Porn hack of village meeting video sparks concerns

A discussion about who pays for sidewalks in Fredonia hit a temporary dead end last Thursday when pornographic images and a video suddenly appeared on the Village Board’s live feed, raising concerns about the village’s cybersecurity system.

About 20 minutes into the meeting, the screen was taken over with the images and a video, complete with music and odd noises.

Gasps and some nervous laughter followed. Clerk Michelle Johnson said, “Oh no” and covered her eyes.

Trustee Richard Abegglen calmly got up walked over to the village’s laptop and cut the feed. He turned it back on to record the meeting but didn’t allow anyone to watch from their computer.

Trustee Shane Van Roo provided the Catholic response.

“Well, now we have to go to confession for that, so that’s great,” he said.

Abegglen called the person responsible for of the hack an “asshat.”

“We apparently don’t have the option for sharing turned off,” he said.

“I thought that I had,” Johnson said, “but clearly did not.”

Besides board members, the only other people at the meeting were the administrator, treasurer, public works director, Senator Tammy Baldwin’s representative Rebecca Buretta and an Ozaukee Press reporter.

The recording of the meeting on YouTube has the pornographic section and village officials’ reactions removed.

After the meeting, Village Administrator Christophe Jenkins said he thought the hack might have been inspired by the fact Baldwin’s representative was at the meeting.

Newly elected Trustee Eric Stowe emailed the board and village officials seeking follow-up.

“Will there be any sort of investigation into our security breach from last night?  IMO, that was inappropriate, disgusting and we must take measures to ensure that never happens again,” he wrote.

Jenkins emailed that Village Marshal Eric Leet will investigate the incident.

“We all unanimously agree that last night’s display by our unwelcomed guest on Zoom was inappropriate. We take this seriously and are looking into security measures we can take moving forward to balance public access while disallowing sharing from viewing audience members,” Jenkins said.

Although important systems such as water and wastewater operations have been the target of hackers throughout the country, Jenkins said the takeover of the village’s video feed is not an indication its other systems are vulnerable.

“The electronic systems that operate the water and wastewater plants are managed through Energenics, a third-party contractor responsible for managing the system and providing cybersecurity,” Jenkins said.

The village contracts with Fortinet, a cybersecurity company based in Sunnyvale, Calif., for firewall services.

The village’s internet and information technology infrastructure are part of Ozaukee County’s IT program, Jenkins said. The village uses WIN Technologies, an Eau Claire-based internet provider, and AppRiver, a cloud-based cybersecurity and productivity services provider headquartered in Gulf Breeze, Fla.

Those systems, Jenkins said, are separate from the Zoom feed that was hacked into during the meeting.

“With respect to that incident, we are conducting our own internal investigation and reviewing our Zoom settings and permissions to ensure we have appropriate controls in place regarding who and what can be enabled going forward,” he said. “As with any municipality, the recording and viewing of our public meetings is a constant balancing act between public accessibility and calculated risk.”