1. United States
2. Mo.
3. Letter

I am writing to ask that Oregon take immediate action to examine and strengthen protections for citizens against catastrophic cyberattacks and failures of critical systems. Much of the public conversation surrounding cybersecurity currently focuses on artificial intelligence. I believe the issue is much broader. Our financial institutions, utilities, healthcare systems, communications networks, government systems, research institutions, and other essential services increasingly depend on interconnected digital infrastructure. A sufficiently sophisticated cyberattack or bad-faith actor could potentially disrupt systems that ordinary citizens rely upon every day. This raises some very basic questions that I believe government should be able to answer clearly: If a cyberattack compromises a bank or financial institution, what protections does an ordinary citizen have? If a brokerage or financial system is compromised, what happens to an individual’s investments? What happens if records are altered, accounts are frozen, or money or securities are stolen? If a utility is successfully attacked and essential services are interrupted, what obligations does the utility have to its customers? If a hospital, healthcare system, communications provider, or other critical service is compromised, what continuity requirements are in place? If an organization fails to maintain reasonable cybersecurity protections and its customers suffer financial losses as a result, what recourse do those customers have? And perhaps most importantly: who is ultimately responsible when a critical system fails because of a cyberattack involving a third-party vendor, contractor, cloud provider, software system, or emerging technology? I recognize that some protections already exist. However, those protections appear to be divided among numerous federal and state agencies and differ substantially depending on the type of institution involved. For example, bank deposits may receive FDIC protection under certain circumstances, while brokerage accounts have a different framework through SIPC. These protections do not necessarily mean that a citizen is made whole after a cyberattack. Oregon already recognizes cybersecurity as an important component of utility safety and reliability, and the state has established cyber incident-response resources for government entities. I believe we should build upon these efforts and consider whether similar principles need to apply more broadly to systems whose failure could have serious consequences for the public. I respectfully ask the Governor and Legislature to consider developing a comprehensive framework addressing: • Minimum cybersecurity and resilience standards for organizations operating critical systems; • Regular independent security assessments, penetration testing, backup requirements, and disaster-recovery exercises; • Clear requirements for timely notification of cyber incidents that could materially affect customers; • Minimum continuity-of-service requirements for essential services; • Clearly defined liability and consumer remedies when regulated organizations fail to meet required security standards; • Appropriate insurance, reserves, or other mechanisms for compensating citizens who suffer losses from qualifying cyber incidents; • Clear responsibility for cybersecurity risks introduced through third-party vendors, contractors, cloud providers, and other technology suppliers; • Standards for the secure development, deployment, monitoring, and auditing of artificial-intelligence systems used in critical infrastructure; and • A coordinated state and federal approach so that citizens are not left trying to determine which agency or regulator is responsible only after something has gone wrong. I am not asking for government to eliminate every possible cyber risk. I understand that no system can be made completely invulnerable. I am asking for something more fundamental: that citizens know what protections exist, what standards critical organizations must meet, what happens when those standards are not met, and what recourse ordinary people have when a catastrophic failure occurs. As our dependence on digital systems continues to increase, I believe these questions should be answered before a major incident forces us to answer them after the fact. Please consider making cybersecurity resilience, continuity of essential services, and meaningful consumer protection a legislative priority.