Louisiana Governor's Executive Order Renewing State of Emergency for Cybersecurity Incident Appears to Grant National Guard Authority to Act
Landry's March 20th renewal, grants authority to director of GOHSEP, a position that no longer seems to exist.
Landry announced an executive order on March 20th, to renew the state of emergency originally declared by governor John Bel Edwards. Edwards originally issued the order in 2019 in response to a massive cybersecurity incident on Louisiana state servers shut down several state websites and email addresses.
According to a news article released at the time of the original declaration:
Edwards said the emergency declaration specifically allows the heads of the Office of Motor Vehicles, Department of Transportation and Development and the Department of Revenue to take certain actions that will assist members of the public affected by the service interruption related to Monday’s cybersecurity incident.
On Monday, the state of Louisiana activated its ESF-17, the cybersecurity response team, after a ransomware attack on Louisiana government servers. The state did not lose any data, nor did it pay a ransom.
June of 2023, Louisiana leaders admitted they had known about an ongoing cyber attack affecting Louisiana citizens that went on for nearly three weeks.
The attack was on a third-party data transfer service, MOVEit, used to send large files, said Casey Tingle, Director of the Governor’s Office of Homeland Security and Emergency Preparedness (GOHSEP). The exposed records were from the state’s Office of Motor Vehicles (OMV). When MOVEit suffered the attack, it likely gave hackers access to an estimated six million Louisiana OMV records, Tingle said. Those records contained the names, addresses, social security numbers, birth dates, driver’s license numbers and other details on most adults in the state, GOHSEP said.
Landry's renewal order is said to be signed to "efficiently and effectively fix the Office of Motor Vehicles once and for all.”
However, on the same day, Landry announced he was placing the "Governor’s Office of Homeland Security and Emergency Preparedness (GOHSEP) under the Louisiana National Guard in a "cost savings restructure."
Section 2 of Landry's order states that the director of GOHSEP is authorized to continue to undertake any activity authorized by law deemed appropriate in response to this emergency.
According to a Nola.com article released on the same day:
GOHSEP Director Jacques Thibodeaux took on a challenging role and served our state with dedication under difficult circumstances. We deeply appreciate his service,” Landry said in the announcement. Thibodeaux said in an interview that, over the next 30 days, he will help transition GOHSEP from a stand-alone agency to one under the purview of the National Guard in a role titled special assistant to the adjutant general of the Louisiana National Guard. His plans after that are currently undetermined, Thibodeaux said. He noted that he’s worked in emergency management for 40 years and is also a retired army soldier and retired U.S. Marshal. “I’m gonna take (a) well-needed break and enjoy my family, and then I’ll determine what’s gonna be the next chapter,"
Thibodeaux stepped into the role of director in February of 2024.
An article from Baton Rouge news station WAFB quotes Thibodeaux as saying:
"One of the most significant things I think Governor Landry challenged all the cabinet secretaries to do is to find a better way to do things. For the last five years being in the municipality, I know every dollar counts,” Thibodeaux said.
The article further explains:
"Expediting money from FEMA will be his main focus during his first couple of months in the role, getting more of those dollars in the pockets of any town or city in need after being hit with a storm. One big change he’s already made is modifying the express pay process to where 90% of the federal dollars for assistance and prevention can be handed out while the other 10% gets audited."
It would appear from the article on March 20th, that Thibodeaux's title of GOHSEP director is no longer relevant given the changes to organizational structure. If Thibodeaux is no longer director, then who is the "he" Landry is referring to in the declaration of emergency?
Louisiana National Guard Brig. Gen. Jason P. Mahfouz will serve as interim director with oversight from Adjutant Maj. Gen. Thomas Friloux.
This would seem to indicate that the national guard is now in charge of the cybersecurity emergency, and can take any legal actions they deem necessary to address cybersecurity threats.
