    [Senate Hearing 117-62]
    [From the U.S. Government Publishing Office]

                                                             S. Hrg. 117-62

                ADDRESSING EMERGING CYBERSECURITY THREATS TO STATE
                                AND LOCAL GOVERNMENT

    =======================================================================

                                    HEARING

                                   before the

                                SUBCOMMITTEE ON
                    EMERGING THREATS AND SPENDING OVERSIGHT

                                     of the

                                  COMMITTEE ON
                   HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
                              UNITED STATES SENATE

                        ONE HUNDRED SEVENTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                 JUNE 17, 2021

                                   __________

            Available via the World Wide Web: http://www.govinfo.gov

                           Printed for the use of the
            Committee on Homeland Security and Governmental Affairs

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                      U.S. GOVERNMENT PUBLISHING OFFICE
    45-441 PDF                  WASHINGTON : 2021

            COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS

                       GARY C. PETERS, Michigan, Chairman
    THOMAS R. CARPER, Delaware           ROB PORTMAN, Ohio
    MAGGIE HASSAN, New Hampshire         RON JOHNSON, Wisconsin
    KYRSTEN SINEMA, Arizona              RAND PAUL, Kentucky
    JACKY ROSEN, Nevada                  JAMES LANKFORD, Oklahoma
    ALEX PADILLA, California             MITT ROMNEY, Utah
    JON OSSOFF, Georgia                  RICK SCOTT, Florida
                                         JOSH HAWLEY, Missouri

                       David M. Weinberg, Staff Director
                        Zachary I. Schram, Chief Counsel
                    Pamela Thiessen, Minority Staff Director
        Andrew Dockham, Minority Chief Counsel and Deputy Staff Director
                         Laura W. Kilbride, Chief Clerk
                         Thomas J. Spino, Hearing Clerk

            SUBCOMMITTEE ON EMERGING THREATS AND SPENDING OVERSIGHT

                     MAGGIE HASSAN, New Hampshire, Chairman
    KYRSTEN SINEMA, Arizona              RAND PAUL, Kentucky
    JACKY ROSEN, Nevada                  MITT ROMNEY, Utah
    JON OSSOFF, Georgia                  RICK SCOTT, Florida
                                         JOSH HAWLEY, Missouri

                         Jason Yanussi, Staff Director
                                Peter Su, Fellow
                     Greg McNeill, Minority Staff Director
                    Adam Salmon, Minority Research Assistant
                          Kate Kielceski, Chief Clerk

                                C O N T E N T S

                                     ------
    Opening statements:
                                                                       Page
        Senator Hassan...............................................     1
        Senator Paul.................................................     3
        Senator Ossoff...............................................    17
    Prepared statements:
        Senator Hassan...............................................    31
        Senator Paul.................................................    33

                                   WITNESSES
                            Thursday, June 17, 2021

    Karen J. Huey, Assistant Director, Ohio Department of Public
      Safety.........................................................     4
    Hon. B. Glen Whitley, County Judge, Tarrant County, Texas........     6
    Hon. Stephen M. Schewel, Mayor, City of Durham, North Carolina...     8
    Russell E. Holden, Superintendent, Sunapee School District, New
      Hampshire......................................................     9
    Dan Lips, Vice President for National Security and Government
      Oversight, Lincoln Network.....................................    11

                         Alphabetical List of Witnesses

    Holden, Russell E.:
        Testimony....................................................     9
        Prepared statement...........................................    93
    Huey, Karen J.:
        Testimony....................................................     4
        Prepared statement...........................................    35
    Lips, Dan:
        Testimony....................................................    11
        Prepared statement...........................................    95
    Schewel, Hon. Stephen M.:
        Testimony....................................................     8
        Prepared statement...........................................    47
    Whitley, Hon. B. Glen:
        Testimony....................................................     6
        Prepared statement...........................................    40

                                    APPENDIX

    Statement submitted by the American Public Gas Association.......   101

                       ADDRESSING EMERGING CYBERSECURITY

                     THREATS TO STATE AND LOCAL GOVERNMENT

                                  ----------

                            THURSDAY, JUNE 17, 2021

                                         U.S. Senate,
                           Subcommittee on Emerging Threats and
                                            Spending Oversight,
                        of the Committee on Homeland Security
                                      and Governmental Affairs,
                                                        Washington, DC.
        The Subcommittee met, pursuant to notice, at 10:15 a.m. via
    Webex and in room 342, Dirksen Senate Office Building, Hon.
    Maggie Hassan, Chairman of the Subcommittee, presiding.
        Present: Senators Hassan, Sinema, Rosen, Ossoff, Paul,
    Scott, and Hawley.

                 OPENING STATEMENT OF SENATOR HASSAN\1\

        Senator Hassan. The hearing will now come to order. Good
    morning. The Subcommittee on Emerging Threats and Spending
    Oversight (ETSO) convenes today's hearing to discuss the
    threats to State and local entities from cyberattacks and the
    consequences of those attacks on national security, the
    economy, and the lives of our citizens. We will discuss what
    State and local entities need in order to be able to
    effectively respond to cyber threats, and how the Federal
    Government can best support State and local authorities as they
    work to combat the growing wave of cyberattacks.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Senator Hassan appears in the
    Appendix on page 31.
    ---------------------------------------------------------------------------
        While the SolarWinds, Colonial Pipeline, and JBS
    meatpacking cyberattacks rightly received a lot of attention in
    recent months, State, local, and Tribal entities have also
    faced serious cyberattacks that can cripple services for
    citizens and decimate local budgets.
        The cybersecurity firm, Emsisoft, estimated that the total
    cost of publicly known ransomware attacks on State and local
    governments in 2020, including cost to restore functionality
    and services, was nearly $1 billion. A report from
    cybersecurity firm, BlueVoyant, found that there was a 50
    percent increase in the number of cyberattacks against State
    and local entities from 2017 to 2019. At the same time, the
    average ransom demanded in these attacks increased 10 times,
    and the average cost to taxpayers to clean up after a single
    cyberattack rose to the millions of dollars.
        Today's hearing sheds a light on the impact of attacks like
    the one we saw on the Sunapee School District in my home State
    of New Hampshire, which is represented here today by
    Superintendent Russell Holden. Luckily for the Sunapee
    community, the district had a plan in place, including a
    separate backup system, so it was able to resume operations
    soon after the attack was discovered, without paying ransom. I
    thank you, Superintendent Holden for your leadership on
    cybersecurity for school districts.
        Amid the coronavirus disease 2019 (COVID-19) pandemic, we
    have also seen more than ever the importance of shoring up our
    cybersecurity. State and local agencies depend on digital
    delivery of services to Americans, and many State and local
    employees are also connecting to central networks from home in
    order to do their work remotely. More investment at all levels
    of government is needed to strengthen cyber defenses.
        A 2020 survey of State chief information security officers
    (CISOs) found that most States only spend 1 to 3 percent of
    their overall information technology (IT) budgets on
    cybersecurity, compared to about 16 percent for Federal
    agencies, and many local governments, with their smaller
    budgets, are even worse off. Cybersecurity risks will continue
    to rise if State and local entities are not able to strengthen
    their cyber resilience.
        I am working across the aisle to help State and local
    officials address cyber threats and increase information-
    sharing at the Federal, State, and local level. I am pleased
    that the most recent National Defense Authorization Act (NDAA)
    included my provision to provide each State with a federally
    funded cybersecurity coordinator. These coordinators will
    provide each State and local governments within them with a
    local contact who can provide support and technical knowledge,
    and act as a bridge to the Federal Government. I was very happy
    to recently learn that New Hampshire's coordinator came on
    board in the last week.
        In addition, in this Congress I introduced a bipartisan
    bill with Senator Cornyn to better enable the National Guard to
    support State and local government cybersecurity. But we need
    to do more. That is why I am also working with my fellow
    Senators to craft a dedicated cybersecurity grant program for
    State and local governments.
        I am excited to discuss these ideas and more with our five
    insightful witnesses today. Four of them represent a State, a
    county, a city, and a school district, and can help us better
    understand the unique environment that each have to operate
    within. They can also help us better understand which types of
    Federal support may be the most effective. The fifth witness is
    an expert in Federal cybersecurity policy and notably a former
    senior staffer for the Homeland Security and Governmental
    Affairs Committee (HSGAC). To all of our witnesses, I
    appreciate your willingness to testify. I want to thank you all
    for the role you play in helping to keep all of us safe, and I
    look forward to learning from you today.
        With that I will now recognize Ranking Member Paul for his
    opening remarks.

