IL Chicago-Bilandic — 2026-10-13 (video 1235508995)

Gonzalez. Here. Didich. Kiker.

Andrade. DeLuca. Doody. Here. Dubuclay. Fries. Gungershowitz. Hammond. Mayfield. Rasheed.

Spokesperson?

Just a couple opening comments. Thank you, Chair Gonzalez and members who have joined us today. Cybersecurity is a core responsibility for public safety, as we are all aware. Also, economic security and emergency management are critical components. Illinois families, businesses, small businesses, manufacturers, municipalities, as well as critical infrastructure operators face persistent threats from bad actors, including criminal actors, criminal groups, and nation-state actors. As technology and artificial intelligence continue to evolve at unprecedented rates, we must be prepared to defend against the bad actors who are finding new ways to exploit vulnerabilities. We need to make sure law enforcement, businesses, and infrastructure operators have the tools, resources, awareness, and knowledge necessary to keep pace with these threats. House Republicans believe Illinois must focus on protecting consumers, businesses, and essential services, but not restrict innovation or stifle technological advancement that can benefit Illinois families, workers, as well as the state's economy. We have to get this balance right. We must take cybersecurity risks seriously and ensure appropriate safeguards are in place while also allowing this responsible innovation to continue. you. The technological advances that AI offers are tremendous opportunities for our state and sound policy should help us capture those benefits while also protecting the people and the systems that depend on them. I look forward to hearing from today's witnesses on the concrete needs of law enforcement, the real world barriers facing small manufacturers and the specific steps required to harden water and other critical infrastructure systems. Our goal should be a safer community's, a more competitive economy through common sense, trusted policy efforts. Any legislative response should be practical and proportionate. It should focus on reducing successful attacks, improving recovery, strengthening information sharing with law enforcement, and supporting baseline controls for those smaller entities. We should avoid unfunded mandates or approaches that discourage timely investment or responsible innovation. And with that, Chair, I thank you for hosting.

