Lawmakers Reintroduce Bill to Bolster Cybersecurity of K-12 Schools

A bipartisan and bicameral group of lawmakers are reintroducing legislation designed to enhance the cybersecurity of the nation’s K-12 institutions, a move that comes as cyberattacks have increasingly targeted primary and secondary schools in recent years. 

The Enhancing K-12 Cybersecurity Act—sponsored by Reps. Doris Matsui, D-Calif. and Zach Nunn, R-Iowa, and Sens. Marsha Blackburn, R-Tenn. and Mark Warner, D-Va.—would direct the Cybersecurity and Infrastructure Security Agency to provide educators with enhanced access to cyber information and resources, while also working to better track the scale of cyberattacks targeting K-12 institutions. A representative from Blackburn’s office said the bill was expected to be formally introduced on Wednesday. 

The legislation calls for CISA to establish “a cybersecurity information exchange to disseminate information, best practices and grant opportunities to improve cybersecurity” for primary and secondary schools, as well as a K-12 cybersecurity technology improvement program that would be administered “through an information and analysis organization to deploy cybersecurity capabilities that will help address cybersecurity risks and threats to information systems of K-12 schools.” Under the bill, this program would be authorized $10 million per year for fiscal years 2024 and 2025. 

The bill would also require that CISA establish a cybersecurity incident registry within the agency to better track cyberattacks targeting K-12 schools. This type of cyber information would be submitted voluntarily to the registry, but would be used to improve CISA’s data collection efforts “to coordinate activities related to the nationwide monitoring of the incidence and financial impact of cyberattacks.”

“Cyberattacks continue to grow in size, frequency and complexity in critical U.S. institutions, including in America’s schools,” Blackburn said in a statement. “We must ensure that our education sector is equipped to address these threats and keep students’ personal information private. This bipartisan and bicameral legislation will improve the cybersecurity tracking system for schools and provide them with necessary training resources and best practices for prevention.” 

Matsui first introduced the legislation in October 2020 with then-Rep. Jim Langevin, D-R.I., and again in June 2021 with Langevin, Rep. Andrew Garbarino, R-N.Y., and then-Rep. John Katko, R-N.Y., but the bill never made it to the full House for a vote. 

“Cybercriminals are rapidly evolving their strategies to cause chaos and disruption, yet a lack of resources for our schools is forcing them to do more with less,” Matsui said in a statement. “The Enhancing K-12 Cybersecurity Act would establish a crucial roadmap to prepare our K-12 cyberinfrastructure for future attacks.”

A joint cybersecurity advisory issued in September 2022 by CISA, the FBI and the MultiState Information Sharing and Analysis Center warned that threat actors were “disproportionately targeting the education sector with ransomware attacks,” noting that primary and secondary schools “may be seen as particularly lucrative targets due to the amount of sensitive student data accessible through school systems or their managed service providers.” 

In response to the growing number of cyberattacks targeting K-12 schools, CISA released a report in January that outlined steps that K-12 school administrators should take to bolster their cyber practices. These included developing “a mature cybersecurity plan,” identifying and addressing resource constraints and focusing on “collaboration and information sharing.” The agency also released an online toolkit to provide schools and districts with additional resources to manage and reduce their cyber risks. 

While CISA’s report said “the total number of K–12 cybersecurity incidents is impossible to reliably quantify due to a lack of consolidated data,” it noted that “reported incidents between 2018–2021 have risen from 400 in 2018 to an accumulated total of over 1,300” in 2021. 

The escalation in cyber threats targeting K-12 institutions was similarly noted in a January report from anti-virus company Emsisoft, which found that at least 45 school districts operating 1,981 schools experienced ransomware attacks in 2022. The report noted that the most significant of these incidents was last fall’s cyberattack on the Los Angeles Unified School District, which resulted in hackers leaking 500GB of stolen data. 

Similar ransomware attacks have already affected K-12 schools in Alabama, Arizona, Massachusetts and Iowa in the first few months of 2023.

In a statement, Nunn cited the disruptive ransomware attack earlier this year on Iowa’s Des Moines Public Schools—the largest public school district in the state—as an example of the need for this type of bipartisan legislation. 

“In the wake of the ransomware incident in January, I’m proud to work across the aisle to ensure our schools have the resources and training they need to protect students,” he said.