Theresa Freed 0:00
With increased reliance on technology, cybersecurity is always a concern. But with COVID-19, many criminals are preying on residents in the pandemic. On this episode, hear from Johnson County experts who will talk about cybersecurity issues and how law enforcement the district attorney and our technology department are addressing cybercrimes impacting Johnson County.
Whether you live in or just love Johnson County, Kansas, JoCo on the Go has everything Johnson County. Here's what's happening and what's coming up in the community you call home.
Theresa Freed 0:35
Thanks for joining us for JoCo on the Go, I'm your host, Theresa Freed, a Johnson County resident and employee of Johnson County government. COVID-19 has created public health related concerns but the pandemic has also created a whole new opportunity for criminals to take advantage of people. We have a great group of experts from Johnson County here with us to talk about what those crimes are and how they're being addressed. If you can each introduce yourselves. We'll go ahead and start with the district attorney and then go to Detective Gressel and Bill and Donna.
Steve Howe 1:04
Good morning. It's great to be on this panel hopefully help protect our community from the constant attacks by fraud. My name is Steve Howe. I'm Johnson County District Attorney.
Brian Gressel 1:15
Good morning. My name is Brian Gressel. I'm a detective with the Johnson County Sheriff's Office, specifically assigned to the Cybercrimes Unit.
Bill Nixon 1:22
I'm Bill Nixon, I'm the director of the Department of Technology and Innovation and the Chief Information Officer for the county.
Donna Gomez 1:28
I'm Donna Gomez. I'm Security Risk and Compliance Analyst with Johnson County government and I manage our Cybersecurity Awareness Program at the county. And I also collaborate with the public and private partnerships and share information with our federal partners related to the cybersecurity threats and the events.
Theresa Freed 1:46
All right, well, thank you all for being here. I really appreciate your time. And I know that we'll have some great information from all of you. The pandemic, as I mentioned, has moved much of our work and even our social lives to a remote world. So can you talk a little bit about how reliant we are on technology right now? And we'll go ahead and start with Bill and Donna.
Bill Nixon 2:04
Obviously the pandemic has really increased everybody's use of technology with almost every service that we rely on going virtual, not just work and school, but churches and other organizations. So everybody's really had to scramble to find new ways to communicate with customers and patrons and members, including the county and including many of the people listening here. And the students in school. Internet services have become just as important as water and electricity and other utility services. And the screen is the way that many of us are interacting each day, especially with loved ones that may be at risk, such as in a nursing home. So this is sort of the next normal until we get the virus under control.
Donna Gomez 2:49
Thinking about how we're going to deliver the information to our audiences in new ways. You know, they want access to information quickly, but at the same time, how is this message meaningful and impactful? And how does it impact me and getting getting it out to them in the way that that they want that information?
Theresa Freed 3:07
All right, we certainly know that the the pandemic has really opened the door to cybersecurity issues. So we're going to talk a little bit about that. And we'll go ahead and start with Detective Gressel, if you want to address it.
Brian Gressel 3:19
Sure, I think from our perspective, it's kind of opened things up in two main areas. One, obviously, a lot of people are suffering from a loss of income. So they're seeking out ways to supplement that, which gives those criminals different angles of attack to try to compromise those people from identity theft or even their computer systems. And then also as people are simply looking for information about COVID. They're going out and seeking information on the internet. And so those criminals are also setting up sites to simply take advantage of those people. So for us, like that's the two broad areas that we look at.
Theresa Freed 3:54
And then can you just talk more specifically about what are the what are the threats that we're seeing? What are people calling in saying, I don't know if I've been a victim of crime here, or I know I'm a victim of a crime? What what are the specific details of some of some of those incidents?
Brian Gressel 4:11
For us, it's, again, it's the same stuff we've always seen, it's just now has that COVID angle to it. We have seen cases of people going to websites to find information and then all sudden their computer is compromised, they suddenly receive a virus or they're getting contacted to say we have information for you or unemployment information or even insurance information. So they're just using the COVID pandemic as a angle to take advantage of people and to get them to want to open up because everybody wants information, how to protect themselves how to financially help themselves and it's simply using that as another angle to do the same stuff that's been going on for quite some time. But because of the pandemic there's more of an emergency in people's minds to get this information or to get themselves financially stable
Theresa Freed 5:00
And District Attorney Howe, I know you're probably plugged in pretty well to what's happening as well in this area. Can you talk a little bit about what you're seeing in your office?