All right, good morning. Good morning, Chair. Good morning, Spokesperson Kiker. Brendan Kelly, I'm the Director of the Illinois State Police. Appreciate the opportunity to be here today to discuss the growing threat of cybercrime. Our job as law enforcement is to protect public safety, which is why you often hear officers say things like, make sure to lock your house and your car and wear your seatbelt and don't drink and drive don't do drugs keep guns away from kids know where your kids are at night in the 21st century our safety message has to expand to include don't click on documents or links to unknown emails don't provide personal information online use multi-factor authentication monitor your kids online activity don't share your passwords we live our lives in a cyber world and our public safety is and must adapt to that as well. Cyber threats against government, business infrastructure, and individuals continue to increase, and whether on a large scale, such as attack on infrastructure, or on a small scale, internet crimes against children, cyber crime is growing. The Illinois State Police oversees and leads the Statewide Terrorism and Intelligence Center, or STIC. That's Illinois' Fusion Center for Intelligence and Information Sharing. Along with our Chicago partners at the Crime Prevention and Information Center, STIC annually identifies existing threats in our shared area of operations by examining intelligence products from federal, state, and local partners. That's information received by the Fusion Center that is reported by law enforcement and public safety partners, as well as other open source information. And our annual threat survey identifying the 10 most prevalent threats in the state of Illinois is distributed to all our partners at those state, local, and federal levels. The most recent assessment identified cybersecurity is the second highest priority of concern for 2026, which is up from the fourth highest in 2025 and 2024. According to IBM's 2026 Threat Intelligence Index, North America was most effective region of all for cyber attacks with malware and server access being the most frequent cyber actions, which indicates prioritized system controls and persistence. So the real underlying theme in all that is that the size often there's individuals who naively or unwittingly in these systems began to clear Achilles heel in the cyber mitigation ecosystem So ISP division of Justice Services is the point of contact for Illinois collection and collation and reporting of crime statistics And according to the FBI there were almost 33 cyber complaints in Illinois last year with a reported loss of $535 million. And that's up $56 million from the year before. Illinois ranks fifth in the nation in reported cybercrime, which makes sense given our population. The cost of cybercrime nationally was $21 billion, and Illinois ranked eighth in total victim losses at $535 million last year, which is lower than previous years. But still, STIC and our law enforcement partners assess that cyberattacks will almost certainly continue to occur on our most targeted sectors. Ransomware is still very profitable, which encourages cyber actors to increase their activity. There are more than 7,400 reported ransomware victims in 2025, which is more than any previous year. The use of access and the lower technical barrier of ransomware as a service means that people without skills can still be able to use cyber techniques to commit these cyber attacks, even though they themselves may not have the technical capability. There is some school of thought that even says that the reductions in violent crime may be in part as a result of an increase in cybercrime. Our criminal activity is moving online. But cybercrime isn't just about money. It includes using technology to commit crimes against people, such as Internet crimes against children. Cybercrime can be sometimes called a faceless crime because the perpetrators operate behind screens and they hide their identities. But it's not a faceless crime. The impact of cybercrime can be seen in the faces of every child exploited on the Internet, every public servant threatened, and every elderly person scammed out of their life savings. In the world of criminal investigation, there's almost no aspect that does not involve digital networks, equipment, and environments. ISP uses digital forensics to investigate these crimes, and technology is not only being able to use crime, it's being used to solve crime. We're reaching a point where all crime, in some ways, is cybercrime. Specifically, on a daily basis, ISP special agents use technology in the form of software programs, digital equipment, and Internet platforms to identify criminal activity. Just last year, our cyber crime and digital forensics efforts included no less than 1,126 cell phone extractions, not to mention other digital forensic investigative methods. ISP is an outstanding partnership with the Illinois Attorney General's Office to specifically target offenders who purchase, transmit, use, possess, and sell child sexual abuse material. We began working these cases in earnest seven years ago and is now really a part of our seven criminal investigative zones. We work complex electronic cases based on the National Center for Missing and Exploited Children. We partner with our federal agencies to investigate this crime. The number of Internet crimes against children in cyber cases that the ISP investigated grew 37% in 2021 to 2025. That may not necessarily be an indication that child exploitation online has increased, but law enforcement and the public are getting better at identifying it, reporting it, and zealously pursuing it. Cyber criminals also target public officials like you all that are part of this hearing, part of this committee that serve in the General Assembly, as well as public employees. The public servants that make our state government and our democracy work. Last year, ISP responded to over 60 reports of inappropriate contact and communications with public servants, which of course includes potential threats commuted data through social media and So majority of those threats that we investigate against public officials have some digital or cyber nexus. It clearly whether it online email social media through other means towards a public threats towards a public official if increased that one way ISP is actively engaged in trying to mitigate this systemic threat of cybercrime Now, it doesn't mean we're just investigating these cybercrimes. Together with all of you and with the governor's office and the governor's direction, we worked with the General Assembly to update Illinois' laws to support cybercrime investigations, digital forensics, and protective services. The only state police law was amended in a bipartisan way to allow ISP to clarify ISP's ability, our ability to hire staff to identify, collect, and recover cyber forensics, including digital evidence. State police law was again amended in 2024, establishing authority for the Division of Criminal Investigation to investigate cyber crimes, and for the Division of Forensic Services to examine electronic devices and digital materials in connection with these cyber investigations. In 2025, we championed Alicia's Law, which was passed and signed by the governor to ensure the state of Illinois devotes resources and supports our continued investigation of Internet crimes against children, making this a permanent part of what ISP does, a permanent part of our missions. We've worked with the General Assembly to update Illinois laws to make sure investigation of cyber crimes is embedded permanently within our state police act. Now, the greatest long-term cyber threats, and you will hear more about it here today from others, is the sophisticated nation-state actors, including China, Russia, Iran, North Korea. These actors are conducting espionage, establishing persistent access to networks, and they continue to position themselves for potential future disruptive attacks. Iran and Iranian government-affiliated cyber activists are expected to continue to use common tactics, including exploiting known vulnerabilities, social engineering, and other publicly available hacking tools. Russia as well. Russian cyber actors continue to improve their ability to conduct cyber operations, targeting software supply chains and technology firms to gain access to broader networks. North Korea, their cyber actors continue to target financial institutions and cryptocurrency platforms to generate revenue for North Korea and deploy thousands of covert IT workers and using fake identities to gain employment to corporate networks and sensitive information. China obviously represents the most significant and dynamic threat to the country and includes the state of Illinois. They've infiltrated numerous levels of communications, energy, transportation, water sector networks, and that's believed to be prepositioning for potential future disruption during a crisis or conflict that could affect all of us, including us here in Illinois. We have a cadre of special agents that are assigned full-time to federal task forces that work daily to mitigate these sophisticated threats aimed at the U.S., including in Illinois. And while investigating cybercrime is one of our clear admissions as we move into the future of the Illinois State Police, as we move into our second hundred years, we cannot do it alone. And that's why it's important that we have these type of hearings and we have this type of communication and opportunity to remind people that just as we need the public to lock the doors and wear their seatbelts, make sure that they're also not sharing personal information online. Not clicking on the emails that says, you know, hey, this is a major investment opportunity with a low buy-in fee. Make sure you're snooping on your kids like good parents do and make sure that they aren't exposed to dangers online. We need to teach our kids cyber safety. And as always, we need you, the leaders and policymakers of this state. That's why we are grateful to join you here today and appreciate your efforts to bring attention to this very real public safety concern. We look forward to continuing work with the General Assembly to raise awareness about the importance of cybersecurity and protecting the people of Illinois from this very real and emerging threat Thank you Chair Thank you Director Two things for the record So first if you can add Representative Don Gershowitz and Representative Fries to the

Spokes?

Leader Hammond.

So you can never have enough. And I know that's an oversimplification of your question and what you're trying to get at, sir. We could always use additional resources because the threat is always continuing to grow on a variety of fronts. A specific area that we're looking at long term is how we sustain our fusion center over the long term. We have a heavy reliance on a lot of federal grants, and that is an area of concern going forward, regardless of whatever is going on with the federal administration, a reliance on those funds to continue to operate a very essential and critical part of the public safety apparatus, including on cyber threats is our fusion center, the statewide terrorism intelligence center. So that's something on the horizon that we certainly welcome having further conversation with you all as you're making difficult budget decisions. I think sustaining the continued predictable and balanced budgets that allows the Illinois State Police to plan for hiring over the long term. I think if you look at what we call the code personnel, the non-sworn personnel that we've been able to hire, given we have a predictable budget, that's been very important, that should be sustained. And our ability also to hire additional sworn. Those are our troopers, our special agents. the people that work on these investigations, the career law enforcement that are part of the overall apparatus, the individuals that are investigating these crimes against children. We've hired, we've been on the largest hiring spree of Illinois State Police officers since Governor Thompson, going back over 30 years. And we have to continue to sustain that. And so a degree of predictability is very important for us to plan and be able to have a longer view and look at issues over the horizon rather than just the crisis of the day. And cybersecurity and all the risks that comes with it. And crime has always been since the beginning of time. What cyber does is make it happen faster, make it happen in a more technical way that accelerates both the criminal activity and the consequences of that criminal but also our ability to counter it. So it's really just like on steroids, you know, regular crime gets, elevated to a faster and quicker and more devastating pace at times as a result of cyber activity. So that predictability and budgeting going forward is very important for us, and we hope you're all able to keep that in mind.

