Court delays mount 2 weeks into ransomware attack on Colorado public defender’s office

The Office of the Colorado State Public Defender remains crippled by a ransomware attack two weeks after the malware first forced the statewide agency to disable its computer systems — and the shutdown is raising growing concern across the state court system as delays mount.

Most public defenders have regained access to their computers, court filings and “some client files” since the ransomware was discovered Feb. 9, but “more work is necessary to return to normal operations,” the agency said in a statement Friday.

Officials with the public defender’s office refused to say how much money was demanded in the ransomware attack, in which criminals blocked access to some of the agency’s files and demanded payment to restore that access.

They also have not said whether the office will pay the ransom, when the agency expects to once again be fully operational, what kind of information was breached, and whether the personal information of attorneys, witnesses or victims of crime was exposed.

Public defenders this week still could not effectively represent their clients in court in most cases, said 18th Judicial District Attorney John Kellner, who serves as the elected prosecutor in Arapahoe, Douglas, Elbert and Lincoln counties.

“It’s reminiscent of the COVID slowdowns a couple years ago,” he said. “We have public defenders asking for continuances or resetting trials on most matters.”

In the week after the attack, the statewide number of rescheduled hearings jumped by nearly 600 compared to the previous week, according to data provided by the Colorado Judicial Department. Hearings were rescheduled in about 3,300 cases across the state in the week before the attack, which increased to about 3,900 cases during the first full week that the public defender’s office was dealing with the ransomware — an 18% jump.

The longer the public defender’s office is non-operational, the more of a problem the repeated rescheduling becomes, said 16th Judicial District Chief Judge Mark MacDonnell.

“I don’t think we’ll be able to continue on this path for a long time,” he said. “It’s been two weeks and it’s getting to the point where if it’s not solved, we may have to look at another workaround from their perspective. And I don’t know what that’s going to be.”

MacDonnell added that most of the criminal cases are handled by public defenders in his rural judicial district, which includes Bent, Crowley and Otero counties.

“Every continuance is a case you still have, and it becomes cumulative after a while, which is what we learned during the pandemic,” he said, referring to the time during the height of COVID-19 when Colorado’s courts saw a massive backlog of jury trials because in-person court proceedings were extremely limited.

The most commonly delayed hearings in the first week after the ransomware attack were arraignments, pre-trial conferences, disposition hearings, status conferences and plea hearings, according to the judicial department data, which includes all cases and not solely cases in which public defenders represent the defendants.

In court Friday, public defenders continued to push back their cases. In one Adams County courtroom, two public defenders delayed hearings in four cases back-to-back over a 10-minute span.

“Your honor, the defense is not ready to proceed to trial next week,” public defender Sam Edgerton said. “As the court knows, there has been a malware incident with the public defender’s office that has locked us out of our files and made it so we cannot access any materials needed to go to trial.”

Kellner said there has been some discussion about the district attorney’s office providing public defenders with discovery materials — often voluminous documents detailing evidence — by printing out the material on paper, but that that process is not a feasible workaround.

“Years ago we were set up for that, we had all these printers, and we had people who collated everything,” he said. “We don’t have that process anymore, and we’re not set up to flip a switch and change it… I don’t think anybody anticipated we would have to go back to the olden days.”

The public defender’s office on Thursday denied a public records request from The Denver Post seeking more information on the breach, citing a broad exemption in the state’s open records rules for judicial agencies, which are not governed by the Colorado Open Records Act but rather by rules set by the Colorado Supreme Court.

Those open record rules require judicial agencies to deny “records of investigations conducted by Judicial Information Security, records of the intelligence information or security procedures relating to security events, incidents, or breach, and security structure, architecture, procedures, policies, and investigations,” among numerous other records.

Get more Colorado news by signing up for our daily Your Morning Dozen email newsletter.