BILL NUMBER: S7289      Revised 1/16/2020

SPONSOR: CARLUCCI
 
TITLE OF BILL:

An act to amend the general municipal law, in relation to prohibiting
the paying of ransom in the event of a cyber-attack

 
PURPOSE: OR GENERAL IDEA OF THE BILL:

To prevent municipal corporations and government entities from paying
ransom in the event of a cyber-attack against them.

 
SUMMARY OF SPECIFIC PROVISIONS:

Section one of the bill amends the general municipal law as it relates
to preventing municipal corporations and other government entities from
paying ransom in the event of a cyber-attack.

Section two of the bill sets the effective date. JUSTIFICATION:  In the
U.S. in 2019, more than 100 state and municipal governments and agencies
              

were targeted by "ransomware" attacks. These attacks block access to
data and/or threaten to release sensitive data unless a ransom is paid.
The combined cost of ransomware attacks totaled more than $7.5 billion
in 2019.

In New York, on December 25, 2019, the Albany International Airport was
targeted by a cyber-attack, rendering the airport inoperable.  Those
responsible for the attack demanded a ransom in exchange for the return
of data and restoration of the airport's systems. In desperation, Albany
International Airport complied, paying an undisclosed amount reported to
be under $100,000.  When municipal corporations and government agencies
comply with these ransoms, they incentivize cyber-attackers looking to
make a quick buck. Prohibiting these entities from complying with ransom
requests will remove this incentive and safeguard taxpayer dollars.

 
LEGISLATIVE HISTORY:

New Legislation.

 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:

Minimal.

 
EFFECTIVE DATE:
This act shall take effect immediately.