So the Statewide Terrorism Intelligence Center was established under the Illinois State Police shortly after 9-11. And again, its initial focus, as was the focus of the country and many of us right after 9-11, was, of course, terrorism specifically and a specific type of terrorism. And what was identified leading up to those events was a lack of sufficient information sharing at multiple levels. Local law enforcement, state law enforcement, federal law enforcement, and the need to make sure that information doesn't get siloed. The answer to that at the state level and for the Illinois State Police and for our partners here in the state and at the federal level was to create a permanent apparatus that allowed us to share that information. Now, those missions have evolved over the years because the focus and the threats have evolved. And certainly cybersecurity is now an eminent and one of those top threats. We can just look at our security assessment over the past couple of years, how that issue has risen increasingly to the top. And what STIC does is make sure when these things occur, let's say there's a cyber attack on a hospital, on a school, on a police department, on a PSAP, like a communication center where dispatchers work, and their systems go down. That can then get reported into our fusion center. And then we're able to share that information and awareness with the appropriate partner, locals that are affected, how we may be affected at the state level, and then how our federal partners may be able to follow those investigations. Sometimes those sources of cyber attacks, they are completely on the other side of the world. That's often the case. And so it has to be a national response, not necessarily just a federal response, not just a state response, not just a local law enforcement response, but all of us integrated together. And that's what STIC is a part of, particularly when it comes to the sharing of information related to cybersecurity. So we hold routine sharing of information with our local partners. So some of the things we just discussed here earlier, what these broad threats might be, they need to be aware of that. You may be a small staffed sheriff's department somewhere in the rural part of Illinois, but that doesn't mean you aren't vulnerable to potential cyber risks that might come from China, China that might come from Russia, it might come from Africa. So sharing of that information makes people readier. And when something happens and we see a trend and we all share that information, we can respond more effectively to that particular threat.

So ever since the explosion of our lives online and on the internet and all sorts of human activity taking place online and in digital platforms, ever since the idea of cybercrime has even started, there has been a need to try to get that digital evidence, the evidence of these cybercrimes, and particularly from these various platforms that people use. There's all types of apps, there's all types of social media companies that even have different sub-levels of companies within them. And getting the evidence of those crimes, particularly internet crimes against children, requires us to get that information in a quick and effective way from those companies. I will not say that those large tech companies are resistant to our investigations, but the process in engaging with them can be cumbersome at times. If there's a clear, specific emergency, a direct threat to safety, we can get them to move a little quicker in turning around the evidence that we may need to be able to safely secure someone or prevent a direct threat. these investigations like, for example, where the evidence may be digital and maybe a child sexual exploitation case, getting the evidence can take too long, in my opinion. And obviously, I'm coming at it from a law enforcement perspective. The turnaround time that we see when we are requesting evidence pursuant to a search warrant or pursuant to a subpoena, that still remains too slow. And I don't think many of the companies would deny that. But I think there needs to be an additional emphasis on being more responsive in a timely manner in order for these cases to be swiftly and effectively investigated and prosecuted. I would say that's an area that there's a need for improvement in terms of any type of cybercrime. Sometimes the turnaround time when we are requesting evidence from these very large companies, which are very well-restorers, they have huge budgets, them not being able to respond quickly enough, supposedly due to the volume of requests, seems to be an unsatisfactory answer, given the challenge and given the resources they have and the ability to apply those resources to get these things back quicker. It's an ongoing dialogue, and we have good professional relationships. But that does remain a concern that there's not a lot of speed and alacrity from some of those companies at times.

Yeah, director, thank you. reminds us of a bill that leader Patrick Windhorst introduced, passed the House unanimously, bipartisan, of course, sponsorship, the primary sponsorships that would help speed up the return of telecommunication carrier, electronic instruments, and that type of thing within seven days. That would certainly help what you're describing here. Does it go far enough, or that a good place to start Well look you know we obviously want instant answers You know our agents our officers our troopers are pursuing justice zealously and they want

of that. Thank you, sir. Appreciate your work. Thank you, sir.

Well, I think we all think back to when we all went through school, we had health class and you had DARE programs, don't do drugs, and just awareness of other safety issues. The older you got as you're going through school, some of the topics might have changed that were age appropriate. I do think that since we all are living our lives on social media and we're all online, you know, trying to just do everything that we do on a daily basis in an electronic way, that we should be laying a clearer groundwork perhaps for our kids.

There could be individuals that will manipulate kids through these platforms and persuade them to do things that would be dangerous to them, sending pictures of themselves that are inappropriate or criminal in nature, exploitive in nature. And so I think more awareness and updating our, I guess, our safety education that we give to kids, our character education that we give to kids. Awareness of just because of it online doesn mean it not real It may be cyber but the danger danger can be very real despite the fact that seems like it just imaginary because it on a screen And so I'm sure there's people working on this issue at various levels of education and dealing with these challenges in schools. And we certainly be happy to be part of any further discussion about what those messaging could be. That isn't scary for little kids, but at least certainly gives them a better defense and awareness and keeps mom and dad in the picture so they know what's going on as well.

Thank you. Thank you all.

