A proposal to create a volunteer cybersecurity incident response team to investigate and troubleshoot threats targeting digital systems around the Commonwealth will be considered again in this year’s General Assembly session.

The legislation, carried by Del. Michael Feggans, D-Virginia Beach, would authorize the Virginia Information Technologies Agency to select people to serve as Virginia Cyber Civilian Corps volunteers and corps advisers and to deploy such volunteers across the state to provide rapid-response assistance under the direction of VITA upon request from a client or government agency affected by a cybersecurity incident. 

The proposal would also create an advisory board within VITA to review and make recommendations regarding the creation and administration of the corps. 

Public data suggests cyberattacks are increasing. In many cases, reporting lags and transparency vary because of reputational or security concerns. 

“The problem today is that localities are ‘soft targets’ these days,” said Tijay Chung, an associate professor in the computer science department at Virginia Tech. “Hackers have shifted (their) focus from hard and corporate targets to schools, hospitals or municipalities.” 

He said House Bill 83 is a smart idea and that hackers are aware local governments do not have the budgets for a state-of-the-art security system or dedicated 24/7 monitoring teams. 

“That’s why these days, hackers, in my opinion, think that (attacking) localities are easy targets — low risk, high reward,” Chung added. 

In 2024, Feggans introduced a similar proposal, which cleared the General Assembly during his first term. However, former Gov. Glenn Youngkin vetoed the bill. Youngkin said creating a civilian cybersecurity corps is premature, costly and legally unclear under Virginia’s current cybersecurity setup. 

According to the Department of Planning and Budget, an estimated $410,000 is projected for VITA to create and fund an advisory board for the Virginia Cyber Civilian Corps. Funds would also be allocated to the Virginia State Police for fingerprinting volunteers. 

Feggans’ interest in introducing the legislation stems from his time as a cybersecurity intern for former Gov. Terry McAuliffe’s administration and research on potential legislation. He also cited the success of similar proposals in states such as Ohio, Michigan and Wisconsin. 

“This wasn’t just something that came up out of the blue,” Feggans said at the start of the General Assembly session. “It’s a model showing that we can increase our cybersecurity resources without adding a large bill to the state. We’ve seen cyberattacks happen in Virginia, and we just need to continue to increase our intellectual abilities to be able to assist in that, and this is my way to address our cybersecurity resources within the state.” 

In December, Campbell County was targeted by a cyberattack on its emergency notification system, OnSolve CodeRED, used for weather and emergency alerts. 

The county said the system has been decommissioned. An initial investigation found an organized cybercriminal group damaged the CodeRED platform. The group may have removed subscriber data and posted some of it online. 

Chung said lawmakers will need to consider vetting volunteer experts in their implementation plan and added that having a certification does not necessarily mean you can stop an active ransomware attack. 

“You really have to have real experience. Conversely, some of the best white hat hackers may not have a formal degree. VITA needs to balance bureaucracy with actual technical capability.” 

If Feggans’ bill is to have any success in advancing to the Senate, it must clear the House of Delegates before crossover on Feb. 18. Gov. Abigail Spanberger would be responsible for signing the legislation. 

This story originally appeared on VirginiaMercury.com.