Editor's note:
This story was updated to include information from a security review that was conducted about the hack. It was also updated to clarify the hack occurred before the auditor was able to share her screen.
The auditor was about to share her screen Monday morning when the presentation turned pornographic.
The Rea & Associates report was supposed to be uneventful — the Development Finance Authority of Summit County’s books were in good shape — but the meeting was derailed about five minutes in by a hacker.
In the DFA board room, on the 17th floor of 1 Cascade Plaza, the drop-down screen where a Zoom meeting was projected was quickly overtaken. In speaker view, the pornographic and antisemitic images loomed large. Racist language came through the speakers.
“What is this?” the auditor, Katie Snyder, said.
“You’ve been hacked by the CCP thugs,” a voice said. “Shut down the meeting now.”
The names of two other groups claiming responsibility also appeared on the screen. Reduced to Brady-Bunch-squares in an attempt to take back control, the images only multiplied — dozens in one box, instead of one, while “TiK ToK” by Kesha played in the background. Leaders of the DFA, a local port authority, rushed to shut it down.
“That is not my screen,” Snyder said.
The images were visible for 30 seconds.
“Wow,” said Mark Lerner, chair of the board of directors and the president emeritus of GOJO Industries, once the meeting had abruptly ended.
“I guess the rest of the meeting will be boring,” said Lori Sallaz, the DFA’s chief lending officer.
“This should not be happening,” said Rachel Bridenstine, the DFA’s president.
Zoombombing disrupts, often halts public meetings
Should not, but does. Since 2020, when much of the world turned to video meetings in the wake of the coronavirus pandemic, zoombombing has affected schools, companies and governments. Then-Sen. Sherrod Brown asked the Federal Trade Commission to investigate its encryption claims in 2020.
Such hacks have continued in recent months.
- In Indiana in March, the Indiana Capital Chronicle reported at least four state meetings had been halted by pornographic content and KKK imagery
- In April, the East Hampton Star reported a Sag Harbor, N.Y. ,budget meeting was interrupted in a similar fashion.
- And in Weber County, Utah, ABC4 reported a June interruption that showed visually inappropriate content.
Bridenstine said she had no reason to believe the DFA had been specifically targeted.
The authority has cybersecurity in place, she said, and reached out immediately after the meeting to see about making it more firm.
A spokesperson from Rea, Becky Boyd, said in an email that she was made aware of the “unfortunate situation” that happened at the meeting and was working to gather more information.
“The situation was in no way related to Rea or any of our team members that were in attendance,” she said.
In a second message, Boyd said a thorough review showed it was “external guests” who displayed inappropriate content. Bridenstine agreed, saying in an email that the DFA’s IT providers reviewed logs and confirmed that rules are in place to prevent someone from elevating themselves to control a meeting without the cybersecurity team accepting it. A series of reviews showed everything was secure.
‘There are evil people out there’
While most of the board members had joined the meeting through Zoom, Lerner, staff members and guests were in the board room for the 8:30 a.m. meeting. The Zoom link was publicly available.
“This event is certainly upsetting for all that were involved in the meeting,” Bridenstine said in a statement. “However, the reality is that this was a public URL for a public meeting, and this was outside of our environment and IT control. We will do all we can to mitigate any future occurrences of this nature.”
She said those efforts include looking at alternatives to Zoom for future meetings.
Bridenstine said that, after the hack, everyone who had been logged on to the meeting was sent a new link. That would have ensured any members of the public who tuned in to watch had access but would have prevented any other interested parties from joining the meeting late.
The rest of the meeting was uneventful, but what to record in the minutes remains an open question.
Chief Financial Officer Chad Mayle apologized to board members once he was able to rejoin the Zoom. His crime, he said, was telling everyone the meeting would be boring.
“There are evil people out there,” said Dan Rice, the vice chair of the board and president and CEO of the Ohio & Erie Canalway Coalition. “So don’t worry about it.”
