by Logan Finney, Idaho Reports

Earlier this year, a ransomware attack on the Jefferson School District forced schools to cancel parent-teacher conferences after administrators couldn’t access student records.

It was far from the first cyberattack in Idaho. Bingham County paid hackers three bitcoin in 2017, worth more than $3,000 at the time, to recover access to servers infected by ransomware. A 2018 malware incident on a state tax commission computer exposed the personal information of 36 taxpayers. Eastern Idaho health facilities like Idaho Falls Community Hospital and Portneuf Medical Center had to manually record patient data on paper during 2023 attacks.

But despite these growing cyber threats, budget pressures are keeping some state agencies from asking for funding for technology to keep Idahoans’ data secure.

Per the Idaho Capital Sun, lawmakers will need $600 million to $1 billion to balance the budget next year. After tax revenues came in under projection, Gov. Brad Little’s office told agencies to extend a 3% budget holdback into ongoing cuts, directing them to revise their upcoming budget requests to the legislature.

The policy memo also told agencies to cut out any general fund requests for replacement items – in other words, money needed to replace existing equipment that is worn-out or broken, including computers and networking technology.

“We did – or at least wanted to be able to – see what the needs were,” Division of Financial Management administrator Lori Wolff said in a phone interview last month.

Because of Idaho’s budget situation, though, the state won’t be able to address all of those needs in the next fiscal year.

---

CUTTING REPLACEMENT TECHNOLOGY SAVES LESS THAN $350K

Idaho Reports analyzed replacement items and related funding sources in agencies’ original budget requests and revised requests for Fiscal Year 2027.

Eleven agencies’ budget requests originally contained general fund replacement items, recommended by the Office of Information Technology Services, which were then removed from their second submissions to the governor’s office.

Line Item 12.79 – ITS Recommended Replacement Items Only

ITS Recommended Replacement Items	$333,783 removed from requests
Idaho State Police	$118,400
Department of Lands	$75,700
Department of Water Resources	$43,200
Office of the Governor	$33,500
Soil & Water Conservation Commission	$23,300
Commission for the Blind & Visually Impaired	$13,700
Commission for the Arts	$9,483
Office of the Lieutenant Governor	$5,400
State Appellate Public Defender	$3,700
STEM Action Center	$3,700
Workforce Development Council	$3,700

The Workforce Development Council, for example, originally asked for $3,700 to replace two laptops that are starting to fail.

“Replacement laptops are on an as needed basis,” says the agency’s first budget request. “Existing laptops are failing, hampering meeting presentation loads, screen freezes, struggle to load pages, connectivity issues, overheating.”

The revision on the DFM website in October made no reference to laptops.

Other agencies that cut their IT items include the Department of Land, Department of Water Resources, the STEM Action Center, and the Commission for the Arts.

Even Little’s office cited cyber threats through its out-of-date network switches.

“The existing switches have reached end-of-life and are no longer supported by the manufacturer, leaving the network vulnerable to security breaches,” according to the office’s first request. “Replacing these switches is necessary to enhance network security, improve performance, and achieve long-term cost efficiency by reducing the risk of unplanned outages and expensive emergency repairs.”

But in the revised proposal, the governor’s office omitted the $33,500 request.

Cutting out all general fund replacement items from all agencies reduced the total proposed budget by about $8.2 million. Items coded as ITS recommendations only – generally, employee laptops and network components like switches – made up only $333,783 of that reduction.

Wolff said some agencies have a little flexibility if they have dedicated funds, or federal funds, and thus aren’t impacted by the general fund revenue shortfall.

The Department of Correction, for example, requests dedicated funds to replace their OITS-recommended items. The Division of Veterans Services, on the other hand, had a decrease in its network and hardware costs and is requesting to use those savings and additional federal funds to buy new dedicated storage servers.

---

2025 LEGISLATURE TURNED DOWN DEDICATED FUND

Outgoing House Appropriations Committee chair Rep. Wendy Horman sponsored bills last year to create a dedicated ITS cybersecurity fund. The legislation did not advance to the floor.

“It seems that some agencies prioritize other needs over critical IT infrastructure,” Horman, R-Idaho Falls, told Idaho Reports in a November phone interview.

She said the joint budget committee wanted more information about the ITS security situation before committing to another $10 million in annual funding.

A dedicated fund would ensure critical needs aren’t “sacrificed on the altar of other priorities, which is what’s been happening,” Horman told Idaho Reports.

Horman, who has since announced her upcoming resignation from the Idaho Legislature, said agency tech needs to be part of future budget conversations.

“This is an important issue. It needs to be a priority for the state, for the good of the citizens,” Horman said. “It’s their information that’s being protected in many cases.”

Office of Information Technology Services communications manager Jennifer Gonzalez told Idaho Reports that cyberattacks on one agency can impact the rest of government.

“For example, not having cyber-secure employee practices, legacy hardware no longer supported even through extended support agreements, or legacy unsecured software applications could compromise the network, firewall or datacenter,” she wrote by email.

OITS keeps track of what technology is deployed at which agencies, and the standard replacement schedule for the various equipment. However, individual agencies are left responsible for managing their own technology, as well as budgeting the funds for it.

“ITS makes recommendations to agencies for replacement or support budget items and understand we all need to fund our programs and supporting needs,” Gonzalez wrote.

---

GOVERNMENT SYSTEMS FACE NEAR-CONSTANT CYBERATTACKS

The state’s cybersecurity system stops an average of 400 million malicious activities every week, OITS chief information security and operations officer Jerred Edgar told lawmakers at a November meeting of the Joint Finance-Appropriations Committee.

He also described Idaho’s nationally recognized cybersecurity training program, which OITS runs with the National Guard and the Idaho Office of Emergency Management.

Participants in this year’s exercise managed to detect numerous real-world cyber adversaries, Edgar said, who were trying to access Idaho’s critical systems in real time.

“You’re probably familiar with who North Korea is. You may not be familiar with who the Lazarus Group is… One of the known bogeymen out there on the internet that likes to target governments,” Edgar told the committee. “We got it triaged real quickly. Not that we wouldn’t have picked it up, but it was a great show that we can bring in folks, show them our processes, and we can start providing value to the fight.”

This year was the first mock scenario in which the defending team has beaten the attacking team, Edgar said, which shows improvement over the past three years.

The legislature will consider each agency’s budget request starting in January. The next legislative session begins with Little’s State of the State address on Monday, January 12.

---