If you’ve ever been pulled over by police or had an ambulance rush to your home, laptop computers offer a way for first responders to check some of your most personal information. Former Chester County Technical Communications Specialist David Cucchi insists however that the laptops in his county also offered a glaring opportunity for hackers.
“It is the worst scenario that you could possibly be in,” Cucchi said.
Cucchi claimed major cyber security gaps in Chester County’s computer-aided dispatch system were obvious even as he and a colleague were first installing it last August. He later filed a whistleblower complaint earlier this spring alleging that he was fired from his job after bringing his concerns to light.
“I had asked the colleague after that, I said ‘Are we not enabling the firewall?’ And they said, ‘No, it’s just been a big mess since the start of the project,’” Cucchi said.
Without an active firewall and without a unified threat management system, the laptops in about 650 emergency vehicles were open to hacking, according to Cucchi.
The vehicles range from Chester County fire engines and ambulances to patrol cars for local police departments and even security for schools in Chester County such as West Chester University and Lincoln University.
Cucchi insists the cyber-security gaps violated federal rules and also endangered the personal information of anyone who interacted with first responders. He also said they endangered police officers as their locations could’ve been tracked by hackers.
“It’s not a matter of ‘if,’” Cucchi said. “It’s a matter of ‘when’ you’re going to be hacked.”
The NBC10 investigators took Cucchi’s complaint to David Lanter, the director of Temple University’s Information Technology Auditing and Cyber Security Programs.
“The exploits, the folks who are trying to break in, are constantly looking for opportunities to break in,” Lanter said.
Lanter says that if Cucchi’s allegations are accurate, then basic cyber security rules he teaches his students were violated and first responders in Chester County are potentially vulnerable to hackers who might jump in the middle of their communications.
“The information systems are all linked,” Lanter said. “So this was a county system tied to a state system tied to a federal system.”
According to Cucchi, since emergency dispatch is a county responsibility, none of the first responders, from police chiefs on down, knew of the security holes.
Chester County declined to comment on Cucchi’s allegations as they’re now part of an active lawsuit. A spokesperson for the county told the NBC10 Investigators however, “To our knowledge, at no point has criminal justice, law enforcement sensitive or personal information been breached or compromised.”
The spokesperson also said Pennsylvania State Police reviewed their system to ensure compliance and allowed it to go live.
Cucchi meanwhile is urging anyone who interacted with Chester County first responders between last summer and this spring to be on the lookout for identity theft.
“There is absolutely no idea what information has been compromised from our citizens,” he said.