SB1740 103RD GENERAL ASSEMBLY

LRB103 28322 AWJ 54701 b

103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
SB1740

Introduced 2/9/2023, by Sen. Steve Stadelman

SYNOPSIS AS INTRODUCED:

New Act

Creates the Ransomware Attack Act. Provides that a governmental unit (the State, a unit of local government, or any other subdivision of the State) may not use any public funds to pay any person or entity to recover its computer system after a ransomware attack unless the Governor first makes a proclamation that the ransomware attack against the governmental unit is a disaster under the Illinois Emergency Management Agency Act and, in the proclamation, authorizes the governmental unit to make a payment to recover its computer system following the ransomware attack. Requires a governmental unit to report a ransomware attack to the Department of Innovation and Technology no later than 24 hours after discovering the attack, and requires the Department of Innovation and Technology to adopt rules to implement reporting requirements. Limits the current exercise of home rule powers. Effective immediately.

A BILL FOR

AN ACT concerning government.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Ransomware Attack Act.

Section 5. Definitions. As used in this Act:

"Governmental unit" means an agency of the State, a unit of local government, or any other subdivision of the State.

"Ransomware" means malware that prevents or limits a user from accessing the user's computer system by locking the user's files until a ransom is paid.

Section 10. Payments due to ransomware prohibited; Governor-approved payments.

(a) Except as provided in subsection (b), a governmental unit may not use any public funds to pay any person or entity to recover its computer system after a ransomware attack.

(b) If the governor makes a proclamation that a ransomware attack against a governmental unit is a disaster under the Illinois Emergency Management Agency Act and, in the proclamation, authorizes the governmental unit to make a payment to recover its computer system following the ransomware attack, then the governmental unit may make any payment needed using public funds to end the ransomware attack.

Section 15. Reports of ransomware attacks; rules. A governmental unit must report a ransomware attack to the Department of Innovation and Technology no later than 24 hours after discovering the attack. The Department of Innovation and Technology shall adopt rules to implement reporting requirements under this Section.

Section 90. Home rule. A home rule unit may not authorize payment for ransomware in a manner inconsistent with this Act. This Act is a limitation under subsection (i) of Section 6 of Article VII of the Illinois Constitution on the concurrent exercise by home rule units of powers and functions exercised by the State.

Section 99. Effective date. This Act takes effect upon becoming law.