House committee debates $10 million cybersecurity fund, votes to hold bill one week

Representative Wendy Horman, R‑District 32 of Bonneville County, introduced House Bill 168 on behalf of the Office of Information Technology Services (ITS), saying the bill would create a cybersecurity and resiliency fund to pay for critical hardware and related software replacements and centralize security spending.

"We need to protect citizen data and we need to protect state infrastructure," Director Alberto Gonzales told the committee, adding that Idaho faces frequent cyber attempts and that the fund would support “critical hardware replacement and all of the associated software that is needed to protect that cyber, to protect that equipment and our network and our citizen data.”

The bill would establish an ongoing funding source to cover periodic replacement of routers, firewalls, switches, servers, wireless access points, endpoint devices and some software. Gonzales and department staff said the fund would be overseen and managed by ITS and that annual reporting and accountability language in the bill would show how funds are spent.

Why it matters: witnesses described repeated cyberattacks on state systems and said legacy equipment that exceeds its secure life cycle increases risk. Gonzales told the committee that in the last six months the state saw “over 100,000,000 attempts at our firewall,” more than 14 million users attacked, 20,000 endpoint devices targeted and roughly 19,000,000 malicious emails stopped. He said the state experienced a near‑catastrophic event last year tied to legacy hardware that was not replaced.

Committee debate focused on two main points: how much money to authorize and the bill’s continuous appropriation language. The bill proposes a base planning figure of $10,000,000 per year for the fund. ITS staff said that replacing only items classified as critical across ITS and agencies is closer to $15,000,000 a year and that a strict five‑year replacement cycle would bring the estimate to about $20 million to $25 million annually. Staff also said many agencies did not request all critical replacements in their budgets this year, creating gaps the bill aims to cover.

Several members raised concerns about oversight if the fund is continuously appropriated rather than requiring an annual appropriation for each project. Representative Petzke said she was "always concerned when we are losing our oversight and control over a big pot of money." Lori Wolfe, identified in testimony as Division of Financial Management staff, and Gonzales said the fund would follow a review process similar to the Permanent Building Fund: agencies and ITS would prioritize projects, the Idaho Technology Authority would review, and the committee would receive a report and visibility — including a five‑year plan and an annual project list — before expenditures were made. Wolfe also acknowledged drafting confusion in the fiscal note and answered that the intent was to build the funding into the base rather than use an ongoing cash transfer language.

Representative Tanner moved to send House Bill 168 to the floor with a due‑pass recommendation. Representative Manwaring offered an amended motion to hold the bill in committee for one week (until Wednesday, March 5) to allow staff to provide additional numbers and documentation. The amended motion carried on a voice vote; the committee chair announced, "Aye. Opposed, nay. Motion carried."

Next steps: committee members asked ITS and DFM staff for a detailed inventory, a five‑year replacement plan, and a clearer fiscal note showing what agencies requested this year and the remaining gaps. Committee members stated they expect to reconsider the bill when the requested materials are provided.

Quotes in this article are taken from committee testimony and attributed to the speakers who made them during the hearing.