Existing law establishes various advisory boards and commissions in state government with specified duties and responsibilities. Existing law establishes in state government the Governors Office of Emergency Services and the Department of Technology.

This bill would continue in existence the California Cyber Security Task Force, consisting of specified members, previously created by the Governors Office of Emergency Services and the Department of Technology, in the Governors Office of Emergency Services. This The bill would authorize the task force to convene stakeholders to act in an advisory capacity and compile policy recommendations on cyber security for the state. The bill would require the task force to meet quarterly, or more often as necessitated by emergency circumstances. This The bill would require the task force to complete and issue a report of policy recommendations to the Governors office and the Legislature. This The bill would also require the task force to perform specified functions relating to cyber security. This The bill would create a State Director of Cyber Security with specified duties within the Governors Office of Emergency Services. This The bill would repeal these provisions on January 1, 2020.

Existing law establishes various advisory boards and commissions in state government with specified duties and responsibilities. Existing law establishes in state government the Governors Office of Emergency Services and the Department of Technology.

This bill would continue in existence the California Cyber Security Task Force, consisting of specified members, previously created by the Governors Office of Emergency Services and the Department of Technology, in the Governors Office of Emergency Services. This bill would authorize the task force to convene stakeholders to act in an advisory capacity and compile policy recommendations on cyber security for the state. The bill would require the task force to meet quarterly, or more often as necessitated by emergency circumstances. This bill would require the task force to complete and issue a report of policy recommendations to the Governors office and the Legislature. This bill would also require the task force to perform specified functions relating to cyber security. This bill would create a State Director of Cyber Security with specified duties within the Governors Office of Emergency Services. This bill would repeal these provisions on January 1, 2020.

Existing law establishes various advisory boards and commissions in state government with specified duties and responsibilities. Existing law establishes in state government the Governors Office of Emergency Services and the Department of Technology.

This bill would continue in existence the California Cyber Security Task Force, consisting of specified members, previously created by the Governors Office of Emergency Services and the Department of Technology, in the Governors Office of Emergency Services. This bill would authorize the task force to convene stakeholders to act in an advisory capacity and compile policy recommendations on cyber security for the state. The bill would require the task force to meet quarterly, or more often as necessitated by emergency circumstances. This bill would require the task force to complete and issue a report of policy recommendations to the Governors office and the Legislature. This bill would also require the task force to perform specified functions relating to cyber security. This bill would create a State Director of Cyber Security with specified duties within the Governors Office of Emergency Services. This bill would repeal these provisions on January 1, 2020.

 THIRD READING  

Bill No: AB 1172

Author: Chau (D), et al.

Amended: 8/31/15 in Senate

Vote: 21

SENATE GOVERNMENTAL ORG. COMMITTEE: 13-0, 7/14/15

AYES: Hall, Berryhill, Block, Gaines, Galgiani, Glazer, Hernandez, Hill, Hueso, Lara, McGuire, Runner, Vidak

SENATE APPROPRIATIONS COMMITTEE: 6-1, 8/27/15

AYES: Lara, Bates, Beall, Hill, Leyva, Mendoza

NOES: Nielsen

ASSEMBLY FLOOR: 78-0, 6/2/15 - See last page for vote

SUBJECT: California cyber security

SOURCE: Author

DIGEST: This bill continues in existence the California Cyber Security Task Force (Task Force), created in 2013 by the Governor’s Office of Emergency Services (OES) and the Department of Technology (Caltech).

ANALYSIS:

Existing law:

1. Establishes Caltech, within the Government Operations Agency (GOA). Caltech is generally responsible for the approval and oversight of information technology (IT) projects by, among other things, consulting with state agencies during initial project planning to ensure that project planning to ensure that project proposals are based on well-defined programmatic needs.

2. Establishes, within Caltech, the California Information Security Office (OIS) under the supervision of the Chief of the Office of Information Security. The OIS has the authority to, including, but not limited to, conduct, or require to be conducted, an independent security assessment of any state agency, department, or office the cost of which is to be funded by the state agency, department, or office being assessed.

3. Requires each state agency to have a chief information officer who is appointed by the head of the entity, and is responsible for supervising all IT, including information security.

