BB2G BB2G Data Resilience
Five-State Stakeholder Proposal · October 2026

BB2G Data Resilience

Sovereign State Infrastructure for the Plains

A threat map and countermeasure plan for the counties, courts, schools and election offices of five states, built from public records and sourced line by line.

NebraskaIowaKansasSouth DakotaWyoming
Kristen Hall Maghuyop, Founder & ArchitectBorn Between 2 Generals LLCPrepared October 27, 2026
Act I · Shared reality

Three weeks ago, one stolen password closed a courthouse.

On October 9, 2026, an intrusion through a single employee password took down the City of North Platte and Lincoln County networks. The courthouse and county offices closed. Nebraska's governor declared an emergency and sent in the Guard's Cyber Protection Team.[1][2] It is the latest of 36 documented incidents we mapped across these five states since 2019, and it fits the pattern: small offices, shared systems, one weak link.

386
counties across the five states
323 of them (84%) are nonmetro[3]
6.4M
registered voters
Latest Secretary of State counts, 2025–2026[4][5][6][7][8]
168
counties without a county-government .gov domain
44% of all counties[9]
$392M
reported internet-crime losses in 2025
Sum of FBI IC3 state figures for NE, IA, KS, SD, WY[10]

Most of these counties run elections, courts, property records and 911 with a handful of staff and no dedicated security team. Meanwhile the federal backstop they relied on has thinned. The free state-and-local threat-sharing center lost its federal funding in September 2025,[11] and three in four local election officials say nothing has replaced the cuts.[12]

Act II · How the threat works

Six mechanics behind almost every incident

These are the mechanics, not headlines. Each card says how the attack works, what it costs, and where it has already happened on the Plains.

Ransomware & extortion

Critical

Criminals encrypt systems and steal data, then go after the backups so recovery is impossible without paying.

  • 34% of state and local governments were hit in a year; average recovery cost $2.83M. Attackers tried to compromise backups in 99% of attacks, and half of those attempts succeeded.[13]
  • Government ransomware causes about 28 days of downtime on average.[14]
  • Kansas courts: 104 of 105 counties disrupted for 5+ weeks.[15][16] Pennington County, SD closed most offices in July 2026.[17]

Stolen credentials & payment fraud

Critical

One phished password or one spoofed vendor email lets an outsider act as an insider, with no malware needed.

  • North Platte–Lincoln County, Oct 2026: a stolen employee password.[2]
  • Tripp County, SD auditor lost $826,357 to a spoofed vendor email;[18] Broken Bow, NE schools sent $1.8M to fraudsters.[19]
  • IC3 complaints passed 1 million in 2025, with $20.9B lost nationwide.[20]

Vendor & supply-chain breaches

Critical

A breach at one software vendor exposes thousands of public bodies at once, and none of them can patch it themselves.

  • PowerSchool (Dec 2024): 62.4M students and 9.5M teachers exposed, including Wyoming districts.[21]
  • Canvas (May 2026): Iowa universities and K-12 student data.[22] Wyoming courts' records vendor breached in 2026.[23]
  • Change Healthcare (Feb 2024) stalled Nebraska hospitals' billing and authorizations.[24]

Nation-state pre-positioning

High

Foreign state actors quietly hold access to utilities and telecom so they can disrupt operations during a crisis.

  • Volt Typhoon held access in US water, energy and transport systems for at least five years.[25]
  • Salt Typhoon reached 600+ organizations in 80 countries, mainly telecom.[26]
  • An attempted intrusion on Rapid City wastewater monitoring was contained in July 2026 (not publicly attributed).[27]

The federal support gap

High

Free federal monitoring, intel sharing and grants are shrinking or expiring just as attacks on local government rise.

  • CISA lost about a third of its staff in 2025;[28] election-specific CIS funding was cut in March 2025.[29]
  • MS-ISAC moved to paid membership after federal funding ended in Sept 2025.[11]
  • The 2015 information-sharing law runs only to Dec 11, 2026.[30] The State and Local Cybersecurity Grant Program was extended to Jan 30, 2026; its status since is unconfirmed.[31]

AI-enabled deception & outages

Elevated

Cheap AI makes convincing phishing, cloned voices and look-alike sites. Meanwhile, single-provider outages take whole services offline.