Steve Howe 5:09
We do a lot of inquisitions and other investigative tools to target or go after the the crooks, who are taking advantage of individuals. And we're seeing a lot of, you know, your standard phishing, as Detective Gressel said, trying to penetrate and, but we're also seeing misrepresentations, there's a little trick that they're doing where they'll put in the email address, and they'll change one digit, or letter, and get people to respond back sometimes with personal information. Probably one of the worst cases I saw was, a person was selling their house, and was going to take the proceeds to a new home that they were purchasing, and they thought it was their lender. And was, in fact, a nefarious individual that had changed one digit in the email. And they sent an entire equity of their house to a third party. And so that, I mean, you talk about a travesty there, you're selling your house and you're buying a new house, and then all sudden you lose all your, your equity. And so that's a trick that we're seeing a lot from this fraud is just changing certain digits, and making a misrepresentation, and then people not checking that email. And you know, a lot of that comes from, as Detective Gressel says, by penetrating into the systems. They know your, your client base for a company, and they can gain access. And in talking with the state, there is a huge uptick in unemployment benefits. misrepresenting who you are like saying that I'm asking for unemployment benefits, and then sending it to a new address. And so the state has been inundated with that, because of the amount of money coming in from the federal government. So I always say, be very careful, especially when you're making large transfers of money, who you're doing it with, confirm the information with those individuals, so you don't fall prey to that. And you know, I know, Bill and Donna talk about this all the time with our county employees. If you get an email from somebody that doesn't, it's not in context with the usually see from that person, then don't respond. Don't don't send the information that they're asking for. And I think just some of that common sense. And, you know, we're too quick to send an email back instead of thinking before we send, because once they get their their talons on the system, that's when we start to see some real tragic situations, especially for small businesses,
Theresa Freed 7:42
We're in a whole different world right now, where, you know, people who were regularly employed may not have had any interaction with with the unemployment system and and have accessed funds that way. So this is all new territory for them. Are there safeguards being put in place, you know, from the county and from from, you know, the state level that will help people I guess, understand some of those risks or, or be aware that these risks are possible.
Donna Gomez 8:13
So we do have some tip sheets out there, we actually have one that's related to COVID scams specifically. And that really can change on the fly. So I, I've even told people that we could change COVID and just brand it with something else. But they just reuse and repurpose the same scam over and over again. We have tip sheets on phishing, we have it on a multitude of security tips out there just to kind of refresh everybody's mind. Because again, a lot of people have been home. And you know, we're we've changed, we've changed our patterns of the way that we do things. And so a lot of the content was out there. So we have videos, we have the tip sheets, and then we have some, we have some references out there to the other websites, you know, like FTC websites, you're getting scam phone calls, you know how to report those. A lot of people don't report and they just hang up. And we really want to encourage people to report them, because that's how you stop. That's how you stop the scam. And just going out there and telling people what you hear what you see sharing that information, that information-sharing is really powerful to tell people and don't be afraid to tell someone you've been a victim. You know, it's not embarrassing, because being a victim, anybody at any point in time can be one. The whole thing is like we've got to do something, we've got to stand up to them and stop them in their tracks. And so that information's out there on our cybersecurity website.
Theresa Freed 9:39
That's great information. It will of course have links to some of those resources in our show notes of this episode. So in terms of being victimized, this can happen not just one time, but if somebody gets your information, can you talk a little bit about how that can just snowball into a very large problem
Steve Howe 9:58
When they get your information, they will sell it to other criminal elements. And it's not uncommon for them to exchange information, for money, and there's a lot of, unfortunately, they'll target the elderly, and get call list for the elderly and target those individuals. And so what used to be the typical, I guess call list in regards to prank calls, we also see that from an internet standpoint targeting the elderly, and that is a very susceptible group. The reason why we do trainings, at least before COVID, we did a lot of trainings in assisted living facilities and care facilities about how to protect themselves. And I know, other law enforcement does the same. But those things are still ongoing and taking advantage of people. And you know, one of the things I always caution people is, one tip is, don't use your debit card, use a credit card, because a credit card will give you additional protection. And they'll be able to cover some of the damage. If fraud occurs, where a debit card, it comes out straight out of your account, and it's too late and you can't get it back. And so especially on large purchases, make sure that you're very, very careful about using debit cards.
Theresa Freed 11:18
All right, that's great information. I do want to address this is Cybersecurity Awareness Month. This is kind of what's prompting this conversation in addition to the pandemic related issues. So can you talk a little bit we'll start with Donna, if you could talk a little bit about why it's important that we call attention to this issue, at least on an annual basis.