Chairman Gonzalez and members of the Cybersecurity Committee, thank you. I really appreciate the opportunity to give remarks today. I'm Scott Cruz. as a senior project engineer at MXD, Digital Manufacturing Institute, and the National Center for Cybersecurity and Manufacturing. I'm here to address cybersecurity in small and midsize manufacturers as an economic issue for Illinois and to support practical help for the firms that cannot solve it alone with their own resources. So a survey that we recently completed at MXD about issues related to cybersecurity and manufacturing is the basis of my remarks today. The vast majority of manufacturers are smaller, mid-sized, and nobody had a clear view on their security posture. So through this survey that we performed, 700 cybersecurity decision makers at manufacturers nationwide at organizations of 2 to 499 employees collected some key information for us. And while the survey is national, Illinois manufacturers use the same equipment, sit in the same supply chains, and face the same requirements as all the firms that we heard from nationwide. Among those firms surveyed, one of the key findings that we had was that 68% of those 700 manufacturers experienced a real disruptive cyber incident in the previous 24 months. So that really speaks to the point that you brought up on manufacturing being the number one target at industry. The interruption to production was the most common impact. So 42% of the firms that reported an incident or attempted attack said that it caused operational downtime in their manufacturing operations. And 30% of those firms reported direct financial losses as a result. And those figures may actually even understate the problem. Smallest firms, those with fewer than 20 employees, reported incidents at about half the rate of firms with 100 to 500 employees. 35% of those small companies reported incidents compared to the 69% of larger firms. And MXD's experience, that gap reflects the visibility more than the safety measures in place. A company without proper cybersecurity monitoring often can't even see the attacks that it's facing. And much as we spoke on the online nature of everybody in social media, everybody's information is out there, a similar trend is occurring in manufacturing. So as risk, as more and more digital manufacturing technologies are adopted in the manufacturing sector, we've found that more than 70% have fully or partially linked their office networks to the equipment on the factory floor. And the trade-off there is that a malicious link clicked in an email in the front office can now reach the production line. One manufacturer in the $1 to $5 million revenue range told us that an employee opened a deceptive email phishing link, and the IT team had to step in immediately to keep that virus out of the production systems, keeping the manufacturing floor running. And many of these small companies lack the people that they need to defend themselves from cyber attacks. Nearly 50% have two or fewer employees dedicated to cybersecurity. And among manufacturers with under a million dollars in annual revenue, 16% have zero employees dedicated to cybersecurity whatsoever. And to expand on why this problem persists in manufacturing, when we asked what keeps the small shops from adhering to compliance structures like the federal cybersecurity maturity model certification, the number one barrier was actually not cost. It was complexity. 41% named the documentation and audit process about twice as many people as claim cost as the number one barrier. One specific IT lead that we spoke to at a small machine shop told us the paperwork is a full-time job that we didn't hire anybody for. A small family-owned shop with less than $5 million in revenue faces the same threats as a large prime contractor but without the human and financial resources to put up a fight. gap is also leadership urgency. A cybersecurity lead at a small manufacturer put it this way, management looks at the ROI, return of investment of a new lathe manufacturing equipment, but they can't see the return of investment of a firewall until they get hit by a cyber attack. After a successful breach, 86% of manufacturing executives report a shift in how they view cybersecurity spending. And they approved budgets for 24-7 network monitoring and penetration testing and all these new technologies. So it turns out that the budget was never the constraint. It was urgency. Waiting for a breach to create urgency is costly. Choosing, buying, and installing a solution can take months, and attackers will keep working the entire time while you work on standing up your defenses. So what can we do for the manufacturing community? I asked the committee to consider the next four steps. First, treat cybersecurity of small manufacturers as shared infrastructure. As government already does for manufacturing institutes and physical trade corridors, tax incentives, partial cost offsets for security work, and shared resource pools where small firms team up with peers or larger customers would put digital defense in that same category. More cybersecurity monitoring and more plants and facilities would allow us to know exactly how big the problem is. And since too few companies share too little information for anybody to know with confidence currently. Second funding hands training built for operational technology and plant environments Hands training for shop floor and plant staff was the single most requested form of help in our survey, chosen by 32% of the respondents. The slide presentation designed for office workers do not teach shop floor staff how to practically respond to a cyber threat in their manufacturing environment. Third, make sure that guidance and templates for manufacturers arrive in plain English. The Federal Plain Writing Act of 2010 set the standard for agencies. Simplified compliance guides were the second most requested form of help, chosen by 26% of respondents. A shop owner facing technical jargon about cryptography and information integrity does not know where to start, so the shop doesn't start their cyber journey. And then fourth, giving operational resilience as much weight as incident prevention. Attackers don't follow a rigid framework, and no defense can stop every single attack. A plant built to recover quickly loses less if and when defenses in cybersecurity ultimately fail. This matters because stop production was the most common consequence for the respondents in our survey. Thank you for your time, and I welcome any questions.

