“This acquisition is an important step in the execution of QinetiQ’s five-year ambitions to expand our presence in the US, the largest security and defence market in the world,” the company’s CEO, Steve Wadey, said in a statement Aug. 5.

The deal would double QinetiQ’s U.S. business, according to the release, and is to be completed by the end of this year, subject to regulatory approvals. A combination of existing cash and new debt facilities are expected to finance the acquisition.

QinetiQ was the 64th largest defense firm in 2021, per Defense News’ Top 100 list, which ranks companies according to defense revenue. Its total revenue for the fiscal year that ended March 31, 2022, was about £1.32 billion, or $1.8 billion, per the list. According to the company, its revenue has grown for the last five years.

Avantus, which was not on the list, brought in $298 million in total revenue in the fiscal year that ended June 30, 2022, and its revenue has grown by double-digit rates over the last three years, according to the release.

Founded in 2016 and based in McLean, Virginia, Avantus provides data and cyber services to the departments of Defense and Homeland Security, among other American military and government entities. QinetiQ also provides products and services to the U.S. government.

While the military services have banned the use of TikTok from government devices, troops and family members do use the app on personal devices.

TikTok is owned by the Beijing-based ByteDance, said Brendan Carr, the senior Republican on the Federal Communications Commission. And he’s concerned about the amount of non-public sensitive data Americans upload that could be flowing into the hands of the Chinese government.

TikTok has grown in popularity in the military community. For example, troops often upload videos of barracks, military equipment and maneuvers, Carr said in testimony Wednesday before the House Oversight Committee’s panel on national security.

“With TikTok, this is a device right in your pocket. It’s going inside the military installation, looking at location data, which can give people information on troop movements,” Carr said. “There’s a range of ways that that sensitive data going back to Beijing with their sophisticated [artificial intelligence] can ultimately be used to harm U.S. national security.”

The hearing was held to explore financial fraud targeting service members and veterans. The threats to active duty and veterans come from a variety of sources, according to Carr, and many of the frauds seen on other online platforms are also perpetrated on TikTok. But there are unique national security concerns when it comes to this video-sharing app.

“TikTok has engaged in a pattern of misrepresentation regarding both the amount and extent of data it’s collected as well as how much has been accessed from inside China,” Carr said.

He cited a recent BuzzFeed News report of leaked audio from 80 internal TikTok meetings that showed China has repeatedly accessed Americans’ user data.

“The flow of this non-public sensitive data into China is particularly troubling given the [People’s Republic of China’s] track record of engaging in espionage and other nefarious acts,” Carr said.

“At its core, TikTok functions as a sophisticated surveillance tool that harvests extensive amounts of sensitive data from search and browsing history, keystroke patterns, location data, and biometrics including face prints and voice prints,” Carr added. “All of the concerns with TikTok are heightened in the military context.”

Rep. Glenn Grothman, R-Wisc., proposed that the military should be proactively urging troops to not use the app.

“Should the military be doing more to tell our members to stay off of TikTok?” he asked.

The federal government should be doing more, Carr said. The government “should address the continued use of TikTok on military installations, as well as any use that depicts U.S. military operations,” he added.

Ongoing national security reviews of TikTok, currently being conducted by officials in the Treasure and Commerce departments, should be finished soon, according to Carr.

Leaders of the Senate Select Committee on Intelligence, chairman Sen. Mark Warner, D-Va., and vice chairman Sen. Marco Rubio, R-Fl., called on the Federal Trade Commission in a July 5 letter to initiate an investigation of TikTok.

In light of reports about the Chinese government’s access to the data, they wrote, the FTC should immediately launch an investigation “on the basis of apparent deception by TikTok, and coordinate this work with any national security or counter-intelligence investigation that may be initiated by the U.S. Department of Justice.”

Carr has also called on Google and Apple to remove TikTok from their app stores. In a July 5 blog, a TikTok official addressed the company’s approach to keeping U.S. data secure.

“The security of the data our community entrusts us with is a top priority at TikTok, despite recent reports questioning that commitment,” wrote Michael Beckerman, TikTok’s head of public policy for the Americas.

