How Often Does the National Guard Respond to Cyberattacks?

Based on publicly available information, governors activated the National Guard at least 41 times since 2018 to provide cybersecurity-related support to state and local governments. To respond to the increase of cyber attacks on public entities, governors have the authority to activate and pay the National Guard to provide response and remediation of cyber incidents; cyber defense analysis; cyber incident response planning; and security planning, threat assessment, and interagency planning.¹ The National Guard therefore plays an essential role in augmenting state and federal resources to prepare for, respond to, and recover from cyber attacks.²

The SamSam ransomware attack on Colorado’s Department of Transportation in February of 2018 marks the first reported case in which the National Guard was called in to respond to a cyber attack. From the reported cases we found, 2020 had the highest recorded number of reported cases with activations—mainly to protect election systems prior to the 2020 elections—with 2021 only having two activations thus far.

27 states activated (24 states were accounted for in this study) the National Guard at least once to either provide cybersecurity support to the state’s election efforts or to respond to a cyber attack.³ North Carolina had the highest number of activations with eight, followed by Louisiana with four.

We found that governors mainly called on the National Guard to address ransomware attacks. Just over half of the reported cases were for such attacks (23) with 17 cases for election security support and one case that served as a hybrid of the two categories. Of those 23 ransomware attacks, eight targeted local government entities, making it the most targeted category of this study. The only other category to have more than five such cases were attacks on public school systems (7).

Note: This map was created based on publicly available information and will be updated periodically.