Thank you, Chairman, members of the committee, and thank you for the opportunity to participate in today's discussion on cybersecurity. My name is Patrick Sveska, and I'm the general counsel for the Illinois Manufacturers Association. The IMA represents manufacturers across Illinois, ranging from small and family-owned businesses to some of the largest companies in the world. From a manufacturing perspective, the most important point I can make today is that cybersecurity is no longer simply an IT issue. Cyber risk is a business risk. That's especially true in manufacturing. Modern manufacturing facilities are increasingly connected. Manufacturers rely on informative technology, operational technology, industrial control systems, automated equipment, software vendors, and interconnected supply chains to produce and move goods. Those technologies have created enormous opportunities. They allow manufacturers to become more productive, improve quality, operate equipment more efficiently, and compete globally. But increased connectivity also creates increased exposure. For a manufacturer, a cyber incident doesn't necessarily mean someone simply loses access to email. It can mean a production line stops running. It can prevent a manufacturer from receiving raw materials or shipping finished products. It can disrupt suppliers and customers. And depending on the type of facility and equipment involved, a cybersecurity event can also create physical or safety concerns. That is one reason manufacturers think about cybersecurity somewhat differently than many other businesses. Manufacturers generally have traditional information technology systems, but many also have operational technology controlling machinery and production processes. Some of that equipment may remain in operation for decades. It was designed first and foremost to manufacture and produce safely and reliably, and in some cases it was designed long before today's cybersecurity environment existed. Replacing or updating that equipment is also not always as simple as installing a software update on an office computer. Taking equipment offline may require shutting down part of a manufacturing process and any changes have to account for operational reliability and operational safety That makes cybersecurity both a technical challenge and a business continuity challenge Another major concern is supply chain. Manufacturers operate with highly interconnected networks of suppliers, customers, logistics providers, technology providers, and contractors. A manufacturer can have very strong internal cybersecurity practices and still face risks through a third party. That means cybersecurity increasingly requires manufacturers to think beyond the four walls of their own facilities. At the same time, we should recognize the opportunities. Technology is making American manufacturing more competitive. Advanced manufacturing systems and connected equipment can dramatically improve productivity, and the goal should not be to discourage manufacturers from adopting those technologies. It should be to make sure that cybersecurity develops alongside them.

Thank you. And finally, we have Mark from DNG Mori.

Thank you very much, everyone. Questions from the committee. Okay. Well, thank you so much, everybody. I do have a few. Actually, from MXD, you mentioned forward, shared infrastructure, hands-on training, using plain English. What was the fourth one? I couldn't catch that. The fourth point was on giving operational resilience just as much emphasis as the incident prevention So I think it was spoke of the incident response plans required So how can you as a manufacturer bounce back to minimize the damage, prevent as much downtime as possible, knowing that no matter how strong of protections you may put in place, the attackers continue to find new ways. And so we would like to say it's not if but when a cyber attack occurs. Do you have the right operational resilience in place to bounce back? I think you said that was 86% of folks that after they got hit, that's when they decided to reevaluate. And so from what you guys mentioned, maybe not necessarily the budget part. It's just the urgency of it. My thinking is, is there a way to build that urgency without just putting all the fear of God in them? Like, what does that look like? How do you build that?

Spokes. Thank you. And I apologize. I don't have an updated list of who's speaking. Gentleman from Maury, help me a little bit understand, you know, you talked about MT Connect. What comes to mind is you have potential of a supply stream that's coming in or end users that are ultimately using your CNC machines in their shop. Are you in the process of evaluating putting updates for those in sandboxes where they just can't be infiltrated or have an air gap, in other words, between updates? Or is it just not feasible in today's environment because of how dependent CNC machines are with updated technology? Can you kind of lay that out for me there?

Yeah. And so what you're describing is very similar to what we had in Iran a handful of years ago with the centrifuges, right? Where that vibration could set it off and catastrophically destroy the machine. And what you've described, you're building machines that build the machines that build the things that we need, right? So you're the core of that. what measures, again, not vetting what you guys do operationally or corporate secrets or anything like that, so please don't share anything out of school, but to what extent are small manufacturers like yourself working with those downstream suppliers that are either doing software updates or control updates into the machines that you're using to build the machines, and what's that vetting process look like? Do you turn away from a supplier if they don't? Because I would imagine in what you do, there's such a small supply chain of experts that you're relying on that it might only be that one critical person or entity that's giving you that?

this information. So after 9-11, the federal government instituted the terrorism risk coverage, you know, meant to protect for vulnerable communities. If we had another 9-11 style, This seems to be the next iteration of terrorism, right, like state actors and nefarious folks out there that would do this. Are you aware of any federal changes that are being discussed or undertaken to try to expand what that terrorism risk coverage on every commercial insurance policy would provide for in circumstances like this? Yes.

Okay. Thank you. Appreciate it, Chair. Any other questions from the committee so far? All right. I have a few more. So following up, Patrick, you had mentioned – I think you had mentioned five points. I think the very last one that you had mentioned that depending on the size of a business or a manufacturer, there's not a one-size-fits-all type of strategy that could probably be applied. At that point, Patience with me, I'm thinking, are you thinking employee-size? Is the product that's actually being made, the location, all of the above? At that point, what would that entail?

and to the fourth point that you mentioned as well that obviously that you know employees must be a part of the cybersecurity plan i think this could probably be applied to question to all of is at that point then, is it a matter of training the leadership and then that trickling down within the organization? Is it a point of hiring a third-party vendor, like a cybersecurity firm to come in and train? What would that look like? What would that training actually look like?

And just for the record, your name again for the record?

Anybody else? I think to follow up with that, because of... Oh, my name is Mark Moore.

Any other questions? I think that the point that was being made, that as you increase connectivity, you increase exposure, And I think the three organizations all touched on that. You know, we all went to black, so maybe we're exposed right now. I think that what I'm really trying to understand is that, you know, obviously, again, to the point that, you know, not one size fits all. But many times, you know, because, you know, cyberspace is so expansive and invisible that, you know, it would make sense that maybe, you know, that the federal government should be moving on this. But because we are not the federal government, obviously we had to do something about this. That being the case, I'm thinking that – wondering if there are any barriers that exist right now within statute or anything like that that prevent our folks, small manufacturers and other mid-sized manufacturers from actually protecting themselves. I think we've all touched on there might be a lack – there's a lack of access to capital. There's an education gap that needs to be filled. You know, my thinking is then, you know, how far down the line then do we need to, like, educate? You know, I think that something that Yuzan mentioned as well is that, you know, you just can't focus on one part of the supply chain. It has to go all the way down the supply chain. At what point do you stop? Like, you know, because eventually there's a point where the return on investment isn't really that much. At what point within the supply chain does investment in this actually make sense? I wonder if anybody can provide some insight on that.

