Tennessee House Bill HB1733

Tennessee 2023-2024 Regular Session

• Introduced: 1/9/24
• Refer: 1/11/24
• Refer: 1/30/24
• Refer: 2/14/24
• Engrossed: 2/22/24
• Enrolled: 2/27/24
• Passed: 3/7/24
• Chaptered: 3/19/24

Caption

AN ACT to amend Tennessee Code Annotated, Title 4; Title 8; Title 9 and Title 12, relative to state entities.

Impact

The impact of HB1733 on state law is significant as it directly amends the Tennessee Code Annotated. By enacting this bill, the state establishes a clear directive that state entities must not only refrain from paying ransoms but also must report any ransom requests to the technology and innovation division of the Tennessee Bureau of Investigation. This requirement enhances oversight and accountability in handling cybersecurity incidents, ensuring state operations are safeguarded against coercive threats and minimizing potential financial losses from ransomware attacks.

Summary

House Bill 1733 aims to enhance cybersecurity measures within state entities in Tennessee. Specifically, the bill prohibits state entities from engaging with any organization that has committed a cybersecurity incident related to ransomware, where data is encrypted and a ransom is demanded for decryption. This regulatory step is designed to prevent state resources from inadvertently supporting criminal behavior and aligns with broader efforts to strengthen the security posture of governmental operations against cyber threats.

Sentiment

The sentiment surrounding the bill appears largely supportive among lawmakers, recognizing the necessity of having stringent cybersecurity protocols in place. Legislators see this measure as a proactive step to protect state resources and maintain public trust. However, there may be some concerns regarding the implications for state partnerships with private vendors and contractors who may face increased scrutiny under this legislation. The balance between maintaining security and fostering collaboration with the private sector will need to be navigated carefully.

Contention

Discussions regarding HB1733 have highlighted potential contention surrounding the definitions of state entities and the extent of the obligation to report cybersecurity incidents. Opponents may argue that the bill could lead to confusion and hinder timely responses in the event of a cybersecurity breach. Additionally, the necessity for immediate reporting could challenge the flexibility needed in crisis management situations. Nonetheless, the overarching goal of enhancing state cybersecurity appears to resonate strongly with a bipartisan consensus for protective measures.