Photo: Shutterstock

After two months and two days of dealing with a disabling ransomware attack that disrupted access to their files, Texas' appellate courts are finally seeing a light at the end of the tunnel.

Through a series of file backup systems, the Texas Office of Court Administration was able to restore most of the appellate courts' files, although some of the smaller courts lost some documents, said Casey Kennedy, director of information services at the agency. At this point, Kennedy and his team have restored the courts' case management system. By next week, they aim to fix an automatic link to the courts' websites, so that case filings will start posting online again.

Although it seems a terrible time to deal with a ransomware attack–in the middle of a pandemic—there was actually a silver lining.

"A machine had to be connected to the network to be ransomwared. And so with COVID, we already had a lot of people out of the office. A lot of people took their laptops and went home," Kennedy explained. "We had a lot of people with no need to connect to the network. We did have a lot of people who did not have much impact at all."

Chris Prine, clerk of the First and Fourteenth Courts of Appeal in Houston, said his courts were lucky because they did not lose any documents.

"It was a horrible time—I don't want to ever do it again—but we got back to where we needed to be quickly," Prine said. "We are back up to 99% functioning, of where we were May 7, before this."

In a ransomware attack, cyber criminals infect a computer system with malicious software that encrypts all of the files in the system, preventing the users from accessing the files. The criminals demand the payment of a ransom to restore access to the files. Most ransomware software infects a computer when a person clicks a link in an email or downloads things from a malicious website.

This ransomware attack entered the appellate courts' system through the Texas Office of Court Administration, and spread to the courts and judicial agencies that get technology services from the administrative office. When staff detected the May 8 attack, they disabled a network, servers and websites, which limited the impact.

Read more: Ransomware Hack Disables Texas Supreme Court's Website

Kennedy said he couldn't talk about details of the ransomware attack, like how it entered the courts' network, because law enforcement is conducting an ongoing investigation into the attack.

Kennedy noted it wasn't just the two high courts and 14 intermediate appellate courts that were hit by the attack. The court administrative office also provides technology services for a handful of judicial agencies, such as the State Law Library, State Commission on Judicial Conduct, Texas Board of Law Examiners and others.

A lot is happening to lessen the chances of future ransomware attacks.

Kennedy explained that the court administrative office is working with Microsoft to strengthen its computer security methods. For example, the agency will roll out two-factor authentication to the courts. Another new protection system can monitor all of the computers in the network for malware and delete it before it does harm, Kennedy said.

For Texas Supreme Court Clerk Blake Hawthorne, the pandemic was the worst time to deal with the cyber attack.

"This is the most difficult thing I have had to deal with as the clerk of the Supreme Court," said Hawthorne, who is comparing this experience to his past 15 years of service. "It was frustrating to every one to not have access to things, but we are seeing the light at the end of the tunnel."

Hawthorne said while the case management system was still down, clerks used eFileTexas.gov, the statewide electronic filing system, to upload new appellate opinions and serve them on litigants. The public could still access filings through re:SearchTX, the statewide court document system.

Once the court administrative office restored the appellate courts' case management system, appellate clerks spent long hours on nights and weekends manually entering filings spanning back to May 8 in the system, Hawthorne said. Now they are caught up.

Hawthorne said, "It worked remarkably well, considering what we were facing."