With the introduction of legislation this week in the Arizona House of Representatives to prohibit many public entities from using public funds to pay for ransomware attacks, AZ Free News recently spoke with Sen. David Gowan about the security of the Legislature’s own computer systems.
Gowan says that the dedicated IT staff of the Arizona Legislature have ensured that its system protections are up to date and meet or exceed industry standards. This would allow the legislative session to continue with little impact if hit with the type of ransomware attack suffered by the Virginia Legislature last month.
“Nothing is 100 percent guaranteed, but we try to figure it out before a hacker can,” he said. “And we have the ability to move forward and maneuver, even if we have to do some things on paper.”
The Dec. 10 ransomware attack on servers used by Virginia lawmakers led to the disabling of the legislature’s voicemail system, its budgeting portal, and the platform used to draft bills. Even access to the Virginia Constitution and state code normally accessible online had to be taken down after the attack, which one state official blamed on an “extremely sophisticated malware.”
For a short time the website serving Virginia’s Division of Capitol Police was also down but there was no report of impacts to critical functions.
Whoever hacked the Virginia Legislature’s system left a ransom note, although it did not include a ransom price nor due date, according to a senior staff member. It is the first reported cyber security attack on a state legislature, although at dozens of public entities across the country were hit in 2021.
Gowan is pleased that Arizona’s legislative staff has safeguards in place which will allow lawmakers to “quickly move forward with our work” if hit by an attack like Virginia experienced. He credits the fact that the legislature’s IT personnel conduct refresher training for lawmakers and staff about suspicious emails, which is the easiest way for a cyber attacker to get into a system.
There is also frequent spot checks of the legislature’s systems. And it helps, Gowan noted, that Arizona has one of the nation’s premiere cybersecurity programs, with the Arizona Department of Homeland Security, the Arizona Department of Public Safety, and the Department of Emergency and Military Affairs all major players, along with local and federal agencies.
Two controversial bills recently introduced by a state representative would make significant changes to Arizona’s laws related to cyberattacks. One would tie the hands of public officials in responding to a ransomware attack, while the other seeks to require anyone who does business in Arizona to report a computer security breach or face a civil penalty from the Arizona Attorney General’s Office.
HB2145 would bar the State and any political subdivision of the state (such as a county, city, town, or school district) from making ransomware payments to secure the release of data. It would also require immediate notification of such an attack to the Director of the Arizona Department of Homeland Security.
Meanwhile, HB2146 would mandate anyone who “conducts business in this state and that owns, maintains or licenses unencrypted and unredacted computerized personal information” to report any security system breach to the Director of the Arizona Department of Homeland Security within 45 days.
A willful violation of the notification statute could lead to a civil penalty of up to $500,000, according to the bill.
After a mini-Wildfire 101 course from the Arizona State Forester, 18 of the 19 members of legislature’s Joint Committee on Natural Resources, Energy, and Water voted in favor of Gov. Doug Ducey’s proposed $100 million fire suppression and mitigation legislation.
Next up for the bill during this Special Session is a quick trip through two Rules Committees on Thursday morning. That should be followed by the House and Senate convening to consider amendments to the two identical bills, SB1001 and HB2001, which are tracking in both chambers.
Wednesday’s hours-long meeting featured a questions and answers session with David Tenney, director of Arizona’s Department of Forestry and Fire Management (DFFM) on the same day that two ongoing destructive wildfires near Globe -the Telegraph and the Mescal- merged with nearly 150,000 acres burned.
Ducey called the Special Session for the sole purpose to pass a wildfire-related supplemental appropriations bill. The joint committee discussed many of the bill’s targeted investments for wildfire preparedness, response, and recovery, including $76 million toward fire suppression efforts, recovery efforts, mitigation of post-fire floods, economic assistance for those displaced by fires or post-fire floods, and assistance to landowners for emergency repairs from wildfire-related infrastructure damage.
There is also nearly $25 million appropriated in the bill for DFFM and the Arizona Department of Corrections (ADC) to partner on wildfire mitigation efforts such as removing hazardous vegetation and fire fuels. The funds include hiring 720 ADC inmates, working in 72 teams of 10 inmates, to target DFFM-designated areas across the state where mitigation is needed. The goal, said Tenney, is for the crews to cover 20,000 acres annually.
