Texas Municipalities and Ransomware: Can the Sheriff Surrender to the Outlaw?

Ransomware attacks against government entities are on the rise. Three Florida towns were infected last month alone, and Texas municipalities are increasingly finding themselves between Scylla and Charybdis: pay ransom to hackers or lose data (or access to data) critical to the basic functions of modern cities. This dilemma has been widely discussed practically and abstractly, but there remains little official guidance as to whether a public entity in Texas can legally pay a ransom, even if it is the financially responsible thing to do.  

In one example from earlier this year, on the morning of January 10, a ransomware attack plunged the municipal government of Del Rio, Texas, into a tech blackout. Hackers encrypted the city’s data and demanded ransom for its release. City Hall employees resorted to working with pens, paper and typewriters to keep the local government functioning.