Why state and local governments are ripe for cyberattacks