“We don’t care about you or your deals, this is just business for us.” That was the message that the Sunapee School District received in October 2019 when it was hit by a ransomware attack. The district’s servers, documents, and critical data and files were locked by an outside entity demanding payment in exchange for the district getting this information back.
Thankfully, Sunapee was prepared. They regularly backed up their systems and were able to get the school back online and restore data, without paying a ransom. Nevertheless, the recovery took nine days and cost the school district $40,000. If cyberattacks can occur in a school district with fewer than 500 students, they can happen anywhere. Unfortunately, not all communities are prepared to address these types of threats.
This summer, I led an Emerging Threats and Spending Oversight Subcommittee hearing about cyber threats to state and local entities and the consequences of cyberattacks on our national security, the economy, and citizens’ lives. There, I was honored to be joined by Sunapee School District Superintendent Russ Holden, who shared the ways in which the Sunapee School District navigated the 2019 attack. At the hearing, experts also reiterated their need and desire to make greater investments in cybersecurity, but explained how funding constraints make it difficult to invest in much-needed cybersecurity improvements.
What happened in Sunapee wasn’t a one-off. A recent study from the Center for Internet Security showed a 19 percent increase in ransomware attacks against K-12 schools between 2019 and 2020. Alarmingly, that number is expected to grow by 86 percent in 2021.
We need to treat cyberattacks as the urgent national security threat that they are, and make sure that all levels of government are prepared to prevent and respond to them – just as we do for other types of threats. We must also significantly improve the cyber resiliency of our communities through dedicated resources and funding, adoption of better strategies for how we respond to and deter these threats, and improved coordination at the federal, state, and local level. We also need to do more to ensure that our country is better prepared to address large-scale cyberattacks like the SolarWinds breach and the Colonial Pipeline attack that have threatened our national security and critical infrastructure.
These threats will continue to evolve, and I am focused on a number of bipartisan efforts to improve our country’s cybersecurity. Last year, I introduced bipartisan legislation, which became law, to ensure that each state will have its own federally funded Cybersecurity Coordinator. Cybersecurity Coordinators will be responsible for helping to prevent and respond to cybersecurity threats by working with federal, state, and local governments, as well as schools, hospitals, and other entities.
In addition, I am working to address the concerns of state and local government officials, who say that they are understaffed and under-resourced in the face of an onslaught of attacks from malicious cyber criminals. Cybersecurity is a key component of our national security and economy, and the federal government –working in tandem with our state and local governments – can make sure our information technology systems are protected against all forms of cyber threats. That is why I am working to create a stand-alone cybersecurity grant program for states.
As we work to improve coordination at all levels of government and give states more funding support, I am also focused on scaling up our national cybersecurity infrastructure. To support that effort, I recently introduced a bipartisan bill to strengthen our federal cyber workforce.
The bill will help bolster our cyber defenses and protect our critical infrastructure by increasing the number of cybersecurity professionals in the federal government. This legislation will also help support our country’s veterans by setting up a cyber-training program at the VA to help veterans secure good-paying, stable jobs.
Just as we saw in Sunapee School District, cybersecurity threats can happen anywhere. We will continue to face new cybersecurity challenges in the years to come, and we must ensure that we have the tools to adapt and respond to them. I am committed to working on a bipartisan basis, and with partners at federal, state, and local levels, to improve our cyber defenses and keep our country safe.
Sen. Maggie Hassan (D-N.H.) currently serves in the U.S. Senate after being elected in 2016 and previously served as the 81st governor of New Hampshire.
Gloss