NJOHSP Director Testifies Before Senate Budget Committee; Increased Adoption of IPFS Observed in Phishing Emails; Maine the Latest State to Seek Tougher Penalties for Swatting

New Jersey Office of Homeland Security and Preparedness Director Laurie Doran appeared before the State Senate Budget and Appropriations Committee hearing April 4 in support of New Jersey Attorney General Matthew Platkin, who addressed the Law and Public Safety Department’s budget needs for the upcoming fiscal year. Director Doran provided information regarding NJOHSP’s various grant programs, including the State’s newest Reproductive Health Security Grant Program and its ongoing New Jersey Nonprofit Security Grant Program, noting ample participation within the NJ NSGP. Director Doran also discussed the agency’s recently released 2023 Threat Assessment and NJOHSP’s strategies for deterring extremist attacks. Regarding the committee’s current appropriation of $8.6 million for cybersecurity initiatives, Director Doran noted that the funding level is sufficient, but added that the agency may consider requesting additional appropriations in the future for new initiatives. “Right now, we are trying to be good fiscal stewards of our funding,” she said during her testimony to committee members. Director Doran concluded her testimony by discussing one of State's newest initiatives – the New Jersey Statewide Threat Assessment Team, NJ-STAT, a collaborative effort among NJOHSP and state agencies to recognize and respond to incidents of potential targeted violence, predominantly in school settings, by creating off-ramps to mental health and other services.

The New Jersey Cybersecurity and Communications Integration Cell observed a high volume of phishing emails attempting to harvest credentials or deliver malware by abusing the Interplanetary File System and other Web3 technologies. The phishing emails include typical phishing red flags and an IPFS file link (1, 2) that redirects recipients to various web pages where hackers will attempt to harvest credentials, steal funds or deliver malware. Analysts assess that this activity will continue to increase due to its resiliency against content moderation, ease of use, obscured attribution and reduced cost to the threat actor. The NJCCIC advises users to refrain from clicking on links in unexpected emails. Threat actors may impersonate well-known services and hosting providers; therefore, the NJCCIC encourages users to verify a website's legitimacy before entering login credentials and enable multifactor authentication where possible. Additionally, if IPFS is not used in the organization, administrators should consider flagging user access to IPFS gateways as atypical. More information, including indicators associated with this campaign, is available on the NJCCIC’s website.

In response to fake reports of active shooters at 10 high schools throughout the state last fall, a Maine legislative committee unanimously approved a bill March 29 making swatting – the intentional triggering of an armed police response and lockdown of a school, place of assembly, building or public space – a felony offense, according to media reports. The vote came a week after emotional testimony from individuals who experienced school lockdowns and evacuations, including teachers, students and public safety officials who said the calls tied up valuable public safety resources and prompted hospital staff to relocate patients to make room for possible gunshot victims. The legislation calls for a maximum five-year jail sentence and a $20,000 fine. Police have not arrested anyone in connection with the incidents, which remain under investigation. Virginia and Ohio also recently enacted swatting laws in March and January, respectively, joining New Jersey, Pennsylvania, California and Texas as other states where the act is now illegal. Lawmakers in New Jersey enacted a law in 2015 criminalizing swatting and, in September 2020, expanded on it by classifying false reports as hate crimes when the act is racially motivated or when it stems from other biases against protected groups.