  • FBI and CISA warned election officials of AI-powered phishing on Oct 16, 2026.[32] About 4,000 new "vote" domains were registered in one month this spring (registration alone is not proof of intent).[33]
  • The July 2024 CrowdStrike update took down election databases and DMV offices in several states.[34]
  • AWS us-east-1 (Oct 20, 2025) and Azure Front Door (Oct 29, 2025) outages hit government sites.[35][36]
Act II · Where it lands

The five-state threat map

All 386 counties, colored by the layer you choose, with 36 documented incidents (red) and 16 major data centers and archives (blue) placed where they happened. Pick a state to zoom in. Click a county or a marker for the record and its source.

Documented incidentData center / archive

Act II · State by state

Five states, five starting points

All five already use paper ballots and post-election audits, which is a strong base. The gaps are in the systems around the ballot: county networks, vendors, courts, payments and records.

Nebraska

1,258,000
Registered voters (Aug 2026)[4]
93
Counties · 82 nonmetro[3]
$71.8M
Reported internet-crime losses, 2025 (3,724 complaints)[10]
21 of 93
Counties without a county-government .gov domain[9]
16
Counties scoring 3 of 3 on the exposure indicator
$3.89M
Federal cyber grant (SLCGP), FY2024[37]
Ballots
Paper ballots; ExpressVote marking devices; paper kept 22 months[38]
Audits
Hand-count audit of random precincts after each statewide election (10% in generals), at the Secretary of State's discretion[38]
Posture
Permanent state CISO named Feb 2026; Nebraska Guard Cyber Protection Team deployed for North Platte (Oct 2026).[39][1]
Documented incidents, 2019–2026
Sep 2020
Nebraska Medicine / UNMC · OmahaRansomware + data theft — Up to 219,000 people affected; systems shut down · source
Jun 2022
NE Dept. of Labor — NEworks (vendor) · LincolnAttack on vendor — Unemployment-claims site offline for days · source
Jul 2022
Butler County Health Care Center · David CityMalware (stopped with FBI help) — No patient data taken · source
Feb 2024
Change Healthcare outage — NE hospitals · Statewide (shown at Omaha)Third-party attack — Claims, billing and prior authorizations delayed · source
Oct 2024
Winnebago Public Schools · WinnebagoCyberattack — Phones and internet intermittently down · source
Spring 2025
Broken Bow Public Schools · Broken BowPhishing / payment fraud — $1.8M sent to fraudsters; ~$700K recovered · source
Oct 2025
Kearney Public Schools · KearneyNetwork compromise — Systems restored after several days · source
Oct 2026
City of North Platte / Lincoln County · North PlatteIntrusion via stolen password — Courthouse closed; governor declared emergency; Guard Cyber Protection Team deployed · source
Act III · The bridge

We don't have to accept this. The weak points are the same every time.

Read the map closely and the same five weak points repeat. Each one has a mechanical fix, and none of the fixes needs a bigger county IT staff.

01 · Backups

One copy is no copy

Attackers target backups in nearly every ransomware case. Recovery must come from copies they cannot reach, held under a key the state controls.

02 · Identity

A password is not a person

North Platte and Tripp County both fell to a borrowed identity. Phishing-resistant sign-in and payment verification remove the weak link.

03 · Blast radius

Shared networks share failure

One intrusion stopped courts in 104 counties. Walls between states, agencies and functions keep one breach in one place.

04 · Vendors

Your vendor is your perimeter

PowerSchool, Canvas and court-records vendors exposed data no county could protect. Data has to stay encrypted under the state's own keys, even inside a vendor's system.

05 · Proof

Proof beats assurance

After an incident, officials need to show the public what was and wasn't touched. Tamper-evident logs turn "trust us" into a record anyone can check.

Act IV · The solution

BB2G Sovereign State Infrastructure

Each state gets its own walled-off environment: its own vault and keys, its own identities, and no public doors. On top of that sit BB2G's custody, monitoring and transparency tools, matched one to one with the weak points above.

NEOwn vault, own identity
IAOwn vault, own identity
KSOwn vault, own identity
SDOwn vault, own identity
WYOwn vault, own identity
ElectionsPer-state vaults; never connects to Commercial
TallyIsolated counting and verification
State EnterpriseAgency records and transparency tools
Education & Child SafetyStudent and family data walled off
SecurityMonitoring and response
Shared PlatformCommon services, no cross-zone peering
CommercialKept apart from all government zones
GPUPrivate AI on demand, no public endpoint
Foundation deployed Oct 26, 2026: 8 isolated zones and 5 per-state vaults and identities, with no public IP addresses.Tested: policies block public IPs and cross-zone links.Data rule: synthetic data only until state-controlled hardware keys are in place.