Yeah, Scott Cruz with MXD. I think kind of the two angles of the education awareness is that bottom-up, giving resources to those smaller manufacturers. But then I would say from the customer level, the OEM, the prime contractor level, There is also a major push in supply chain visibility and supply chain risk assessment. So that as you mentioned where is the ROI return on investment of you know helping your smallest you know two supplier achieve a CMMC compliance through supply chain visibility and better understanding those risks within your supply chain and those priority areas within your supply chain It helps you from that top-down view of a prime contractor figure out where those areas of needs are as well. And there is, you know, a recent executive order, I believe, in July 14405 or 14415 on supply chain visibility and resiliency. And so, you know, I think that's the two angles of it, of bringing that bottom-up education and awareness and tools to these smaller manufacturers, and then putting some impetus, you know, from the top-down view to make sure that those high areas of risk are identified as well.

Good afternoon, Chair Gonzalez. Vice Chair Didich and Spokesperson Kiker and members of the committee. My name is Matthew Moss, and I am the Division Manager of Public Water Supplies at Illinois EPA. So to date in the state of Illinois, cybersecurity assessments for drinking water facilities have been conducted at the federal level. Safe Drinking Water Act Section 1433, which was amended by America's Water Infrastructure Act, Section 2013, 3 requires community water systems that are serving more than 3,300 people to prepare or revise their risk and resiliency assessments, which we refer to as RRAs, and their emergency response plans, which are referred to as ERPs. The systems must then certify to the U.S. EPA that this work has been completed. Additionally, community water systems have to review, revise where applicable, and recertify this RRA and ERP to the US EPA every five years from the original deadlines that are specified in the law. US EPA will review the system's RRA and ERP on site when the US EPA conducts inspections on the system but they do not request copies of these RRAs or ERPs. Other resources that are available to the drinking water systems and that Illinois will direct systems to include the US EPA's drinking water and wastewater resilience webpage. On this webpage They can access a form for cybersecurity technical assistance from cybersecurity subject matter experts. They can access a form to register for a free cybersecurity assessment. And they also have the ability to report a cybersecurity incident directly to CISA and the FBI. Additionally, the feds have made available new programs that address cybersecurity through EPA Water Sector's Cybersecurity Evaluation Program, CISA Vulnerability Scanning, and through CISA's Cybersecurity Evaluation Tool. Thank you for your time today and happy to answer any questions that you might have.

thank you, esteemed members of the committee. Thank you for allowing me to be here today. My name is Jackie White. I serve as the Major Account Manager for the State of Illinois at Fortinet, where I work very closely with our state agencies, our constitutional offices, and higher education institutions in the public sector. I also am honored to be serving as a board member for the InfraGard organization, which is a member alliance between the public and private sector that was established after 9-11 to help kind of vet some of those threats and help create a more direct line for the FBI. In addition to that, I work with GMS Illinois, which is an organization of our quote-unquote smalls, the counties and the cities, to make sure that we are thinking about all of the constituents within the state, whether they are being serviced by the state entities, city, county, or otherwise. And in my prior role, before coming to Fortinet, perhaps this is the most valuable to this committee, I worked for what is arguably the largest organization that provides media for and by public sector IT leaders. And through that role, I had the opportunity to learn a lot about what is happening throughout the Midwest, seeing where those red threads are and what we can learn from them. But today I am so excited to talk about one of my favorite topics, operational technology or OT. With that, securing it for the state of Illinois is paramount to us. When most people think about cybersecurity, they think about protecting small networks or email systems, sensitive data. But OT is inherently different. operational tech refers to the systems that are really controlling the physical infrastructure so allowing ourselves to separate that out is is paramount these systems keep things like transportation moving they keep our water treatment facilities safe public safety communications the infrastructure that allows those agencies to connect and as a judge of election here in Illinois, I also think about what we are all using by every county for our physical voting systems. For Illinois, OT is particularly important because we are a hub of national logistics and transportation. We are also located on one of the Great Lakes, and the responsibility to be a good steward of those resources is critical. OT supports systems, agencies, and entities responsible in all of these areas, transportation, water, wastewater, public utilities, emergency management systems, and all of these other segments that support our government. If we are thinking about this as the environment increases in a space where we are connecting cybersecurity and IT with the physical components of OT, we realize that there is a vulnerability that may or may not have existed even five short years ago. At the same time, we have tools in our tool belt to help. So I have a great deal of optimism. I don't think it's naive. I think that we are uniquely poised to be thought leaders across the country in helping solve some of these big issues. The risks of OT are fundamentally different from the IT risks. Those ransomware attacks, perhaps the ones that we heard about in the news this summer, those attacks can impact not only water, but transportation systems. And this risks undermining the public trust. Federal and state agencies have specifically highlighted cybersecurity risks for waste and water systems due to the reliance on operational technology and industrial control systems, as you just heard about. Some of the most significant challenges that we face for many of our organizations is having a complete inventory of the operational assets in their environments. Simply put, we can't secure what we don't see. In some cases, what we don't acknowledge we have. and it's an innocent oversight. I don't believe anyone is doing this with malintent from the inside.