TikTok recently stood up a new U.S. data security division “to bring heightened focus and governance to our ongoing efforts to strengthen our data protection policies and protocols, further protect our users, and build confidence in our systems and controls in the United States,” he stated.

The creation of that division was an important milestone in the goals they previously laid out, he said: “minimizing access to U.S. user data and minimizing data transfers across regions – including to China.”

A Brazilian-drafted presidential statement approved by all 15 council members said the U.N. must “improve the culture of strategic communications across civilian, military and police components” of peacekeeping missions in order to protect civilians — a key mandate for the U.N.’s 90,000 peacekeepers in Africa, the Middle East, Asia and Europe.

The council noted “with great concern the increasing amount of disinformation and misinformation directed against United Nations peacekeeping operations, which may negatively impact missions and peacekeepers.”

Brazilian Foreign Minister Carlos França, whose country holds the council presidency this month and chaired Tuesday’s meeting, said that “strategic communications are essential for a successful peacekeeping operation.”

U.N. Secretary-General Antonio Guterres told the council that the world in which peacekeepers operate “is more hazardous today than any time in recent memory,” with geopolitical tensions reverberating locally and conflicts “more complex and multi-layered.”

“Peacekeepers are facing terrorists, criminals, armed groups and their allies — many with access to powerful modern weapons, and many with a vested interest in perpetuating the chaos in which they thrive,” the U.N. chief said.

But, he added, “The weapons they wield are not just guns and explosives. Misinformation, disinformation, and hate speech are increasingly being used as a weapon of war.”

Guterres said a recent survey found that nearly half of all U.N. peacekeepers feel misinformation and disinformation severely affect their work and threaten their safety and security.

As an example of false information spreading “like wildfire,” Guterres said a fake letter alleging that U.N. peacekeepers in Mali were collaborating with armed groups “went viral on WhatsApp and was picked up by national media.” It stirred up hostility and resentment against peacekeepers and made their efforts to protect civilians even harder, he said.

Lt. Gen. Marcos Da Costa, commander of the peacekeeping force in Congo, told the council that it operates in a country where successive surveys find “an overall poor perception” among the population about the mission’s relevance in improving their security.

“Anti-mission sentiment prevails in certain parts of the country that even prevent some of our deployments,” he said. “Unfair speeches by several actors against the mission put in risk the safety of our peacekeepers. The extensive use of social media by armed groups and other spoilers undermines the confidence in the U.N.”

He said these armed militias “use regular information warfare techniques” and their fake news diffusing through messaging and social media is difficult to distinguish from reality.

“These emerging technologies are driving a fundamental change to the character of the war, and peace operations are already being affected,” Da Costa said.

Guterres said the U.N. is moving to improve communications in peacekeeping operations between uniformed and civilian personnel, seek military and police officers skilled in communicating, and work with tech and media companies and member states to collect and share best practices.

Speaking during a C4ISRNET webcast, Kenneth McNeill said an initiative called “Bring Your Own Approved Device” would allow guardsmen to use personal mobile equipment to perform the same functions in the field that they would otherwise carry out at a desktop in their offices.

“In a typical state, all of our guardsmen, unfortunately, they may not have government-furnished devices — mobile cellphones, iPads,” McNeill said. “It cuts down on time when we’re planning for a mobilization.”

The initiative, which is a collaboration with the Department of the Army and the Pentagon’s cybersecurity office, is in its third phase of a pilot program consisting of a yearlong trial with the largest sample size to date. After this trial, if deemed successful, the initiative will be enacted, McNeill said.

Work began on the initiative before the pandemic, which drove a transition to remote work. The realities of the situation forced the Guard to accelerate its efforts.

“This is another tool in the toolkit that will give us an opportunity to allow our workforce, even after the pandemic, to continue to telework and [perform] remote work that is critical in the National Guard,” McNeill said. “I don’t think we’re going back [to] everyone in the office. I think this is the future of how we’re going to operate here in the government and in the Department of Defense.”

While deployed to the streets of Washington, D.C., following the Jan. 6 insurrection on the Capitol, the National Guard employed a similar capability called Commercial Virtual Remote to carry out the mission that was limited in scope and time.

“Now we will have a capability that really links our force, even before they are called up for deployment,” he said. “This will be a game-changer.”