Donna Gomez 11:40
Well, if I had my way every day, it would be Cybersecurity Awareness Month. I mean, I'm just making it a holiday all the time. Because it's meant to raise awareness. Again, we we are creatures of habit, but somehow, some way we always, you know something derails us and gets us off of there. So the month is meant to help residents stay safe online and arm them, really arm them with the information to protect themselves from all the threats. We're providing information and presentations, we did some presentations to our aging population to help them with online scams. You know, they've been kind of disconnected from the world right now. But they are a prime target. And really helping them understand, you know, that emotional response when they're getting that phone call, especially with the way that some of these predators have been to them was that that emotional response should be the first thing to tell them, don't respond, don't give them money, don't give them information. So giving those examples in the presentations is been one of the key. One of the key messages that we provided, knew what not to include in an email what not to say on the phone, making sure everyone you know gets us refreshers on password security and even trying to say don't use a password, use a passphrase going through the all of that part trying to kill the word password, go to passphrase instead. And we increased awareness with our social media with Tech Tuesdays and directing everybody to our cybersecurity website, you that way you get all the tip sheets, and we had our cyberforum today, again, just going over cyber tips and password security tips.
Bill Nixon 13:18
Another key thing I think is think about the information that you're sharing online and use some common sense as the district attorney mentioned. A lot of people participate in Facebook and other social media platforms. And you're sharing a lot of information that people will use, potentially against you. So you may might share where you went to high school or what your first car was, or something like that. A lot of those are security questions that are used to reset passwords. So people just need to be aware and use some of that common sense, and not share as much information online. I hate to say that in this type of environment, but the more you share online, the more people are going to gather about you and the more information they can use to engineer an attack against you.
Theresa Freed 14:05
That's good information. And I think the passphrase, and that's kind of new. So can you talk a little bit more about what that is.
Bill Nixon 14:13
So the the idea behind a passphrase is is really think think of something that you can use to to that would you can use to remember to gain access to system. So typically what people have done is they've used passwords, and it's a combination of upper and lowercase letters and numbers and symbols. And I never can remember them and you probably write them down on a piece of paper somewhere or you use the same one across different websites. And that is not very secure. So the idea behind a passphrase is really think about some type of phrase that you would remember that is longer. So it might be something like something around me right now. So I have a cup that basically says Folds of Honor on it. So I might use that as a passphrase. And include some numbers and letters associated with that. So I might associate Folds of Honor, put 2020 in there, put $1 sign in there something like that, that's going to be something that I can remember a whole lot easier. And it's long. So it will be hard to crack compared to a have random combination of letters and numbers. Another thing that a lot of people can use is a password wallet. And there's, there's a number of them that are out there that will generate passwords for you. And you really don't have to remember any of your passwords for your websites, or for your online services, they're stored in this wallet. And as long as you know the password to the wallet, then you can get access to that. The nice thing about that is it forces you to use a different password, or passphrase, across different websites. That is critically important. Don't use the same password to get to your online banking website. For example, as you do to get to Facebook, as you get to get to Twitter, use different passwords across those different platforms. Because if one site gets compromised, and passwords get leaked, then they might have access to your banking accounts or other accounts that you have out there.
Theresa Freed 16:17
Alright, those are some good tips there. I want to talk a little bit to about how you investigate these crimes, and then also how you prosecute them. It seems like when you think of a cyber-related issue, that there's just some criminal out there far, far away who you'll never be able to catch. So can you kind of talk a little bit about how you approach these issues?
Brian Gressel 16:42
Well, it's, it's really pretty complicated, because usually, there's more than one issue to resolve, you obviously, potentially have kind of a social engineering identity theft issue, you might have a financial issue. And then you also might have the technology that's involved. So we've spent a lot of time initially, just trying to figure out what exactly is occurred, do we have just someone was convinced to give their information away, that's certainly a big problem. But in the middle of all that did they also compromise that person's computer system, so we need to look at that also. And then obviously, usually money's involved. So we also the banking side to look at. And so these investigations turned into multiple avenues we have to look into. And luckily here in our area in Johnson County, we kind of have not only the resources, but some places we can take things to look at the technology side, between most law enforcement in Johnson County, the District Attorney's Office, we have pretty good resources to look into the financial side. But all that takes time. And sometimes it also takes our victims if you will, like we said earlier, it's, it's I understand the embarrassment, but it's not time to worry about that if we have a chance to get any money back, we need to get on it immediately. And we run into that a lot that usually find people call us three or four or five weeks later. And then on the finance side, we're stuck. And then technology side, new things come out every day. So it's it's tough to stay on top of that. But it is extremely difficult, technical, and complicated. But at least here, we definitely try our best to look into it and figure out where things went.
