Hawaii 2022 Regular Session

Hawaii House Bill HB2052 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	HOUSE OF REPRESENTATIVES H.B. NO. 2052 THIRTY-FIRST LEGISLATURE, 2022 STATE OF HAWAII A BILL FOR AN ACT RELATING TO CYBERSECURITY. BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:
2	2
3	3	HOUSE OF REPRESENTATIVES H.B. NO. 2052
4	4	THIRTY-FIRST LEGISLATURE, 2022
5	5	STATE OF HAWAII
6	6
7	7	HOUSE OF REPRESENTATIVES
8	8
9	9	H.B. NO.
10	10
11	11	2052
12	12
13	13	THIRTY-FIRST LEGISLATURE, 2022
14	14
15	15
16	16
17	17	STATE OF HAWAII
18	18
19	19
20	20
21	21
22	22
23	23
24	24
25	25
26	26
27	27
28	28
29	29
30	30
31	31	A BILL FOR AN ACT
32	32
33	33
34	34
35	35
36	36
37	37	RELATING TO CYBERSECURITY.
38	38
39	39
40	40
41	41
42	42
43	43	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:
44	44
45	45
46	46
47	47	SECTION 1. Chapter 128A, Hawaii Revised Statutes, is amended by adding a new section to be appropriately designated and to read as follows: "§128A- Cybersecurity incidents; cyber ransom or ransomware attacks; payment of ransom. (a) No government agency, business entity, or health care entity in the State shall pay, or have another entity pay on its behalf, ransom related to a cyber incident or a cyber ransom or ransomware attack. (b) Government agencies, business entities, and health care entities shall report all cyber incidents and cyber ransom or ransomware attacks to the office of homeland security within hours after the agency or entity has discovered or has been notified of a cyber incident or cyber ransom or ransomware attack. (c) Any business entity or healthcare entity that violates this section shall be subject to a civil penalty of no less than $ and more than $ for each violation and the costs of any investigation. The attorney general may bring an action pursuant to this section. No such action may be brought against a government agency. (d) The penalties provided in this section shall be in addition to the remedies or penalties available under all other laws of this State. (e) As used in this section: "Business entity" means any legal entity that conducts business in the State. The term includes a sole proprietorship, partnership, corporation, association, or other group, however organized, and whether or not organized to operate at a profit; and a financial institution organized, chartered, or holding a license or authorization certificate under the laws of the State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. "Cyber incident" means the compromise of the security, confidentiality, or integrity of computerized data due to the exfiltration, modification, or deletion that results in the unauthorized acquisition of and access to information maintained by an entity. "Cyber ransom" or "ransomware" means a type of malware that encrypts or locks valuable digital files and demands a ransom to release the files. "Government agency" means any department, division, board, commission, public corporation, or other agency or instrumentality of the State or of any county. "Health care entity" means hospitals, nursing homes, home care agencies, hospice, and any other health care facilities licensed or certified by the department of health." SECTION 2. Section 128A-4, Hawaii Revised Statutes, is amended to read as follows: "[[]§128A-4[]] Homeland security responsibilities. (a) The director may: (1) Prepare comprehensive plans and programs for homeland security and homeland defense; provided that these plans and programs shall be integrated and coordinated with the plans of the counties and the federal government to the fullest possible extent; (2) Make studies and surveys of the vulnerabilities of critical infrastructure and key resources in this State as may be necessary, and participate in planning for their protection; (3) Develop and maintain a list of critical infrastructure, coordinating the list with the counties of the State, other state agencies, federal agencies (including the Departments of Defense and Homeland Security), the private sector, and other agencies and organizations as necessary; (4) Develop and maintain a capability to process security-clearance applications for civilian workers of the state and county governments; (5) Foster coordination on security matters with all nations of the Pacific region to the extent permitted under federal law, including but not limited to coordinating planning efforts, as appropriate; sponsoring discussions and seminars; and hosting periodic international conferences; and (6) Solicit and manage funding, including but not limited to grants from the federal government, funds from other divisions in the department of defense and other state agencies, and funds to provide personnel support to the office of homeland security. (b) The director shall develop and maintain a list of all cybersecurity incidents and cyber ransom or ransomware attacks reported to it pursuant to section 128A- and make the list available to the public." SECTION 3. There is appropriated out of the general revenues of the State of Hawaii the sum of $ or so much thereof as may be necessary for fiscal year 2022-2023 to carry out the purposes of this Act. The sum appropriated shall be expended by the office of homeland security for the purposes of this Act. SECTION 4. Statutory material to be repealed is bracketed and stricken. New statutory material is underscored. SECTION 5. This Act shall take effect upon its approval. INTRODUCED BY: _____________________________
48	48
49	49	SECTION 1. Chapter 128A, Hawaii Revised Statutes, is amended by adding a new section to be appropriately designated and to read as follows:
50	50
51	51	"§128A- Cybersecurity incidents; cyber ransom or ransomware attacks; payment of ransom. (a) No government agency, business entity, or health care entity in the State shall pay, or have another entity pay on its behalf, ransom related to a cyber incident or a cyber ransom or ransomware attack.