                  OPENING STATEMENT OF SENATOR PAUL\1\

        Senator Paul. Thank you, Chair Hassan, and thank you to our
    panelists today for your time. I look forward to hearing from
    each of you.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Senator Paul appears in the Appendix
    on page 33.
    ---------------------------------------------------------------------------
        I would like to begin my remarks with an observation, which
    is that the recent wave of ransomware attacks seems to have
    broken through into the public consciousness. I traveled to my
    home State of Kentucky recently, and was asked more questions
    about cybersecurity in those 10 days or so than in the previous
    10 years. Of course, we as policymakers have been concerned
    about this malicious activity for some time, and at the Chair's
    request the Subcommittee held a hearing on this last December,
    and I am glad that we are still continuing to look at this
    issue.
        From what I saw and heard from the people I represent,
    there is now a much more widespread appreciation for how
    disruptive these attacks can potentially be. Obviously, the
    Colonial Pipeline interruption and the spectre of gas shortages
    was a major concern. The Kentuckians I spoke to were also
    concerned about the ransomware attacks affecting North American
    meatpacking facilities owned by JBS, which may not have
    received quite as many headlines as the pipeline but which was
    also alarming.
        Clearly we have a problem on our hands. The nation must be
    able to secure its food supply and deliver fuel where it is
    needed. Recent cyberattacks have also targeted hospitals,
    school systems, water systems, and other essential services.
        How can we combat this? As the old saying goes, an ounce of
    prevention is worth a pound of cure. Cybersecurity must be
    prioritized in the same way that any other essential services
    are prioritized. As we will hear, recovering from cyber events
    such as ransomware attacks and data breaches, is several orders
    of magnitude more costly than what it takes to implement and
    maintain good cybersecurity practices on the front end.
        Finally, I believe Congress needs to make sure that the
    Federal Government's role in detecting and responding to
    cyberattacks is limited and clearly defined, and that Federal
    cybersecurity personnel are focused, first and foremost, on the
    security of Federal information networks. The government can
    and should share information on threats and best practices with
    the private sector, State, local, Tribal, and territorial
    (SLTT) authorities. However, Congress must keep critical
    infrastructure operators and State, local, Tribal, and
    territorial in the proverbial driver's seat. One size fits all
    is not always the answer. Centralization is also not always the
    answer to cybersecurity.
        I am particularly worried about a proposal that recently
    passed the House of Representatives which would create a new,
    multibillion-dollar grant program to subsidize State and local
    cybersecurity. The Washington solution seems to be throw money
    at every problem, with the result being a $28 trillion national
    debt.
        As Americans, we face cybersecurity concerns that involve
    the availability of gasoline, the food supply, the electric
    grid, water, sanitation systems, and our communication
    networks. Some of these are the very fundamental building
    blocks of our society.
        I look forward to the conversation, and I think we can all
    be open to what the solutions are, but I think we also need to
    be conscious of the fact that many of these things can be done,
    and are being done, in the private sector.
        Thank you.
        Senator Hassan. Thank you, Ranking Member Paul.
        It is the practice of the Homeland Security and
    Governmental Affairs Committee to swear in witnesses. Mr. Lips,
    if you could please stand, and all the witnesses who are
    joining us virtually could stand as well, and please raise your
    right hand.
        Do you swear that the testimony you give before this
    Subcommittee will be the truth, the whole truth, and nothing
    but the truth, so help you, God?
        Ms. Huey. I do.
        Mr. Lips. I do.
        Mr. Whitley. I do.
        Mr. Schewel. I do.
        Mr. Holden. I do.
        Senator Hassan. Thank you. Please be seated.
        Our first witness today is Ms. Karen Huey, Assistant
    Director of the Ohio Department of Public Safety. As Assistant
    Director, Ms. Huey manages the department's six divisions,
    including Ohio Emergency Management and Ohio Homeland Security.
    Ms. Huey was previously the Assistant Superintendent of the
    Ohio Bureau of Criminal Investigations, and she has nearly 25
    years of experience in State government. Ms. Huey also
    currently serves as the homeland security advisor to Ohio
    Governor Mike DeWine.
        Welcome, Ms. Huey. You are recognized for your opening
    statement.

        TESTIMONY OF KAREN J. HUEY,\1\ ASSISTANT DIRECTOR, OHIO
                      DEPARTMENT OF PUBLIC SAFETY

        Ms. Huey. Good morning. Chair Hassan, Ranking Member Paul,
    and Members of the Subcommittee, we appreciate the opportunity
    to share Ohio's specific concerns and information with you this
    morning. The topic of today's hearing is of great importance,
    and although I speak with you today from the State of Ohio, I
    know many of my colleagues from across the country would echo
    these comments.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Ms. Huey appears in the Appendix on
    page 35.
    ---------------------------------------------------------------------------
        Today I would like to share our concern that a small carve-
    out for cybersecurity in the current Homeland Security funding
    does not meet the needs of our State and local governments. The
    current challenge of cyberattacks, as the Federal Bureau of
    Investigation (FBI) Director Wray recently said, is equal to
    the challenge we faced by the September 11th terrorist attack.
        Preventing cyberattacks takes dedicated resources,
    coordinated strategies, and local commitment. Ohio is investing
    in and making strides in our efforts to strengthen
    cybersecurity. The Ohio National Guard has taken the lead and
    brought together more than 30 public, private, military, and
    educational organizations to form the Ohio Cyber Collaboration
    Committee (OC3). Its mission is to develop a stronger
    cybersecurity infrastructure and workforce.
        Two major accomplishments of the OC3 are the Cyber Range
    Institute and the Ohio Cyber Reserve. As the Subcommittee is
    aware, States have been receiving Homeland Security Grant
    funding since 9/11. It has allowed us to build fusion centers,
    harden targets, identify critical infrastructure, and form
    relationships across sectors that never worked together before.
        A great example of this occurred last week in Ohio. Ohio
    Homeland Security was alerted by a Federal Department of
    Homeland Security (DHS) intelligence officer who shared
    information about two Chinese video surveillance companies
    whose products have been banned by the Federal Government since
    2018. Despite that Federal ban, dozens of these systems were
    purchased in Ohio, including some school districts and at least
    one hospital.
        Ohio Homeland Security immediately distributed a
    situational awareness bulletin to alert those Ohio entities
    that these companies are likely providing U.S. customer data to
    the Chinese government for espionage and surveillance
    operations. Almost immediately we started receiving concerned
    calls from Ohio entities that had purchased these products. We
    were able to provide high-level technical mitigation
    information and CISA personnel are working on a more detailed
    risk management solution.
        With the inclusion of cyber as a priority in the Homeland
    Security Grant, Ohio's local governments are struggling to
    address traditional preparedness needs while also prioritizing
    cyber projects. As the seventh-largest State, with a population
    of over 11 million, Ohio currently receives $6.7 million in
    Homeland Security funding. The current carve-out for
    cybersecurity is less than $340,000. I would assert that
    continued use of a small portion of Homeland Security Grant
    dollars both takes away from the needs of the traditional
    Homeland Security efforts and minimizes the importance of
    cybersecurity that we are talking about today.
        We would urge Congress to consider a dedicated grant
    program that will enhance Ohio's and other States' ability to
    focus on cybersecurity capabilities. We would focus on three
    main areas for dedicated funding. The State would share
    industry standards with its local governments and small
    businesses; the State would also offer assessments of current
    systems to identify gaps and direct local governments to
    resources. We would provide education and training that
    includes cyber exercises, end user training, and resources and
    guidance documents.
        The State would make improvements to existing secure
    communication platforms that would be used to gather and
    disseminate important, timely cyber threat information to our
    trusted partners.
        The last piece I would mention, if there is dedicated
    funding, we would like to see that future funding require a
    condition that recipients share indicators of compromise and
    intrusion with the State in a confidential manner. Adding a
    requirement of after-action reporting will allow us to learn
    from and be better prepared for incidents in the future.
        In closing, many States like Ohio recognize the importance
    of responding to cyber incidents and building a level of
    preparedness with our local governments. Our hope is that a
    dedicated cyber grant program will help ensure that we remain
    prepared for both the traditional terrorist event and the cyber
    threat, without having to choose between the two.
        We appreciate the Subcommittee's commitment to addressing
    cybersecurity. On behalf of the Ohio Department of Public
    Safety, thank you for the invitation to testify.
        Senator Hassan. Thank you very much, Ms. Huey, for that
    excellent testimony.
        We now turn to our second witness, Judge Glen Whitley,
    County Judge for Tarrant County in Texas. Judge Whitley has
    served as Tarrant County Judge since 2007, and previously
    served as Tarrant County Commissioner since 1997. Judge Whitley
    presides over the Tarrant County Commissioners Court and
    provides leadership on issues related to policy and county
    services for the 15th-largest county in the United States. He
    was also a board member of the National Association of Counties
    and one of its past presidents. As County Judge, Judge Whitley
    also serves as the head of Emergency Management for Tarrant
    County.
        Welcome, Judge Whitley. You are recognized for your opening
    statement.

     TESTIMONY OF THE HONORABLE B. GLEN WHITLEY,\1\ COUNTY JUDGE,
                         TARRANT COUNTY, TEXAS

        Judge Whitley. Thank you, Chairwoman Hassan, Ranking Member
    Paul, and Members of the Subcommittee. My name is Glen Whitley
    and I serve as County Judge for Tarrant County, Texas. I also
    serve on the Board of Directors for the National Association of
    Counties, and it is an honor to participate in today's hearing.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Judge Whitley appears in the Appendix
    on page 40.
    ---------------------------------------------------------------------------
        In just the past year, we have seen several cyberattacks
    cause major disruptions across the United States. These attacks
    all demonstrate the vulnerability of our nation's cyber
    infrastructure. At a local level, Pinellas County, Florida
    recently experienced an attack on their water treatment
    facility that allowed hackers to manipulate their water supply.
    As county reliance on technology increases, these attacks will
    likely increase as well.
        To better understand how local government can respond to
    cyber threats, it is important to start with an understanding
    of the underlying challenges to the local revenues and
    resources. General revenue from local property taxes are the
    backbone of county funding, because they are not restricted to
    a particular activity. Currently, though, 43 States are
    imposing some type of limitation on a county's ability to
    increase local taxes.
        Restrictions on Federal and State resources also remain a
    challenge. Locally collected general revenues are not
    restricted to a particular activity. Unfortunately, about 93
    percent of State and Federal funding used by county governments
    is restricted to a specific function. Matching requirements for
    Federal grant and loan programs also make leveraging Federal
    resources impossible for many counties.
        We applaud Congress for providing $61.5 billion to county
    governments in the American Rescue Plan (ARP) Act. However,
    local governments are prohibited from using these dollars as a
    non-Federal match for grant and local programs. Without
    relieving these pressures, counties will struggle to invest in
    the cybersecurity infrastructure they need.
        Collectively, counties own or operate thousands of
    hospitals, public health departments, water and waste
    management centers, jails, and emergency operations centers,
    all of which create significant cyber vulnerabilities. Without
    robust and reliable funding, these local assets expose our
    communities and these critical programs and services.
        It is important to note that cybersecurity needs are not
    only driven by exposures and vulnerabilities but also by the
    need to meet national standards. In Tarrant County, we adhere
    to the four principles of the NIST Cybersecurity Framework.
    Achieving and maintaining the core principles require an
    Information Security Program that includes policies,
    procedures, and resources. While policies and procedures can be
    downloaded and customized, resources require continuous
    funding.
        More generally speaking, county cyber resources are
    typically directed to three main areas: education,
    infrastructure, and preparedness.
        An organization's greatest cyber weakness is the end user
    or the employee. A recent cybersecurity survey found that 70
    percent of the employees polled said they had recently received
    training from their employers, yet 61 percent failed their
    basic quiz.
        One of the best cybersecurity practices is the
    implementation of multi-factor authentication. Counties must
    also update and replace network devices and vet cloud software
    and supply chains, all of which require time, money, and
    skilled personnel.
        Preparedness depends on the county's ability to effectively
    monitor cyber threats. Counties must develop, test, and retest
    security policies and incident procedures or hire trusted,
    expensive third-party contractors.
        As the Committee considers how to best allocate
    cybersecurity investments, it is imperative that Federal
    resources reach their intended targets as quickly as possible.
    We applaud Chairwoman Hassan's work to provide local
    governments with reliable and flexible cybersecurity resources
    in the State and Local Cybersecurity Improvement Act.
        In closing, counties need a strong Federal partner that can
    provide direct and flexible resources that allow local
    governments to adopt resources to meet the unique needs of
    their communities. This is especially true for cybersecurity
    resources. Again, local governments own and operate some of our
    nation's most critical infrastructure.
        Thank you for allowing me to be here today.
        Senator Hassan. Thank you very much, Judge. Now we will
    move on to our third witness, Mayor Steve Schewel of Durham,
    North Carolina. Mayor Schewel has served as mayor since 2017,
    and previously served 6 years on the Durham City Council and as
    Vice Chair of the Durham Public School Board. He is a long-time
    member of the Durham community and a visiting professor at the
    Sanford School of Public Policy at Duke.
        Welcome, Mayor Schewel. You are recognized for your opening
    statement.

