Video, Audio, Photos & Rush Transcript: Governor Hochul Announces Nation-Leading Cybersecurity Strategy

Earlier today, Governor Kathy Hochul announced New York’s first-ever statewide cybersecurity strategy aimed at protecting the State’s digital infrastructure from today’s cyber threats. The Strategy articulates, for the first-time, a set of high-level objectives for cybersecurity and resilience across New York. It clarifies agency roles and responsibilities, outlines how existing and planned initiatives and investments knit together into a unified approach, and reiterates the State's commitment to providing services, advice, and assistance to county and local governments. New York State’s cybersecurity strategy provides public and private stakeholders with a roadmap for cyber risk mitigation and outlines a plan to protect critical infrastructure, networks, data, and technology systems.

VIDEO of the event is available on YouTube here and in TV quality (h.264, mp4) format here.

AUDIO of the event is available here.

PHOTOS of the event are available on the Governor's Flickr page.

A rush transcript of the Governor's remarks is available below:

Good morning. Yeah, that's a good response. Let’s pretend we're in church on a Sunday. Can I get an amen for that? All right. All right.

As Governor, my number one priority is to keep New Yorkers safe. Protect people's physical security during a public health crisis like COVID, keep people safe with nation leading gun laws, protect our economy, ensuring the stability of our financial markets as we did after some bank failures earlier this year, and to protect our institutions and critical elements of infrastructure from cyberattacks. That's why we're gathered today to announce what is a national model on how to protect our people, but also our state and our nation.

And I want to acknowledge all those in attendance here today, our speaking program, who share my sense of urgency in addressing these threats. First of all, to the Dean, this institution has been extraordinary in your leadership. First of all, again, two decades ago, leading the charge, sounding the alarm about the need to protect cyberspace. And people were very unfamiliar with everything we're talking about, but this institution took the lead. The rest of the nation is watching, and I'm really proud to have NYU and NYU, Tandem School of Engineering in our city, and all the graduates of which I've hired many in our administration. Keep them coming, they're the most brilliant people. So, thank you, Dean. Let's give our Dean another round of applause.

We also have representation from the White House here today, which is significant. Because they're looking to us as well as we partner with President Biden and his strong initiatives to protect Americans. We have Jake Braun, the White House Acting Principal Deputy Director for National Cybersecurity. You'll be hearing from him about national, federal initiatives, but also how we're partnering together as a state that is really taking the lead. Craig Newmark, the Founder of Craig Newmark Philanthropies, who has really dedicated himself to investigating ways that he can use resources from himself and others to really help bulk up our resources and our protections for our citizens.

Colin Ahern, who is our first ever Cybersecurity Officer, I appointed him, one of the most brilliant people I've ever met in this space. Whatever he says I disagree with, and it goes well. So, Colin, thank you. Thank you for bringing your life's experiences to government. Sometimes it's a hard transition for people, but there's not always the monetary gains, but certainly you're making a difference and you're making a legacy for our state, and I thank you for that.

Another individual who we do many events with who, because he's so embedded in the values that we share, building more housing near MTA’s train stations and making sure that our, our subways are safe from crime and making sure that our trains are protected from cyberattacks and that would be Janno Lieber, the Chairman and CEO of the MTA. I want to thank you Janno, for being with us here once again. And I'm joined by one of my commissioners, Jeanette Moy, who's the Commissioner of Office of General Services. So, thank you everyone who's here and also the audience.

This is not a new issue for me. As a member of Congress, over a decade ago, I was a member of our capital's Homeland Security Committee. I was also a member of the Army Services Committee. That took me traveling around the world – battlefields in Afghanistan and elsewhere, and I had a strong sense of our vulnerabilities, not just from physical attack, but also from cyberattack even then. And I became well acquainted with those issues and all the briefings I had from the White House – disturbing information that only members of Congress and senators are aware of what was unfolding around us, knowing full well we were vulnerable. And in the decade, since cyberattacks have only intensified every day and every single day, we've become more reliant on computers, how you bank, pay your bills, access your medical records, but even for our energy infrastructure, transportation networks, water supply, all of them are deeply reliant on digital systems.

And as these innovations become critical to our daily lives, so as we prepare against these threats. We already saw this in Suffolk County just a few months ago, literally almost brought to their knees because of a ransomware attack that forced many government functions to shut down or go offline, disconnecting more than 1.5 million residents from the services they rely on. We saw it firsthand right here. Emergency dispatchers spent weeks taking calls by hand. Real estate transactions were held up entirely. And literally, county employees had to use pen and paper. Younger ones didn't even know what those tools were.

Cyber criminals are determined to disrupt our systems and our lives. Their intent is nothing but malicious – statement of fact, and they're only getting more brazen. The FBI estimated that more than 25,000 New Yorkers, not across the country, but New Yorkers fell victim to cybercrimes last year alone. And we are a prime target. This is New York. Prime target for those who want to harm us, disrupt our way of life, not something new to us. And during 9/11, our city was attacked because they thought they could have the broadest impact on our national and global economy by hitting the epicenter of the financial world. They've hit Wall Street to disrupt our institutions and everything we stand for. The cyberattacks represent the same danger today.

