It should be noted that the NY library system (NYPL, QPL, BPL) are some of the most well funded libraries in the world, and they still have issues like this. Smaller libraries have no chance.

I'm unconvinced this is true.

Most of what libraries do technologically is now outsourced to SAAS companies that specialize in the library space (there are at least 2 major one in the US, and I think at least 3 or 4). (encore and bibliocommons are the 2 major ones that I remembered and am pretty sure I've seen at least 2 others).

If everything you are doing is in the cloud, I'd argue that recovering from a ransomware attack is more of a question of if the SAAS company did its job right (which it should be more capable of handling). Of course, that's a reasonable question if they did (similarly why I prefer paying with paypal or google or even (as not so common) amazon third party payment systems than a retailers own internal payment system, yeah they might screw up too, but they invest a lot more into not screwing it up).

There's a good list illustrating the market at https://librarytechnology.org//products/

I've noticed Spydus seems to have a big marketshare in the UK.

The data is probably is somewhat safe in the cloud. I expect what’s infected is a bunch of PC clients locally. The logical thing that could have happened is someone with an admin level of access on the Windows domain opened an attachment or got phished, and that allowed the ransomware to deploy to all the on-prem systems. Unless they have customized the ransomware to do anything special for this particular library software, it may be not all that bad in terms of data at risk. Though it’s possible the human attackers received cloud software credentials, and could have used that to exported patron data to threaten to leak.

And they would risk being completely shut down, I assume. Is that a better option? I'm not even talking about the livelihood of the librarians, but about the loss of the public service.

As long as they are digitally storing/processing PII, I would say yes. If they can't reasonably guarantee the security of such information, they should simply shut down their online presence.

Winging it and making do with what you can is still probably a great deal for the public. Assuming that something shouldn't be done if it can't be done very well is an interesting position to take.

Typical developer response: if you can’t do X 100% properly you shouldn’t be doing it.

Sure, let’s close down all libraries and all public services for that matter. Let the public feel the pain. They will understand and vote better next time, right?

You think it is lack of information that got people to vote for this nonsense?

Closing things down is the argument taken to a logical extreme. Could they function without collecting that much PII though? If you can't do it right, don't do it, is far more reasonable when limited to just the collection of PII or other potentially sensitive information. Some identifying data might be absolutely required of course, but the great many cases like this show that collecting the absolute minimum must become the default choice.

If you leave your car unlocked and police detects that, they can confiscate your keys and probably even fine you after you collected them. The same principle applies to everything. To a certain extend, it is your duty to secure things. Just putting a sign there "please dont fuck with me" isn't enough these days.

What if the budget is cut so harshly that there is no budget for someone who might potentially notice the problem (and fix it before it is exploited, or make the “we have to stop” decision) at all? The problem becomes undetectable until exploited, so you can't proactively shut things down.

Your assumption that enough people would change their vote (or non-vote if they didn't turn out previously) based on this to make a difference, I think is unlikely to be correct. People complain a lot about public services when they don't work well, but seldom consider (or do but seldom prioritise them) them at the ballot box.

Well, i am basing this on 25+ years of being sysadmin at governmental organisations where most of my colleagues never learned the password to the next level. The password being “no”. Instead they always (alway!) hide the pain so the management layers above know nothing. If they were ever interested. By showing the pain we may actually get them interested. We tried hiding it. Didnt work. Lets try something different.

> People complain a lot about public services when they don't work well

It is their right to "complain" since they pay for these services with their tax money.

That's the yardstick we use for corporations who put profit before safety, and you want use it with government services. Good luck with that.

Was it really so bad the last time you visited a Queens Public Library?