4. Authorizes OIS to require an audit of information security to ensure program compliance, the cost of which shall be funded by the state agency, department, or office being audited, and requires the office to report to Caltech any state agency found to be noncompliant with information security program requirements

This bill:

1. Continues in existence the California Cyber Security Task Force, created in 2013 by OES and Caltech.

2. Provides that the Task Force shall consist of the following members:

1. The Director of OES, or his or her designee with knowledge, expertise, and decision-making authority with respect to OES’ IT and information security duties.

2. The Director of Caltech, or his or her designee with knowledge, expertise, and decision-making authority with respect to the director’s IT and information security duties.

3. The Attorney General, or his or her designee with knowledge, expertise, and decision-making authority with respect to the Department of Justice’s IT and information security.

4. The Adjutant General of the Military Department, or his or her designee with knowledge, expertise, and decision-making authority with respect to the Military Department’s IT and information security.

5. The Commissioner of the California Highway Patrol, or his or her designee with knowledge, expertise, and decision-making authority with respect to the Department of the California Highway Patrol’s IT and information security.

6. A representative of the Public Utilities Commission or California Energy Commission with knowledge, expertise, and decision-making authority with respect to IT and information security, who shall be appointed by the Governor.

7. A representative from the utility or energy industry, who shall be appointed by the Governor.

8. A representative from law enforcement, who shall be appointed by the Governor.

9. Three individuals with cyber security expertise, who shall be appointed, one each, by the Governor, the Senate Rules Committee, and the Speaker of the Assembly.

3. Provides that the Task Force may convene stakeholders, both public and private, to act in an advisory capacity and compile policy recommendations on cyber security for the State of California.

4. Specifies that the Task Force shall complete and issue a report of policy recommendations to the Governor’s office and the Legislature on an annual basis.

5. Provides that the Task Force shall meet quarterly, or more often as necessitated by emergency circumstances, within existing resources to ensure that the policy recommendations from the report are implemented and any necessary modifications that may arise are addressed in a timely manner.

6. Provides that the OES and Caltech may conduct the strategic direction of risk assessments performed by the Military Department’s Computer Network Defense Team.

7. Creates within OES a State Director of Cyber Security, appointed by the Governor and subject to Senate confirmation who shall do all of the following:

1. Be the Executive Director of the Task Force.

2. Provide strategic direction of risk assessments performed with state resources.

3. Complete a risk profile of state assets and capabilities for the purpose of compiling statewide contingency plans including, but not limited to, Emergency Function 18 of the State Emergency Plan which pertains to cyber security.

4. Act as point of contact to the federal government and private entities within the state in the event of a relevant emergency as declared by the Governor.

5. Be an adviser to OES and Caltech on cyber security.

8. Specifies that the Task Force shall perform the following functions based on the following priorities:

1. Develop within state government cyber prevention, defense, and response strategies and define a hierarchy of command within the state for this purpose. This duty includes, but is not limited to, the following activities:

1. Ensuring the continual performance of risk assessments on state IT systems. The assessments shall include penetration tests, vulnerability scans, and other industry-standard methods that identify potential risk.

2. Using assessment results and other state-level data to create a risk profile of public assets, critical infrastructure, public networks, and private operations susceptible to cyber-attacks. The risk profile shall include the development of statewide contingency plans including, but not limited to, Emergency Function 18 of the State Emergency Plan.

2. Partner with the United States Department of Homeland Security to develop an appropriate information sharing system that allows for a controlled and secure process to effectively disseminate cyber threat and response information and data to relevant private and public sector entities. This information sharing system shall reflect state priorities and target identified threat and capability gaps.

3. Provide recommendations for IT security standards for all state agencies using, among other things, protocols established by the National Institute for Standards and Technology and reflective of appropriate state priorities.

4. Compile and integrate, as appropriate, the research conducted by academic institutions, federal laboratories, and other cyber security experts into state operations and functions.

5. Expand the state’s public-private cyber security partnership network.

6. Expand collaboration, as specified, with the state’s law enforcement apparatus assigned jurisdiction to prevent, deter, investigate, and prosecute cyber attacks and IT crime, including collaboration with entities like High-Tech Theft Apprehension Program, and its five regional task forces, the Department of the California Highway Patrol, and the Attorney General’s eCrimes unit.

7. Propose, where appropriate potential operational or functional enhancement to the state’s cyber security assessment and response capabilities, as well as investment or spending recommendation and guidance for the state’s IT budget and procurement.