     TESTIMONY OF THE HONORABLE STEPHEN M. SCHEWEL,\1\ MAYOR, CITY
                       OF DURHAM, NORTH CAROLINA

        Mr. Schewel. Thank you very much, Chair Hassan, Ranking
    Member Paul, and Members of the Subcommittee. On behalf of the
    city of Durham and the National League of Cities, thank you for
    convening this important discussion today. I am Steve Schewel,
    mayor of the great city of Durham, North Carolina, home to more
    than 280,000 residents, and home to Duke University, North
    Carolina Central University, and North Carolina's Research
    Triangle region.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Mr. Schewel appears in the Appendix
    on page 47.
    ---------------------------------------------------------------------------
        Cybersecurity is a top priority for the city of Durham. Our
    city has experienced recent cyberattacks, including a
    ransomware attack in March 2020, at the start of the COVID-19
    pandemic. During that attack, our city was fortunate to
    maintain functioning of critical systems, including our 911
    call center, and we did not pay a ransom. This was due to the
    city's prioritization of cybersecurity planning and preparation
    in the wake of an extremely disruptive attack on Durham Public
    Schools in 2009, and a smaller malware attack on city networks
    in 2018. Our city was able to resume full network functioning
    in less than a week after the attack. This was thanks to our
    advanced planning, our robust system of cloud backups for city
    data, and our partnerships with our vendors, the FBI, and the
    North Carolina National Guard.
        However, this preparation is costly for our city, and too
    many cities, towns, and villages are not as well prepared as
    the city of Durham. It is not a matter of if another
    devastating attack will paralyze critical municipal networks
    and infrastructure, but when.
        The United States has thousands of municipal governments
    which operate water systems, gas and electric utilities, 911
    answering centers, transportation systems, and countless other
    critical services. Most of these municipal governments are
    small with limited budgets. Cybersecurity is competing directly
    with direct services such as providing safe, quality drinking
    water, maintaining infrastructure, such as replacing 100-year-
    old water pipes or repaving pothole-ridden streets, and
    employing first responders to keep our communities safe.
        Meanwhile, cybersecurity has become more complicated and
    expensive every year. Criminal organizations, including State-
    backed criminals, continue to develop sophisticated methods for
    penetrating public networks and disrupting city functions. Even
    small-town networks are attractive targets for these bad
    actors, and we can no longer rely on security through
    obscurity.
        Relatively basic steps, such as implementing multi-factor
    authentication, conducting cyber hygiene training for city
    staff and elected leaders, and maintaining up-to-date hardware
    and software can be very costly for a city. Many
    municipalities, including the vast majority of smaller towns,
    lack sufficient budget for cybersecurity and outsource most IT
    functions. We depend on our partnerships with vendors, the
    State, and Federal agencies to keep our networks safe and
    recover from an attack.
        Congress has the opportunity to bolster these partnerships
    and provide cities, towns, and villages with new resources to
    strengthen our collective security posture. We recommend three
    principles for any new cybersecurity program in support of
    State and local governments.
        First, Congress should provide sustainable new funding
    without cannibalizing existing public safety grant programs.
    Cybersecurity measures are ongoing expenses, and while a one-
    time grant will help get some efforts off the ground, network
    monitoring, training, and upkeep must be budgeted for every
    year.
        Second, Congress should prioritize intergovernmental
    partnership. Closer collaboration between city, county, State,
    and Federal agencies on things like planning, procurement,
    training, and incident response will help reduce the impact of
    attacks experienced by local governments and the time needed to
    recover.
        Finally, Congress must be careful not to impose a one-size-
    fits-all solution on local governments. Cities and towns come
    in all shapes and sizes. Some would benefit most from a direct
    grant, while smaller communities may prefer that Federal
    support be administered by the State.
        Again, I thank you so much for your attention on this
    important and timely issue, and I look forward to your
    questions. Thank you very much.
        Senator Hassan. Thank you so much, Mayor. I really
    appreciate the testimony.
        Now we will go to our fourth witness today, Superintendent
    Russ Holden, of Sunapee School District in my home State of New
    Hampshire. Superintendent Holden has worked as a public school
    administrator in New Hampshire for the last 26 years. As
    superintendent, he is responsible for evaluation of all
    administrators and directors for the school district, and for
    managing all Federal and State grants. He is also the Vice
    President of the New Hampshire School Administrators
    Association, where he serves as the chair of the Policy
    Committee.
        Welcome, Superintendent Holden. I am looking forward to
    when I can see you again in person, and you are recognized for
    your opening statement.

      TESTIMONY OF RUSSELL E. HOLDEN,\1\ SUPERINTENDENT, SUNAPEE
                     SCHOOL DISTRICT, NEW HAMPSHIRE

        Mr. Holden. Thank you, Senator Hassan, and thank you to the
    Subcommittee. I appreciate the opportunity to speak to you
    today, and I will keep my comments brief because you have my
    written testimony.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Mr. Holden appears in the Appendix on
    page 93.
    ---------------------------------------------------------------------------
        In October 2019, we came in after a weekend and found out
    that our data had been held for ransom, and everything that we
    had in our school district was kept from us. Sunapee is a small
    district in the western part of the State. We have about 430
    students, Pre-K through 12, and about 120 faculty members. Our
    IT department consists of 1.3 people. We are basically the
    biggest employer in our town.
        Upon finding that we were held for ransom we quickly
    notified our local police and State police and our insurance
    carrier. Unfortunately, neither our local police or State
    police at the time really did not have much assistance that
    they could give us, and the assistance really came from our
    insurance carrier, putting us in touch with professionals and
    lawyers that had dealt with these situations in the past.
        Fortunately enough we had a backup system in place, and the
    interesting piece about our backup system was prior to this
    incident, a week prior, we realized that our backup system had
    failed, and if we had not recognized that at that time and
    instituted a new backup system, we would have lost information
    going back 6 months. With the backup system in place, we were
    able to recover our data, without paying the ransom.
        The long and short, we accumulated fees and materials
    totaling more than $40,000, and it took over 9 days for our IT
    department to get us back up and running fully.
        While 9 days may not seem like a lot, fortunately
    technology has really integrated itself into education, and
    education into technology, and really having our teachers pivot
    very quickly and go back to some of the older ways that we
    learned how to educate our students, using more paper, pencil,
    and traditional materials. Our ability to do that really
    allowed us to continue and not to have to cancel school and
    allowed us to stay in school and educate our children, which is
    our primary task.
        We have about a $12.5 million budget here in Sunapee, and
    about $500,000 of that is dedicated to technology. After going
    through this ransom situation, we invested last year $10,000 to
    go through an audit that looked at our entire security system.
    Through that audit, much of what other folks are presenting
    here today have said, we found out that we quickly needed to
    put things in place, like disaster recovery plans, business
    continuity plans, backup systems particularly that can be held
    offsite or in the cloud, enabled multi-factor authentication,
    and train ourselves in phishing drills and help educate staff
    and students on outside threats, including looking at dry
    sprinkler systems within our IT server closets.
        Again, as I mentioned, our IT department consists of 1.3
    people. Going through that audit process we quickly realized
    that we were completely understaffed, but hiring a new person
    would add at least one percent to our overall budget.
        I am also a member of the American Association of School
    Administrators (AASA), and was completing my national
    certification program in February 2020, and I had the
    opportunity to share this incident with 20 colleagues from
    across our country, from States of California, Pennsylvania,
    Illinois, and Virginia. At that point in time, little old
    Sunapee represented the smallest school district in the cohort,
    Bakersfield, California, with 260,000 students. When speaking
    to my colleagues they all said, ``We are not prepared to know
    what we would be able to recover the data potentially that was
    lost and get ourselves back on our feet.''
        I would echo again what some of the other folks said here
    today. I think there are ways that we can look at Federal
    monies, either using Homeland Security or Title IV monies that
    are given to school districts, try to free up some of the
    restraints and constrictions that are on those so they can be
    sent to help us look at more appropriate ways and more
    sufficient ways to help educate our students and staff and
    community of these security and ransom attacks.
        I would again thank the Senate Subcommittee and Senator
    Hassan for representing the State of New Hampshire and by
    continuing to bring this topic forward. Thank you.
        Senator Hassan. Thank you, Superintendent Holden.
        Now I am going to turn to our final witness who is joining
    us in person in the hearing room today, Mr. Dan Lips, Vice
    President for National Security and Government Oversight at the
    Lincoln Network. At the Lincoln Network, Mr. Lips focuses on
    research and advocacy between technology, government oversight,
    and national security.
        Mr. Lips began his career as an intelligence analyst with
    the FBI. He also served as a staff member of the Senate
    Homeland Security and Governmental Affairs Committee, where he
    worked on cybersecurity policy and served as Homeland Security
    Policy Director.
        Welcome, Mr. Lips. You are recognized for your opening
    statement.

