A ransomware attack on the City of Atlanta has hamstrung a number of city services for almost a week.

The ransomware breach is thought to be the most extensive on a local government to date. Nearly a week after the attack was first discovered, some city systems remain offline, including city payment and court information portals. Some government employees were able to turn on their computers for the first time Wednesday.

The city tweeted on March 28 that there is “no evidence to show that customer or employee data has been compromised. However, customers and employees are encouraged to take precautionary measures to monitor and protect their personal information.”

Hackers gave the City of Atlanta a week to pay the 6 bitcoin (or roughly $51,000) ransom, the full amount of which would be due March 28, should the city decide to pay the ransom. According to IT security media group CSO, the Bitcoin wallet listed in the ransom note provided to the city has not received any new payments as of Tuesday. Mayor Keisha Lance-Bottoms has not commented on the city's plans for the ransom payment.

Atlanta is not the first city to deal with the question of whether to give in to ransom demands, nor is it is likely to be the last. State and local governments are increasingly a target of ransomware demands. A 2016 survey of local government chief information officers noted that about 32 percent of their data breaches were ransom-related, making such attacks the type most frequently experienced by local governments.

Although cybersecurity vulnerabilities are quickly becoming a headline staple for nearly every major organization, local governments are widely seen as easy targets for breach. The same survey found that less than half of local governments polled had a formal cybersecurity policy, and only 34 percent had a formal incident response plan.  

Jordan McQuown, chief information officer at technology consultancy LogicForce, said that while it may be tempting to think of hackers specifically targeting city governments, he thinks they are usually operating far more simply. “In my opinion, ransomware in almost every form is not targeted,” he said. Ransomware attackers, rather, are looking for the path of least resistance. “They want to make money. It's as simple as that. They want to do it quickly, they want to do it easily, and they want to do it without consequences.”

To McQuown, the question of whether to pay ransom fees comes down to a fairly simple calculus. “The only reason you pay is if you have no real ability to recover your data or if the time to recover would take longer than you have,” he said.

Some city governments have paid for the return of data in a ransomware attack. Officials in Montgomery County, Alabama, paid around $40,000 in bitcoin last year for the return of their data after finding that the county's data backups would be too difficult to retrieve. County commission chairman Elton Dean told the Montgomery Advertiser, “When you are talking about losing $5 million worth of files, that's kind of like an emergency situation.”

Crowell & Moring partner Paul Rosen said that cost alone might be reason enough to pay a ransom. “It may be the case that, from a pure cost perspective, paying a ransom can be more cost-effective for an organization, depending on the harm being caused. But there are also potential risks in doing so, including legal and reputational, some of which may not be easily calculable in economic terms,” he said.

Even when municipalities opt to pay for the restoration of their data, costs associated with rebuilding systems to safeguard against further attacks can be very costly. Officials in Bingham County, Idaho, also opted to pay part of a ransom demand after they were unable to restore some data from backup servers. Even after paying for the return of their data, however, Bingham County spent over $100,000 to rebuild their servers after the ransomware attack.

Most city governments have refused to pay ransomware attackers for the return of their data, usually instead opting to rely on backup servers to restore data.

The U.S. Department of Justice formally “does not encourage paying a ransom to criminal actors.” The agency suggests that affected organizations consider the possibility that ransom payments will not guarantee the safe return of data or that payment will increase the likelihood that organizations will be attacked again.

“I strongly recommend never negotiating with hackers—there's not a guarantee you'll get your data back,” said Darius Goodall, director of product marketing at computer security company Barracuda, though he acknowledged that the dictum is “tough advice to follow when critical data is involved.”

That critical data tends to look a little different for city governments. In Atlanta's case, the ransomware's takeover of city portals has prevented residents from doing business with the city in a multitude of small ways, from paying water bills online to filing event permits.

However mundane these services seem, they're far more valuable in the context of a city's mandates. “A city can have different constituencies than a company. A company often exists to produce profits for its shareholders. A city has other mandates, including public safety and security for its citizens. A city has to think through a broader set of issues than a business may have to consider when it comes to addressing ransomware attacks,” Rosen said.

Chris Morales, head of security analytics at cybersecurity management company Vectra, said that, even when services are down, city governments like Atlanta would do better to revert back to analog systems than to pay ransoms. “The current solution has been to revert to pen and paper manual processes by various city agencies, and that is actually a sustainable model,” he said.

“It is tempting to pay the ransom demand (which is really like a hostage situation), as the value of the ransom to release files and systems is lower than the cost of responding to the situation. That, however, is a bad precedence, and as is commonly known, the U.S. federal government prefers the stance of not negotiating in these type of situations. We need to not reward attackers for their behaviors,” Morales added.

Opting not to pay a ransom isn't always a smooth path, however, even with appropriate backups in place. Following a similar attack last month, the Colorado Department of Transportation announced that it would not pay the ransom; the agency was hit with a second variant ransomware attack. “The tools we have in place didn't work. It's ahead of our tools,” Brandi Simmons, a spokeswoman for the state's Office of Information Technology, told the Denver Post.

Atlanta is currently looking to shore up the city's defenses against cyberattacks for the future. Bottoms told reporters Monday that, while she hadn't thought digital infrastructure security would be a central priority of her tenure as mayor, “at Day 80-something, it certainly has gone to the front of the line.”

Rosen hopes that other organizations, governmental and otherwise, see Atlanta's issues with ransomware as a warning shot. “Whether it's a city or a business, companies and organizations that want to operate in today's digital age need to think through and prepare for these kinds of attacks, and mitigate them by devoting sufficient resources to prevention, planning, and practicing for these kinds of incidents,” Rosen said.