9. Provides that the Task Force shall take all necessary steps to protect personal information and privacy, public and private sector data, and the constitutional rights and liberties of individuals, when implementing its duties.

10. Provides that the Task Force may issue reports, in addition to the report described in this bill, to the Governor’s office and the Legislature detailing the activities of the task force, as specified.

11. Allows the Task Force to engage or accept the services of agency or department personnel, accept the services of stakeholder organizations, and accept federal, private, or other nonstate funding, to operate, manage, or conduct the business of the Task Force.

12. Provides that each department and agency shall cooperate with the Task Force and furnish it with information and assistance that is necessary or useful to further the provisions of this bill.

13. Includes a sunset date of January 1, 2020.

Background

Purpose of the bill. According to the author, “as our state’s operations become more digitally connected, it is more vulnerable to both foreign and domestic cyber-attacks. Recent cyber-attacks on private and public entities have shown that these attacks are growing in number and are becoming increasingly sophisticated. Unfortunately, the state’s overall capability to coordinate and respond to cyber-attacks in both the public and private sector is fragmented. AB 1172 would ensure that California has a central entity and a comprehensive strategy in place to prevent and respond to cyber-attacks.”

CalTech/OIS. CalTech is the central IT organization for the State of California and is responsible for the approval and oversight of all state IT projects. Among its various offices is the California Information Security Office, or OIS.

OIS is the primary state government authority for ensuring the confidentiality, integrity, and availability of state systems and applications, and ensuring the protection of state information. The office represents California to federal, state, and local government entities, higher education, private industry, and others on security-related matters. According to the author's office, there are a total of 384 state entities subject to the OIS (which excludes some constitutional offices).

Cyber Threats in California. According to the California Military Department (CMD), California's size and importance makes it vulnerable to cyber incidents that disrupt business, shutdown critical infrastructure, and compromise intellectual property or national security.

CMD calls cybercrime "a growth industry" causing $400 billion in negative impacts annually on the global economy. Thirty percent of all cyber-attacks and other malicious activity are targeted at the government, making these networks and systems the most vulnerable target of cybercrime.

According to CMD, the threat to government networks has never been higher. “Hacktivists”, nation states, cyber criminals and other threat groups are attacking government networks to steal sensitive information and make a political/economic statement. It is not known how many attacks, whether successful or unsuccessful, have been made against state agency computers over the past year.

Existing Task Force. OES and CalTech, acting at the direction of Governor Brown, created the Task Force to be a statewide partnership comprised of key stakeholders, subject matter experts, and cyber security professionals from California's public, private, academia, and law enforcement sectors. The Task Force serves as an advisory body to the State of California Senior Administration Officials in matters related to Cybersecurity. The Task Force holds public meetings once per quarter. Its mission is to enhance the security of California digital infrastructure and to create a culture of cybersecurity through collaboration, information sharing, and education and awareness.

The Task Force operates as an advisory body only – it has no formal authority, it takes no votes, it has no budget, and its membership is open and voluntary.

Prior/Related Legislation

AB 670 (Irwin, 2015) requires OIS, within Caltech to conduct an independent security assessment of the IT resources of every state agency, department or office at least once every two years. (Pending on the Senate Floor)

AB 739 (Irwin, 2015) provides legal immunity for civil or criminal liability for private entities that communicate anonymized cyber security threat information and meet specified requirements, until January 1, 2020. (Held in Assembly Judiciary Committee)

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

According to the Senate Appropriations Committee, ongoing staff costs of at least $650,000 to OES for the Director of Cyber Security position and two additional full-time staff to manage the responsibility of the Task Force (General Fund). In addition, an estimated cost of at least $50,000 per year to cover Task Force member’s expenses related to the four mandated annual meetings (General Fund).

SUPPORT: (Verified 8/28/15)

California District Attorneys Association

California State Sheriffs’ Association

OPPOSITION: (Verified 8/28/15)

None received

ASSEMBLY FLOOR: 78-0, 6/2/15

AYES: Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Perea, Quirk, Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Atkins

NO VOTE RECORDED: Chávez, Beth Gaines

Prepared by: Felipe Lopez / G.O. / (916) 651-1530

8/31/15 10:15:40

**** END ****

SENATE COMMITTEE ON APPROPRIATIONS

Senator Ricardo Lara, Chair

2015 - 2016 Regular Session

AB 1172 (Chau) - California cyber security

This bill meets the criteria for referral to the Suspense File.