Among the questions Tenney was asked was whether Arizona should own a fleet of firefighting aircraft instead of contracting with providers. Tenney was also asked whether DFFM should purchase a handful of $500,000 firetrucks designed for off-road wilderness access that could be “borrowed” to smaller fire departments.
Tenney also noted that as of this week, Arizona’s 2021 fire season will have impacted nearly 300,000 acres. That puts the state of track for its worst fire season in history due to the combination of excessive heat in all 15 counties as well as drought conditions.
Some committee members tried to get Tenney to discuss whether Arizona’s increasingly larger wildfires are the result of climate change, but the director stuck to the purpose of the legislation -and the Special Session- which is to ensure funding for activities which can have an immediate affect on reducing fires or limiting the damage from fires.
The climate change comments received pushback from Sen. David Gowan (LD-14), who said no one is disputing there is climate change.
“Climate change happens every decade, happens every century, millennium, we have climate change,” he said.
Some Democrats questioned whether the Ducey-backed appropriations bill goes far enough as they preferred legislation addressing more than the immediate critical need. However, committee chairs Rep. Gail Griffin (R-LD14) and Sen. Sine Kerr (R-LD13) guided the discussion back onto the purpose of the legislation – to address the wildfire and post-fire flooding crisis facing Arizona now.
The only no vote was cast by Sen. Juan Mendez (D-LD26).
Two pieces of state legislation aimed at protecting gunowners’ rights made it out of the Senate on Wednesday, and it is now up to House Speaker Rusty Bowers to assign the bills to House committees.
SB1382 deems stores which sell firearms, ammunition, or components of either as “an essential business” during a state of emergency. The bill cleared the Senate Judiciary and Senate Rules committees in early February and passed on the Senate Floor by a 16 to 14 vote along party lines.
The bill impacts ARS § 26-303 under Military Affairs and Emergency Management, which currently guarantees emergency powers shall not allow the imposition of additional restrictions on the lawful possession, transfer, sale, transportation, carrying, storage, display or use of firearms or ammunition or firearms or ammunition components.
Under SB1382, the statute would be amended to add one sentence that specifies stores that sells firearms, ammunition, or components of such are essential businesses “and there may not be any restrictions imposed on the store’s normal operations” during a state of emergency.
The legislation would not require a store’s primary source of revenue to come from gun or ammunition sales, thus allowing businesses which sell other retail items in addition to firearms to remain open. One such business that would benefit from the legislation is Lilly’s Tombstone Memories, a specialty gift store on historic Allen Street in Tombstone.
If SB1382 had been the law when COVID-19 first hit, owners Lillian and Bob Hritz would have been able to remain open without fear of retribution against their business license. They, like a number of gun store owners, saw an increased customer demand starting last March but due to Gov. Doug Ducey’s executive orders many had to close.
Among those supporting the bill are the Republican Liberty Caucus of Arizona and the Arizona Citizens Defense League.
Another gun rights bill passed out of the Senate on Wednesday, this one by a 17 to 13 vote.
SB1328 -known by its working title of the Second Amendment Firearm Freedom Act- would declare any federal act, law, treaty, order, rule, or regulation to be null and unenforceable in Arizona if the action violates the right to bear arms as provided by the Second Amendment of the U.S. Constitution or by the Arizona Constitution.
The bill sponsored by Sen. David Gowan (R-LD14) would also prohibit the State and any of its political subdivisions from using personnel or financial resources to enforce, administer or cooperate with any federal act, law, treaty, order, rule, or regulation deemed in violation of the U.S. or Arizona Constitutions.
But unlike many bills, SB1328 as currently written includes a provision putting teeth into the new law by making the impairment of a citizen’s right to bear arms a Class 1 misdemeanor for the first offense. Each subsequent offense would be a Class 6 felony, and a judge would be required to impose the maximum fine and sentence allowed by law for anyone convicted of such conduct.
The bill also contains a provision allowing citizens to sue any “entity, agency, bureau, employee or official of Arizona or a political subdivision of Arizona” that engages in such infringement for judicial relief, damages, and attorney fees. However, it excludes persons working under the authority or orders of a government entity, agency, bureau, employee or official from the outlined prohibitions.
