Quincy Police Chief Rob Copley says a recently completed FBI
investigation revealed that a Web site hosted on the city of Quincy's
computers was hacked into and altered last year.
However, Copley said there is no way to identify who was responsible for the breach.
Copley said last fall that an e-mail address listed on the Quincy
United Soccer Club's Web site was altered, which led the Quincy Police
Department to ask the FBI for assistance in investigating the matter.
"The FBI has finished their investigation," Copley said. "Our
investigation remains open until we receive official reports from
them."
Jim Murphy, director of the city's Information Technology Department
and the president of the soccer club, filed a police report in early
October stating that the Quincy United site had been accessed without
authority and information had been "altered."
Murphy stated the "intrusion" took place on more than one occasion
between mid-July and mid-September. Murphy said his contact information
on the Quincy United Soccer Club site was changed from his personal
e-mail address to his city e-mail address.
Copley said there was speculation Murphy himself might have hacked into the site, but he says that theory "doesn't make sense."
"The issue came to light after somebody outside of city government
saw his work number on the site," Copley said. "We were hoping for a
direction to go, but the results we are getting indicate there is no
direction to go in. It could be anybody."
Copley said QPD wouldn't be doing much more "active investigation"
and said the case likely will be closed if no new leads are developed.
Murphy says he "wouldn't want to speculate" on who might have altered the site.
"Relief? No. We were not involved in the first place, but it is nice
for the public to understand it was not internally done by the city,"
Murphy said. "We knew all along nobody on my staff was responsible, but
that's why we took it outside and got the FBI involved."
Quincy United is a nonprofit group of traveling soccer teams. The
city permits state-approved nonprofit groups to use the city's server
as a Web site host free of charge. Murphy said six or seven groups use
the server.
Both Murphy and Copley said the city's server is secure.
"We wanted to make sure the city's Web site wasn't compromised, and
they did find out it wasn't compromised at all," Murphy said. "To me,
that's the biggest relief of this whole thing."
The FBI used a backup file to examine server access. Copley said the
FBI investigation indicated the site was breached by an automated
"bot," software applications that run automated tasks over the
Internet.
The FBI could not determine who loaded the information because an
anonymizer, used to protect identity, did not leave embedded codes to
trace.
"When there is a change in a file, it normally shows the user's name
and password," Murphy said. "We saw the file get changed, and that
didn't happen."
Copley said there were no extra costs incurred by QPD for having the FBI assist in the investigation.
-- rhart@whig.com / 221-3370