Cybersecurity News Roundup

All right, welcome back to In Case You Missed It, GovTech's weekly government technology news roundup, where we're going to take a look at some of the biggest GovTech news from the past week and give you our thoughts on what it means for government, citizens, and the market as a whole. I'm Dustin Haisler, your host, joined here by my co-hosts Joe Morris and Jed Pressgrove. Hey guys, thanks so much for, uh, another conversation, another week. This week we're diving into cybersecurity, and we know that cybersecurity is top of all the headlines more recently. We also have a special guest on, our Vice President of the Center for Digital Government, Phil Bertolini, will be joining us and answering our questions about cyber, the market, and what cities and states are prioritizing in 2022. So you don't wanna miss that. But let's start first with cybersecurity. And, you know, this is no shortage to our In Case You Missed It episodes as we look at a new attack that has impacted the Albuquerque school system. This one kind of as a follow-up to the ransomware attack that happened first. GovTech talked a little bit about how some of the— how the superintendent and the school district were able to kind of recover from this attack. So, Joe, I know you've been following this one really closely. What do you make of all of this?

Yeah, I mean, it's caught my attention. Obviously, we have a little bit of cyber fatigue when it comes to headlines, but this stood out to me not because it was just the public school system that got hit by ransomware, but you also saw the county that Albuquerque's in, Bernalillo County, get hit with a corresponding ransomware attack, unrelated, but at the same time. So you had a whole community that was kind of really set back. By corresponding ransomware. So you couldn't get county government service for a while. Your kids couldn't go to school while the school was shut down and responding to this. They've since recovered. So this attack hit their student information system, and the superintendent had some very interesting comments about how, as they pivoted to online learning, it opened up a whole new threat vector space for attacks like this. So while they're still investigating it, it sounds like the school has now, I think, is back in session. You've got the county that's largely been restored as well. They're still dealing with a backlog of in-person related items, but I think online services have been restored. But this just points to the fact that no matter what we do, no matter how often cybersecurity is at the top of the priority list, it takes one moment like this where you can have a significant setback and make headlines, and then yet, you know, you're showing up on shows like this and news across the country.

Yeah, and I think to me it reiterated, you know, kind of the back-to-the-basics conversation that we've been having, right? I mean, you know, it's inevitable you're going to have cybersecurity-related risk, but but it's what happens when you are breached that is the most important thing, right? So business continuity, disaster recovery, some of the basic tenets, some of the basic foundational pillars of being able to weather a cyber-related incident, I think are really key. And I think we need, you know, new tools for this new era that we're in. I mean, ransomware is here, but we've also seen kind of this whole cyber landscape evolve and become more complex. Ransomware has become increasingly automated with artificial intelligence and other things. So we kind of have to play keep up when it comes to this. Jed, I know, you know, you've been in the trenches of some of these Cyber stories on the GovTech side. What do you make of this?

I'm gonna start with a metaphor. What do they say in boxing? It's not the punch that you see coming that knocks you out. It's the punch that you don't see coming that knocks you out. And I think that's what's going on with these cyber attacks, that people are not seeing the punches coming. So it raises a question, how can they start seeing the punches coming? And what this means is that we need to get people way more aware about their environments. We need to basically make the entire workforce of the United States a group of skeptics on a day-to-day basis because you never know how a criminal can get through when it comes to cyber. The other point that really stood out to me, especially in this article, is at the very end there's a source talking about the idea of school districts resolving this problem of cybersecurity by themselves. The quote that this source has at the very end of the article is, I think that's going to be tough. Basically implying that, you know, states and the federal government need to come up with some kind of task force to resolve these sorts of things. But anyway, I think that's going to be tough. I think that statement is an understatement. I think that it would be impossible. And we're not just talking about school districts, we're talking about law enforcement, we're talking about local utilities. They can't do it by themselves.