JADC2

McNeill also discussed an addition to the Joint All-Domain Command and Control concept being implemented by the DoD that would focus on the needs of the National Guard’s mission set. Called “Project Homeland,” the initiative would apply the same capabilities of JADC2 to the domestic front.

JADC2 is a project by the Department of Defense to connect all the sensors from the individual services and compile data collected into a single information network. Previously, each service had their own tactical networks that were unable to interface with each other.

“JADC2 is a warfighting necessity to keep pace with the volume and complexity of data in modern warfare and to defeat adversaries decisively,” the department said in a statement. “JADC2 enables the Joint Force to ‘sense,’ ‘make sense,’ and ‘act’ on information across the battle-space quickly using automation, artificial intelligence (AI), predictive analytics, and machine learning to deliver informed solutions via a resilient and robust network environment.”

Project Homeland would apply those same capabilities during domestic deployments across the 54 states and territories National Guard units and their civilian interagency partners as opposed to the military services and their coalition forces.

McNeill spoke to the challenges the National Guard faced during their humanitarian relief operations post Hurricane Katrina. On the ground, the Guard was unable to talk with the local first responders because they did not have cross-banding communication systems.

“We learned from that experience that we’ve got to think out of the box,” McNeill said. “We’ve got to look at capabilities that can talk to first responders and focus on what we do in the homeland.”

This year’s $1.5 trillion omnibus spending package includes an unprecedented budget increase for the Cybersecurity and Infrastructure Security Agency, as well as tightened cyber incident reporting requirements for sectors like transportation and energy.

To build cyber resilience in this heightened threat environment, agencies must work closely with both international counterparts and industry to align on a proactive, global approach to all cyber threats –– not just state-sponsored attacks. That means understanding the threat landscape, shoring up critical infrastructure and developing a plan to coordinate well before attacks happen.

Understanding an increasingly turbulent cyber threat landscape

In general, the massive state-sponsored cyberattacks many analysts expected on critical infrastructure in Ukraine and elsewhere have yet to materialize. Still, the conflict has given rise to a complex and shadowy landscape of citizen cyber hacktivists, vigilantes and criminal groups taking advantage of the crisis to steal money and working as potential proxies for state actors.

Chatter within ransomware groups indicates some threat actors are siding with Russia, some with the West and some are simply using the theater of war as a smokescreen to facilitate cybercrime. FortiGuard Labs researchers also identified email phishing scams perpetrated by opportunistic criminals posing as trusted organizations like the United Nations to fraudulently solicit donations and potentially infect devices.

History shows the potential for outsized impact when the tools of cyber conflict inevitably proliferate. In 2017, for example, the NotPetya ransomware initially was launched in the update servers for accounting software in Ukraine but quickly and predictably spread worldwide, affecting even large and well-prepared firms and causing an estimated $10 billion in damage.

Many analysts believe that despite having some of the surface charactaristics of ransomware, NotPetya was intended from the outset to be destructive, rather than a tool for criminal profit. And as the conflict in Ukraine continues, threat researchers are encountering increasing amounts of “wiperware”––malicious software designed to disrupt operations or delete data.

Shoring up critical infrastructure

Within the United States, new investments in cybersecurity from both the omnibus bill and the Infrastructure Investment and Job Act offer a unique opportunity to help mitigate the risk of both state-sponsored and criminal cyberattacks on critical infrastructure.

Recent CISA guidance emphasizes the vital importance of including cybersecurity in the design of new infrastructure projects, regardless of the sector or the size of the organization. This is where national cybersecurity becomes a state and local issue as well. This summer, CISA is expected to issue guidelines to help mayors and governors utilize the law’s $1 billion cyber grant program dedicated to building cyber maturity at the state and local level. However, if we spent only $1 billion on cybersecurity out of a $1.2 trillion total, we would be woefully underinvesting in cybersecurity and resilience.

For those state and local governments, it’s better to build in cyber protocols now as the infrastructure upgrades are being planned and implemented than trying to chase down vulnerabilities as they’re being exploited.

Coordinating across borders and sectors

In addition to fortifying our defenses domestically, slowing the success of malicious cyber actors will require robust cooperation beyond our borders, as well collaboration with the private sector.

