3 Weeks After Hack, This Island Nation’s Government Is Still Off-line

The government of the Pacific Island nation of Vanuatu has essentially been off-line for three weeks because of a cyberattack, leaving people struggling to get access to services and forcing some civil servants to use pen and paper to conduct business.

The government’s network, official sites and online services were “compromised” on Nov. 6, officials told local news media a few days later. Since then, the government has been closed-mouthed about the attack and its attempts to restore the system, leading to criticism from some. One news outlet called the hack “our worst kept secret.”

The attack — which took place the day after a new government, led by Prime Minister Alatoi Ishmael Kalsakau, was sworn in — has caused significant inconveniences for many of Vanuatu’s 320,000 residents, who live on dozens of islands.

“Everything runs on email here, so the email outages are causing a lot of issues,” said Glen Craig, the managing partner of Pacific Advisory, a consulting firm that works with businesses and governments in the Pacific, including Vanuatu’s government. “If you’ve got things in process like building permits or residency applications or work permits — all those services have been held up.”

Emergency services were also affected, with a police hotline disabled for about a week. Government workers’ salary payments were delayed, and some people said they had trouble paying taxes.

“A friend of mine could not get his driver’s license renewed,” said Gilbert Fries, who helps run the Million Dollar View resort on the island of Luganville. “Another friend of mine was unable to pay his property tax on a piece of land within a deadline.” He said workers at ports had used pen and paper to register incoming and outgoing cargo.

Mr. Craig, who lives in Port Vila, the capital, said that while tax payments could be made in person at a government office, “in terms of recording the transaction, it’s being done manually in a spreadsheet.”

Pat Conroy, the minister for the Pacific for Australia, Vanuatu’s biggest neighbor, said on Friday that his country had been helping to bring the government back online.

“We immediately made offers of assistance and we sent in a team to assist with that disgraceful cyberattack and the response, and we are working through the process of bringing the government I.T. systems back up to speed,” Mr. Conroy told reporters in Vanuatu, which he was visiting for a regional conference.

The Sydney Morning Herald in Australia reported this month that the hackers had demanded a ransom, which the government had refused to pay. The office of Vanuatu’s chief information officer did not respond to repeated requests for comment by phone, text and email.

Though governments are hit by cyberattacks “every day,” it is unusual for their systems to be brought down because “invariably governments are pretty good with cybersecurity,” said Nigel Phair, the director for enterprise at the Institute for Cyber Security at the University of New South Wales.

Hackers usually target sensitive data that a government would be likely to pay to protect, Mr. Phair said. “If it’s highly sensitive tax information, or social security or health information or some part of the prime minister’s department — that’s more likely to elicit a favorable response for the criminals rather than an I.T. system which just, for example, looks after the mowing schedule for local parks.”

Carsten Rudolph, the deputy dean of the faculty of I.T. at Monash University in Melbourne, Australia, said that because of their small populations, it can be hard for Pacific Island nations to maintain a cybersecurity staff that can meet the challenges governments currently face.

“It’s not only a problem for the Pacific, but they have specific issues around it because of the sizes of the countries, and because of people moving away because of contact with climate change and risks in the area,” he said. “So we cannot just look at cybersecurity just as an issue that is not connected to all these other issues.”

Mr. Craig, the consultant, said it was “disappointing” that Vanuatu’s government did not have more extensive contingency plans for keeping services going in the event of a prolonged network outage.

“Some departments have been good, they’ve immediately gone on their social media and said ‘these are the alternative Gmail accounts for our staff,’” Mr. Craig said. “Other departments — no, I wouldn’t have any idea of how to communicate with them.”

Vanuatu has been deemed the world’s most at-risk nation for natural hazards and disasters, and climate change will only make it more vulnerable, Mr. Craig said. Another Pacific nation, Tonga, was knocked offline by a volcanic eruption in January, which severed the only fiber-optic cable connecting it to the world.

“In this day and age, especially when Vanuatu is so at risk, it would be expected that there would be more robust systems in place to account for that,” Mr. Craig said.