On a normal Monday morning, police surveillance cameras might have spotted Vivian Marrow’s killer as he left the grandmother to die in her wheelchair. But a cyber attack on the city’s cameras in the days before President Donald Trump’s Jan. 20 inauguration left the surveillance footage blank, and Marrow’s family searching for answers.
On Jan. 12, 70 percent of Washington, D.C.’s police surveillance cameras went dark. The cameras had been infected with ransomware, a type of malware that shuts down a device until its owner agrees to the hacker’s demands, usually money. Four days later, a camera on a southeast D.C. corner was still inactive when Marrow, 68, left her home on her motorized wheelchair and crossed paths with two men, one of whom was chasing the other with a gun. Footage from the nearest functional camera—distant, grainy, and partially obstructed by a tree—shows two blurred figures sprinting from the scene while Marrow’s wheelchair spins in place. But the closest camera, which might have shown her killer’s face, was on lockdown.
Neighbors in Marrow’s apartment complex knew her as “Miss Vivian,” they told The Washington Post. A grandmother, Marrow was known to open her home to anyone in need, taking in the homeless and playing gospel music from her wheelchair. In the summer, Marrow would grill hot dogs outside her apartment and give them to anyone who asked, neighbors told the Post. She kept cookies for neighborhood children, who called her “the Candy Lady.”
ADVERTISEMENT
Marrow’s kindness was a balm to her community, where 10 people had been shot to death over the past two years on her block alone. In an effort to step up security, the housing complex had installed 22 cameras. But when a stray bullet struck Marrow shortly after 10 a.m. on Jan. 16, the closest camera was one of the 123 police-owned devices that were shut off during the ransomware attack.
The use of ransomware against government-owned computer systems has increased in recent years. In November, hackers locked down computers in San Francisco’s train system, refusing to unlock them unless the city paid approximately $73,000 in Bitcoin. (The city refused and gave commuters free rides until an IT department managed to wrest control from the hackers.) U.S. Police departments and schools also came under ransomware attack in 2016.
When 123 of D.C.’s 187 police cameras went offline on Jan. 12, the district refused to pay the hackers’ ransom. The hackers reportedly targeted cameras connected to public internet, disabling 70 percent of police CCTVs. But even with an IT team working frantically to restore the cameras before Inauguration Day, the system still took four days to fully repair—and on the fourth day of the outage, Marrow was killed.
Footage from one of the apartment complex’s cameras, released by D.C. police, shows the scene in partially obscured, grainy detail. Marrow was in her electric wheelchair, the same seat from which she would play gospel music for her neighbors. She was moving down the sidewalk on a morning trip to the grocery store, her son William told WUSA9. When the two figures came running from behind her, one of them—a man in a red shirt—appeared to be fleeing the other, a man in a dark sweatshirt. As they ran past Marrow, her chair stopped moving. The gunman in the dark shirt paused and turned back toward Marrow. For a second he appeared to consider going to her aid, then sprinted off around a building. The man he was chasing made a beeline in the opposite direction.
In a statement to The Daily Beast, D.C. police confirmed that their nearby security camera had been hacked but said they doubted whether the footage could have identified Marrow’s killer.
“The camera located at Elvans and Stanton Roads, SE was infected with the ransomware, though we believe it did not have an impact on the case,” a police spokesperson said. “As you are aware, we were able to retrieve footage of the shooting from the residential property that captured the masked subject responsible for the senseless murder of Mrs. Marrow. We have received community tips concerning the shooting but still need additional information to identify the individual responsible and believe that the community will be instrumental in helping us close the case. All cameras are operational at this time and there are measures in place to prevent this from occurring in the future.”
But an unnamed police source told D.C.’s WUSA9 that the hacked police camera was closer to the crime scene and higher quality than the apartment complex camera that recorded some of the killing.
On Jan. 19, Britain’s National Crime Agency arrested two 50-year-olds for the ransomware attack on D.C.’s police cameras. The unnamed suspects, one British and one Swedish, have been released on bail until April.
In D.C., officials have yet to announce any suspects in Marrow’s killing. Police have offered a $25,000 reward for any information leading to an arrest.