That means more information sharing before, during and after attacks. President Biden even went so far as to write guidelines into his 2021 cyber executive order, ensuring that IT services providers be able to share information with the government as a whole and require them to share certain breach information. And the recently enacted Cyber Incident Reporting for Critical Infrastructure Act requires that critical infrastructure providers notify CISA of any significant cyber incident within 72 hours or any ransomware payment within 24 hours.

Internationally, governments and the private sector should be aligning cyber defense and mitigation playbooks among NATO allies—a critical first step to mitigate the risk of burgeoning threats. Beyond that, multilateral organizations such as the World Economic Forum Centre for Cybersecurity could convene global public-private partnerships to encourage information-sharing and the development of cyber norms.

This is just a taste of what we’ll need to do in the coming months and years, but it’s a good start.

Delivering more effective cybersecurity to protect our nation’s networks is a complex challenge –– one that will require governments and industry to work together effectively to confront. Progress is necessary and it will take an effort of allies. No single government or organization or cybersecurity vendor can take this on alone.

Jim Richberg is public sector field CISO at Fortinet. He formerly served as the national intelligence manager for cyber in the Office of the Director of National Intelligence, where he set national cyber intelligence priorities.

Concerns about cybersecurity threats posed by foreign adversaries were on the rise even before the conflict. According to the 2022 SolarWinds Public Sector Cybersecurity Survey Report, 56% of federal IT operations and security decision-makers state foreign governments are now one of the top security threats, along with the general hacking community and untrained insiders.

To combat these threats, protect American critical infrastructure and safeguard personal information, the federal government is actively seeking to strengthen its cybersecurity workforce. Agencies must find innovative ways to compete with lucrative private sector positions to do so, but it’s a perpetual challenge. In recent years, many federal agencies have seen their pool of cyber talent shrink.

Here are some best practices federal agencies can implement to better attract and retain a federal cybersecurity workforce.

Make a Case for a Rotational Cyber Workforce Program

On June 21, President Joe Biden signed the Federal Rotational Cyber Workforce Program Act into law, offering agencies a practical solution to the cyber staffing crisis—if they act proactively.

Under this new law, the Office of Personnel Management must establish a cross-agency rotational workforce development program allowing employees to work outside a single position within a single public office. The idea is that as cybersecurity professionals move across departments, agencies will benefit from knowledge transfer and collaborative efforts to address advanced threats.

The program could also be used as a recruitment and retention tool. In theory, cybersecurity professionals will gain substantial experience across different departments, enhancing career opportunities and facilitating the expansion of each person’s professional network.

The program will be open to IT, cybersecurity, and cyber-related functions. The OPM will be charged with developing policies, processes, and procedures for detailing employees among rotational positions.

Therefore, it behooves IT and security leaders to make a case for their agencies’ participation and eligibility for the program sooner rather than later.

Address the Soft Skills Gap

Today’s cybersecurity professionals have a broad range of responsibilities. In addition to technical ability, they’re often called on to display nontechnical skills. For instance, they may be required to make a business case for IT investments, resource allocation, and new risk reduction strategies. They must also collaborate and share best practices within the federal government and industry.

Unfortunately, these “soft” or “people” skills are rarely sought or fostered within the federal cybersecurity workforce. As agencies enter a new paradigm of cyber risk, they must do everything they can to address this gap and ensure employees have the soft skills to adapt quickly and easily to the future of cybersecurity and succeed in a federal career. Indeed, strengthening and empowering the high-tech federal workforce is a key goal of the Biden administration’s management agenda.

For instance, strong communication skills are essential to ensuring teams understand the criticality of a project. Each stakeholder must appreciate the technical goals of any cybersecurity initiative and how it relates to the agency’s mission and convey all this in nontechnical terms (i.e., speak “the language of the business”). This is especially important if a project impacts many staffers and cyber professionals are called on to gain broader buy-in from the rest of the agency.

Collaboration is also vital. No agency works in a vacuum, and different groups must work together to share intelligence and accelerate efforts to lock their digital doors.

Adaptability is another crucial soft skill. Change is constant in today’s world, and the pressures on federal cyber pros have been unrelenting over the past few years. After successfully helping the federal government pivot to ensure secure remote work policies, many are hoping for a return to normal. But once again, society is at an inflection point, and there’s no room for overconfidence or security apathy.

