IE 11 Not Supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Mobile, Ala., Official Claims Cyber Training Has Racial Bias

Fred Richardson, a councilman running for mayor in Mobile, Ala., refused to do cybersecurity training overseen by the city's mayor. After being locked out of his email, Richardson referenced Jim Crow.

Mobile Councilman Fred Richardson
Mobile City Councilman Fred Richardson
John Sharp
(TNS) — Mobile Councilman Fred Richardson, a mayoral candidate, claims he has been locked out of his city email because he refused to complete a cybersecurity training required by a department overseen by Mayor Sandy Stimpson, one of his opponents in next month’s election.

Richardson, during Tuesday’s council meeting, said he was not going to “bow down to a tyrant,” and would not “give up my authority” as a member of the council.

Richardson claims council members, as representatives of the city’s legislative body, are not required to follow a directive from the mayor’s administrative staff, which is the city’s executive branch.

Richardson then compared the situation to Jim Crow-era discrimination of being told “which water fountains to use, what school I could not go to and what neighborhood to go to.”

On Wednesday, Richardson told AL.com he felt the Stimpson administration’s approach was political because the election is looming.

“I believe this is political and has to do with the election,” Richardson said. “You are cutting me down during the final leg of the campaign.”

Only 18 people, or 1% of the 1,748 Mobile city employees required to take the cybersecurity training, have opted not to do so. That includes the six other members of the Mobile City Council, who have done so, and Mobile municipal judge Karlos Finley, who is also running for mayor. Stimpson has also completed the training.

The mayor’s race is August 24.

“This is not a legal issue,” Stimpson said in a statement. “If anything, it is an issue of accountability and human rights.”

He added, “It is clear that the only person politicizing this simple cybersecurity training is Councilman Richardson.”

SUSPENDED ACCOUNT


Richardson’s city email account is suspended because he did not complete the training that required watching five 10-minute modules and answering, “a few simple review questions after each,” according to Scott Kearney, the city’s chief technology officer.

Kearney said the training was initiated on March 15 and was required to be completed for all users of the city’s email and computer systems.

The initial notice indicated users had six weeks to complete the training and that the following would occur if it had not been completed: A reminder would be sent out after four weeks, a warning after five weeks, notification to the department head after six weeks and suspension of email and Window accounts after eight weeks.

“Because this training was new, I extended the suspension deadline from eight weeks to 19 weeks and worked with each department head or senior director whose staff were non-compliant including having automatic reminders emailed to the user every two days with a link to the training portal,” Kearny wrote in a memo on Monday to Richardson.

Richardson, during Tuesday’s council meeting, blasted the administration for what he said were tactics that should not be applied to the council, resurfacing old legal issues of mayoral-council authority between Stimpson and the council that were fought more than two years ago before they were settled in October 2019.

“You know why his branch is the executive branch?” Richardson said. “They execute what we do. We are the legislative branch. We make the laws and the rules. We are the leaders of this city.”

CYBER THREATS


Stimpson, in his statement, said it’s the IT department — which falls under the administration’s purview — that hosts the cityofmobile.org domain and email addresses associated with it, including those used by police, courts, permitting and several other city services that communicate with the public.

“While we are bound by the stipulations in our cyber insurance agreement, we also have a responsibility to protect the private information and data of citizens and companies that interact with the city,” Stimpson said in his statement. “That is why we will follow best practices and guidelines set forth by cybersecurity experts.”

Kearny, in his letter to Richardson, said that ransomware and data extortion are becoming more frequent and troublesome for local governments. He said that most incidents involve phishing emails or social engineering scams which are “preventable through end-user education.”

The threats come as computer systems have come under attack in recent months. Among the most high-profile occurred in May by a group with ties to Russia on Colonial Pipeline, the largest fuel pipeline in the U.S. That attack crippled fuel delivery in portions of the Southeast for several days and sent gas prices rising in Alabama and beyond.

Closer to home, Mobile County’s systems had to be shut down for three days in late May after malware was discovered affecting “certain systems.” Mobile County officials have since notified all employees, more than 1,600 people, that their Social Security numbers, dates of birth and other sensitive information could have been compromised during the computer attack.

Stimpson said the testing was a “simple step” meant to educate city employees and elected officials who use an @cityofmobile.org email address about how to recognize common cybersecurity threats.

“In today’s world, cybersecurity is an important human rights issue,” Stimpson said. “One would think Councilman Richardson could take a couple of minutes out of his day to ensure that as he communicates with constituents through email, he isn’t being reckless with their personal information.”

Richardson said that Stimpson should have written to the council members to see if they were open to taking the training, instead of having the IT Department order them to do so. He said he doesn’t have “anything against training.”

Richardson said that he wasn’t faulting his fellow council members who took the training. A resolution, which he is sponsoring and could be voted on next week by the council, makes it the council’s position that all members on the elected body should be allowed “unhindered” to have access to their city email accounts.

“We make the laws of this city,” Richardson said. “Not the executive branch.”

©2021 Advance Local Media LLC. Distributed by Tribune Content Agency, LLC.