National Guard Cyber Units Aid Ransomware Response in Multiple States

Minnesota called in its National Guard last month after a ransomware attack struck Winona County. The county had experienced a prior cyberattack three months earlier. Officials authorized the state's National Guard cyber protection team to support incident response efforts and ensure continuity of municipal operations.

The April 6 attack caused significant disruptions and impaired the county's ability to provide vital emergency and critical services, according to the governor. Local personnel and commercial cybersecurity firms could not contain the incident. The FBI is investigating the attack, though its role does not include system recovery and rebuilding.

As a result, the Minnesota National Guard deployed 15 soldiers from its cyber protection team. This marked the second such cyber response by the unit in less than a year. In July of the previous year, the team assisted St. Paul after a cyberattack that shut down first responders' dispatch systems for ambulances, police vehicles and firetrucks.

Those systems remained offline for a week. Recovery took months even with National Guard support. The National Guard's resources and qualifications have enabled similar assistance in other states.

In 2019, a large-scale ransomware attack hit 54 schools in Louisiana. After a state of emergency was declared, the Louisiana National Guard's cyber team responded and recovered the school systems within two weeks. The effort also mitigated attacks on additional schools across the state.

One month later, 22 counties in Texas were affected by a ransomware incident that disrupted local services and financial operations. Problems included utility payments and access to birth and death certificates. The mayor of one affected city stated that just about everything at city hall was impacted.

The scope exceeded local IT capabilities, prompting 40 members of the Texas National Guard's cyber unit to assist. National Guard units are uniquely positioned for such missions because their members often remain in their communities for long periods, unlike active-duty personnel who rotate every two to four years.

This helps bridge gaps between industry and government. However, not every state maintains a National Guard cyber unit, and existing units have varying capabilities. Virginia operates the 91st Cyber Brigade, a 1,000-person unit that conducts annual exercises to test state cyber response plans.

Montana recently appointed its first cyber warfare officer. Standardized training and formal certification for all National Guard cyber protection teams could help address these differences.