The ability to function in this ever-changing environment is becoming increasingly important. Federal cyber pros must be able to shift their thinking quickly and be willing to embrace—and thrive through—change.

Communication, collaboration and adaptability will take on new significance with the recent implementation of the Federal Rotational Cyber Workforce Program Act. As such, IT and security leaders must revisit their job requirements (even for the most technical staffers) and prioritize skills development with strategic training opportunities capable of bringing value to the organization and the workforce—and time is of the essence.

Brandon Shopp is Group Vice President, Product Strategy, at SolarWinds, a supplier of network and systems management software.

The new board is modeled after the National Transportation Safety Board, which reviews plane crashes and other major accidents, and was mandated by an executive order President Joe Biden signed last May. Some supporters of the new board have criticized DHS for taking so long to get it up and running.

Department of Homeland Security Secretary Alejandro Mayorkas said the board will have 15 members and will be a mix of public and private officials.

Robert Silvers, a top DHS policy official, will be the new board’s chairman. And Heather Adkins, a senior director at Google, will be the deputy chair. New board members include officials from the FBI, NSA and Defense Department, as well as Verizon and Microsoft.

The board’s first review will be of the log4j vulnerability, a flaw first made public in December that lets internet-based attackers easily seize control of everything from industrial control systems to web servers and consumer electronics.

Biden’s executive order directed the board to conduct its first review on the massive Russian cyber espionage campaign known as SolarWinds, but DHS said it and the White House now agree that reviewing the log4j incident is the best use of the new board’s expertise.

The speech at the Ronald Reagan Presidential Library amounted to a stinging rebuke of the Chinese government just days before Beijing is set to occupy the global stage by hosting the Winter Olympics. It made clear that even as American foreign policy remains consumed by Russia-Ukraine tensions, the U.S. continues to regard China as its biggest threat to long-term economic security.

“When we tally up what we see in our investigations, over 2,000 of which are focused on the Chinese government trying to steal our information or technology, there’s just no country that presents a broader threat to our ideas, innovation, and economic security than China,” Wray said, according to a copy of the speech provided by the FBI.

The bureau is opening new cases to counter Chinese intelligence operations every 12 hours or so, Wray said, with Chinese government hackers pilfering more personal and corporate data than all other countries combined.

“The harm from the Chinese government’s economic espionage isn’t just that its companies pull ahead based on illegally gotten technology. While they pull ahead, they push our companies and workers behind,” Wray said. “That harm — company failures, job losses — has been building for a decade to the crush we feel today. It’s harm felt across the country, by workers in a whole range of industries.”

Chinese government officials have repeatedly rejected accusations from the U.S. government, with the spokesman for the embassy in Washington saying last July that Americans have “made groundless attacks” and malicious smears about Chinese cyberattacks. The statement described China as a “staunch defender of cybersecurity.”

The threat from China is hardly new, but it has also not abated over the last decade.

“I’ve spoken a lot about this threat since I became director” in 2017, Wray said. “But I want to focus on it here tonight because it’s reached a new level — more brazen, more damaging, than ever before, and it’s vital — vital — that all of us focus on that threat together.”

The Justice Department in 2014 indicted five Chinese military officers on charges of hacking into major American corporations. One year later, the U.S. and China announced a deal at the White House to not steal each other’s intellectual property or trade secrets for commercial gain.

In the years since, though, the U.S. has continued to level accusations against China related to hacking and espionage. It’s charged Chinese hackers with targeting firms developing vaccines for the coronavirus and with launching a massive digital attack of Microsoft Exchange email server software, and also blacklisted a broad array of Chinese companies.

In his speech, Wray highlighted as an example the case of a Chinese intelligence officer who was convicted last November of economic espionage for targeting an advanced engine by GE that Chinese state-owned enterprises were working to copy.

But there have also been some setbacks. Though the FBI director mentioned Monday night that the bureau was working to protect academic research and innovation at American colleges and universities, he did not discuss the much-criticized China Initiative.