Bill Summary:

AB 1172 would formally codify the California Cyber Security Task Force (Task Force) until January 1, 2020, establish the State Director of Cyber Security within the Office of Emergency Services (OES), and prescribe the duties and responsibilities of the Task Force.

Fiscal Impact:

• Ongoing staff costs of at least $650,000 to OES for the Director of Cyber Security position and two additional full-time staff to manage the responsibilities of the Task Force. (General Fund)
  
  

• Estimated costs of at least $50,000 per year to cover Task Force members’ expenses related to the four mandated annual meetings (travel, meals, per diem, reimbursements of actual expenses). (General Fund)

Background:

Existing law provides that the Department of Technology is generally responsible for the approval and oversight of state information technology (IT) projects. The Office of Information Security (OIS) within the Department of Technology is responsible for ensuring the confidentiality and integrity of state data systems. The OIS is required to establish policies, standards, and procedures for state agencies to manage security and risk. Existing law authorizes the OIS to conduct independent security assessments of any state agency, department, or office, and requires the state entity whose systems are being assessed to pay for the security assessment.

In 2013, the Governor administratively directed OES and the Department of Technology to create a Cyber Security Task Force comprised of specified stakeholders, subject matter experts, and cyber security professionals from public, private, academic, and law enforcement sectors. The Task Force serves as an advisory body to senior state officials on cyber security issues, and holds quarterly meetings. The Task Force is currently comprised of seven subcommittees: risk mitigation; information sharing; workforce development and education; economic development; emergency preparedness; legislation and funding; and high tech and digital forensics. Its mission is to enhance the security of California digital infrastructure and to create a culture of cybersecurity through collaboration, information sharing, and education and awareness.

Proposed Law:

AB 1172 would codify and continue the Task Force in existence within OES, consisting of 11 specified members. The bill would also do the following:

• Authorize the Task Force to convene public and private stakeholders to act in an advisory role and compile policy recommendations on cyber security.

• Require the Task Force to annually report policy recommendations to the Governor and Legislature.

• Require the Task Force to meet at least quarterly, or more as necessary, to ensure implementation of policy recommendations and make timely modifications to those recommendations.

• Authorize OES and the Department of Technology to conduct the strategic direction of risk assessments performed by the Military Department’s Computer Network Defense Team.

• Establish the appointed position of the Director of Cyber Security within OES to be the executive director of the Task Force, provide strategic direction of risk assessments, complete a risk profile of state assets and capabilities, act as a point of contact to the federal government and private entities during an emergency, and advise OES and the Department of Technology on cyber security.

• Require the Task force to perform the following functions:

  • Develop cyber prevention, defense, and response strategies, and define a hierarchy of command within state government, as specified.

  • Partner with the U.S. Department of Homeland Security to develop an information sharing system to reflect state priorities and identified threat and capability gaps.

  • Provide recommendations for IT security standards for state agencies.

  • Compile and integrate research conducted by academic, federal, and other cyber security experts into state operations and functions.

  • Expand the public-private security partnership network.

  • Expand collaboration with the state’s law enforcement apparatus assigned jurisdiction to prevent, deter, investigate, and prosecute cyber-attacks and IT crime.

  • Propose potential operational or functional enhancements to the state’s cyber security assessment and response capabilities, and investment or spending recommendations and guidance for the state’s IT budget and procurement.

• Require the Task Force to take necessary steps to protect personal information and privacy, public and private sector data, and constitutional rights.

• Authorize the Task Force to issue reports to the Governor and Legislature that detail Task Force activities.

• Authorize the Task Force to engage or accept services of agency or department personnel, accept services of stakeholder organizations, and accept federal, private, or other non-state funding for Task Force purposes.

• Require state agencies and departments to cooperate with the Task Force and provide information and assistance necessary to fulfill the bill’s purposes.

• Repeals the Task Force on January 1, 2020.

Related Legislation:

AB 670 (Irwin), which is currently pending in this committee, would require the Department of Technology to perform security assessments of the IT resources of every state agency, department, or office at least once every two years.

