Virginia to Consider Joining States Creating Volunteer Cyber Civilian Corps

A proposal to create a volunteer cybersecurity incident response team, investigating and troubleshooting threats targeting digital systems around the commonwealth, will be considered again in this year’s General Assembly session.

The legislation, carried by Del. Michael Feggans, D-Virginia Beach, would authorize the Virginia Information Technologies Agency to select people to serve as Virginia Cyber Civilian Corps volunteers and corps advisors, and to deploy such volunteers across the commonwealth to provide rapid-response assistance under the direction of VITA upon request from a client or government agency affected by a cybersecurity incident.

The proposal would also create an advisory board within VITA to review and make recommendations regarding the creation and administration of the corps.

This comes as public data suggests cyber attacks are increasing. In many cases, reporting lags and transparency vary due to reputational or security concerns.

“The problem today is that localities are ‘soft targets’ these days,” said Tijay Chung, an associate professor in the computer science department at Virginia Tech. “Hackers have shifted (their) focus from hard and corporate targets to schools, hospitals, or municipalities.”

He said House Bill 83 is a smart idea and that hackers are aware that local governments don’t have the budgets for a state-of-the-art security system or dedicated 24/7 monitoring teams.

“That’s why these days hackers, in my opinion, think that (attacking) localities are easy targets —  low risk, high reward,” Chung added.

In 2024, Feggans introduced a similar proposal, which cleared the General Assembly during his first term. However, former Gov. Glenn Youngkin vetoed the bill. Youngkin believed creating a civilian cybersecurity corps is premature, costly, and legally unclear under Virginia’s current cybersecurity setup.

According to the Department of Planning and Budget, an estimated $410,000 is projected for the Virginia Information Technology Agency to create and fund an advisory board for the Virginia Cyber Civilian Corps. Funds would also be allocated to the Virginia State Police for fingerprinting volunteers.

Feggans’ interest in introducing the legislation stems from his time as a cybersecurity intern for former Gov. Terry McAuliffe’s administration and their research on potential legislation. He also saw the success of similar proposals in other states like Ohio, Michigan, and Wisconsin.

“This wasn’t just something that came up out of the blue,” Feggans said at the start of the General Assembly session. “It’s a model showing that we can increase our cybersecurity resources without adding a large bill to the state. We’ve seen cyber attacks happen in Virginia, and we just need to continue to increase our intellectual abilities to be able to assist in that, and this is my way to address our cybersecurity resources within the state.”

In December, Campbell County was targeted by a cyberattack on its emergency notification system, OnSolve CodeRed, for weather and emergency alerts.

The county says the system has been decommissioned. An initial investigation found that an organized cybercriminal group damaged the CodeRED platform. The group may have removed subscriber data and posted some of it online.

Chung said lawmakers will need to consider vetting volunteer experts in their implementation plan.

Chung said that having a certification does not necessarily mean you can stop an active ransomware attack.

“You really have to have real experience. Conversely, some of the best white hat hackers may not have a formal degree. VITA needs to balance bureaucracy with actual technical capability.”

If Feggans’ bill is to have any success in passing to the Senate, it will have to clear the House of Delegates before crossover on Feb. 18. Gov. Abigail Spanberger would be responsible for signing the legislation.

Virginia Mercury is part of States Newsroom, a nonprofit news network supported by grants and a coalition of donors as a 501c(3) public charity. Virginia Mercury maintains editorial independence. Contact Editor Samantha Willis for questions: info@virginiamercury.com.