HB 886: State government; prohibit state agencies and local government entities from responding to ransomware activity

Right now Georgia law does not directly address whether state agencies or local governments can pay hackers who lock up computer systems with ransomware and demand payment. This bill would add a new section to Georgia's general government code (O.C.G.A. Chapter 1 of Title 50) that flatly bans state agencies and local government entities from paying ransom or otherwise communicating with anyone carrying out a ransomware attack against them. Instead of negotiating, any affected agency or local government would have to immediately consult the Georgia Technology Authority, which would guide and coordinate the response. Affected entities would have to share whatever information the authority needs to handle the incident. The bill defines ransomware activity, state agency, and local government entity broadly, covering everything from school districts and sheriff's offices to public universities and technical colleges.

• Prohibits state agencies and local government entities from paying ransom to anyone carrying out a ransomware attack against them.
• Prohibits those same entities from otherwise communicating with the individuals or groups behind a ransomware attack.
• Requires any affected state agency or local government to immediately consult the Georgia Technology Authority when hit by ransomware.
• Directs the Georgia Technology Authority to provide guidance and coordinate the response to ransomware incidents.
• Requires affected entities to give the Georgia Technology Authority any information needed to address the response.

State agencies including executive, legislative, and judicial branch offices, public universities, and technical colleges, plus local government entities such as counties, municipalities, school districts, authorities, and sheriff's offices and other local law enforcement agencies. The Georgia Technology Authority gains new coordination duties.

If a Georgia school district, county, or state office is hit by ransomware, officials would no longer be allowed to pay or negotiate to restore access, changing how these entities can respond to an active cyberattack and shifting decision-making to the Georgia Technology Authority.

• Adds new Code Section 50-1-14 to Chapter 1 of Title 50, defining 'local government entity,' 'ransomware activity,' and 'state agency' broadly.
• Subsection (b) bars any state agency or local government entity from submitting payment to or communicating with attackers engaged in ransomware activity against it.
• Subsection (c) requires immediate consultation with the Georgia Technology Authority, which provides guidance and coordinates the response.
• Subsection (c) also requires affected entities to supply the Georgia Technology Authority with information needed to address the response.
• Section 2 repeals any conflicting laws.

1. 2025-04-04House Second Readers (Cámara de Representantes)
2. 2025-04-02House First Readers (Cámara de Representantes)
3. 2025-03-31House Hopper (Cámara de Representantes)

• Stacey Evans (D, HD-057)Patrocinador principal
• Debra Bazemore (D, HD-069)
• Tanya Miller (D, HD-062)
• Kim Schofield (D, HD-063)
• Park Cannon (D, HD-058)

• cybersecurity
• ransomware
• local government
• state agencies
• Georgia Technology Authority