Threat-to-countermeasure matrix

ThreatBB2G countermeasureToolsStatus
Ransomware & extortionEach state's data sits in its own vault under keys the state holds, with off-network backups and scheduled restore drills.Answers law 01: attackers can't reach the copy that brings you back.StrongRooms, Five-State Assurance ConsoleIN BUILD
Stolen credentials & payment fraudPhishing-resistant sign-in for every operator, plus out-of-band confirmation for payment and vendor-banking changes.Answers law 02: a borrowed password alone opens nothing.Pro ID, Cyber SentinelIN BUILD
Shared-network spreadEight isolated zones and per-state identities, no public IPs, and cross-zone links blocked by policy.Answers law 03: one breach stays in one room.Sovereign State Infrastructure foundationDEPLOYED
Vendor & supply-chain breachesState-held encryption keys, a vendor map with data-lineage records, and least-privilege vendor access.Answers law 04: a vendor breach leaks ciphertext, not records.Vendor Map, Data Lineage, VigilantGuardIN BUILD
Proving integrity after an incidentSigned, append-only custody logs anchored for public verification, so anyone can confirm what changed and what didn't.Answers law 05: show the record instead of asking for trust.ProofCore, MBLTS, Bolt ledger, ERC EvidenceIN BUILD
Nation-state pre-positioningContinuous monitoring with humans and automated agents cross-checking each other, plus a web firewall at the only front door.Catch quiet, long-lived access before it can be used.Cyber Sentinel, Election multi-bot swarm, Election ShieldDESIGN
Federal support gapA five-state shared watch floor and threat feed, plus local talent pipelines for rural counties.Replace lost federal coverage with a regional one the states own.National Watch, AEA National Cyber Cadet InitiativeDESIGN
AI deception & impersonationHelp counties move to .gov domains, verify official channels, and track election rules and records publicly.Makes the real voice easy to find and the fake one easy to spot.RULEBOOK, State Transparency, ROLLBOOKIN BUILD

Status key: DEPLOYED = running in BB2G's environment and tested; IN BUILD = code exists and is being integrated; DESIGN = specified, not yet built. No BB2G tool counts or casts votes.

Act V · The path

A phased path that respects the calendar

The general election is November 3. Nothing in this plan touches a state system before then. The first step is to listen and check this map with the people who run the systems.

Phase 0 · Now – Nov 2026

Validate the map

  • Brief each state CIO, CISO and election director
  • Correct and add to this threat map
  • No changes to any state system
Phase 1 · Winter 2026–27

Synthetic pilot

  • Each state's vault running on synthetic data
  • Tabletop exercise built on a real incident from this map
  • Restore drill with measured recovery time
Phase 2 · Spring 2027

State-held keys

  • Hardware keys under state control
  • State-by-state legal review of data use
  • Independent security assessment
Phase 3 · 2027 onward

County onboarding

  • Start with counties scoring 3 of 3
  • .gov migration and sign-in hardening
  • Shared five-state watch floor goes live
The ask

One 90-minute working session per state, after the election, with the state CIO or CISO and the election director. We'll walk the map together, mark what we missed, and choose one county for the pilot.

Appendix

Sources & method

Every figure links to a public source. County layers come from the CISA .gov registry, the U.S. EAC 2024 Election Administration and Voting Survey, and USDA rural-urban codes. Incident markers are placed at the city named in public reporting, so locations are approximate. Kansas's Seward County appears only on ransomware leak-site trackers and is left off the map, as are several aggregator-only reports. Iowa did not report voting equipment in EAVS 2024. All facts are as of October 27, 2026.