Chairman, members of the committee, thank you for the opportunity to speak with you today. I'm Bill Bowers. I'm the Chief Information Security Officer at American Water, which is the largest investor water and wastewater utility across the United States Here in Illinois Illinois American Water serves more than 150 communities across the state My organization, our role is to protect its IT and OT systems. So that includes all of our business processes as well as all the processes for treating water and wastewater in all of our communities. I'm going to start out with a single point, and it's actually in line with what somebody said earlier today. They made the point that cyber risk is actually business risk. When it comes to the water sector, cyber risk is actually a public health issue. So if there's a cybersecurity issue at a water system, we're not only worried about if data was you know left the building we're also worried about if our consumers can trust the water that comes out of their tap you know and if we can have if the consumers in Illinois can trust that everything we're doing from a water and wastewater treatment is being protected in a way that makes sense you know and we also want to make sure things like our fire systems things like you know if somebody if a fire company's coming to put out a fire in your neighborhood making sure there's pressure in that hydrant. These are all things that can be impacted in the physical world because of cyber threats. The reality is the threat has changed over the last six months. We have seen the advent of Frontier AI and how cyber attackers have used AI to facilitate some of the things that they're doing. This summer, over a weekend in July, attackers were able to impact 30 systems in Minnesota alone. And, you know, over that weekend, we saw 12 additional states reporting the same type of issues. These were not sophisticated attacks. These were generally attackers found control systems, right, OT systems, ICS systems, connected directly to the Internet with either weak or their default passwords, which could have been prevented if just the basics of cybersecurity had been followed when these systems were implemented. Director Kelly actually stated pretty well the types of threats that we're seeing when it comes to nation states. I'm not going to go back over all the things he said, but whether it's China, Iran, North Korea or Russia, we are seeing these nation states attacking our critical infrastructure with the intent either to lie in wait in those systems or to cause some type of impact immediately. we also see uh monetarily motivated uh cyber criminals right so we there was a talk the first panel was around cyber crime um you know as a large organization right we we see ourselves being targeted by financially motivated threat actors on a daily basis and then last is hacktivists right so people who are just out to make headlines by gaining access to uh you know an american water system. On top of these things, right, in the last four months, we have seen the barrier of entry for cyber attackers lower considerably. So the use of AI, you know, it used to be a skilled attacker have to come looking for a system in order to find it and then try to exploit it. It's no longer the case You know AI has allowed people to put something in a prompt please find me systems that look like this try their default passwords and report back to me what was found We have you know used to be a hacker Now it just a person who can access an AI prompt to be able to get this type of information pretty readily. The problem we have in the water sector is not necessarily awareness. It's capacity. Of the nearly 50,000 community water systems across the United States, most of them are very small. They are manned by a dedicated group of individuals who are responsible for maintenance, compliance, emergencies, and chemistry. They don't have a security staff. They don't have people who are dedicated to do this type of work. They're not being negligent. They just don't have the resources to do it. And going forward, the support that they've relied on is uncertain. There are, whether it's federal or state funding across the United States, there's uncertainty in some of the funding they may have relied on in the past. And as a member of the water sector, I can say confidently that the water sector is only as strong as its weakest link. So ensuring we have these smaller community systems meeting a minimum level of cyber capacity is super important. So how can Illinois help in the fight? So again, this is a national fight, but how specifically can Illinois help? Setting a clear, achievable baseline across all water systems, regardless of size. Using something that is pretty basic. We're talking about no control systems exposed to the internet. No default passwords. using multi-factor authentication on all remote access and a tested plan to run each of these water systems manually. Adopting a way to measure these systems in a way that they're already using. So, for example, whether it's a NIST cybersecurity framework or the recommendations from the American Water Works Association, these standards exist, using these as the measuring sticks across all of our water systems, you know, sets that minimum baseline. The second piece is around reporting. So if there is a cyber incident and a water system is responding to an attack, ensuring that there is a consistency to the reporting that is required, right? There are federal reporting requirements, and different states have different reporting requirements. So ensuring that we have a consistent methodology for applying how we report cybersecurity incidents is very important. The last here is strengthened response and information sharing. Ensuring that every water system has access to the intelligence to help bolster their systems before a cyber attack happens. And then resources, they're aware of the resources that are available to them on how to respond to those type of incidents when they come. At American Water, we really rely on our relationships with all of our states, DHS, CISA, the EPA, Water ISAC, the FBI, and all the other industry associations that we're a part of, in order to ensure we're doing this as a community. Because in the end, we really want to strengthen the entirety of the water sector. When American Water acquires smaller systems one of the things we do immediately is you know how do we bring them to our standards for cybersecurity That way we ensure when we going into these communities we are providing value in a you know they are better protected the day we step in than the day before. The threats we are facing in the water sector are real and they are growing. The most important protections we can apply are known and they're achievable if we can work on it together. Thanks for the time.