According to Louisiana state legislative law §724. Powers of the governor:
A. The governor is responsible for meeting the dangers to the state and people presented by emergencies or disasters, and in order to effectuate the provisions of this Chapter, the governor may issue executive orders, proclamations, and regulations and amend or rescind them. Executive orders, proclamations, and regulations so issued shall have the force and effect of law.
B.(1) A disaster or emergency, or both, shall be declared by executive order or proclamation of the governor if he finds that a disaster or emergency has occurred or the threat thereof is imminent. The state of disaster or emergency shall continue until the governor finds that the threat of danger has passed or the disaster or emergency has been dealt with to the extent that the emergency conditions no longer exist and terminates the state of disaster or emergency by executive order or proclamation, but no state of disaster or emergency may continue for longer than thirty days unless renewed by the governor.
(2) Either the House of Representatives or the Senate, by petition signed by a majority of the surviving members of that house, may terminate the entire state of disaster or emergency or any part or subpart of the executive order or proclamation at any time. This petition terminating the state of emergency or disaster or any part or subpart of the executive order or proclamation may establish a period during which no other declaration of emergency or disaster may be issued. The petition terminating the state of emergency or disaster or any part or subpart of the executive order or proclamation, duly signed by a majority of the surviving members of the House of Representatives or the Senate, shall be transmitted to the clerk of the House of Representatives or secretary of the Senate, as applicable, who shall transmit the petition to the governor. The termination shall be effective upon the transmission of the petition to the governor.
(3) All executive orders or proclamations issued under this Subsection shall indicate the nature of the disaster or emergency, the designated emergency area which is or may be affected, and the conditions which have brought it about or which make possible the termination of the state of disaster or emergency. An executive order or proclamation shall be disseminated promptly by means calculated to bring its contents to the attention of the general public and, unless the circumstances attendant upon the disaster or emergency prevent or impede it, promptly filed with the Governor's Office of Homeland Security and Emergency Preparedness and with the secretary of state.
C. The declaration of an emergency or disaster by the governor shall:
(1) Suspend the provisions of any regulatory statute prescribing the procedures for conduct of state business, or the orders, rules, or regulations of any state agency, if strict compliance with the provisions of any statute, order, rule, or regulation would in any way prevent, hinder, or delay necessary action in coping with the emergency.
(2) Utilize all available resources of the state government and of each political subdivision of the state as reasonably necessary to cope with the disaster or emergency.
(3) Transfer the direction, personnel, or functions of state departments and agencies or units thereof for the purpose of performing or facilitating emergency services.
(4) Subject to any applicable requirements for compensation, commandeer or utilize any private property if he finds this necessary to cope with the disaster or emergency. For purposes of this Paragraph, private property does not include firearms, ammunition, or components of firearms or ammunition.
(5) Prescribe routes, modes of transportation, and destination in connection with evacuation.
(6) Suspend or limit the sale, dispensing, or transportation of alcoholic beverages, explosives, and combustibles, excluding those components of firearm ammunition.
(7) Make provision for the availability and use of temporary emergency housing.
NOTE: See HCR 5 of the 2021 R.S. regarding the suspension of certain criminal penalties and restrictions related to religious assemblies through the 60th day after final adjournment of the 2022 R.S.
Also of possible importance:
F. No organization for homeland security and emergency preparedness established under this Chapter shall be employed directly or indirectly for political purposes
It does not appear that the law was written with the possible consideration that one day the governor might absorb the entire agency within the national guard.
References
https://www.theadvertiser.com/story/news/local/acadiana/2025/03/21/gov-landry-louisiana-omv-emergency-software-failure/82590867007/
https://gov.louisiana.gov/page/cybersecurity-incident-resources-
https://www.wdsu.com/article/state-of-emergency-declared-over-cyberattack-that-affected-state-websites-email-accounts/29896201
Chris Rosato
https://www.nola.com/news/politics/jeff-landry-restructure-gohsep-under-louisiana-national-guard-fiscal-responsibility/article_7e9e08f2-ee67-463c-a2b3-424f6165a087.html
Chris Rosato
https://www.legis.la.gov/legis/Law.aspx?d=85670