  1. WOWT, National Guard cyber team deployed after North Platte–Lincoln County outage (Oct 9, 2026). https://www.wowt.com/2026/10/09/national-guard-cyber-team-deployed-after-north-platte-lincoln-county-internet-outage/
  2. WOWT, Stolen employee password caused city cyberattack, mayor says (Oct 16, 2026). https://www.wowt.com/2026/10/16/stolen-employee-password-caused-city-cyberattack-mayor-says/
  3. USDA ERS, Rural-Urban Continuum Codes 2023 (with 2020 Census population), via cwimpy/rurality. https://www.ers.usda.gov/data-products/rural-urban-continuum-codes
  4. Nebraska Secretary of State, Statewide voter registration, August 2026. https://sos.nebraska.gov/sites/default/files/doc/elections/vrstats/2026VR/Statewide-August-2026.pdf
  5. Iowa Secretary of State, Voter registration totals, September 2026. https://sos.iowa.gov/elections/pdf/VRStatsArchive/2026/CoSep26.pdf
  6. Kansas Secretary of State, Election statistics data (Nov 2025). https://sos.ks.gov/elections/election-statistics-data.html
  7. South Dakota Secretary of State, Voter registration totals. https://vip.sdsos.gov/VoterRegistrationTotals.aspx
  8. Wyoming Secretary of State, Voter registration statistics, Aug 18, 2026. https://sos.wyo.gov/Elections/Docs/VRStats/2026/26Aug18_PrimaryElection_VR_Stats.pdf
  9. CISA .gov registry, cisagov/dotgov-data current-full.csv (downloaded Oct 27, 2026). https://github.com/cisagov/dotgov-data
  10. FBI IC3, 2025 Internet Crime Report (released Apr 2026). https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
  11. Route Fifty, Federal funding runs out for cyber info-sharing center (Oct 6, 2025). https://www.route-fifty.com/cybersecurity/2025/10/federal-funding-runs-out-cyber-info-sharing-center/408612
  12. Brennan Center, Local Election Officials Survey (Apr 2026). https://www.brennancenter.org/our-work/research-reports/local-election-officials-survey
  13. Sophos, The State of Ransomware in State and Local Government 2024. https://www.sophos.com/en-us/blog/the-state-of-ransomware-in-state-and-local-government-2024
  14. Comparitech, Worldwide government ransomware attacks 2018–2024 (Mar 13, 2025). https://comparitech.com/news/worldwide-government-ransomware-attacks
  15. Kansas Reflector via Lawrence Times, Kansas officials confirm details of cyberattack (Nov 21, 2023). https://lawrencekstimes.com/2023/11/21/ks-officials-confirm-details-cyberattack/
  16. KCTV5, Kansas courts need at least $2.6M to recover from cyberattack (Jan 17, 2024). https://www.kctv5.com/2024/01/17/top-official-says-kansas-courts-need-least-26-million-recover-cyberattack
  17. KOTA, Pennington County closes most public-facing offices amid cybersecurity incident (Jul 6, 2026). https://www.kotatv.com/2026/07/06/pennington-county-closes-most-public-facing-offices-monday-amid-cybersecurity-incident/
  18. Dakota News Now, Tripp County government email scammed into transferring $826,000 (Jan 7, 2026). https://www.dakotanewsnow.com/2026/01/07/tripp-county-government-email-scammed-into-transferring-826000
  19. KSNB, Broken Bow Public Schools working to recover funds after $1.8M phishing scam (Jul 14, 2025). https://www.ksnblocal4.com/2025/07/14/broken-bow-public-schools-working-recover-funds-after-18-million-phishing-scam/
  20. CyberScoop, FBI IC3 annual cybercrime report (Apr 2026). https://cyberscoop.com/fbi-internet-crime-complaint-center-annual-cybercrime-report/
  21. The Record, PowerSchool data breach and Texas lawsuit (Sep 4, 2025). https://therecord.media/powerschool-data-breach-texas-lawsuit-ken-paxton
  22. KCRG, Canvas back online after global cyberattack exposes Iowa students' data (May 8, 2026). https://www.kcrg.com/2026/05/08/canvas-back-online-after-global-cyberattack-exposes-iowa-students-data/
  23. Cowboy State Daily, Wyoming court system hacked (Sep 2, 2026). https://cowboystatedaily.com/2026/09/02/wyoming-court-system-hacked-could-have-exposed-10-years-of-personal-data/
  24. Nebraska Examiner, Change Healthcare outage hits Nebraska hospitals (Mar 4, 2024). https://nebraskaexaminer.com/?p=18283