So, this is not just a concern for New York, but the ripple effect of some of the institutions taken down here in New York, the effect on the national economy. So, it's a matter of national security. It's also, we live in an area of geopolitical turmoil. There are increased cyber authority threats and attacks from places like Russia and China because everybody knows New York. Many European countries have been targeted as well. And certainly, since Putin's entry into Ukraine, attacking an innocent country, the attacks have intensified on us as well. So, China also, we've unveiled hidden malware inside networks controlling infrastructure, power grids, communication system, water supplies.

So, it falls upon us. As I said at the outset, my job is to protect New Yorkers, protect them every way I can. We must stay vigilant, proactive, and always be prepared. And fortunately, the Biden administration understands this. They've done more to shore up cybersecurity and build cyber resilience than any presidential administration in history. And I'm proud to say following that model that's striving to be the best. New York also has done more than any other state. We committed over $500 million in our most recent budget to enhance IT infrastructure and healthcare, particularly protecting against cybersecurity threats. I signed nation-leading legislation to create cybersecurity protections for our energy grid. As we are seeing the effects of climate change, how often we're relying on air conditioning more often than anticipated, and in the wintertime, power lines down because of Mother Nature. We don't need them down because of malicious attackers.

I also created the Joint Security Operations Center down the street, a combined command center, and this is what happens in government. I've served in every level of government there is. People get into silos, they do their own jobs, they don't cross pollinate and share information. That is detrimental to our interests and only helps the bad actors. That's why I've also established this position of Chief Cyber Officer, to advise me on how to assess risk and increase our resilience across the state.

So, President Biden called on state leaders to harness the power of state governments. Here in New York, we're not just meeting that moment – we're leading the nation by launching the first ever statewide cybersecurity strategy. Now you're seeing it here first. This is what we've been planning for. This is what we've been working on, and this is what we're so willing and happy to share with the rest of the nation as the template, the blueprint on how to address this.

So, I'm proud of the team that puts this together. We're going to make sure that it's implemented, continue to enhance this, take our ideas from others, and people certainly in this audience have ideas for us and we're going to keep bulking up our defense against these attacks, and this is to protect critical infrastructure, but also personal information and our digital assets.

This is based on three core values, unification, resilience, and preparedness. Let me walk through each. Unification means, very simple, we’re aligning whole of state government against this problem. I have a lot of agencies, a lot of points of entry, a lot of vulnerabilities. We're boosting our cybersecurity information tools and information services across the state, and it's going to be sophisticated. It's sophisticated. It's not just being attacked and then trying how to figure out cleaning up. I am always, whether it's crime on the streets, crime on our subways, I'd rather be preventing crimes than solving crimes. The same goes with cybersecurity.

We're also focused on local governments. We mentioned Suffolk County. I spent 14 years as a local government official, a long time ago when computers were just starting to assist us in managing our operations, our real estate transactions, our financial information. We’ve got to report to the state. There are many points of entry from local and county government, from my time as a county official, where we are connected to the systems of the state.

So, I immediately realized this is a point of vulnerability. If our local governments and our county governments allow something in to infiltrate our system because of those connections, then our security is compromised. That's why I approached us with this knowledge, but also the sense of urgency I'm talking about. So, I'm always thinking about the local partners. I've been there and they would often say, “We don't know what to do. We're vulnerable. We have no idea what to do.” They don't have the money for their own cybersecurity officers. They can't afford Colin, I'm sure. “We don't have the money,” they said. So, I said, “We'll take care of that. We'll give you money.” Many times, you can help them by just saying, “I get that. I understand.”

I also knew that, as I mentioned, these areas needed training. They need help. That's why our latest budget provided $30 million in shared cybersecurity services to help county and local governments identify and fix the gaps in their security system. So as a result, 53,000 computers owned by county and local governments are now protected by the latest security technology and integrated into a statewide picture for the first time ever. Think about that, before that happened, all those vulnerabilities were very ever present. So, I want to emphasize this is not a top-down approach. It is understanding, collaborating with local governments to understand their unique challenges as the way to go.

And it's making a big impact. You know, counties that some of you may have not ventured out to yet. Allegheny County, Wyoming County, Suffolk County, perhaps you've been to. Every one of them, everyone has thanked us profusely for our efforts and some even calling it the best state-run program they've ever been involved with. I'm proud of that. This is new. It's innovative, but it's what must be done. And the second element, not just this unification of working together, but resilience, we must expand the scope of our cybersecurity efforts to protect our critical infrastructure.

Last February, we announced the formation, as I mentioned, the Joint Security Operations Center, literally brought to people from all over federal, state, local, under one roof. And I want to mention here today, it's not just what government can do, but the private sector has a role, and we have people like Craig Newmark, who's here with us today, who you'll hear from, who is also helping us. He committed $100 million to the Cyber Civil Defense Initiative. That is extraordinary and I want to give him a round applause right now for that amazing show of support for our efforts here because he understands the need to connect all levels of government, but with the private sector and nonprofits as well, because they don't have the resources or the ability, they're busy out there taking care of our institutions and our cultures and our people. They don't have time to worry about this. This is how we can team up and help them protect themselves as well.

