Senate passes Queens lawmaker's bill to prepare and protect state agencies against ransomware attacks

State Senator Kristen Gonzalez passed her fourth piece of legislation during her first legislative session in Albany. (Courtesy of NYS Senate)

June 7, 2023 By Bill Parry

With her first legislative session in Albany drawing to a close for the summer, rookie state Senator Kristen Gonzalez, the youngest woman ever elected to the Senate at age 27, has proven herself to be a prolific lawmaker.

Her Secure Our Data Act was passed by a full Senate vote on May 31, becoming the fourth piece of legislation passed by Gonzalez this year. The legislation, S.5007, requires New York state governmental entities to increase preparedness for ransomware cyberattacks.

“The volume of cyberattacks shows that we are underprepared for online threats and must strengthen the systems that store our information,” Gonzalez said. “The New York state government has an immense amount of data on New York citizens. That information should not be vulnerable to breaches.”

The legislation would require the Office of Information and Technology Services to develop data protection standards for state agencies and require them to engage in regular vulnerability testing of its information systems and require each state entity to create an inventory of its information systems.

The bill would also require each state entity to develop an incident response plan for ransomware and other malware attacks. According to the National Association of State Chief Information Officers, there has been a “five-fold increase in phishing attacks in the last three years.” Similarly, since 2017, more than 3,600 local, state, and tribal governments across the country have been targeted by ransomware hackers.

“New Yorkers should never have to fear that their personal information is at risk because they have interacted with a state agency,” Gonzalez said. “With the Secure Our Data Act, the state would be taking proactive steps to protect that information. I am glad that the Senate is taking the threat cyberattacks pose seriously, and I remain committed to protecting our data and ensuring our state has strong cybersecurity measures in place.”

As chair of the Senate Internet and Technology Committee, Gonzalez passed her first bill relating to recovering online accounts on May 15. Three days later her measure requiring information on economic abuse be made available at shelters and similar facilities and on May 30, Gonzalez passed her third piece of legislation reducing barriers to filing class action lawsuits.

Setting the table for the next legislative session, Gonzalez introduced her Consumer Utility Protections During Investigations Act, legislation that would protect residential and commercial utility customers by pausing late fees and service terminations while the Public Service Commission investigates a utility and for 120 days after the investigation has concluded.

“Currently, consumers are left holding the bag as utility companies under investigation pass on the cost of lost revenues to their customers,” Gonzalez said. “This bill will go a long way to ensuring consumers across the state have guaranteed protection from fees and shut-offs and creates a strong accountability measure to ensure utilities operate with caution.”

Hudson Valley Assemblywoman Sarahana Shrestha is carrying the bill in the lower chamber.

“We know the industry will be able to absorb the costs of temporary nonpayment, just as it did during a broad moratorium on utility shut-offs at the onset of the COVID-19 pandemic,” Shrestha said. “What’s most important is that ratepayers aren’t punished when their utility is at fault.”