Steve Howe 18:24
And the struggle that both the investigators and the prosecutors have is that technology is ever changing. And so are the strategies of the criminals who are employing technology to commit fraud and other types of criminal conduct. And so that makes us always a step behind trying to catch up with the different techniques that they're using. And I agree with Detective Gressel, I think we're much better equipped in our jurisdiction than most jurisdictions in not only investigating, but following through with investigations and going after individuals. You know, that probably the biggest frustration is some of these frauds are actually things that occur from outside Johnson County and outside the United States. And so when those things happen, we have no opportunity to go after the bad guys. And so usually we refer those cases on when we find out that's where it went to the FBI, so they can track that and see if there's any kind of consistency that they can show and be able to target those individuals. But we also have homegrown individuals that commit these frauds and when those things happen. Luckily, we have a great investigations unit with the sheriff's office and other agencies. We've taken down some local groups that target people committing these frauds, and I give them a lot of credit. They work very hard with us to target those individuals get them arrest them, and we prosecute them and they're not always easy cases as Detective Gressel said, they're very complicated, it takes time to go after them. But, you know, everybody's been a victim of some form of identity theft, I have. And so I think it touches upon our entire community. And that's why we've made it a real emphasis is, you know, we may not be able to stop all of it, but we're going to be able to stop some of it, and do our best to protect people. And then, you know, Donna and Bill talked about, you know, really working on the education piece and trying to reduce the number of people who are victims of crime. And I think that's an important component, whether it's through the county directly through their sites, and also with law enforcement, educating individuals about their, their banking habits and what they should or shouldn't do. I think it's a kind of a cohesive strategy to try to reduce that type of crime.
I want to talk just a little bit too about what the recovery process looks like for victims, I know that, you know, especially if you've been hit multiple times, or in multiple ways, it can be very challenging, are there any resources available to help people through that process?
Brian Gressel 21:06
We spend a lot of time on our investigations really focusing on the victim, we recognize that with this type of crime or suspects literally, could be anywhere. And so we spent a lot of time discussing with them on avenues they can take, we encourage people, you can go to identitytheft.gov, which basically is there to help you learn what you need to do to protect yourself. And it provides forms and different things you can contact. And then we you know, we encourage people, unfortunately, the danger to this is, which is kind of been mentioned earlier years, you're gonna have to keep track of what your finances look like, for quite some time, if not forever, and to really pay attention to your your financial situation, your banking information, your credit cards, your emails, and all that stuff. And so really, we just encourage people to keep track of their information. Going forward and certainly after something's happened.
Steve Howe 22:05
And so many people are going to have to change their bank accounts or credit card numbers, because they just been compromised to the point where if they keep them open, they're just susceptible to further fraud and so many times, yeah, it's a huge pain for people. But they've got to transfer all that data and information into new accounts, to protect themselves and, you know, using Experian and other type of credit checks. I mean, I know, Brian and I both talked about, hey, you got to continually check those moving forward to make sure that again, you don't have an incident eight, nine months later, where someone's trying to use that same information. And so it, it is probably the biggest crime as far as the magnitude on society. Is this type of fraud that's occurring over the internet.
Theresa Freed 22:55
What do you do first, you know, if you find out like, your bank account is suddenly down like $1,000, or something just isn't right, something looks looks like you've become a victim, what is the very first step that you need to take to get the ball rolling and stop it,
Bill Nixon 23:11
As soon as you notice something, contact the right person. So if you notice that something is weird on your credit card account, or your bank account, contact the credit card company, contact the bank. If you're at work, contact the security department or the technology department at your employer. as Detective Gressel said earlier, timing is critical around this. So contact somebody as soon as you think something strange is going on. Even if you're not sure. It's better to reach out and have that discussion with your bank to say, Hey, I see these charges. I really don't remember what happened. Can you let me know. And it may be something that you forgot about or that your spouse did or something like that. But have that discussion as quickly as you can. And make sure that you're reviewing your bank accounts and your credit card statements on a regular basis as well so that you can see them.
Theresa Freed 24:04
What's your top tip. In order to avoid becoming a victim?
Donna Gomez 24:08
I promote see something, say something. That's the biggest thing. Don't be afraid to speak up and talk about it. Because you know, a lot of times somebody else has been a victim where they've seen the exact same thing. And that helps law enforcement as well. Information-sharing is key. And so talking about what's happening to you helps make other people aware of the problem and aware of the threats to prevent you stepping into it. We talk about when somebody is lurking in our neighborhood, but we don't talk about the cyber stuff, because we can't touch it. We need to start talking about that a little bit more to help other people not fall for the same type of threat.