  25. CISA/NSA/FBI Advisory AA24-038A, PRC state-sponsored actors (Volt Typhoon) pre-position on US critical infrastructure (Feb 7, 2024). https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
  26. CISA et al. Advisory AA25-239A on Salt Typhoon; reported by The Register (Aug 28, 2025). https://www.theregister.com/2025/08/28/china_salt_typhoon_alert/
  27. South Dakota News Watch, South Dakota cyberattacks and government spending (Aug 17, 2026). https://www.sdnewswatch.org/south-dakota-cyberattacks-government-spending/
  28. CyberScoop, CISA shutdown impact testimony (Jan 2026). https://cyberscoop.com/cisa-shutdown-impact-dhs-funding-testimony/
  29. NACo, MS-ISAC loses federal funding (Mar 25, 2025). https://www.naco.org/news/multi-state-information-sharing-and-analysis-center-ms-isac-loses-federal-funding
  30. Congressional Research Service IF12959, Cybersecurity Information Sharing Act of 2015 extension (Sep 3, 2026). https://www.everycrsreport.com/files/2026-09-03_IF12959_e88b818ccb3aca205dcf1ba233b57cd55207205b.html
  31. MeriTalk, Cyber grant program gets short-term extension after shutdown (Nov 14, 2025). https://meritalk.com/articles/cyber-grant-program-gets-short-term-extension-after-shutdown/
  32. Reuters via The Star, US tells election officials to guard against AI-powered tricks (Oct 16, 2026). https://www.thestar.com.my/tech/tech-news/2026/10/16/us-tells-election-officials-to-be-on-guard-against-ai-powered-tricks-ahead-of-midterms
  33. Nextgov/FCW, Hackers already laying groundwork to disrupt 2026 midterms (Check Point research) (Jun 1, 2026). https://www.nextgov.com/cybersecurity/2026/06/hackers-are-already-laying-groundwork-disrupt-2026-midterms-research-says/413874
  34. Center for Internet Security, Monitoring and support during the CrowdStrike Falcon outage. https://www.cisecurity.org/insights/case-study/monitoring-and-support-during-the-crowdstrike-falcon-outage
  35. The Register, AWS us-east-1 outage (Oct 20, 2025). https://www.theregister.com/2025/10/20/amazon_aws_outage/
  36. PYMNTS, Microsoft says configuration change caused cloud outage (Oct 2025). https://www.pymnts.com/cybersecurity/2025/microsoft-says-problematic-configuration-change-caused-outage-of-cloud-services/
  37. FEMA, FY2024 State and Local Cybersecurity Grant Program updated allocations (Jan 8, 2025). https://fema.gov/sites/default/files/documents/fema_gpd_fy24-slcgp-ib-updated-allocations_01082025.pdf
  38. Nebraska Secretary of State, Election Security. https://sos.nebraska.gov/node/95
  39. GovTech, Nebraska makes Bryce Bailey its permanent cybersecurity leader (Feb 25, 2026). https://www.govtech.com/workforce/nebraska-makes-bryce-bailey-its-permanent-cybersecurity-leader
  40. Verified Voting, Post-election audits: Iowa. https://verifiedvoting.org/auditlaw/iowa/
  41. KTTC, Iowa brings together federal and state officials to secure June primary (May 26, 2026). https://www.kttc.com/2026/05/26/iowa-brings-together-federal-state-officials-secure-june-primary-elections/
  42. Kansas Secretary of State, Did You Know?. https://sos.ks.gov/elections/did-you-know.html
  43. Kansas Legislature, 2024 House Sub. for SB 291 summary. https://www.kslegislature.gov/li/b2023_24/measures/documents/summary_sb_291_2024
  44. Kansas Legislative Research Dept., Briefing Book 2026: Cybersecurity update (Mar 2, 2026). https://klrd.gov/2026/03/02/briefing-book-2026-cybersecurity-update/
  45. South Dakota Secretary of State, Secure Elections in South Dakota. https://www.sdsos.gov/elections-voting/assets/Secure-Elections-in-South-Dakota.pdf
  46. Verified Voting, Post-election audits: South Dakota. https://verifiedvoting.org/auditlaw/south-dakota/
  47. Route Fifty, South Dakota's cybersecurity program running out of time and money (Aug 24, 2026). https://www.route-fifty.com/digital-government/2026/08/south-dakotas-cybersecurity-program-running-out-time-money-local-governments-face-attacks/415592/
  48. Verified Voting, Post-election audits: Wyoming. https://verifiedvoting.org/auditlaw/wyoming/
  49. Cowboy State Daily, Only 2 other states taken by online scammers more than Wyoming (May 18, 2025). https://cowboystatedaily.com/2025/05/18/only-2-other-states-taken-by-online-scammers-more-than-wyoming-fbi-says