Yep, it's definitely going to take a group effort. And, you know, outside of even just sharing the incidents, I mean, We have to collectively start to think about how we counter some of these attacks, and it's a matter of national security now, and it's, you know, an increasingly important threat vector. So great points. But speaking of cybersecurity, we have the gentleman to give us some insight, and a former cybersecurity expert also in the public sector as the Deputy County Executive and CIO for Oakland County, Michigan. Phil Bertolini is our Vice President at the Center for Digital Government. So I want to welcome Phil to the—

Hi, Dustin.

And thanks so much, Phil, for carving some time out to join us.

Guys, thanks for having me. I mean, when I get to watch Jed do boxing references, I love boxing. That's great. The knockout punch, Jed. They got to really watch, don't they?

Absolutely. All right. Well, I'm sure we'll have many, many more analogies as we go through this. But Phil, just to start, you know, what are some of the highlights for you from 2021? You know, we've seen a lot of things change in response to the pandemic. But, you know, what are some of the standout changes that you've seen across behavior, expectations, government IT? Delivery, everything has changed. What is the most notable changes on your plate?

Dustin, it almost seems like 2021 was like the waiting game. You know, I guess we could have had like the Dating Game music, Bring Me On, but it really was the waiting game. I think local governments and governments in general were trying to find ways to get things done, but they kept having to wait. So it's time to look forward, it's time to strategically plan, it's time to think about Do we modernize some of our technologies? Then another variant comes along. Then the question is, is where was the federal money going to come in? So I think the waiting game was a big part of 2021. Cybersecurity, it blew up. It went on steroids. I mean, everybody working remote, you had digital services, all these pieces and parts and things changing so quickly that really impacted governments of all sizes over the 2021 timeframe. Towards the end of the year, it was interesting to watch budgets recover. And, you know, this whole issue at the beginning of the year when we did some of our survey work towards the end of 2020, people were thinking, oh, our budgets are going to be devastated, we're going to have priority issues, and budgeting became very much a high priority. Then in 2021, the bottom fell out. It was like, no, we're going to be okay, the revenue didn't suffer as much, we're going to get some federal stimulus dollars. So we saw some budget recovery that was very interesting, and I think The last, the last 2 things I would mention. One, definitely data in the cloud. You know, the whole push, this race to the cloud heated up definitely in 2021, and data became a big part of that. But also you have this remote work situation, and if you think about it, we had some data that came out of our surveys. I know we're going to talk more about that in a little bit, but 56% of cities and 82% of counties had over 20% of their workforce working remote, but 93% of them believed they could have more than 20% working remote. So there was this transformation that was taking place in 2021. Hopefully people can lift their heads up and plan a little bit more for the future coming up.

Phil, it's always a pleasure to converse with you, and I'm glad to hear that you're a fellow boxing fan. So we're in 2022 right now. Obviously last year was a big deal. So in 2022, In your opinion, what are some of the hottest areas of focus for local and state agencies?

Jed, definitely data. You know, if you think about the issue of what people are going to have to do to make decisions, they're going to need to focus more on data in 2022, which then brings this whole issue of digital privacy into play. You're going to see a great deal more of people worrying about that. I think in the data analytics side, there was so much work that went on And now you have this digital privacy issue that's going to be even more important in 2022. They're going to have to grapple with that. So there's going to be a big one there. I think the big one though, and I think as the local governments and state governments really look at planning, is their legacy systems were exposed pretty badly during the pandemic. Is even a good word? I don't know if that was good English, but anyway, I used it. So during the pandemic, they were exposed. Now what do they do? Do they modernize? Do they go ahead and take care of some of these legacy issues going forward in 2022? You're gonna see a big push there. And then anything around the federal funding, broadband, cybersecurity, you name it, anything they can do to become more resilient is gonna take priority in 2022.

All right, Phil, so we wanna dig into the research. You know, that's kind of my background, and I know that you've been at the helm of our local government surveys now for a bit. So when you look at the most recent Digital Cities and Digital Counties survey results, What were some of the trends that stood out to you?

