ARIZONA

Ducey creates security team to combat cyberattacks against Arizona

The Republic | azcentral.com

Gov. Doug Ducey announced Thursday that he was forming the Arizona Cybersecurity Team through an executive order to bolster the state's efforts to combat cyber intrusions.

As threats of cyberattacks on state data systems increase, Arizona Gov. Doug Ducey is assembling a team tasked with better securing everything from residents' driver license information to health and financial records.

The Republican governor is forming the Arizona Cybersecurity Team through an executive order issued Thursday. The team aims to bolster the state's efforts to combat online intrusions by sharing information and tackling the issue on a unified front, instead of a piecemeal approach that varies by state agency or department.

Ducey's order is consistent with an effort by the National Governors Association to ramp up cybersecurity efforts on a variety of fronts.

It comes two days after NBC News reported the U.S. intelligence community developed "substantial evidence" in 2017 that state websites or voter registration systems in seven states — including Arizona — were compromised.

However, a spokesman for Secretary of State Michelle Reagan said again this week the office has no evidence of cybersecurity breaches.

Tim Roemer, Ducey's public safety adviser and the deputy director of the state Department of Homeland Security, said the team will make officials more comfortable sharing information.

"Information sharing is key when it comes to preventing cybersecurity breaches," he said.

"So many of the biggest data breaches in our nation's history probably could have been avoided if some of those organizations had shared information of what they were seeing with other organizations."

The team will include about two dozen officials and representatives from the Governor's Office, the secretary of state, the attorney general, information technology officials, federal and local-law enforcement officials, and higher-education officials.

The team will regularly update Ducey on cybersecurity issues and determine how to access federal resources to combat threats.

State agency directors "will be held accountable to protect data," the order states.

Already, Republican Attorney General Mark Brnovich is working to advance a bill through the state Legislature that would overhaul the state's data breach statutes.

House Bill 2154 would set a timeline for companies to notify the attorney general, as well as three major consumer reporting agencies when a breach happens.

Ryan Anderson, a spokesman for Brnovich, said the legislation is intended to protect consumers.

"...What the attorney general is saying is that if you're a company, and you lose a consumer's personal information, you have a responsibility to notify that consumer so they can take proper safeguards to protect themselves," Anderson said. "If you don't notify a consumer, or if you try to cover it up, there's going to be legal consequences."

Last June, Nevada's Republican Gov. Brian Sandoval signed a bill to create a cyber "nerve center" to prepare, respond and react to cyber-risks.

In New Mexico, according to the National Governors Association, Republican Gov. Susana Martinez signed a bill that clarified when the National Guard can be used during cyber-related events. And Oregon's Democratic Gov. Kate Brown signed an executive order last year to unify the state's cybersecurity efforts into one agency.

Yvonne Wingett Sanchez is The Arizona Republic and azcentral.com's Governor's Office and state political reporter. Follow her on Twitter and Facebook and email her at yvonne.wingett@arizonarepublic.com.