That Justice Department effort was created in 2018 to counter economic espionage and to protect against research theft, but critics have accused investigators of scrutinizing researchers and professors on the basis of ethnicity and of chilling academic collaboration. Earlier this month, prosecutors dropped a fraud case against a Massachusetts Institute of Technology professor, saying they could no longer meet their burden of proof.

The department is in the process of reviewing the fate of the China Initiative, and expects to announce the results soon.

On the video, there were shout-outs for a new custodian for his hard work, and the typical announcements from administrators and the union rep. But in the chat, there were hints of a looming crisis. Nobody could open attendance records, and everyone was locked out of class rosters and grades.

Albuquerque administrators later confirmed the outage that blocked access to the district’s student database — which also includes emergency contacts and lists of which adults are authorized to pick up which children — was due to a ransomware attack.

“I didn’t realize how important it was until I couldn’t use it,” said Sarah Hager, a Cleveland Middle School art teacher.

Cyberattacks like the one that canceled classes for two days in Albuquerque’s biggest school district have become a growing threat to U.S. schools, with several high-profile incidents reported since last year. And the coronavirus pandemic has compounded their effects: More money has been demanded, and more schools have had to shut down as they scramble to recover data or even manually wipe all laptops.

“Pretty much any way that you cut it, incidents have both been growing more frequent and more significant,” said Doug Levin, director of the K12 Security Information Exchange, a Virginia-based nonprofit that helps schools defend against cybersecurity risk.

Precise data is hard to come by since most schools are not required to publicly report cyberattacks. But experts say public school systems — which often have limited budgets for cybersecurity expertise — have become an inviting target for ransomware gangs.

The pandemic also has forced schools to turn increasingly toward virtual learning, making them more dependent on technology and more vulnerable to cyber-extortion. School systems that have had instruction disrupted include those in Baltimore County and Miami-Dade County, along with districts in New Jersey, Wisconsin and elsewhere.

Levin’s group has tracked well over 1,200 cyber security incidents since 2016 at public school districts across the country. They included 209 ransomware attacks, when hackers lock data up and charge to unlock it; 53 “denial of service” attacks, where attackers sabotage or slow a network by faking server requests; 156 “Zoombombing” incidents, where an unauthorized person intrudes on a video call; and more than 110 phishing attacks, where a deceptive message tricks a user to let a hacker into their network.

Recent attacks also come as schools grapple with multiple other challenges related to the pandemic. Teachers get sick, and there aren’t substitutes to cover them. Where there are strict virus testing protocols, there aren’t always tests or people to give them.

In New York City, an attack this month on third-party software vendor Illuminate Education didn’t result in canceled classes, but teachers across the city couldn’t access grades. Local media reported the outage added to stress for educators already juggling instruction with enforcing COVID-19 protocols and covering for colleagues who were sick or in quarantine.

Albuquerque Superintendent Scott Elder said getting all students and staff online during the pandemic created additional avenues for hackers to access the district’s system. He cited that as a factor in the Jan. 12 ransomware attack that canceled classes for some 75,000 students.

The cancellations — which Elder called “cyber snow days” — gave technicians a five-day window to reset the databases over a holiday weekend.

Elder said there’s no evidence student information was obtained by hackers. He declined to say whether the district paid a ransom but noted there would be a “public process” if it did.

Hager, the art teacher, said the cyberattack increased stress on campus in ways that parents didn’t see.

Fire drills were canceled because fire alarms didn’t work. Intercoms stopped working.

Nurses couldn’t find which kids were where as positive test results came in, Hager said. “So potentially there were students on campus that probably were sick.” It also appears the hack permanently wiped out a few days worth of attendance records and grades.

Edupoint, the vendor for Albuquerque’s student information database, called Synergy, declined to comment.

Many schools choose to keep attacks under wraps or release minimal information to prevent revealing additional weaknesses in their security systems.

“It’s very difficult for the school districts to learn from each other, because they’re really not supposed to talk to each other about it because you might share vulnerabilities,” Elder said.

Last year, the FBI issued a warning about a group called PYSA, or “Protect Your System, Amigo,” saying it was seeing an increase in attacks by the group on schools, colleges and seminaries. Other ransomware gangs include Conti, which last year demanded $40 million from Broward County Public Schools, one of the nation’s largest.

