Bill creating standard procedures before paying hackers gets House committee nod

A bill advanced Tuesday to require local governments to go through a checklist — including reports to law enforcement — before paying hackers for hijacked data.

The Committee on Military and Veterans Affairs, Space and Domestic Security approved Sen. Travis Hutson’s proposal (SB 1670). The bill is not so strict as other legislation (PCB Sat 22-02) forbidding paying hackers’ demands altogether.

Instead, it outlines training certain government employees should have and requires local governments to have a cybersecurity plan.

“This bill deals with the importance of being on top of and training for cybersecurity attacks, which are very prevalent and ever-increasing means by which our adversaries around the globe seek to gain information and also sabotage our systems within our country,” said Sen. Danny Burgess, who stood in place of Hutson to introduce the bill.

A rising wave of hackers is using ransomware to target government entities.

The city of Riviera Beach agreed to a $60,000 ransom payment to regain data access in 2019. The Broward County schools refused to pay a $40 million ransom demand and had some 26,000 files stolen from district servers posted online last April. The city of Pembroke Pines was hit with one last month that disabled the city’s systems. And in late 2021, Broward Health, one of the county’s two health care authorities, also had a breach that exposed patients and employee data.

This bill directs the Florida Digital Service to create a checklist for local governments to consider before paying out. Payouts would not be allowed until both the Florida Digital Service and local law enforcement are informed about the ransom demand.

Sen. Gayle Harrell called it an area that has been neglected.

“This is a step in the right direction,” Harrell said, “but we have a very long way to go in the state of Florida to truly address this.”

She noted that the bill does not explicitly include school district and constitutional officers that she believes absolutely need to be included.

Harrell added: “I … hope we can help it get better.”