    TESTIMONY OF DAN LIPS,\1\ VICE PRESIDENT FOR NATIONAL SECURITY
               AND GOVERNMENT OVERSIGHT, LINCOLN NETWORK

        Mr. Lips. Thank you. Good morning, Chairwoman Hassan,
    Ranking Member Paul. Thank you for the opportunity to testify.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Mr. Lips appear in the Appenidx on
    page 95.
    ---------------------------------------------------------------------------
        My name is Dan Lips. I am the Vice President for National
    Security and Government Oversight at Lincoln Network. As a
    former HSGAC staffer, it is a real honor to testify. I
    sincerely respect the Members and staff of this Committee and
    the work that is done in this hearing room.
        We have heard sobering testimony this morning. State and
    local governments face growing cyber threats that warrant a
    proactive response by the Federal Government. But Congress
    should be thoughtful about the resources currently available to
    spend on cybersecurity. The Government Accountability Office
    (GAO) has warned that the Nation is on an unsustainable fiscal
    path, including that the growing Federal debt could cause a
    large drop in the value of the dollar and limit Congress'
    ability to respond to future emergencies.
        With that context, what should Congress and the Committee
    do to help State and local governments manage growing cyber
    risks? I will offer four recommendations.
        First, Congress should streamline Federal rules to reduce
    State governments' compliance costs to allow more resources to
    be spent on improving security. For years, the National
    Association of State CIOs and the National Governors
    Association (NGA) have urged Congress and the White House to
    harmonize agencies' information security rules, which are often
    contradictory and duplicative.
        In 2018, the Oklahoma State CIO testified that his office
    spent 10,000 personnel hours complying with Federal rules and
    audits. That is a year's worth of work for five employees,
    full-time, and that is time that could be spent otherwise on
    improving security.
        GAO has reported that the Office of Management and Budget
    (OMB) has issued guidance to agencies, encouraging them to
    harmonize rules, but did not require them to do so. Congress
    and the Committee could pass legislation to require agencies to
    harmonize Federal rules and audits to fix this problem.
        Second, Congress should prioritize cybersecurity and
    existing Homeland Security Grant programs, and States should
    use available Federal funds for cybersecurity. I appreciate
    that Members of Congress have proposed creating a new
    cybersecurity grant program, but DHS, through the Federal
    Emergency Management Agency (FEMA), already awards more than $1
    billion in annual Homeland Security Grants. Secretary Mayorkas
    recently announced the Department would require grant
    recipients to spend 7.5 percent of grants on cybersecurity.
    Congress could further increase that amount.
        But States and localities do not need to wait on Congress.
    They already have billions in unspent DHS grants and other
    funds that could be used for cybersecurity. According to OMB,
    States had not spent 50 percent of the Homeland Security Grants
    that have been awarded since 2015, and $2.7 billion was still
    available as of 2020. After receiving $340 billion in
    additional funds through the American Rescue Plan, State and
    local governments should have resources to improve
    cybersecurity.
        Third, the Federal Government should share meaningful
    threat information and security recommendations to help
    organizations manage cyber risks. Over the past decade,
    Congress has passed bipartisan laws to establish Federal
    programs to facilitate information sharing. But watchdogs have
    identified limitations and opportunities to improve DHS'
    information-sharing programs. Congress should press the
    Department to implement these recommendations.
        The Federal Government should also better leverage its
    expertise to help State and local governments and other
    partners implement best practices. For example, NIST provides
    valuable guidance through its Cybersecurity Framework. But the
    framework includes a checklist of more than 100
    recommendations, which are difficult for many organizations to
    fully implement.
        The White House recently issued a memo to American
    companies with five specific recommendations to prevent and
    prepare for ransomware attacks. This is exactly the kind of
    specific and focused security recommendations that are needed
    to help organizations manage cyber risk.
        Fourth, Congress and the Subcommittee should conduct a
    strategic review of cyber threats and assess current and future
    resource needs to manage long-term risks. The intelligence
    community (IC) recently assessed that technological innovations
    will likely result in increasing competition in the cyber
    domain in the future. Congress should forecast what resources
    are needed moving forward.
        President Biden proposed spending $9.4 billion on Federal
    civilian agency cyber programs in his recent budget, or a 14
    percent increase. In comparison, he proposed spending $750
    billion on national defense. Congress should consider whether
    these resource allocations are appropriately balanced to
    address current and future threats.
        There is also significant waste in the Federal budget, such
    as the $75 billion that is lost annually on improper payments,
    according to GAO, which is much larger than what Congress
    currently spends on cybersecurity. Given the Subcommittee's
    mandate, you are uniquely positioned to review and forecast
    what Federal spending resources are needed to counter emerging
    threats.
        Again, thank you for the opportunity to testify. I look
    forward to your questions.
        Senator Hassan. Thank you so much, Mr. Lips, for that
    testimony. We now will turn to our rounds of questions. I will
    start and then move to Ranking Member Paul.
        To Ms. Huey and Mayor Schewel, a functioning government
    depends on functioning computer systems, and we have seen this
    more than ever during the COVID-19 pandemic. A cyberattack on a
    State or local entity can easily disrupt services to people or
    hamper the functioning of a government entity.
        Ms. Huey and Mayor Schewel, can you outline what the
    consequences might be of a cyberattack on your organization?
    What data do you have that would potentially be at risk? What
    critical services might be disrupted? We will start with you,
    Ms. Huey.
        Ms. Huey. Thank you. At the Ohio Department of Public
    Safety we have, obviously, several large systems under the
    Bureau of Motor Vehicles. You can picture the driver's license,
    vehicle registration, all of that citizen data would be
    impacted if we sustained an attack.
        In addition to that, we also operate the Law Enforcement
    Automated Data System (LEADS), and this is the system that
    collects all local law enforcement arrests, criminal justice
    information. It is shared throughout the State, and it is also
    shared with our Federal partners.
        We feel that we have very robust security measures around
    this, but it obviously would be a very big blow to public
    safety at the State, local, and Federal level if something were
    to happen to LEADS.
        Finally, we use a confidential information management
    system for Homeland Security to communicate with our trusted
    partners, and we would hate to see something happen to that,
    that would disrupt services to our citizens.
        Senator Hassan. Thank you. Mayor Schewel.
        Mr. Schewel. Thank you very much. Our 911 center is
    absolutely crucial. We receive 300,000 calls a year to our 911
    center, and any disruption in that service would be a terrible
    blow to our residents. In addition, we operate a water system
    that has 90,000 customers, and 25 million gallons a day of
    water. Any disruption to that would also be an absolutely
    terrible blow.
        There are other systems as well, but I think those are the
    two most crucial systems that we operate that could potentially
    be devastatingly impacted by a cyberattack.
        Senator Hassan. Thank you very much, Mr. Mayor.
        The next question is for Superintendent Holden, again Mayor
    Schewel, and Judge Whitley. Superintendent Holden, Mayor
    Schewel, and Judge Whitley, you all experienced a cyberattack
    within the last few years. Would each of you highlight the
    actions your organizations took to limit the impact of these
    attacks on your operations? What can other local entities learn
    from your example? We will start with you, Superintendent
    Holden.
        Mr. Holden. Thank you, Senator. I think first and foremost
    I have to say what will win at that is your personnel. Having
    dedicated IT professionals that are willing to spend the time
    and energy to continue to be up to date and put not only
    systems in place but to stay current on what is going on in the
    world around us, when it comes to these matters. Making sure
    that the appropriate training is in place, making sure that you
    have the proper amount and rightly placed backup systems I
    think are also a key part of ensuring these things did not
    happen and preventing them from happening.
        Again, the last piece I think, again going back to the
    training, we are only going to be as good as our users. At
    Sunapee we have about 650 end users, and that is what it is
    going to come down to, how well we can train our end users.
        Senator Hassan. Thank you. Mayor Schewel.
        Mr. Schewel. We had a terrible attack, devastating attack
    on Durham Public Schools network in 2009, and after that we
    established plans and policies and procedures to ensure that
    the city would not experience a similar costly disruption. We
    established a comprehensive plan and budget for improvements
    over time. We established working relationships with the FBI,
    State leaders in North Carolina, the Multistate Information
    Sharing and Analysis Center, and these plans were tested in
    2018, when a second attack occurred, this time impacting the
    city's fleet vehicle network.
        We established a war room, once we were attacked in 2020,
    with representatives from our staff, contractors, other
    governmental partners, including the North Carolina National
    Guard, to respond to and recover from the attack. I will say
    this was made particularly challenging, because we were
    navigating this with the new social distancing protocols that
