In a press alert sent to local media Monday night, Oak Ridge Police Chief James Akagi described an email phishing scam in which the recipient was informed of a red light camera violation and given a false hyperlink to see photos of the violation and pay the fine. Akagi’s alert suggested those receiving the email should immediately delete it.
As it turns out, no such scam existed.
The email was part of a cyber security exercise at Oak Ridge Associated Universities. ORAU spokesperson Pam Bonee tells WUOT News the company regularly plants these faux emails in their employees’ inboxes as a way of teaching them about phishing scams. “Our cyber security people have gotten really good at making them look real,” she says.
Bonee says the Oak Ridge Police Department knew nothing about the exercise until an ORAU employee alerted officers. “We assumed it would stay in the organization,” she says.
Speaking to WUOT News Tuesday morning, Akagi says he's not upset with ORAU. “In fact, this is good policy. ORAU is smart to do this to educate their employees about phishing scams. And they don’t have any obligation to coordinate this exercise with the police department.”
Pam Bonee says any employee clicking on the link would have received a message informing them that they’d fallen for a hoax. The message would then explain options for dealing with similar scams in the future.
When asked if anyone at the police department had clicked on the link, Akagi says it would have been risky to do that. “And at that point, we didn’t have any victims,” he says.
Akagi says he wouldn’t handle the situation any differently in the future. “Our role was to inform the public as quickly as possible and that’s what we did.”
“These things just happen.”