I certainly don’t want to promote complacency either, but someone needs to explain to these representatives that the technological aspects of state government, associated universities and health systems, and most businesses with any tech aspect at all are entirely dependent on VPNs to operate. Existing privacy laws (esp. HIPAA) already prohibit sending protected medical data in the clear, so say goodbye to any ability to run the University of Michigan Health System, for instance.