BILL NUMBER: S348

SPONSOR: KAPLAN
 
TITLE OF BILL:

An act to amend the education law, in relation to annual notifications
to school districts to combat cyber crime

 
PURPOSE:

This legislation would require the State Education Department to annual-
ly notify via email head of data and information technology services in
each school district of a reminder of strategies and best practices that
are most effective in combating cybercrime, and a copy of a National
Institute of Standards and Technology report aimed at improving critical
infrastructure and cybersecurity.

 
SUMMARY OF PROVISIONS:

Section 1 adds a new section 115 to the education law to require annual-
ly on or July first, SED to notify via email the head of information
              

services of each school district a reminder of the strategies and best
practices that are most effective in combating cybercrime, as well as a
copy of "Framework for Improving Critical Infrastructure Cybersecurity
Version 1.1" published by the National Institute of Standards and Tech-
nology on April 16, 2018.

Section 2 is the effective date.

 
JUSTIFICATION:

The need for improved cybersecurity is real. Hackers who are able to
access schools networks can do irreparable harm. This legislation seeks
to identify and provide best practices to school districts so that they
have a better understanding of what steps they can do to prevent attack.
Malicious attacks or attacks undertaken for ransom pose very real
threats to school districts. In 2019 hackers held two Long Island school
districts hostage, forcing one to pay $88,000 to retrieve student infor-
mation. Best practices can prevent having to pay a ransom by protecting
student information, as well as preparing school districts with know-
ledge of how to react quickly to mitigate an attack.

 
LEGISLATIVE HISTORY:

S. 7001; Referred to Senate Education Committee

 
FISCAL IMPLICATIONS:

None.

 
EFFECTIVE DATE:
This act shall take effect July 1 next succeeding.