. I hope someone calls me soon. And I hope that when the systems are back, the town hall rebuilds them so that the next attack can’t stop everything again.