AB 2200 (J. Perez), which was approved by the Senate but died without a final vote in the Assembly in 2014, would have created the California Cyber Security Steering Committee within OES and continue the Cyber Security Task Force in existence until 2020.

Staff Comments:

AB 1172 would formally codify the current administratively-created Task Force, establish a full-time Director of Cyber Security position, and prescribe duties and responsibilities of the Task Force. OES indicates that the prescribed functions of the Task Force exceed the responsibilities of the current Task Force, and would require a minimum of two additional PY of technical and analytical staff to work with the new Director of Cyber Security. The estimated costs of these three positions would be approximately $650,000 annually. The current Task Force does not have a budget or dedicated staff, but some functions are being conducted by existing OES and Department of Technology staff.

The Department of Technology indicates that the bill would conflict with current statutory authorities on several levels: (1) current law requires the Director of Technology to supervise the Department and report directly to the Governor on IT issues, and strategic management of the state’s IT resources; (2) current law makes the OIS responsible for information security and risk management, including the direction of risk assessments; (3) current law requires the OIS to serve as the state’s Chief Information Security Officer, providing direction for information security and privacy to state agencies, and to represent the state when coordinating with federal, state, private, and local entities on issues that impact information security and privacy. This bill would create duplicative duties for the Task Force that would be located within OES, with the Department of Technology as a junior partner on the Task Force.

In recent years, the federal government has made a significant amount of grant funding available to the states for programs and projects relating to cyber security. It is not known the extent to which some of the requirements of this bill could be funded with existing or new federal grant funds.

Proposed Author Amendments:

The author has proposed a minor amendment to specify that the Director of Cyber Security would be “subject to Senate confirmation,” rather than “confirmed by the Senate.”

-- END --

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Isadore Hall, III

Chair

2015 - 2016 Regular

Bill No: AB 1172 Hearing Date: 7/14/2015

SUBJECT: California cyber security.

DIGEST: This bill continues in existence the California Cyber Security Task Force (Task Force), created in 2013 by the Governor’s Office of Emergency Services (OES) and the Department of Technology (Caltech).

ANALYSIS:

Existing law:

1. Establishes Caltech, within the Government Operations Agency (GOA). Caltech is generally responsible for the approval and oversight of information technology (IT) projects by, among other things, consulting with state agencies during initial project planning to ensure that project planning to ensure that project proposals are based on well-defined programmatic needs.

2. Establishes, within Caltech, the California Information Security Office (OIS) under the supervision of the Chief of the Office of Information Security. The OIS has the authority to, including, but not limited to, conduct, or require to be conducted, an independent security assessment of any state agency, department, or office the cost of which is to be funded by the state agency, department, or office being assessed.

3. Requires each state agency to have a chief information officer who is appointed by the head of the entity, and is responsible for supervising all IT, including information security.

4. Authorizes OIS to require an audit of information security to ensure program compliance, the cost of which shall be funded by the state agency, department, or office being audited, and requires the office to report to Caltech any state agency found to be noncompliant with information security program requirements

This bill:

1. Continues in existence the California Cyber Security Task Force, created in 2013 by OES and Caltech.

2. Provides that the Task Force shall consist of the following members:

1. The Director of OES, or his or her designee with knowledge, expertise, and decision-making authority with respect to OES’ IT and information security duties.

2. The Director of Caltech, or his or her designee with knowledge, expertise, and decision-making authority with respect to the director’s IT and information security duties.

3. The Attorney General, or his or her designee with knowledge, expertise, and decision-making authority with respect to the Department of Justice’s IT and information security.

4. The Adjutant General of the Military Department, or his or her designee with knowledge, expertise, and decision-making authority with respect to the Military Department’s IT and information security.

5. The Commissioner of the California Highway Patrol, or his or her designee with knowledge, expertise, and decision-making authority with respect to the Department of the California Highway Patrol’s IT and information security.

6. A representative of the Public Utilities Commission or California Energy Commission with knowledge, expertise, and decision-making authority with respect to IT and information security, who shall be appointed by the Governor.

7. A representative from the utility or energy industry, who shall be appointed by the Governor.

8. A representative from law enforcement, who shall be appointed by the Governor.

9. Three individuals with cyber security expertise, who shall be appointed, one each, by the Governor, the Senate Rules Committee, and the Speaker of the Assembly.

