Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

James Sherer Comments on Client Questions Post-Election in Law.com and The Recorder Articles

Peter Roskam and BakerHostetler’s Post-Election Webinar Mentioned in Articles on Trump’s Second Administration

Michael Snarr Comments on Tariffs and Trade Under New Administration

Sarah La Voi, Lauren Bass Pen Article for The Licensing Journal on Morals Clause

<figure class="wp-block-image alignright size-large is-resized"><img decoding="async" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2022/07/DADM_GettyImages-1148091793_1200x630-662x348.jpg" alt="Abstract colorful grid surrounded by glowing particles" class="wp-image-7115" width="428"/></figure>



We recently <a href="https://www.bakerdatacounsel.com/data-counsel/north-carolina-first-state-prohibit-public-entities-from-paying-ransoms/">wrote about North Carolina’s new law</a> prohibiting state agencies – including public schools and universities – from paying a ransom or even communicating with a threat actor following a ransomware incident. On June 24, Florida followed suit when its governor signed HB 7055 into law, amending portions of the State Cybersecurity Act (the Act), which became effective on July 1.



Among other things, the Act now requires that if a Florida state agency, county or municipality experiences a ransomware incident, it must provide notice to Florida’s Cybersecurity Operations Center<a href="#_ftn1" id="_ftnref1">[1]</a> and the Cybercrime Office of the Department of Law Enforcement<a href="#_ftn2" id="_ftnref2">[2]</a> (and in the case of a local government, to the sheriff with jurisdiction over that local government) within 12 hours of discovery. The report must include at least the following:



<ol type="1">
<li>A summary of the facts surrounding the incident.</li>



<li>The date on which the agency most recently backed up its data, the physical location of the backup, whether the backup was encrypted by the ransomware and whether the backup was created using a cloud-based solution.</li>



<li>The types of data compromised by the incident.</li>



<li>The estimated fiscal impact of the incident.</li>



<li>Details of the ransom demanded.</li>
</ol>



Given the difficulty of compiling this information within 12 hours in the midst of addressing a ransomware incident, Florida state agencies would be well advised to keep their backup schedule somewhere outside the network to prevent it from being inaccessible as a result of either the encryption itself or containment measures taken immediately following a ransomware incident.



Importantly, the updates to the Act also only prohibit a state agency, county or municipality experiencing a ransomware incident from paying or otherwise complying with a ransom demand. Unlike the North Carolina law, which proscribes state agencies from even “communicat[ing] with an entity that has engaged in a cybersecurity incident,” the Florida Act does not appear to prohibit a state agency, county or municipality from communicating with a ransomware threat actor in order to gain intelligence about the nature and scope of the attack or to delay the publication of stolen data.



Unlike North Carolina’s law, Florida’s law appears to exclude public school districts and universities from the list of public entities that are prohibited from paying a ransom. The Act defines the term “state agency” as any official, officer, commission, board, authority, council, committee or department of the executive branch of state government; the Justice Administrative Commission; the Public Service Commission; the Department of Legal Affairs; the Department of Agriculture and Consumer Services; and the Department of Financial Services.<a href="#_ftn3" id="_ftnref3">[3]</a> Although some questions remain about the nature and scope of Florida’s law prohibiting state agencies from paying ransoms to cybercriminals, the recently passed laws in North Carolina and Florida appear to mark a growing trend in which states prohibit public entities from paying ransoms. In the coming months, we expect to see similar laws introduced and/or passed in several additional states. As such, it is imperative that public entities take proactive measures to reduce their cybersecurity risks and position themselves to recover from cybersecurity incidents without the need to purchase a decrypter. Such measures include, but are not limited to, implementing multifactor authentication, deploying an endpoint detection and response tool throughout the entity’s environment, regularly creating system backups, and keeping those backups separate from the system itself.



<hr class="wp-block-separator has-css-opacity"/>



<a href="#_ftnref1" id="_ftn1">[1]</a> <a href="https://cyberflorida.org/">https://cyberflorida.org/</a>.



<a href="#_ftnref2" id="_ftn2">[2]</a> <a href="http://www.fdle.state.fl.us/FCCC/FC3-Home">http://www.fdle.state.fl.us/FCCC/FC3-Home</a>.



<a href="#_ftnref3" id="_ftn3">[3]</a> Fla. Stat. Ann. § 282.318(2) (2022).

core/freeform

Data Counsel

Philadelphia

Counsel

Benjamin D. Wanger

Cincinnati

Associate

Elise R. Elam

Digital Risk Advisory and Cybersecurity

Digital Assets and Data Management

Florida Follows North Carolina in Prohibiting State Agencies from Paying Ransoms

Related Services

Featured Insights