A big trend, I think, for most of the people, especially the ones that finished in the upper echelon of the ratings, you know, in the 1 through 4, 1 through 5 area, had an enterprise approach to everything. It wasn't this one-off, you know, we're going to do this and see what sticks. We're going to do this and see what sticks. They were trying to figure out if I have to throw something against the wall to see what sticks, does it fit into my enterprise approach going forward? So that was a big part of what we saw in the surveys. I mentioned data that it was interesting is, you know, I was wondering how the data information would come out. 70% of counties and cities in both surveys, 70% equally, had advanced data analytics in place and were either going to modernize that or they were already in use and they were in good shape. So that's great news, 70%. So that you're seeing the upper counties and cities making sure they're using data. Emerging tech was another issue, and I know, Dustin, we always, we always talk about emerging technology, but AI and machine learning— I figured it would be low. I really did. I thought it would be low, but 62% of counties and 59% of cities are using some form of AI and ML in their process. So that's good news that they're actually going there. I think the other is resilience, and Dustin, you mentioned that early on, is about The resilience of government. Can you protect yourselves? Can you be bolstered? And Joe, we've talked about this many times. Our government's gonna be ready for these things that are gonna happen. 100% across the board, DR and continuity of operations was, was, was high on their order board. And if you just went back 10 years, I can remember the people taking diskettes home or, and, and putting 'em in, putting 'em in their safe at home and then bringing 'em back thinking that's a DR plan. That's all changed now and they're doing much better. I think the pivot to digital services, when you look at the counties that really have their stuff together, they were able to pivot faster. They were able to— they were the ones that had gone to the cloud early. And now if you look at some of the data we had, everybody pretty much has something in the cloud, whether it's email or some sort of SaaS offering that they're using. But 76% of counties could have more than 30% in the cloud. They actually have more than 30%. of their systems and data in the cloud. 77% of cities said they could do that too, and even a higher percentage believe they can go more into the cloud. We wouldn't have seen that prior to the pandemic. Those percentages were much lower. So the counties that are doing really well, they're pushing harder to make sure that they're moving forward with emerging tech, cloud, being resilient, and using their data.

That's great. Now I know everybody wants to be on top, and one of the common questions that I've seen when we do our awards program is How do I become first place? But I'd love to get your kind of take on some of the common characteristics that you saw with those first-place winners, 'cause that's often the best starting point for those that aspire to be on top.

Yeah, definitely, Dustin. The, the, I mentioned earlier the enterprise approach, and you see that, I believe more governments are looking at that and doing more of that as they go forward, maybe not communicating it as well. So we see in the survey responses that they're doing a really good job of making sure they understand how all the parts and the pieces fit. So that's one thing we're seeing. The other thing we're seeing is this alignment with leadership. They're making sure that whatever the county's or city's mission is and where they're going to go forward and what they're going to do and, and all of the priorities, they're making sure the enabling technologies are there and they're really communicating that well. Whether it's through their PIO or they're doing it within their leadership groups or executive boards, they're doing a really good job of communicating that. And the other piece of this, I found that the counties that end up being number one, they are really focused on the constituent. They have looked at the constituent. They realize now that it's not a build it and they will come. They realize they need that input and they need to engage more. to make sure they're doing the right things. So the citizen or constituent engagement is a big part of what they're doing. And then lastly, they're not afraid to try new things. And I think this is something that when we talk about the future and you look at it is, are they gonna be willing to take some risks? And government has always been risk-averse. They don't wanna take chances. They don't wanna end up on the front page of the newspaper. I guess the digital version now, right? But they don't want to end up on the front page. So the question is, can they take those risks? Can they fail fast? And those that are at the upper echelon, they're trying things. If they're failing, they're moving on to the next thing. And then I will say one last thing, and I was just talking to Tanya Hanna, a great CIO from King County, Washington, yesterday. Don't be afraid to take from others. The ability to go and do the homework and know what your, your peers are doing and then bringing those programs back That's what winners do.