Most are Russian-speaking groups that are based in Eastern Europe and enjoy safe harbor from tolerant governments. Some will post files on the dark web, including highly sensitive information, if they don’t get paid.

While attacks on larger districts garner more headlines, ransomware gangs tended to target smaller school districts in 2021 than in 2020, according to Brett Callow, a threat analyst at the firm Emsisoft. He said that could indicate bigger districts are increasing their spending on cybersecurity while smaller districts, which have less money, remain more vulnerable.

A few days after Christmas, the 1,285-student district of Truth or Consequences, south of Albuquerque, also had its Synergy student information system shut down by a ransomware attack. Officials there compared it to having their house robbed.

“It’s just that feeling of helplessness, of confusion as to why somebody would do something like this because at the end of the day, it’s taking away from our kids. And to me that’s just a disgusting way to try to, to get money,” Superintendent Channell Segura said.

The school didn’t have to cancel classes because the attack happened on break, but the network remains down, including keyless entry locks on school building doors. Teachers are still carrying around the physical keys they had to track down at the start of the year, Segura said.

In October, President Joe Biden signed the K-12 Cybersecurity Act, which calls for the federal cyber security agency to make recommendations about how to help school systems better protect themselves.

New Mexico lawmakers have been slow to expand internet usage in the state, let alone support schools on cyber security. Last week, state representatives introduced a bill that would allocate $45 million to the state education department to build a cybersecurity program by 2027.

Ideas on how to prevent future hacks and recover from existing ones usually require more work from teachers.

In the days following the Albuquerque attack, parents argued on Facebook over why schools couldn’t simply switch to pen and paper for things like attendance and grades.

Hager said she even heard the criticism from her mother, a retired school teacher.

“I said, ‘Mom, you can only take attendance on paper if you have printed out your roster to begin with,’” Hager said.

Teachers could also keep duplicate paper copies of all records — but that would double the clerical work that already bogs them down.

In an era where administrators increasingly require teachers to record everything digitally, Hager says, “these systems should work.”

Associated Press writers Michael Melia in Hartford, Connecticut, and Alan Suderman in Richmond, Virginia, contributed to this report.

Attanasio is a corps member for the Associated Press/Report for America Statehouse News Initiative. Report for America is a nonprofit national service program that places journalists in local newsrooms to report on under-covered issues. Follow Attanasio on Twitter.

The alert, sent out by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, the Internal Revenue Service, the Department of the Treasury, and the U.S. Secret Service, said the federal government “continues to encounter” attempts by cybercriminals to steal personal or banking information using coronavirus-related lures through email or text.

The joint alert warns that “at a minimum” criminals will use phishing emails or scam websites exploiting the CARES Act — a $2 trillion aid package that provided direct financial relief to taxpayers and businesses — to trick financial institutions and their customers into providing private information.

“Themes for these scams might include economic stimulus, personal checks, loan and grant programs, or other subjects relevant to the CARES Act,” the alert read. “These CARES Act-related cybercriminal attempts could support a wide range of follow-on activities that would be harmful to the rollout of the CARES Act.”

The CARES Act sent $1,200 nontaxable payments to millions of taxpayers and provided billions of dollars in loans to small businesses.

The four agencies also warned of adversaries and criminals attempting to disrupt the operations of organizations implementing parts of the CARES Act. To combat the threat, the agencies recommend that government agencies and financial institutions initiate a “comprehensive security review” of critical systems.

According to the alert, the federal government and international partners have increased sharing threat intelligence and best practices with industry in response to the virus-related threats. The Secret Service is investigating malicious actors and will try to recover funds that are stolen as a result of their activity, it said.

“These investigations will include actions over the near term, but also in the coming months and years to hold criminals accountable and recover assets,” the alert read.

CISA, the federal agency under the DHS tasked with protecting critical infrastructure and federal networks from cyberattacks, has issued several alerts in recent weeks during the COVID-19 pandemic. In an April alert, CISA and the National Cyber Security Centre in the United Kingdom sent an alert warning of coronavirus-related phishing attempts.

In early May, CISA and the NCSC again issued a joint alert warning of “large-scale” malicious password-spraying campaigns targeting health care organizations and medical research groups.