Oregon lawmakers reduce planned funding for cybersecurity by millions – Oregon Capital Chronicle

Oregon lawmakers plan to fund just a fraction of a $15 million request for a cybersecurity program and center that would help local government agencies.

House Bill 2049 allocates $4.9 million for a proposed Cybersecurity Center of Excellence – about one-third of the original request from a joint legislative technology committee. The center would help government agencies monitor cybersecurity, train specialists and respond to data breaches like the one affecting 3.5 million Oregonians.

Oregon’s Department of Motor Vehicles said Thursday anyone with a driver’s license and state identification card could have their personal information, including birth date, home address, height, weight and eye color compromised by a data breach. State officials are advising people to monitor their credit and check reports for errors.

The League of Oregon Cities, which represents municipalities of all sizes in the state, is concerned about the limited funding.

“It’s unfortunate timing,” Nolan Pleše, lobbyist for the league, said in an interview with the Capital Chronicle. “It’s not one of those issues that jumps to the top of the list for funding opportunities in the Legislature. It’s not something that rises to the top of the list for your average Oregonian. But the impacts when there is a breach and the collection of the individual data is huge.”

The reduction in funding would limit the new center’s reach, he said. With the reduction, just three universities – Portland State University, Oregon State University and University of Oregon – would be involved. The universities would provide help such as training for the cybersecurity workforce and be available as a resource for agencies and businesses that need guidance on how to monitor for threats and respond to breaches.  

Breaches can hit large and small agencies. Since February, cyberattacks in Oregon also have involved Dallas School District, Oregon City, Curry County and Lewis & Clark College in Portland.

In November 2021, a state audit found the Oregon Department of Consumer and Business Services had not followed basic cybersecurity practices and was vulnerable to attacks.

The center is needed, especially for smaller agencies that don’t have as many resources, Pleše said.

Pleše said the league will continue to advocate for more funding to work on the issue.

In legislative sessions, budget requests often get reduced, as lawmakers balance priorities with limited money.