    we needed in March 2020. We were fortunate that we had regular
    backups from all city data, and that was crucial.
        Senator Hassan. Thank you. Judge Whitley?
        Judge Whitley. Again, I think the backups, we have heard
    this mentioned a couple of times today already. That is very
    important. We have a playbook that we look at, that helps us to
    identify, contain, eradicate, and really begin the recovery
    from that. Then we go back to the education process of trying
    to make sure folks understand and learn from any issues that we
    have, and we looked at that. We always are having tabletop
    discussions and exercises, from that standpoint.
        Senator Hassan. Thank you very much, sir.
        One more question before I turn to the Ranking Member. To
    Superintendent Holden and Judge Whitley, good cybersecurity
    requires up-front investment, but State and local entities
    often have limited resources and they have to balance competing
    priorities. A Federal grant program that focuses on
    cybersecurity can help relieve State and local resource
    constraints and increase investment in cybersecurity.
        Superintendent Holden and Judge Whitley, what are the
    resource constraints that you face when deciding how much to
    invest in cybersecurity, and are there improvements to
    cybersecurity resiliency that you would make if given a
    reasonable amount of additional resources?
        We will start with you, Superintendent Holden.
        Mr. Holden. Thanks, Senator. The answer to your last
    question is yes, absolutely. Our ability to improve our
    resources greatly has an impact on our financial situation. One
    of the first things I think that comes to mind for us would be
    a dual authentication, and that would be allowing you to sign
    in not only on a computer but on another device. That would us
    having another device for every person in our district, so
    basically doubling what it is that we currently have in the
    public sector. That would have a tremendous impact on our
    budget. Thank you.
        Senator Hassan. Thank you. Judge Whitley.
        Judge Whitley. I think as we look through there is always
    the balancing of how do we spend our dollars, and more often
    than not now what we are seeing are attempts, sometimes from
    the State level, to limit the amount of dollars that we can
    raise and to be able to allocate. Flexibility is key as far as
    I am concerned.
        One of our witnesses before talked about how different we
    are among counties, among States, among cities and towns. The
    flexibility really allows the local area to assess the threats
    that they feel most strongly about and to be able to allocate
    that, among personnel or among different programs.
        Senator Hassan. Thank you. I will now turn to the Ranking
    Member for his round of questions.
        Senator Paul. Mr. Lips, the Chairwoman and I have been
    interested in duplication, and I have a bill actually to have
    reports on bills from the Congressional Budget Office (CBO),
    whether or not we already are doing through another program.
    You mentioned that we hand out FEMA grants that already deal
    with cybersecurity. In your opinion, would a new grant program
    just for cybersecurity be a duplication of what we are already
    doing through the FEMA grants?
        Mr. Lips. I believe so, particularly since cybersecurity is
    an allowed use of the existing FEMA grants.
        Senator Paul. I think this is an important question because
    money does not grow on trees. We are institutionally about $1
    trillion short every year, just for Medicare, Medicaid, food
    stamps, and the military. We are short on the ordinary
    expenses, and we have been adding extraordinary expenses of
    trillions of dollars. Last year the deficit was over $3
    trillion, likely over $3, maybe even $4 trillion this year. We
    have to figure out how to most wisely use our resources.
        I was intrigued by your point, though, that even without
    legislation we are giving $1 billion a year--so we have about
    $5 billion over the last 5 years--and yet we have only spent a
    little over half of it. Has that money been given in grants and
    just not spent by the recipient, or it has not yet been applied
    for?
        Mr. Lips. My understanding is that it has been awarded, and
    that it is with the States, and that it could be put to use.
    Why States have not spent that is not fully clear to me.
        Senator Paul. All right. I think that is worth a letter,
    and maybe the Chair might consider that we send a letter asking
    if the money has been allocated, and it is for cybersecurity,
    asking the people who received it to tell us why they have not
    used it yet or what the problem is. Maybe try to figure out
    what is going on with that money.
        Senator Hassan. I am certainly happy to consider that. I
    think this depends a lot on what the overall grant is and how
    much is restricted.
        Senator Paul. Our staffs can work together to figure that
    out. But it is also interesting that even without legislation,
    Secretary Mayorkas has increased the requirement from 5 percent
    to 7.5 percent, so that is a 50 percent increase in the
    funding. Instead of $5 billion it will be $7.5 billion over the
    next 5 years?
        Mr. Lips. My understanding is that it is actually out of
    that pot of funding, so out of $1 billion, 5 percent is
    required to be spent on cybersecurity, and he is increasing it
    to 7.5 percent.
        Senator Paul. OK. The whole $5 billion does not go to
    cybersecurity. It is 5 percent of that, and he is increasing
    that to 7.5 percent of that. OK, I got where we are.
        But the other possibility is you could even go up even more
    significantly. We could either do that through legislation, we
    could say 20 percent of that money needs to go to
    cybersecurity. If we really thought cybersecurity was a
    pressing issue we could try to reallocate or resource that
    money that already exists.
        Mr. Lips. Absolutely, Senator Paul, and I think it would be
    wise for Congress to consider doing that. The FEMA grant
    programs for homeland security were expanded and created after
    9/11, and the intention was for them to be risk-based and to
    focus on existing security threats. Twenty years later, it is
    clear that this has become a serious security threat and it
    should be prioritized. It would make a lot of sense for more of
    those funds to be used to address these problems.
        Senator Paul. While I think we all agree that cybersecurity
    is a problem, putting in perspective of our overall national
    security is important, when you talked about weighing how much
    we spend on national defense. But also there have been remarks
    from even folks within the military community. Admiral Mullen
    said, a few years ago, that the greatest threat to our national
    security was actually our debt.
        I think we cannot, on the one hand, say we are going to
    throw unlimited resources. We have to be careful about where
    the resources are and try to redirect resources to a problem.
    If we think cybersecurity is a pressing issue, which it sounds
    like it is, let's take it from maybe less pressing issues and
    try to force some of the money over toward that without
    necessarily spending more money. I would probably support
    legislation if we had legislation that did what Secretary
    Mayorkas did. We could do it even more, figuring out what the
    appropriate number is. But you could take more of that $5
    billion and push more toward national security simply by
    looking at those percentages.
        I had one other question that kind of a technical question.
    I always ask this because I am somewhat intrigued, without
    being a technological or a computer expert on this. It seems
    like the articles that you read say most of the people get into
    your system through your email. Is that still true? Would half
    the people be getting in through email, or is that a rare way
    they get in?
        Mr. Lips. It is certainly one of the ways that attackers
    get into systems, and certainly it is encouraging to hear some
    of the precautions that are being taken by my fellow panelists.
    There is a lot that can be done to understand best practices,
    to improve cyber hygiene, such as not clicking on suspicious
    emails, and other measures to----
        Senator Paul. It would seem to me that it should not be
    that hard, technologically, to wall off your email, where your
    email has no communication and you cannot get from your email
    to your operating system. Can you make it a wall such that it
    cannot be penetrated?
        Mr. Lips. That is a good question, and I am not sure. I am
    encouraged by what the Biden administration recently put out as
    recommendations to address malware and ransomware. There are
    simple things that can be done, such as backing up systems,
    encrypting data at rest to make it less valuable to ransomware
    attackers. There are some relatively simple things that can be
    done to improve organization security posture, that should be
    prioritized.
        Senator Paul. Twenty years ago, as a physician, we used to
    back up our records every day on a floppy disk, and we would
    put them in a fireproof safe, in case the building burned down
    or in case you had an electrical surge you would not lose all
    your patient data. I know it would not be on a floppy disk
    anymore but it would seem that there would be ways to back this
    up on a daily basis and protect yourself. There has to be ways.
        I think a lot of this stuff is not necessarily rocket
    science. There are available solutions out there, and I think
    it is important that we get that out there for folks to
    prevent.
        The other thing I had heard a lot was that people were
    doing a lot more work from home. They would be working on their
    phone or their computer and they had not done the updates, and
    the updates are pretty sophisticated to protect against
    viruses. I am guilty of it too, not always pushing to accept
    the update, and maybe that has been part of the problem in the
    last year as well.
        Mr. Lips. Absolutely, and those were some of the
    recommendations, sir, that were included in the White House's
    recent memo to companies, to update and patch systems
    regularly. These are basic actions that organizations can take
    to improve their security.
        Senator Paul. Thank you.
        Senator Hassan. I think we are expecting Senator Ossoff
    shortly, but why don't I ask a question until he gets here,
    unless that is him.
        Senator, would you like a minute? You are up, or----