3. Provides that the Task Force may convene stakeholders, both public and private, to act in an advisory capacity and compile policy recommendations on cyber security for the State of California.

4. Specifies that the Task Force shall complete and issue a report of policy recommendations to the Governor’s office and the Legislature on an annual basis.

5. Provides that the Task Force shall meet quarterly, or more often as necessitated by emergency circumstances, within existing resources to ensure that the policy recommendations from the report are implemented and any necessary modifications that may arise are addressed in a timely manner.

6. Provides that the OES and Caltech may conduct the strategic direction of risk assessments performed by the Military Department’s Computer Network Defense Team.

7. Creates within OES a State Director of Cyber Security, appointed by the Governor and confirmed by the Senate, who shall do all of the following:

1. Be the Executive Director of the Task Force.

2. Provide strategic direction of risk assessments performed with state resources.

3. Complete a risk profile of state assets and capabilities for the purpose of compiling statewide contingency plans including, but not limited to, Emergency Function 18 of the State Emergency Plan which pertains to cyber security.

4. Act as point of contact to the federal government and private entities within the state in the event of a relevant emergency as declared by the Governor.

5. Be an adviser to OES and Caltech on cyber security.

8. Specifies that the Task Force shall perform the following functions based on the following priorities:

1. Develop within state government cyber prevention, defense, and response strategies and define a hierarchy of command within the state for this purpose. This duty includes, but is not limited to, the following activities:

1. Ensuring the continual performance of risk assessments on state IT systems. The assessments shall include penetration tests, vulnerability scans, and other industry-standard methods that identify potential risk.

2. Using assessment results and other state-level data to create a risk profile of public assets, critical infrastructure, public networks, and private operations susceptible to cyber-attacks. The risk profile shall include the development of statewide contingency plans including, but not limited to, Emergency Function 18 of the State Emergency Plan.

2. Partner with the United States Department of Homeland Security to develop an appropriate information sharing system that allows for a controlled and secure process to effectively disseminate cyber threat and response information and data to relevant private and public sector entities. This information sharing system shall reflect state priorities and target identified threat and capability gaps.

3. Provide recommendations for IT security standards for all state agencies using, among other things, protocols established by the National Institute for Standards and Technology and reflective of appropriate state priorities.

4. Compile and integrate, as appropriate, the research conducted by academic institutions, federal laboratories, and other cyber security experts into state operations and functions.

5. Expand the state’s public-private cyber security partnership network.

6. Expand collaboration, as specified, with the state’s law enforcement apparatus assigned jurisdiction to prevent, deter, investigate, and prosecute cyber attacks and IT crime, including collaboration with entities like High-Tech Theft Apprehension Program, and its five regional task forces, the Department of the California Highway Patrol, and the Attorney General’s eCrimes unit.

7. Propose, where appropriate potential operational or functional enhancement to the state’s cyber security assessment and response capabilities, as well as investment or spending recommendation and guidance for the state’s IT budget and procurement.

9. Provides that the Task Force shall take all necessary steps to protect personal information and privacy, public and private sector data, and the constitutional rights and liberties of individuals, when implementing its duties.

10. Provides that the Task Force may issue reports, in addition to the report described in this bill, to the Governor’s office and the Legislature detailing the activities of the task force, as specified.

11. Allows the Task Force to engage or accept the services of agency or department personnel, accept the services of stakeholder organizations, and accept federal, private, or other nonstate funding, to operate, manage, or conduct the business of the Task Force.

12. Provides that each department and agency shall cooperate with the Task Force and furnish it with information and assistance that is necessary or useful to further the provisions of this bill.

13. Includes a sunset date of January 1, 2020.

Background

Purpose of the bill. According to the author, “as our state’s operations become more digitally connected, it is more vulnerable to both foreign and domestic cyber-attacks. Recent cyber-attacks on private and public entities have shown that these attacks are growing in number and are becoming increasingly sophisticated. Unfortunately, the state’s overall capability to coordinate and respond to cyber-attacks in both the public and private sector is fragmented. AB 1172 would ensure that California has a central entity and a comprehensive strategy in place to prevent and respond to cyber-attacks.”

CalTech/OIS. CalTech is the central IT organization for the State of California and is responsible for the approval and oversight of all state IT projects. Among its various offices is the California Information Security Office, or OIS.