52	52
53	53	(b) Government agencies, business entities, and health care entities shall report all cyber incidents and cyber ransom or ransomware attacks to the office of homeland security within hours after the agency or entity has discovered or has been notified of a cyber incident or cyber ransom or ransomware attack.
54	54
55	55	(c) Any business entity or healthcare entity that violates this section shall be subject to a civil penalty of no less than $ and more than $ for each violation and the costs of any investigation. The attorney general may bring an action pursuant to this section. No such action may be brought against a government agency.
56	56
57	57	(d) The penalties provided in this section shall be in addition to the remedies or penalties available under all other laws of this State.
58	58
59	59	(e) As used in this section:
60	60
61	61	"Business entity" means any legal entity that conducts business in the State. The term includes a sole proprietorship, partnership, corporation, association, or other group, however organized, and whether or not organized to operate at a profit; and a financial institution organized, chartered, or holding a license or authorization certificate under the laws of the State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution.
62	62
63	63	"Cyber incident" means the compromise of the security, confidentiality, or integrity of computerized data due to the exfiltration, modification, or deletion that results in the unauthorized acquisition of and access to information maintained by an entity.
64	64
65	65	"Cyber ransom" or "ransomware" means a type of malware that encrypts or locks valuable digital files and demands a ransom to release the files.
66	66
67	67	"Government agency" means any department, division, board, commission, public corporation, or other agency or instrumentality of the State or of any county.
68	68
69	69	"Health care entity" means hospitals, nursing homes, home care agencies, hospice, and any other health care facilities licensed or certified by the department of health."
70	70
71	71	SECTION 2. Section 128A-4, Hawaii Revised Statutes, is amended to read as follows:
72	72
73	73	"[[]§128A-4[]] Homeland security responsibilities. (a) The director may:
74	74
75	75	(1) Prepare comprehensive plans and programs for homeland security and homeland defense; provided that these plans and programs shall be integrated and coordinated with the plans of the counties and the federal government to the fullest possible extent;
76	76
77	77	(2) Make studies and surveys of the vulnerabilities of critical infrastructure and key resources in this State as may be necessary, and participate in planning for their protection;
78	78
79	79	(3) Develop and maintain a list of critical infrastructure, coordinating the list with the counties of the State, other state agencies, federal agencies (including the Departments of Defense and Homeland Security), the private sector, and other agencies and organizations as necessary;
80	80
81	81	(4) Develop and maintain a capability to process security-clearance applications for civilian workers of the state and county governments;
82	82
83	83	(5) Foster coordination on security matters with all nations of the Pacific region to the extent permitted under federal law, including but not limited to coordinating planning efforts, as appropriate; sponsoring discussions and seminars; and hosting periodic international conferences; and
84	84
85	85	(6) Solicit and manage funding, including but not limited to grants from the federal government, funds from other divisions in the department of defense and other state agencies, and funds to provide personnel support to the office of homeland security.
86	86
87	87	(b) The director shall develop and maintain a list of all cybersecurity incidents and cyber ransom or ransomware attacks reported to it pursuant to section 128A- and make the list available to the public."
88	88
89	89	SECTION 3. There is appropriated out of the general revenues of the State of Hawaii the sum of $ or so much thereof as may be necessary for fiscal year 2022-2023 to carry out the purposes of this Act.
90	90
91	91	The sum appropriated shall be expended by the office of homeland security for the purposes of this Act.
92	92
93	93	SECTION 4. Statutory material to be repealed is bracketed and stricken. New statutory material is underscored.
94	94
95	95	SECTION 5. This Act shall take effect upon its approval.
96	96
97	97
98	98
99	99	INTRODUCED BY: _____________________________
100	100
101	101	INTRODUCED BY:
102	102
103	103	_____________________________
104	104
105	105
106	106
107	107
108	108
109	109	Report Title: Cybersecurity; Cyber Ransom; Ransomware; Payment Prohibition; Reporting; Appropriation Description: Prohibits government agencies, business entities, and health care entities in the State from paying or having another entity pay on its behalf ransom for cyber incidents or cyber ransom or ransomware attacks. Requires all agencies and entities to report incidents and attacks to the office of homeland security. Establishes penalties for violations. Requires the director of homeland security to develop and maintain a list of all incidents and attacks and make the list available to the public. Appropriates funds. The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.
110	110
111	111
112	112
113	113
114	114
115	115	Report Title:
116	116
117	117	Cybersecurity; Cyber Ransom; Ransomware; Payment Prohibition; Reporting; Appropriation
118	118
119	119
120	120
121	121	Description:
122	122
123	123	Prohibits government agencies, business entities, and health care entities in the State from paying or having another entity pay on its behalf ransom for cyber incidents or cyber ransom or ransomware attacks. Requires all agencies and entities to report incidents and attacks to the office of homeland security. Establishes penalties for violations. Requires the director of homeland security to develop and maintain a list of all incidents and attacks and make the list available to the public. Appropriates funds.
124	124
125	125
126	126
127	127
128	128
129	129
130	130
131	131	The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.