                  OPENING STATEMENT OF SENATOR OSSOFF

        Senator Ossoff. I am ready to go.
        Senator Hassan. You are ready to go? Then I will turn the
    questioning over to Senator Ossoff.
        Senator Ossoff. Thank you, Madam Chair. Thank you to our
    panelists who are here in person and remotely. My first
    question is for Ms. Huey.
        Ms. Huey, in March 2018, the city of Atlanta suffered a
    severe ransomware attack. According to Bloomberg CityLab, the
    hackers encrypted files, locked access to online services,
    blocked the city of Atlanta from processing court cases and
    warrants, and demanded a $51,000 ransom. Just 2 months prior,
    the City Auditor's Office released a report finding that the
    city's information security management system, ``has gaps that
    would prevent it from passing a certification audit,'' and that
    many information security management processes, ``are ad hoc or
    undocumented, at least in part due to lack of resources.''
        Similar issues prevail across major cities. It is not
    unique to Atlanta. A recent study by the National Association
    of State Chief Information Officers found that States spend
    only a fraction of their IT budgets on security, between 1
    percent and 3 percent, compared to about 16 percent for Federal
    agencies.
        Given the budget constraints that States and municipalities
    face, what are the cybersecurity investments that, in your
    view, would have the biggest impact, the highest return on
    investment, when it comes to preventing, for example,
    ransomware attacks and securing State and municipal networks?
        Ms. Huey. Thank you for that question. Senator, I believe
    that State government has done a good job of looking at State
    assets and providing a level of security. Where I think
    dedicated cybersecurity funding that could come into the State
    could help us focus on local governments. As you have heard
    today from the other witnesses, there is a variety of levels of
    preparedness that local governments have been able to do with
    cybersecurity.
        What we would hope to do, at the State level, is those
    standards there already identified in industry, making sure
    that those are communicated across the State, and then provide
    those assessments and those audits so that we can go out and
    help people identify those gaps and then identify resources for
    them to use.
        I think this is always a combination of local, State,
    private investment, along with Federal dollars that will make
    it successful. Thank you.
        Senator Ossoff. Thank you, Ms. Huey, and, of course, we do
    want that strong intergovernmental communication and
    communication and best practices, sharing of threat
    information. Can you drill down in a little more detail, what
    do you think consistently municipal or local governments are
    maybe underinvesting in? What would be the best use of their
    limited resources? Is it data hygiene practices for personnel?
    Is it firewall technology? Is it supply chain checks? Is it
    robust patching practices, hardware, software? How should local
    governments deploy resources that are limited for most effect?
        Ms. Huey. I can tell you that the locals that took
    advantage of the 5 percent cyber set-aside, our first round of
    funding here in Ohio, obtained cyber risk assessments. That is
    what they were looking at, was looking at a contractor, and
    this was a little bit of a regional approach, so maybe 3, 5, 6
    counties went together and were looking at doing a cyber risk
    assessment that would then make recommendations on hardware and
    the issues that you identified.
        Senator Ossoff. OK. Thank you, Ms. Huey.
        Mr. Whitley, you mentioned in your testimony that lack of
    cybersecurity awareness, training, and implementation and best
    practices for employees as well as local government staff is a
    major impediment. I believe you cite a study showing that most
    folks polled had been given cybersecurity training but also
    failed basic quizzes on the topic and best practices.
        Committee-provided information indicated that recent
    cyberattacks in both Tarrant County and Durham, North Carolina,
    were the result of phishing email campaigns, where individuals
    are tricked into clicking links that can load malicious
    software.
        If the Federal Government were inclined to make investments
    in cybersecurity training, how could we be certain those
    investments would have a positive impact and actually address
    the security challenges counties like yours are facing, and
    what do you believe are the best practices for not putting
    personnel through online presentations and then calling it job
    done but actually ensuring that staff understand the underlying
    concepts and best practices.
        Judge Whitley. Thank you for that question. I think the
    best thing is to continuously test, retest, educate. A lot of
    time we will say, OK--in fact, we just finished a program by
    which everyone had to go in and do this training, and if they
    did not we ended up turning their systems off. I know actually
    five elected officials who all of a sudden looked and their
    screens were blank.
        We have to keep pushing and pushing and pushing on the
    education, but even after that, sometimes testing from
    internally and saying, ``OK, we told you about this and now all
    of a sudden we tried you and you still failed,'' that has a
    lasting impression on at least that employee. I think that word
    gets around to other folks, and they begin to realize, OK, this
    really can happen and I need to be a little bit more careful,
    because the last thing in the world you want to do is be the
    reason why our systems were taken over or were shut down.
        It is a combination of things, but it has to be a
    continuous, constant reminder, and emphasizing how important it
    is to be careful about whatever you open and whatever websites
    you may go to.
        Senator Ossoff. Thank you, sir. Mr. Lips, finally, in your
    testimony you emphasized the need to improve information
    sharing about cyber threats and best practices across the
    Federal Government, between Federal agencies, about potential
    vulnerabilities in the information technology ecosystem to
    improve their technology acquisitions and strengthen supply
    chain risk management. Obviously, sharing information is good.
    But can you describe, in a bit more detail, the current
    limitations on information sharing, in particular with respect
    to supply chain risks?
        Mr. Lips. Thank you for the question, Senator. Over the
    past decade it has become clear that the Federal Government has
    focused increasing attention on addressing supply chain risk
    management. We have seen actions to ban the use of certain
    technologies by Federal agencies. From my perspective it seems
    like there is a time delay between when Federal agencies become
    aware of these problems and then when it reaches an
    understanding on Capitol Hill and then when it is implemented
    across the Federal Government.
        In 2018, there was legislation that attempted to address
    this problem by creating a stronger interagency process to
    improve that information sharing across the Federal Government.
    It seems like it would be a productive next step for Federal
    agencies and that interagency task force to also share
    information and specific information, to your point, with State
    governments, municipal governments, and the private sector.
        One of the challenges we have seen over the years with
    cybersecurity best practices is that there is often long lists
    of information provided to organizations. Providing very
    specific and discrete recommendations will help organizations,
    particularly those with limited resources, decide how to
    prioritize and manage risk.
        Senator Ossoff. Making the information that is shared more
    actionable rather than just a bureaucratic dump of data
    perhaps?
        Mr. Lips. Absolutely, Senator.
        Senator Ossoff. OK. Thank you, Mr. Lips. Thank you, Madam
    Chair.
        Senator Hassan. Thank you, Senator Ossoff. I am going to
    start my second round of questioning. I think we are expecting
    Senator Rosen to be available relatively soon, and when she
    gets here let me know and we can let her jump in, and then I
    can finish up with additional questions.
        I want to start with a question to Judge Whitley and Ms.
    Huey, because, again, this is a theme we are hearing,
    cybersecurity is a team effort. We know State and local
    governments often have separate structures for technology and
    security, but working together and sharing resources and best
    practices can improve the cybersecurity of all entities.
        Judge Whitley and Ms. Huey, do you think States should use
    a committee or other structure to bring together State and
    local representatives to help plan and coordinate cybersecurity
    efforts, and if your State already has such a committee, could
    you please elaborate on how effective you think it is? We will
    start with Judge Whitley, please.
        Judge Whitley. I do feel like it is extremely important. In
    this recently adjourned session of our legislature they created
    a committee that will go into effect on September 1st, and I
    think that will be very helpful. We will see how it works
    itself out.
        I really want to say, though, it is important to get our
    dollars back down as much as possible to the end user.
    Committee is OK, but again we are very different, we are very
    diverse, we are a very large State, and the quicker the dollars
    can get from wherever they are coming, whether it be the Feds
    or the State, and get it down to the end user, the better off
    it will be.
        An excellent example that I will use is the ARPA funds,
    which you allocated out. Counties, regardless of their size,
    receive the monies as direct payments.
        Senator Hassan. Right.
        Judge Whitley. In the CARES Act, it was distributed out to
    the State, except for those counties and cities over 500,000.
    Some of that money is still sitting in the States. The quicker
    you can get it down to the local areas, the better off we are.
        Senator Hassan. Thank you. Ms. Huey.
        Ms. Huey. Thank you, Chair. I absolutely believe that using
    an advisory committee, an advisory board, made up of a
    combination of State and locals best help define the strategy
    on how to spend funding and how to address cybersecurity.
        In Ohio, we have two organizations, the OC3, which I had
    already mentioned, which is a combination of public and
    private, is always a resource for any cybersecurity decisions.
    They are very much focused on economic development and
    workforce and sort of prevention. That would be their
    expertise. Then we also have the Homeland Security Advisory
    Council, which actually advises us on how to spend the Homeland
    Security Grant on our strategic goals.
        There are already a couple of systems in place in Ohio, and
    I would hope that many States have this. That would be a help
    with funding decisions.
        Senator Hassan. Thank you both for those answers. I am now
    going to ask another question of Ms. Huey and then Mayor
    Schewel. While the Federal Government can provide some
    resources and support to State and local cybersecurity efforts,
    we also need to encourage more State and local investment in
    cybersecurity, and that is a theme that we have been hearing
    this morning. That is why recent proposals for State and local
    cybersecurity grant programs have included a cost share where
    the grant would supplement funds already provided by the State
    or local entity.
        However, sometimes this cost share can be a barrier to
    State and local entities utilizing the grant program,
    especially during economic downturns, especially because State
    and local governments have to balance their budgets.
        Ms. Huey and Mayor Schewel, do you think that the Federal
    Government should be able to waive the cost share requirement
    in certain limited circumstances, and what would those
    circumstances be? We will start with Ms. Huey.
        Ms. Huey. Thank you for that question, and I appreciate
    having the cost share requirements, the match requirements. I
    think it is important to have skin in the game. But, if that
    can be done on a graduated basis so that things can get stood
    up and get started, and then other sources of funding can
    eventually supplement, I think that is a great approach.
        Are there opportunities to waive that? I think that would
    be interesting and potentially a multi-state project or
    something that is a little bit broader. At that point in time
    if it is a waiver or maybe we could leverage private dollars
    for something like that, I think that would be something
    interesting to pursue.
        Senator Hassan. Thank you. Mayor Schewel.
        Mr. Schewel. Thank you very much, Senator. Durham is lucky.
    We are a fairly large city with really good IT staff. We have
    wonderful staff. But 80 percent of municipalities in the United
    States are small with populations below 50,000 people. Most of
    these municipalities have very little ability to cost share,
    and I think that really needs to be an important consideration.
        The Public Technology Institute found that 65 percent of IT
    officers in municipalities felt that their cybersecurity budget
    was inadequate, and many of these cities are pressed in many
    ways, multiple needs for their budgets. Cost sharing certainly
    can be an impediment to have the adequate cybersecurity
    infrastructure that is needed.
        Senator Hassan. Thank you very much, Mr. Mayor. I now see
    that Senator Rosen has joined us virtually, so I will recognize
    her for her 7-minute round of questions.
        Senator Rosen. Thank you, Madam Chair. I appreciate that.
