Suffolk lawmakers kill cybersecurity bill, ban sale of vaping pens in disguise

Suffolk County lawmakers on Tuesday killed a measure to consolidate cybersecurity across departments as outgoing County Executive Steve Bellone made a rare appearance at their meeting to urge its approval.

The legislation sought to define the powers of the Office of the Chief Information Security Officer, a position Bellone's administration filled in May following a widespread cyberattack discovered in September 2022. Under the bill, the officer would oversee cybersecurity policy and compliance for all departments and submit a twice annual report with an “overall compliance risk score." 

The legislation also directed technology personnel across county departments to meet at least once per month to discuss cybersecurity. The systems are segregated, with the county's main Department of Information Technology controlled by the Bellone administration, and independent sub-networks under elected officials such as the county clerk and sheriff.

Bellone, a Democrat who is term-limited and leaves office at the end of the year, took the podium and urged the Republican-controlled legislature to pass the resolution. Bellone has said it would help the county obtain a cyber insurance policy, which it did not have at the time of the attack and still does not have.

“This is the most important thing that you can do to secure the county's IT future moving forward,” Bellone said.

The legislature, meeting for the final time this year, voted along party lines to table the measure.

County Clerk Vincent Puleo, Comptroller John Kennedy and representatives of Sheriff Errol Toulon and District Attorney Ray Tierney urged a legislative committee last week to reject the measure on the basis it would threaten their departments' autonomy.

Allen L. Bode, chief assistant district attorney, said the transition team of County Executive-elect Ed Romaine, a Republican, wasn’t consulted about the bill. He called it “inappropriate” to introduce it in the last few weeks of the Bellone administration.

Bode noted the legislature has passed a resolution requiring the county IT department to study separate “tenancies,” or restricted domains, for the district attorney's office that would ensure emails and related files could not be accessed by county IT staff.

“Right now, the county IT, if they wanted to, could go and look at the district attorney’s email,” Bode said. “They could look at the presiding officer’s email. They could look at the sheriff’s email. We need those separate tenancies. The resolution as currently drafted doesn’t account for those issues. And we need to account for those issues.”

Legis. Anthony Piccirillo (R-Holtsville), who chairs a legislative committee probing the source of the hack, said Tuesday the legislature should “make no move until this investigation is completed.”

Legis. Tom Donnelly (D-Deer Park) countered: “We want to pass a healthy IT infrastructure on to the next administration.”

Bellone on Tuesday again blamed the county clerk’s office and its IT director, Peter Schlussler, for failing to patch a security breach in the clerk’s network, which Bellone said led to the attack. Schlussler was put on paid leave after it was discovered. 

Last week, as Bellone ended a 16-month state of emergency declaration tied to the attack, he ordered Schlussler to return to work.

Schlussler, who did not return a call seeking comment, has testified the county missed numerous opportunities to prevent the hack months before it happened and blamed the lack of a chief information security officer as a root cause.

Also Tuesday, lawmakers unanimously approved a measure sponsored by Legis. Jim Mazzarella (R-Moriches) that bans the sale of vaping products disguised as school supplies and personal items. Bellone spokeswoman Marykate Guilfoyle said he plans to sign it.

By Vera Chinese

vera.chinese@newsday.com@VeraChinese

Vera Chinese joined Newsday in 2017 after working as an editor for the East End lifestyle publication northforker and a general assignment reporter for the New York Daily News.