House approves legislation to protect K-12 schools against cyberattacks

The House on Wednesday unanimously passed legislation intended to help strengthen K-12 institutions against cyber threats, which have ticked up as classes have moved online during the COVID-19 pandemic. 

The K-12 Cybersecurity Act would require the Cybersecurity and Infrastructure Security Agency (CISA) to create cybersecurity recommendations and tools for schools to use to defend themselves against hackers, after conducting a study on the cyber risks facing K-12 institutions. 

The Senate unanimously approved the bill last month. There, the legislation is sponsored by Senate Homeland Security and Governmental Affairs Committee Chairman Gary Peters (D-Mich.) and Sen. Rick Scott (R-Fla.), with Rep. Jim Langevin (D-R.I.) primarily sponsoring the bill in the House. It now goes to President Biden for approval. 

“Ransomware and other cyber-attacks that can shut down our K-12 schools and compromise the personal information of our students and dedicated educators are unacceptable and must be stopped,” Peters said in a statement following the late afternoon vote. “We must provide faculty and staff with the resources and means that they often lack to defend themselves and their students against complicated cyber-attacks.”

Scott said in a separate statement that “we must do everything possible to protect the safety of every American student — and as we move to an increasingly digital world, this includes the safety of their personal information online.”

The legislation is being put forward amid escalating threats to K-12 institutions during the pandemic, with a growth in the number of successful cyberattacks that have disrupted online classes and crippled learning. 

A report released by the K-12 Cybersecurity Resource Center earlier this year found that U.S. K-12 institutions had experienced a “record-breaking” number of cyber incidents in 2020, with an 18 percent increase as compared to 2019 and an average of two attacks per school day. 

Successful incidents included ransomware attacks on school districts in Miami-Dade County, Fla.; Baltimore County, Md.; and Fairfax County, Va.

“Throughout the pandemic, criminal hackers have ramped up their attacks on our nation’s schools, disrupting entire school districts and jeopardizing the personal information of students and educators alike,” Langevin, who serves as co-chair of the Congressional Cybersecurity Caucus, said in a statement Tuesday.

“This legislation will help shore up our schools’ cyber defenses and protect our students and educators against those who wish them harm,” he added.