    Thank you for chairing this meeting in the absence of Senator
    Peters being here on the loss of his mother. I really
    appreciate you stepping in, and the witnesses, of course, for
    being here today, because cyberattacks can be expensive, they
    are debilitating, especially for small governments. I am really
    glad that we are coming together in a bipartisan way to talk
    about how we are going to protect communities in this really
    challenging time, and it is not going to get any easier.
        Elementary and secondary schools, they remain increasingly
    vulnerable to hostile cyber actors. Last year, the FBI warned
    that K-12 institutions represent an opportunistic target to
    hackers, and many school districts, they lack the budget and
    the expertise to dedicate to network integrity.
        In August of last year, Clark County School District,
    Nevada's largest school district, and our nation's fifth-
    largest school district, was the victim of a ransomware attack.
    The hacker published documents online containing sensitive
    information, Social Security numbers, student names, addresses,
    and the like. Of course, this is absolutely unacceptable, and
    the Federal Government must help schools obtain the tools and
    resources to protect their students, their families, their
    teachers, educators, everyone who works there. It is something
    that I have raised with CISA and the Department of Education.
        Mr. Holden, what more could CISA be doing to assist our
    elementary and secondary schools with being sure that they have
    some way to understand how to implement the tools and
    cybersecurity standards and protocols?
        Mr. Holden. Thank you for the question. I think really what
    needs to happen is there needs to be a set of standards
    developed. I think if either Homeland Security took a look at
    cybersecurity and implemented a set of standards that would
    then pass down to us, that we could look at at the local level,
    or even at the State level, to make sure that we have
    implemented those systems to prevent ourselves from what is out
    there.
        I would highly recommend a set of standards that could be
    looked upon, and then a way for either Homeland Security or the
    local or State to test those systems for us, and then to
    identify where we may be weak in those systems so that we can
    implement what needs to be implemented at the local level.
        Senator Rosen. That is a great suggestion, because we need
    to get it out to every school district, large and small.
        Another thing that we may have to do in order to do this,
    is our cybersecurity surge capacity. Ms. Huey, in your
    testimony you note that Ohio has created a civilian Cyber
    Reserve, consisting of a volunteer force of trained
    cybersecurity civilians to assist in a variety of cybersecurity
    needs. Senator Blackburn and I recently introduced the Civilian
    Cyber Security Reserve Act to establish a civilian Cyber
    Reserve at DHS and the Department of Defense (DOD) to call up
    cybersecurity experts at our times of greatest need.
        Ms. Huey, how has the Ohio Cyber Reserve helped reduce
    cyber threats to the State, and what are some lessons you think
    that we could draw on what you have done and apply that to the
    national level in order to supplement DHS's existing personnel
    and add additional cyber capacity?
        Ms. Huey. Thank you, Senator, for that question. The Ohio
    Cyber Reserve operates much in the way that you were pointing
    out. It was introduced by OC3 and then it was authorized by the
    Ohio General Assembly in 2019, and it really does operate like
    a military reserve. It is under the adjutant general. It can be
    activated by the Governor.
        Currently we are in the process of building out ten
    regional teams across Ohio. We have three of those teams
    already stood up and running. They do not publicize when they
    are deployed, but they have been deployed, and they have been
    successful.
        I think there would be a lot of lessons learned and
    information that we could share with the new program at the
    Federal level as to how we identified that expertise, because
    we really wanted a cross-section of expertise, people that know
    the latest but also people that know how to deal with legacy
    systems as well. Thank you.
        Senator Rosen. I think I am going to have my team reach out
    to you and see what some of the lessons learned and best
    practices are, and we can see what we can do with those here.
        I think when we talk about this, what I would like to ask,
    especially to the mayor, as you are dealing particularly at the
    local level, when we are talking about all the cybersecurity
    personnel and implementation and setting standards, and we do
    have to do all of that. But we really have to create a trained
    workforce, not in cyber but really a technologically savvy
    workforce, because there is not an area that someone is not
    going to have to be aware of a phishing scheme, any way that
    the vulnerabilities and multiple ways that people get in.
        Mayor Schewel, can you describe the resource and workforce
    constraints that you may have and perhaps how we might consider
    a career in technical education down at, I guess, the city
    level or school districts, and they could be city or county, to
    try to really increase workforce talent and capacity, because
    at the end of the day, they are the faces on the other side of
    the computer that may be the ones that get taken advantage of
    unknowingly, and that hurts all of us.
        Mr. Schewel. Senator, thank you very much for the question.
    You are absolutely right. I think there are two aspects to
    that. One is--and Judge Whitley spoke to this early--the
    ability to train our young folks within the city to avoid
    phishing attempts, which is the way this successful cyberattack
    happened against our city. We were fortunately backed up, but
    that is the way people got in. I think that kind of training is
    critically important, and we do a lot of that. It cannot only
    be training, though. Multi-factor authentication, those kinds
    of things, are also critical.
        But I also think that there is the issue of having the--we
    live in the Research Triangle region of North Carolina. We have
    highly trained technical workforce, and making sure that we
    have enough of those people on staff is really important. That
    is one of the reasons I think it is really important that we
    have additional funding. It costs us $900,000 a year to do our
    IT security. It is very expensive, and we need support for it.
        Senator Rosen. I guess I have a few second left, but what I
    would like to say is I think--and it is not a question of this
    Committee, but I do think that we have to increase our STEM
    education across the board, I would say pre-K through 12, so
    that they are ready to work right away, in all these areas, to
    protect whatever business, government, whatever they go to do
    as an adult. I look forward to working on some of those things
    in the future.
        Thank you, Madam Chair.
        Senator Hassan. Thank you very much, Senator Rosen.
        I have additional questions, and I am going to check with
    the staff. That is all the Senators we have lined up right now,
    right?
        I thank the panel for so much excellent testimony, and I do
    have a few more questions. I am going to start with a question
    to Ms. Huey.
        Collaboration among States could serve a really important
    role in bolstering cybersecurity, and you have referenced that
    a bit already this morning. Ms. Huey, do you think multi-state
    cybersecurity projects would boost cooperation among States and
    improve cybersecurity beyond what States could achieve alone?
        Ms. Huey. Thank you for that question, Senator. I
    absolutely do, and I do not believe that there has probably
    been enough done at that level. Ohio Homeland Security is
    currently in the process of surveying all of the State's fusion
    centers, just to get a real good feel on what their cyber
    structure looks like. We want to benchmark ourselves and see if
    we are doing well. In the conversations with our surrounding
    States, there is a lot of interest and a lot of communication,
    and I think there is some ability to really work on some
    collaborative projects.
        Additionally, I think the Federal Department of Homeland
    Security has a number of centers of excellence, partnered with
    universities, and I think that would be a real opportunity as
    well, that should be explored.
        Senator Hassan. Thank you for that.
        Mr. Lips, I want to turn to you, obviously, it is something
    you have talked about in your testimony and in the purview of
    this Subcommittee, we have a duty to ensure that taxpayer
    dollars are spent efficiently and effectively. In this case,
    the goal is to efficiently and effectively spend grant funds to
    reduce the cybersecurity risk of State and local entities.
        How do you think the Federal Government should measure how
    effective grants are at reducing State and local cybersecurity
    risk, and how should this be integrated into the grant program?
        Mr. Lips. Senator, thank you for the question. I think that
    is a great issue to be raising, particularly if Congress is
    considering establishing a new, dedicated cybersecurity grant
    program. It is one of the lessons, I think, that we have
    learned over the past 20 years with the FEMA grant program.
    That program was originally intended to be risk-based and
    focused on helping States and urban areas buildup capabilities
    that were needed, particularly after 9/11.
        Unfortunately, over time, my view is that that program has
    become more of a formula-based program that is no longer
    essentially risk-based, and as GAO and others have pointed out,
    FEMA has struggled to measure how States are buying down risk.
        Senator Hassan. Right.
        Mr. Lips. With a cyber grant program, I would urge the
    Committee to be focused on--starting from the beginning, of
    ways to measure that, to not be looking back years later and
    think, this should have been more risk based.
        Senator Hassan. OK. Thank you. I want to turn back to the
    issue that Senator Ossoff was talking a little bit about, which
    is information sharing. To Mayor Schewel, to Judge Whitley, and
    to Mr. Lips, information sharing has been one of the key ways
    that the Federal Government supports State and local
    cybersecurity. However, there are many questions about how the
    information sharing regime could be improved.
        Mayor Schewel and Judge Whitley, how useful has the
    information that the Federal Government shares with you been,
    and are there other types of information that the Federal
    Government could provide that you would find useful? I will
    start with you, Mayor Schewel, and then go to Judge Whitley.
        Mr. Schewel. I will tell you, Senator, I do not honestly
    know the answer to that question in detail. I can tell you that
    we have really needed our Federal Government partners,
    including the FBI at times, during our recent cyberattack. But
    I am sorry, I have to get back to you on real information about
    the usefulness.
        Senator Hassan. Sure. OK. Thank you. Judge Whitley.
        Judge Whitley. I know that our IT folks are in constant
    communication not only with the Federal agencies, also with the
    local. They are meeting on a monthly basis or a quarterly
    basis. Then any time any particular event happens, then they
    are working with one another and helping one another out. Any
    type of collaboration that can occur needs to be encouraged,
    because that is the way that we will keep people up to date on
    what the new style or the hack of the day is, and go under that
    type of a scenario. But the Feds have been very helpful. I know
    our folks are members of just about any organization they can
    become a member of that will assist or will help in identifying
    threats or things that are going on in the community.
        Senator Hassan. Thank you. Mr. Lips, how do you think we
    can improve cybersecurity information sharing between Federal,
    State, local, and Tribal organizations?
        Mr. Lips. Thank you for the question, Senator. Generally I
    think that information sharing programs have been very well
    intended and have been a step forward from where we were a
    decade ago.
        That said, the various watchdogs, like the inspector
    general, have identified challenges within DHS's information
    sharing programs, issues such as timeliness, over-
    classification, and frankly, general value of the information
    that is shared has resulted in limited participation from the
    private sector, from what I understand, and from what the IG
    has found. I think addressing these areas and open
    recommendations broadly, both for private sector partners as
    well as State and local governments would be a valuable
    improvement.
        In addition, I think there is valuable information sharing
    that can be provided about security recommendations, from
    supply chain acquisitions risks, also just general best
    practices having recommendations be made in a way that is
    prioritized would be really helpful for organizations across
    the board, including State and local governments.
        Senator Hassan. Thank you. I want to ask a question of all
    the government witnesses now about Homeland Security Grants,
    because there has been a little bit of discussion about what
    already exists, and I want to really try to drill down on the
    effectiveness and usefulness of that.
        The Department of Homeland Security provides grants that
    can be used for a variety of purposes, including, as has been
    pointed out, cybersecurity. The State Homeland Security Grant
    program used to require that recipients use at least 5 percent