Phil, when you were in government, cybersecurity was at the forefront of what you did. So I have a 2-part question for you. First, what are you seeing in the cyber landscape right now? And then second, do you have any words of advice for agencies that are dealing with this landscape?

Jed, great point. Talk about the knockout punch. It's happening so fast, Jed, people can't keep up. You know, and I was a big fan of the rope-a-dope and all the things that went on in boxing. You can't play that game anymore in government. You can't wait around to see what happens to your neighbor. You have to be ahead of it, and it's happening so fast they're struggling to keep up. Ransomware is still prevalent, and people are getting hit all the time. The phishing attacks, you know, and the other thing is we always think, you know, what was it, 80, 90% Were people-related issues when it came to cybersecurity. Training, training, training is something that they're, they're going to have to do. But what I'm seeing is this is happening so fast and it's so furious that now we're finding that governments are slipping more and more behind. The other reason is because they can't find cybersecurity professionals. 80% in our survey said they need more cybersecurity professionals, but how are you going to pay them enough? And how are you gonna get the quality of what you need to come in? And if you're a midsize or smaller city or county, how are you gonna get 'em? So I see those as big issues. Now, as far as advice goes, first thing is don't give up. I always used to say that— I'll use my own analogy here, Jed. I won't go boxing, but, you know, the old story is if you're at the campfire and the bear walks into the campfire and you're there with all your friends and you all run away, do you have to be faster than the bear?

No.

And the answer is no. You just have to be faster than the slowest person in your group. So my point there for government: don't be the slow one. Make sure you have multi-factor authentication. Make sure that you're doing all the things to make sure you don't have administrative rights on people's PCs so they can get malware. Do all the things you have to do to be basically in charge and in control, and maybe they will pass you by. And then the last thing is don't trust anyone. And I don't mean that here, guys. I trust you. Implicitly. But, you know, zero trust is going to be a big, important part of cybersecurity going forward. The question is, on the teeter-totter of risk versus usability, where is that going to fall? If I don't trust anyone, do I make it unusable? If I trust more, I make it more usable, but I open myself up to risk. How do you accept that risk is going to be the biggest decision they're going to have to make.

Yep, absolutely. Well, it's good to hear that we have your trust. You can click on the link that I just sent you in that email.

No problem.

No problem at all. So we've had boxing, analogies, bear analogies. We'll see if we've got any room for any other ones to fit in here. But last question for you is around 2022. You know, it's going to be a wild year of lots of market activity, lots of changes. What are you looking forward to most this year for state and local government? What's on your radar that excites you about the potential for government this year?

Dustin, I'm gonna, I'm gonna just say one: the article you wrote on the App Store moment. Every government needs to read that because they have to start understanding what is their future going to look like. You know, are they going to race to the cloud? Are you going to do that in a quality way? Are you going to make sure you have the right technologies in place? So that article gives some very good foundational information about what they should be looking at. So one, I recommend that everybody does that, but what I'm looking forward to is them actually doing it. They raced to the cloud. People need to get there. They found that in the pandemic, and we heard it from CIOs, if they were already in the cloud, they fared better. Do we think there's another variant of, you know, that's going to come along? Of course there is. The question is, is how will we react to it? How will we respond? And will we be resilient enough to manage it? The other is digital privacy. You know, I'd mentioned about what, you know, what you could see in 2022. I'm really looking forward to framing that out. There's not enough information out there. What I learned as a CIO for all those years is I relied on what I could find out there or what people could— experts could tell me. If there's frameworks around this, if there's information that can be put out there to say this is the right way to do digital privacy and this is how you manage it, that's going to be very important. I'm excited because I believe that's coming. When you think about what we're doing at the Center for Digital Government, we have a Cybersecurity Advisory Council, we have a digital privacy group, That's now meeting to do exactly that. So I'm excited about the fact there's information that's going to be out there to make things happen. Now, something else you mentioned in your article, Dustin, speeding up procurement. This happened during the pandemic. They've got to keep it going. You can't wait 8 months to do something cutting edge. So to go through a long protracted procurement process will kill innovation. So what we need to do is learn from what we learned from there. and get it done. And then the last thing I would mention is what I'm really excited about is governments are now accepting startup companies and emerging technology. They now realize, I don't need this, this, this craziness out here that I have to have a company that's been around for 20 years to do this. If I can find the right company to do the right thing, I'm going to be willing to take a chance. So it's going to be an exciting 2022.