Good afternoon, chairman and committee. My name is Dylan Boyd. I'm a domain architect with SHI. SHI is a value-added reseller, which basically means we are a distributor of hardware and software, IT, and cybersecurity. But we don't just pass paper. We help. So we have over 1,000 technical resources available for our customers just as a value-add. that includes engineers and architects, which are subject matter experts in various fields such as OT and AI, topics we're talking about here today, security operations, everything you can imagine in cybersecurity and networking and IT in general. um ai in particular is is a hot topic recently uh of course um maybe aware of china's attack on taiwan uh fully autonomous attack using ai agents uh the hugging face hack um and um the federal government blocking of uh mythos because of the the danger it poses if it gets out um again we have folks on staff that are dedicated subject matter experts on these kinds of things. We also have field CISOs, which can help with navigating governance and compliance, IR planning, things like that at an executive level. We also have a dedicated team of engineers for the public sector. So not only are they technical, but they understand what public sector budgets are like. what RFP processes are like and government specific things like frameworks such as CIGIS. So some examples of how we can help. We can have conversations, you know, strategic conversations, things like, you know, here's what our budget is. How should we spend this money to be most effective? Product expertise. So, you know, we need a new tool. What's going to be the best fit for, you know, our organization and what we're trying to do? We can do gap analysis. So, you know, basically just inventory of your staff and your tooling and help you identify where you need to focus your efforts. We can do briefings and workshops, which are basically educational as well as hands-on, you know, helping your staff understand how to use the different tools and what kind of threats they're facing. And again, these are all value adds. You know, no commitment from your organization, whether you're public sector, private, tiny, one-person cybersecurity team, whatever the case is. We also do professional services, so tabletop exercises, which is like a mock cybersecurity incident or attack. Risk assessments, so again, you know, hands-on, on-site, helping you identify your risks. and mitigate those risks. Assistance with deployments and configurations. You know, a lot of smaller organizations don't have the staff they need. Even if they've got the budget to purchase a new tool, you might need help deploying it and configuring it from, you know, experts in that area. And virtual CISO services such as hands-on guidance through certifications, things like that. I'll keep it short, stop there, and thank you for your time.

Dave Lehman, SHI. So basically we vet it for you essentially. So it's based on the customer's need, whatever the problem that is looking to be solved there. We have access to over 300,000 different products. So depending on the need, we will basically do a box check essentially to make sure it's fitting what you're looking for within the budget, but also with all the performance that you're looking to get from that tool. So we're not tied to any specific manufacturer. We assist with the process as far as vetting.

niche was for her firm i think if anything i might ask the same from you guys like you know again that uh so you guys mentioned you do a box check and you work within the budget is there a common uh product that people are looking for um or like usually like is there majority product or there a plurality that people are looking for a specific thing um i know that everybody different but is there usually a common theme Yes so Dave Lehman again SHI So we focus on all these different pockets I guess like hardware infrastructure, security.

Thank you. Turning over to the folks from American Water, like obviously you mentioned that cyber risk becomes both a business risk but also a risk, obviously, for folks who are drinking water. What is the response time? What has that looked like for your folks? You mentioned there's the issue of a data breach, but there's also the issue of, you know, can folks actually trust the water that they're drinking? You know, how long does it take for you to respond, I guess, to both of those? Because they are separate incidents, you know, and probably they have very different timelines as well. I'm assuming that the water, like, eventually had to go through some separate testing. And what does all that look like?

I think, turning back to you, for the products that some of your folks might be getting, I guess, does it reduce the amount of time that they have? is that something that people are actively looking for? Is it just a byproduct? What it is that they get? Some insight on that. Yeah, everybody got it.

If I can chime in on that. So I believe one of the things you were asking out there was resiliency, right? And so for one of the processes we have at all of our plants is ensuring we could operate the plant manually, which means loss of – that is a test that we perform quite often, right, is a loss of SCADA test where we are ensuring that our plant operators can, you know, walk into the plant and manually turn the knobs and understand what they are looking at with the loss of their computer systems. And, you know, from a resiliency perspective, right, that needs to be baked into any of the plans that any of our systems have. I believe at the beginning of the panel, the gentleman from the IEPA had said that, you know, one of the things that we are required to do, right, is have an emergency response plan at every single plant. And so ensuring that accounts for the manual operation of those systems and the testing of that plan to make sure it's not something you just have on paper that you can actually execute, I think, are super important, especially in the water sector.

I appreciate that breakdown across different folks and their different world times. at this point then is there a because of like the the systems that you mentioned like wire utilities comm systems transportations others um from from your perspective um is there it's like which one of them has proven to be a fighter not most at risk uh which ones like probably has uh across those systems have the most dwell time and or maybe which ones take the longest to recover and then get back to working properly.

do you mind if i uh talk about that a little bit the the water sector is different from let's call it electric or um you know transportation in that right there are 50 000 community water systems but there's over a hundred thousand um you know in in its entirety water systems across the united States. So we're talking about filling a large college football stadium full, right, of just people running water systems in the United States. You know, that being said, it is a little harder to get all these folks on the same page, right, when it comes to minimum standards and the like, whereas, you know, and the other thing is we have almost no federal regulations, right, that really to water. EPA is our federal agency responsible for cyber over water. However, we don't have a NERC-SIP type of model for the electric utilities. So that's why you'll see kind of a bigger, more desperate configurations when it comes to water than you'll see for electric or for transportation, for example.

Bill Bowers, American Water. So we see a little bit of all over the place when we go into the community water systems. There are ones that have chosen not to connect their systems to the Internet in any way. So they are running entirely on their own, which is okay, right? We walk into those with an understanding of you have to physically get into that facility in order to do much of anything. From a cyber perspective, I would much prefer those systems. If we could walk into one of those every few weeks that would be ideal for me We are seeing more and more that these OT systems are connected directly to the Internet We've seen kind of an explosion of it over the last, I'll call it three or four years. What I have attributed that to is people went home during COVID and needed to operate these water systems remotely. And so things got put on the Internet. They could function that way. and it was very convenient for folks. So then they could, they continued to do so. So when we walk into those systems, right, we have to walk in with the assumption that they may not be the only people operating that system, right? That a bad guy may already be in that space. So, you know, we take the precautions, right, to protect ourselves, right, protect, you know, all of our systems while we level up their maturity and cybersecurity before we can kind of connect them to the rest of the environment.

I don't have great numbers for that off the top of my head. What I will say is we are seeing more systems for our recent acquisitions that are connected to the Internet. It is getting fewer and fewer systems that are completely isolated.