Florida Digital Service launches $15.9M overarching cybersecurity initiative

The Florida Digital Service is launching a cybersecurity initiative to keep much of the state’s cybersecurity services under one roof.

Officials from the Department of Management Services (DMS), which houses the new Digital Service, touted the $15.9 million program as a “historic” interagency collaboration bringing enhanced, standardized threat protection to more than 20 agencies.

By bundling the agencies together under one contract, the Digital Service saved $4 million compared to what it would have cost the state for each agency to work with contractors directly, which officials say is the current standard.

Lawmakers created the Florida Digital Service in 2020 to maintain state data, set up testing environments to demo state software before it’s rolled out, and facilitate data sharing between government agencies. Among the plans for the Digital Service is to establish a cybersecurity operations center, for which DMS and the Digital Service have requested $8 million for the coming fiscal year.

Former Rep. Jamie Grant, who was instrumental in creating the Digital Service, heads the agency as Florida’s Chief Information Officer.

“This is a historic level of interagency collaboration on cybersecurity. With this step, we are creating the foundation for increasing Florida’s cybersecurity capabilities while also leveraging economies of scale,” Grant said. “By purchasing as an enterprise, FL[DS] will save Florida taxpayers nearly 25%.”

The history of getting state agencies to collaborate on cybersecurity has been “long and fraught with failures,” Grant told the House State Administration and Technology Appropriations Subcommittee on Tuesday.

Last year, the Legislature set aside $30 million in reserves for the Digital Service to pull from, with the Legislature’s permission. The $15.9 million represents the most significant tranche of that cash. But DMS Secretary Todd Inman told lawmakers Wednesday that the office is nearing additional budget amendments “to continue providing the greatest protection to the state’s IT infrastructure.”

For the coming fiscal year, which begins in July, DMS is requesting a second $30 million round of cybersecurity resilience funding, including another $15.9 million to keep the contract spending recurring.

“The safety and security of Florida communities continue to remain a priority for Gov. (Ron) DeSantis throughout his administration,” Inman said when DeSantis unveiled his budget proposal in December. “Reliable public safety communication systems allow front-line responders to do their jobs — these critical investments are yet another example of how important it is in Florida to provide first responders with the greatest available resources during an emergency.”

Florida has been the target of multiple cybersecurity attacks in recent years.

In late 2020, an attack took the Department of Business and Professional Regulation offline. Last January, applicants’ personal information may have been stolen from the state children’s health insurance site. In July, hackers stole the personal data of at least 58,000 unemployment applicants, such as Social Security numbers and bank information.

While not a cyberattack, last fall, multiple state websites went offline after a hardware malfunction at the Digital Service’s State Data Center. A backup processor didn’t kick in as intended, causing about 1,100 servers to go down.

Grant told the State Administration and Technology Appropriations Subcommittee that the Digital Service’s approach has been to earn the trust of state offices to get them to use their services rather than telling them to cooperate with the digital agency.

“We’ve kind of taken the approach as a digital service that we know it might be a little slower to earn the trust, but these agencies have to see us as the cavalry and quit seeing us as internal affairs if they’re going to give us access to the information in the infrastructure necessary for us to do our job,” Grant said.

House Speaker Chris Sprowls didn’t name many priorities during his speech before House members on the opening day of the 2022 Session last week. But he did name cybersecurity as one of the state’s current gaps.

“We’re Florida. We are a huge target for everybody,” Sprowls told reporters that afternoon.

Culprits could span from low-level hackers or 14-year-olds trying to hack local governments to individuals from foreign countries trying to infiltrate state resources. In one instance last year, a hacker reportedly attempted to poison Oldsmar’s water supply by upping the share of sodium hydroxide, a chemical harmful to human tissue at high levels.

“This is something that we expect to read in, like, an Ian Fleming spy novel,” Sprowls continued. “We don’t expect this to really happen to our water supply.”