Bill readying state’s response to potential cyberattacks heads for House Floor

For people charged with digital security in the information technology industry, the mantra is when, not if, a cyberattack will occur.

As an example, Rep. Kristin Bahner (DFL-Maple Grove) said states have received FBI and Department of Homeland Security warnings that state-sponsored hackers in Russia have “openly threatened” to attack people or institutions that oppose them or the Ukraine invasion. “They are one bad actor on a very long list.”

Ideally, nothing will happen to the state’s information and technology telecommunications infrastructure. But what if something occurs and Minnesotans could not access health benefits, renew a driver’s license or receive a tax refund?

Bahner sponsors HF4568, a bipartisan bill that would designate IT infrastructure as critical infrastructure, would reference cyberattacks in much of the state’s emergency management law, and allow the governor to declare a peacetime emergency for a cyberattack on the state's information and telecommunications technology infrastructure, systems or services.

“The intent is to be laser-focused on the preservation of infrastructure assets and benefits to our state and our citizens in the event of a cyberattack,” she said.

“The (proposed) legislation provides clarification to allow us to respond more quickly with the partners and resources we need at the table to address urgent and critical needs,” said Rohit Tandon, chief information security officer for Minnesota IT Services. “This will be used if and when a cyberattack threatens life or property and local government resources are not equipped to handle the situation.”

Approved 12-0 Tuesday by the House State Government Finance and Elections Committee, the bill’s next stop is the full House.

“This is something that is actually nation leading,” said Rep. Jim Nash (R-Waconia), who serves on a National Conference of State Legislatures cybersecurity task force. “… This is a good bill and will actually make a difference.”

If a cyberattack were to occur, Bahner said, the goal is to act without hesitation. “There is no time for deliberation or debate. As legislators we have a duty to our citizens and our state. We must lead, not wait for disaster to strike.”

Having such a process would make Minnesota eligible for federal disaster relief funding to recover should an attack occur.

A companion bill was introduced Tuesday. Sponsored by Sen. Mark Koran (R-North Branch), SF4388 awaits action by the Senate Judiciary and Public Safety Finance and Policy Committee.