A Cyberattack Could Make N.Y. State’s Late Budget Even Later

First it was an earthquake, then an eclipse. What else could throw a wrench into the works of New York’s budget process?

A cyberattack.

The early-morning attack affected the New York State Bill Drafting Commission, a little-known legislative agency responsible for writing and printing bills — temporarily disabling a critical system as the Legislature and the governor move closer to a full agreement on the state budget, now 16 days late.

Gov. Kathy Hochul said that the attack was expected to slow down the process on the legislative side, adding that it would force the state to dust off computer systems from the early ’90s.

“We have to go back to the more antiquated system we had in place from 1994,” Ms. Hochul said in an interview with Brian Lehrer on WNYC. She said it was too soon to determine whether the attack had been politically motivated, adding that the state’s cybersecurity team was scrutinizing it.

But representatives for the State Legislature seemed less concerned that the attack would be disruptive, stressing that staff were continuing to work regularly with both houses even as they sought to resolve the issue.

“Nothing is delayed,” said Mike Whyland, a spokesman for the Democratic majority in the State Assembly.

When asked to clarify the governor’s remarks, a spokesman, Avi Small, said the administration would not comment further on an “ongoing investigation.”

Sanjay Goel, a professor of Information Security and Digital Forensics at the University at Albany, said that there are often two motivations behind these kinds of attacks: disrupters just looking to cause chaos or nation states that wished to directly interfere in the democratic process.

“The question is who is attacking them and why and what the extent of damage is,” Dr. Goel said. “From what I can see, this was designed just to pull them offline and delay this process.”

Dr. Goel said that those chaos agents could have been scanning any system for any vulnerability to exploit, while a nation state, like China, Russia or Iran, would have specifically targeted New York and waited for a weakness to arise before capitalizing on it.

News of the cyberattack ricocheted through the State Capitol Wednesday morning, drawing considerable speculation as to what it might mean, and who was behind it.

“This is like the Albany game of Clue!” said Blair Horner, a legislative director for a watchdog group and longtime Albany observer. “It could be anyone who doesn’t like how the budget is going. Or it could be Russia!”

The attack comes just days after leaders in Albany reached a tentative deal on a more than $237 billion state budget that is said to include more money for Medicaid, a housing deal and authority to crack down on unlicensed cannabis vendors.

Dr. Goel said he had not heard of a similar attack on a state legislature before. In an election year, he added, these kinds of attacks should only be expected to increase.

“We are under constant threat,” Dr. Goel said, before noting that most local and state governments have braced ourselves pretty well. But, he added, “you never know.”