    of these grant funds for cybersecurity, but that has now been
    increased to 7.5 percent. That was done earlier this year. It
    also requires that a portion of these funds pass through to
    localities.
        My question to all our government witnesses is whether
    these requirements are enough to address cyber needs? Judge
    Whitley, Mayor Schewel, and Superintendent Holden, have any of
    the local entities you represent received funding through the
    State Homeland Security Grants for increasing your
    cybersecurity? I will start with Judge Whitley.
        Judge Whitley. We have received funding but this is one of
    the things that because of the increase in activity we do need
    more funds. I know that that is the standard answer you feel
    like you get any time you ask a governmental entity about any
    particular issue, but I think we all recognize, just as we
    stated earlier, about the very public threats and confidential,
    where they come in and seize operations or stop operations from
    happening. This is an ever-increasing area of threat, and we
    need to be focusing more and more dollars and efforts on that.
        Senator Hassan. Thank you. Mayor Schewel.
        Mr. Schewel. Thank you, Senator. I think it is really
    important that we not be cannibalizing other Homeland Security
    programs to do this cybersecurity work. We are going to need
    all of it. The cybersecurity threats that we are facing, every
    day there are cybersecurity attacks on the city of Durham, and
    we are able to fend them off. But all the actors have to do is
    be successful once. Our needs in this area are going to be
    greater and greater. We are going to need funding that is not
    competitive and not cannibalizing other Homeland Security
    funding. I think that is really going to be critical to us.
        Senator Hassan. Thank you. Superintendent Holden.
        Mr. Holden. I am unaware of any funding that we have
    received at the local level regarding the Homeland Security
    Grants. I have to look, though, past funding. I think really
    what I am looking for is more information. I think the more
    information that can be given to me at the local level from
    Homeland Security or from the State would be much more
    beneficial for me to be able to implement systems that will
    help us from these type of attacks.
        Senator Hassan. Thank you. Ms. Huey, in your view is the
    increase from 5 percent to 7.5 percent enough to improve State
    and local cybersecurity, or is there more assistance needed?
        Ms. Huey. Thank you for your question, Senator. I believe
    that there is more funding needed. I do not believe just
    increasing from 5 to 7.5 percent really recognizes the need for
    cybersecurity funding and the importance of the risks across
    our States. In fact, with Ohio, our total Homeland Security
    award went down, even though the carve-out for cybersecurity
    went up.
        I just think we keep making the pie smaller and then
    putting another priority in that, really does not do justice to
    what we need for cybersecurity across the country.
        Senator Hassan. Do you think a dedicated grant program
    would better ensure that State and local cybersecurity needs
    are met?
        Ms. Huey. I do. I do believe it will, because I believe
    that we could do more planning, more coordination, and really
    work better with the local governments and the small business
    to bring everybody up to a level that we want them to be.
        Senator Hassan. Thank you.
        I have a couple of more questions if the witnesses will
    indulge me. I thank you. The testimony has been terrific, and I
    want to get to a couple of more things and make sure that there
    are not any other Senators who want to pop in and ask
    questions.
        Let me go to this one now, to Superintendent Holden, Mayor
    Schewel, and Judge Whitley. It has become increasingly clear
    how important cybersecurity is for all organizations. However,
    some officials in charge of setting priorities may not fully
    appreciate the vulnerabilities of their cyber systems. You all
    clearly pay more attention to cybersecurity issues than many
    others may.
        Superintendent Holden, Mayor Schewel, and Judge Whitley, do
    you believe that creating a State and local grant program
    dedicated to cybersecurity would encourage officials to focus
    more on it, and how might that increased engagement boost
    cybersecurity beyond just the extra resources that a grant
    program would provide? We will start with you, Superintendent
    Holden.
        Mr. Holden. Thanks for the question. Yes, I think a grant
    program and a committee to look at these things at the State
    level would absolutely highlight the need and the ability to
    continue to focus on these things. New Hampshire votes all
    State, whether it is through the Superintendents Association,
    through the Department of Education. I think the more attention
    that could be given in this small State, where we have a very
    locally committed but yet regionally organized, I think would
    absolutely benefit our ability to address some of these issues.
        Senator Hassan. Thank you. Mayor Schewel.
        Mr. Schewel. Thank you very much, Senator. Yes, definitely,
    we really need such a program, again, when I think about our
    small cities and how this would not just help them with funding
    but help them with the kind of coordination that you talked
    about. Again, 80 percent of cities in this country are below
    50,000 people in population, and their ability to do the work
    that they need to do for cybersecurity, they just simply cannot
    do it on their own.
        A grant program that would encourage the kind of
    cooperation necessary would be an incredible boon to those
    small cities. It would be good for all of us, but I think
    especially for our small municipalities it would be essential.
        Senator Hassan. Thank you. Judge Whitley.
        Judge Whitley. I think anything that helps in the
    coordination and the collaboration of understanding the issues
    and the problems will be very helpful. All too often, anyone
    who is affected is very reluctant to get out there and announce
    that they have been affected. Sometimes you feel like, OK, we
    are small enough, we will slip under the radar, and in today's
    environment that is just not happening.
        I think the more you can bring folks together, whether it
    be on a statewide basis or a regional basis or a county-wide
    basis, to talk about what is going on and to make people aware
    of some of the issues, that is going to be beneficial. That is
    going to maybe result in them allocating a few dollars that
    they have not allocated before, to help address, or to be
    prepared and understand that maybe your backup system was broke
    a week ago, and had you not done that, look at the effect that
    it would have had once you did get hit.
        The more collaboration that we can have with all of the
    entities around us, the better off we will be.
        Senator Hassan. Thank you. Ms. Huey, would you like to
    provide your perspective on this?
        Ms. Huey. I would agree with what the other witnesses were
    talking about. I think this is not an urban issue. When we
    think about criminal justice funding or some of those things we
    focus on big-city problems. This is a problem all across our
    local governments, regardless of size. Having the ability to
    help out the ones, as the mayor pointed out, with the smaller
    budgets, I think is critical. Again, that standard of
    preventive preparedness that we can bring everybody up to.
        Senator Hassan. Yes, I sometimes think people forget that
    coordination and preparedness takes resources. You can be well
    intentioned in it but if you do not have people who can spend
    the time doing it, it gets difficult to actually accomplish.
        Because I have the time, and I know, Ms. Huey, you have
    mentioned this too, I want to ask one more question to you, and
    then in a wrap-up question to all of you. I am going to preview
    the question so you can think about your answer. When we close
    I would like you to think about one piece of advice each of you
    would give to your colleagues working in State, county, local,
    or Tribal government when it comes to cybersecurity. That will
    be the final question.
        But first, Ms. Huey, I want to talk to you a little bit
    about the National Guard's role here. Earlier this year,
    Senator Cornyn and I reintroduced the bipartisan National Guard
    Cybersecurity Support Act. This legislation explicitly
    authorizes the National Guard to provide cybersecurity support
    services at the request of a State Governor, to be performed as
    training duty upon approval by the relevant service Secretary.
        Ms. Huey, can you speak to the role that the National Guard
    plays in Ohio's cybersecurity, particularly as a part of the
    larger plan for how Ohio is improving the cybersecurity of
    State and local systems?
        Ms. Huey. Absolutely. Thank you for that question. As I
    indicated in my comments earlier, the Ohio National Guard
    really took a lead role in cybersecurity early on in Ohio. The
    Cyber Reserve was authorized by our General Assembly in 2019,
    and they really went out and recruited that civilian expertise
    that really existed already in the State, and they were very
    strategic about making sure that each regional team had the
    breadth of experience that could respond to a variety of
    attacks. That has been very successful, and it is wonderful to
    see the Federal Government will be able to support that and
    backs that up. That has been something that we are very proud
    of here in Ohio.
        The Ohio Cyber Reserve, the Cyber Range Institute, is also
    connected to that, and that is in some of our universities is
    really a think tank and a testing site, and it is very
    education focused. We have the existing expertise in the Cyber
    Reserve and the Cyber Range is trying to build that workforce
    development through our K-12 and our universities.
        Senator Hassan. Thank you very much.
        Now the wrap-up question here, the one piece of advice each
    of you would give to your colleagues who are working State,
    county, local, or Tribal government when it comes to
    cybersecurity. Why don't we start with you, Mr. Lips, then we
    will go to Superintendent Holden, the mayor, and the judge, and
    then I will allow Ms. Huey to wrap it up.
        Mr. Lips. Thank you, Senator. One piece of advice I would
    offer to State, local, county, and other government officials
    working at that level is that it is very helpful for Members of
    Congress and congressional staff to hear your perspective about
    some of the challenges you are facing. In my testimony, I
    referenced the issue of compliance costs that the State CIOs
    have raised. It is very helpful to hear directly from State
    officials about what their day-to-day experience is and what
    those challenges are. I recall hearing from NASCIO and State
    CIOS in the anteroom several years ago, bringing that
    recommendation to my attention. There is great interest in
    their perspective, and it is very valuable to hear their view.
        Senator Hassan. Thank you, Mr. Lips. Superintendent Holden.
        Mr. Holden. Yes. I would let my fellow local and State
    folks know to be informed, to provide ongoing training and to
    implement needed systems, and that being proactive is a lot
    cheaper than being reactive.
        Senator Hassan. Thank you. Mr. Mayor.
        Mr. Schewel. Thank you, Senator. With your permission I
    will give two pieces of advice. One is to have an immutable
    backup of all data, including structured, unstructured, and
    binary data, and that is critical for quick recovery. We back
    up in Durham every 2 hours.
        Then second, having an established partnership between
    Federal, State, and private sector parties so that if you are
    attacked, if you quickly define and contain the threat, we were
    able to do that and quickly set up a war room, and that is what
    really contained the cyberattack that we had. Thank you for
    that question.
        Senator Hassan. Thank you. Judge Whitley.
        Judge Whitley. Again I want to thank everybody for the
    opportunity to speak today. The thing that I would say is test,
    train, perpetual, perpetual training and testing, to just keep
    at the front of everyone's minds that every time they are on
    that computer that there is someone trying to get in. The more
    we can do to keep our people thinking in that perspective, the
    better off we will be.
        Senator Hassan. Thank you, Judge. Ms. Huey.
        Ms. Huey. Thank you, Senator. My advice would be know your
    partners. Do not wait for the event to occur before you know
    who your resources are, your partners. Regularly communicate.
    There is a saying in the EMA world, that a disaster is not the
    place to exchange business cards. You need to know who your
    network is, and your partners that are to help in a situation.
        Senator Hassan. Thank you so much. I want to thank all of
    the witnesses this morning for giving us so much of your time
    and sharing your expertise and your perspective and experience.
    It is really invaluable and it really does help inform the work
    of this subcommittee and the U.S. Senate. Thank you.
        Your testimony here today is going to help us craft better
    bipartisan legislation to help State and local officials
    address cyber threats. The hearing record will remain open for
    15 calendar days, until 5 p.m. on July 2nd, for submissions of
    statements and questions for the record.
        The hearing is now adjourned.
        [Whereupon, at 11:51 a.m., the Subcommittee was adjourned.]

                                A P P E N D I X

                                  ----------

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]