And we talk about things with our young people, making sure that they're protected, our kids in schools are protected. This is a whole other initiative, which is showing the vulnerabilities of our young people and their exposure to this cyber world. You only need to have a teenage daughter or a niece or someone you care about. Boy, am I glad my kids are old. It is a tough time out there. Myspace was just starting when my kids are in high school and I was like, what is this? But here we are today. It's a scary time for parents. And I'll just digress for one second that we are also, at the state level, continuing to do what we can. In my world, this is a different kind of cyberattack. It's an attack on the psychology of our children, our daughters, particularly when one out of three teenage girls entertain thoughts of suicide because they've been attacked or bullied and made to feel worthless because of what's happening with online predators sometimes, and sometimes it's their own classmates.

It is a tough world out there, and we as the adults have to continue to find ways to protect our children too, because their emotional and mental health is being jeopardized every single day when this continues. So, as I say, the third part of our realm, our pillars, is preparedness. We're not naive to the threats any longer. We cannot say we didn't know it's coming. We've now seen enough. We know enough now. And by failing to prepare, you're preparing to fail.

Now, if you check chatGPT, they say, “Benjamin Franklin said that.” But someone else disputes that, they actually think – see what I'm talking about? We don't even know if that's true, but it's a good line.

But in New York, we're preparing to succeed, not fail. So, we're going robust, bulking up our protections. And again, it's not just about systems, digital platforms, computers. I'm saying, and I've said this, "I don't just need AI, I need H-I, human intelligence." I need humans like the people in this room to do what they can to help us thwart these threats. And it all begins in a classroom. We're expanding our SUNY programs into more high-tech cyber research. I need more professionals. It's hard to hire people. We talk about this. There aren't enough people trained. Dean, give me more students, give me more. And providing resources to college, high school students as well so they understand the career opportunities as well. I want to bulk up our workforce in this space. We're investing in programs like P-Tech, exposing them to STEM and technology opportunities and also increase the number of workforces in this field overall.

We're building the first-in-the-nation team in our Division of Homeland Security and Emergency Services, a team embedded in our Homeland Security Services to work on this with young people as well and get them excited, in internships and elsewhere. But also, when you think about this, why we're here today, while we have a class of graduates with us here today, how we can infuse cybersecurity in places you might not have thought we needed it before.

And I want to acknowledge all the MTA personnel joining us here today. Put up your hand if you're with the MTA. Oh, well, okay, okay. Who is running the trains? Please don't tell me they're all going to be late today. We have such a great record of on time arrivals. Right, Janno? We may have just blown your record. But all of you are the first graduates, the first graduates of the NYU – again, thank you, NYU - MTA Operational Technology Cybersecurity Certification program. Now, that is going to be one big certificate on your refrigerator back home. I guarantee it. You put it next to your kids' report cards. But it's the first of the kind because we do things first here. But we need to train the train operators, the switch signal operators, the workers in our other elements of critical infrastructure, training them through a variety of topics.

And these graduates have gone through two eight-week courses. And you might wonder, “Why does a train operator – who we value, for many, many reasons, you take care of us every day, and I'm grateful for that - but why do you need this kind of preparation?” Well, you're already trained in a wide variety of crisis scenarios. It's what you do. It's part of the job. Most people wouldn't think this, but that's why you are so outstanding in the moment when your skills are needed – from natural disasters to terror attacks to crimes, you know what to do. They know what to do out there. But this program provides additional know-how, so you can help prevent attacks, alert authorities when the system is exhibiting behaviors that could indicate a cyberattack that others would not have noticed if they didn't have this training. And also, operate with reduced digital capacity. Sometimes that's what it's going to take to minimize the exposure. And also, help get the system back online so New Yorkers can continue to travel safely and securely and on time.

So, to all the graduates here who took the time to learn these skills, you know more than most now, you see more threats than others would have if not for this program. And I'm grateful for your dedication to enhance your own skills because I know every day you go out there in your jobs, it is not easy. There's not a lot of thank you’s. But this city does not run without you, does not run. And your ability to have this training to go into your jobs and have now the mental awareness, the human intelligence that I need to have on site, that is going to protect us. You may never know all the lives you could have saved or the disruptions you prevented, but I know you're going to do that because you're now trained as a result of this program.

So, cybersecurity is really a team sport here. There's not a single person who shouldn't be aware of what it looks like, what it feels like, how to alert the authorities when something happens. And that's what the collaboration is all about. We're protecting individuals, protecting local governments, protecting our state, and ultimately protecting our nation.

And I want to thank everybody who understands, as I do, the time has passed the talk about this. This is New York, and we are acting, and this is the plan that's going to make it happen. Thank you very much for your attendance here today. Congratulations to our graduates. Thank you. With that, let me bring up Janno Lieber, who now is also a cybersecurity expert as well. So, thank you, Janno.