Jesse Scheckner
State lawmakers have agreed for years on the need to strengthen Florida’s cybersecurity infrastructure, but the Legislature is nevertheless divided on several key budget items meant to protect governments from digital intrusion.
The House and Senate have concurred on a few smaller items, including $1.5 million for staff hires in the office of state Chief Information Officer James Grant, a former state Representative. On $117 million in additional spending, however, the chambers are in deadlock, prompting negotiations to be “bumped” from subcommittees Thursday to the full appropriations committees.
The House has proposed spending the full $117 million sum on four items.
The Senate’s counteroffer so far: not a cent for any of them.
One of the items would see $50 million in general state revenue set aside to implement some of the 87 recommendations included in a 2021 report from the Florida Cybersecurity Task Force. Half would be recurring funds, the other for this year alone.
Another would OK $30 million in nonrecurring general revenue funds for a local government cybersecurity technical assistance grant program. The Department of Management Services would be in charge of administering the grants, whose clearance to counties and municipalities would depend on criteria Grant and his staff determine.
Reports on the program’s progress would be due to the Governor’s office and the heads of the Senate and House appropriations committees every quarter.
Yet another item would approve $30 million more in nonrecurring general funds to help government employees beef up their cybersecurity skills.
The money would be transferred to the Florida Center for Cybersecurity, also known as Cyber Florida, “to conduct cybersecurity training for state and local government executive, managerial, technical, and general staff.”
The University of South Florida, which has housed the center since its 2014 creation, would be required to “coordinate training to minimize travel and ensure that training already offered by state colleges and universities are utilized.”
The university also would be responsible for delivering quarterly progress reports identifying, “by government entity, the quantity and type of staff receiving training, planned and actual costs incurred, and any issues and risks.”
The House and Senate also are split on $7 million for Cyber Florida to use in conducting “a comprehensive risk assessment of the state’s critical infrastructure,” which would result in “recommendations to support actionable solutions for improvement of the state’s preparedness and resilience to significant cybersecurity incidents.”
Those assessments would be due June 30, 2023, to the Governor, Senate President, House Speaker and the Florida Cybersecurity Advisory Council, which lawmakers established last year.
The appropriations incongruity between the House and Senate has little to do with the need for cybersecurity improvements across the state. In October 2020, the state’s licensing agency fell victim to “malicious” online activity. Last February, a hacker unsuccessfully tried to poison the City of Oldsmar’s water supply. A few months later, a breach of Florida’s unemployment site exposed the personal data of 58,000 claimants.
Instead, it could be because of how slowly prior funding earmarks were spent. Florida lawmakers allocated $30 million last year for Florida Digital Services, an agency Grant oversees within the Department of Management Services.
But months after the money was cleared, Grant had yet to spend a penny, according to the Miami Herald, which found the agency was bleeding staff, including two chief information security officers, a chief data officer, enterprise architect, chief operations officer and half the state’s new cybersecurity team.
More recently, Florida Digital Services announced a $16 million interagency program to enhance threat protection for more than 20 state agencies.
The Senate also may see the funding set-asides as redundant following Gov. Ron DeSantis’ announcement Wednesday of a $20 million cybersecurity workforce education program. The program will launch at the Florida Center for Cybersecurity but branch out to other college and public school campuses in the future.