Absolutely. Well, thanks for answering our questions. And if you've got some time to stick around, we've got one more story we're going to talk a little bit about today. And that is when we look at the state level, IT is getting big and so are the funds that are being applied to technology investment, modernization, and cybersecurity. This was a recent article around how the Massachusetts governor is proposing a $5 billion bill, but $185 million of that new budget is dedicated to IT, which includes cybersecurity and system-wide upgrades. Joe, Jed, what do you make of this?

I mean, this is a big deal, right? I think when you look at the order of magnitude of the overall bill, $5 billion for infrastructure, I think it goes to Phil's earlier point. Coming out of the pandemic, we've learned the hard lessons of outdated infrastructure, whether that's digital, whether that's roads and bridges to government buildings. And I think this shows that commitment to addressing the plumbing and the real issues to modernize government.

You know, when I saw this story, I couldn't help but think of the story from last year about the Vermont governor wanting to establish a special permanent IT fund for these sorts of upgrades. And if you look in this article, this current article about Massachusetts, a lot of this money, it seems like, would go toward— if it, you know, if this bill ends up getting passed, it seems like a lot of the money would go toward the unemployment insurance system. And as we saw in the pandemic, those just got battered.

And again, Yes.

Is it good to look at a crisis, to use a crisis to like do this sort of thing? It's really interesting to see governors taking the bulls— taking the bull by the horns more when it comes to IT. And, you know, we actually have a State of the State address feature in Government Technology that's coming out next week on Thursday, and we're going to dive even more into whenever governors mention technology. So this is going to be an interesting trend to continue to watch. I do think governors, it seems that they are paying more attention to this. I talked to my editor earlier today about this, Noelle Nell. She said that she had the same sense. The only thing I'll say is that, you know, aside from it being a good thing, is that I wish that it didn't take a crisis for this to happen. I wish that, you know, these sorts of things could be dealt with before the crisis, because the thing is, is that if you don't deal with IT Soon enough, it's going to become sort of like a snake in the grass that's going to bite you, you know, and yeah, no one wants that.

And then, Phil, I'd love to get your thoughts because I think, you know, one of the points you made around the enterprise approach really stood out to me as it related to this article because, you know, $185 million is a great amount of investment. You think about the challenges with tech debt and the need to kind of look at an operational-focused budget versus a capital-intensive budget. But enterprise, you know, taking that enterprise approach is kind of like what this article was screaming at me, like, how are you gonna wrap all this stuff together? What do you make of this?

Yeah, about time. I mean, this is great. They're investing in technology. Now, on the other side of that teeter-totter again is expectation to actually get it done and having the right people to get it done and the skill sets. So I love the fact that governors realize it. I love the fact that this governor said, Hey, let's make sure we put in a heavy investment in technology. Now the CIO and the team there are gonna have to actually get it done. The partners are gonna need to be at the table. They're gonna have to find the right people to do it. But if they can make this work, this could be a model for the future. This is very exciting times.

All right, well, that's all the time we got for us today. Make sure you join us again next week, Friday at 12:00 PM Pacific for more GovTech news, insights, and interviews. We'll actually be joined by Teri Takai, our other vice president, some state government updates. Until then, have a wonderful weekend.