Theresa Freed 24:48
That's great. Thanks, Donna. And Bill.
Bill Nixon 24:49
Don't be afraid to ask the question or reach out. If you see something that's strange and you think well, I'm really not sure. Don't be afraid to pick up the phone. call somebody, don't be afraid of the technology use the resources that are available to you so that you're not a victim so that you can help us fight against the cybercrime that's out there.
Brian Gressel 25:12
Right the question may be more than one. I know for us when someone's kind of been a victim of identity theft through a computer, or they've been pressured to give money or pressured to go get a gift card, everybody hears all the time. Government doesn't ask for that. Everybody knows that. But what I find is those who end up doing that. Almost every single person says I knew better. I don't know why I did this. And so you hear if it seems too good to be true, or it just doesn't seem right. But people are taking advantage of them by saying it's COVID related or, you know, using their emotions. So if it doesn't, if something doesn't feel right, even if you don't understand what it is, like Bill said a second ago, stop. Contact somebody, there are a lot of these criminals will tell you, you can't hang up the phone, whatever. But if you start in your mind, something doesn't seem right. That's probably true in almost everything, you can stop at some point and contact someone, if it's if it's that good of a thing, it'll still be there. But so I think for us, trying to listen to your intuition really would probably help a lot. And then if you if you still went through with it, contact law enforcement contact, I think we'll have some things sites to go to but let people know. So that we can look at it.
Theresa Freed 26:35
That's great. All right, district attorney?
Steve Howe 26:39
I would say two things, hang up and delete. So if you don't know a person that is calling you and trying to pressure you, and you don't know them hang up. If you see an email that you're just like, wow, that I don't know that person or that that doesn't sound like what Donna usually sends me or that's something odd, delete. Because if they are legitimate calls, or legitimate email, someone's got a follow up, right. But that's how they get you hooked. And so I always say hang up and delete is that if I don't recognize you, if I get a crank call, it's like, hang up. And that will protect you nine times out of 10 by just taking those simple steps. And so that's my advice.
Theresa Freed 27:33
All right. Great advice there. And just a final final question there. So someone's a victim of the crime they call 911. Do they call the FBI? Who should they reach out to?
Steve Howe 27:45
I would say everybody should call Brian Gressel. I would say call your local police department.
Brian Gressel 27:55
Yeah, and I would too. If we get a lot of calls at the sheriff's office where there's no money lost. And they're not sure if they should or shouldn't call, yes, call. If there's no money lost, we still want to document one of the sites that anybody I talked to I tell them to go to ic3.gov. That's run by the FBI. And what's good about that at the local level, yeah, we can't necessarily know what's going on in the state two or three states over on the East Coast, West Coast. But if everybody would go there, they have analysts that look at that and can help say, wait a minute, this, this email address compromised someone in Overland Park and oh, they also compromised somebody in San Francisco. That's how the federal government and even local government can kind of start trying to piece together where some of this is occurring. And, you know, that site, again, if you're happen to unfortunately, don't want to contact local law enforcement because you're embarrassed or whatever, go there, put it there, we can still take that information and apply it. Pretty much. There's several law enforcement agencies in Johnson County, they're attached the FBI to the Secret Service, so we have resources to try to take these investigations further. But if we never know about them, then we obviously can't do anything about them.
Steve Howe 29:12
And I would agree with buying is like report it because I will tell you even locally, if Brian starts to see a trend of three or four different calls, then either his office or my office will send out a bulletin if there's a trend hitting the county where they're like, you know, the old, hey grandpa I got arrested. Can you send me some money so I can get out of jail, that kind of stuff. So when those things start circulating through the county, if we get enough of those calls, we'll we'll send out a bulletin alert to the public. And that's why it's so important for people to report that to law enforcement so we know things that are going on.
Theresa Freed 29:49
All right, great information. Thank you guys for for joining us today. I know that you're all very busy and taking the time to discuss this important topic is of great benefit to the public and hopefully none of our listeners become a victim but if they do, they now know where to turn for help. So thank you all. All right, and thanks for listening.
You just heard JoCo on the Go, join us next time for more everything Johnson County. Have a topic you want to discuss? We want to hear from you. Follow us on Facebook and Twitter at JoeCoGov. For more on this podcast, visit jocogov.org/podcast. Thanks for listening.