OIS is the primary state government authority for ensuring the confidentiality, integrity, and availability of state systems and applications, and ensuring the protection of state information. The office represents California to federal, state, and local government entities, higher education, private industry, and others on security-related matters. According to the author's office, there are a total of 384 state entities subject to the OIS (which excludes some constitutional offices).

Cyber Threats in California. According to the California Military Department (CMD), California's size and importance makes it vulnerable to cyber incidents that disrupt business, shutdown critical infrastructure, and compromise intellectual property or national security.

CMD calls cybercrime "a growth industry" causing $400 billion in negative impacts annually on the global economy. Thirty percent of all cyber-attacks and other malicious activity are targeted at the government, making these networks and systems the most vulnerable target of cybercrime.

According to CMD, the threat to government networks has never been higher. “Hacktivists”, nation states, cyber criminals and other threat groups are attacking government networks to steal sensitive information and make a political/economic statement. It is not known how many attacks, whether successful or unsuccessful, have been made against state agency computers over the past year.

Existing Task Force. OES and CalTech, acting at the direction of Governor Brown, created the Task Force to be a statewide partnership comprised of key stakeholders, subject matter experts, and cyber security professionals from California's public, private, academia, and law enforcement sectors. The Task Force serves as an advisory body to the State of California Senior Administration Officials in matters related to Cybersecurity. The Task Force holds public meetings once per quarter. Its mission is to enhance the security of California digital infrastructure and to create a culture of cybersecurity through collaboration, information sharing, and education and awareness.

The Task Force operates as an advisory body only – it has no formal authority, it takes no votes, it has no budget, and its membership is open and voluntary. It is currently comprised of seven subcommittees: risk mitigation; information sharing; workforce development and education; economic development; emergency preparedness; legislation and funding; and high tech and digital forensics.

Prior/Related Legislation

AB 670 (Irwin, 2015) requires OIS, within Caltech to conduct an independent security assessment of the IT resources of every state agency, department or office at least once every two years. (Pending in Senate Appropriations Committee)

AB 739 (Irwin, 2015) provides legal immunity for civil or criminal liability for private entities that communicate anonymized cyber security threat information and meet specified requirements, until January 1, 2020. (Held in Assembly Judiciary Committee)

AB 2200 (Perez, 2014) would have created a 13 member California Cyber Security Steering Committee in OES and continue the existence of the California Cyber Security Task Force until January 1, 2020. (Held at the Assembly Desk)

AB 1620 (Rodriguez, 2014) would have established the California Emergency Management and Disaster Preparedness Commission as a statewide executive-level commission to assess and improve the condition of the State’s emergency preparedness, management, and disaster recovery capabilities. (Vetoed by Governor Brown)

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT:

California District Attorneys Association

California State Sheriffs’ Association

OPPOSITION:

None received

ASSEMBLY THIRD READING

ATR Bill Id:AB 1172

Author:(Chau)

As Introduced Ver:February 27, 2015

Majority vote

SUMMARY: Creates a California Cyber Security Task Force (Task Force) within the Governor's Office of Emergency Services (OES) to act in an advisory capacity and make policy recommendations on cyber security for the State of California. Specifically, this bill:

1. Codifies the existence of the Task Force within OES.

2. Specifies the nine members of the Task Force.

3. Authorizes the Task Force to convene public and private stakeholders to act in an advisory capacity and compile policy recommendations on cyber security for the State of California.

4. Requires the Task Force to complete and issue a report of policy recommendations to the Governor's office and the Legislature on an annual basis, as specified.

5. Requires the Task Force to meet quarterly, or more often as necessitated by emergency circumstances, to ensure that the policy recommendations from the report are implemented and any necessary modifications that may arise are addressed in a timely manner.

6. Authorizes OES and California Institute of Technology (CalTech) to conduct the strategic direction of risk assessments performed by the Military Department's Computer Network Defense Team.

7. Creates within OES the position of a State Director of Cyber Security.

8. Requires the Task Force to perform certain functions, as specified.

9. Requires the Task Force to take all necessary steps to protect personal information and privacy, public and private sector data, and the constitutional rights and liberties of individuals, when implementing its duties.

10. Authorizes the Task Force to issue reports to the Governor's office and the Legislature detailing the Task Force's activities.

11. Authorizes the Task Force to engage or accept the services of agency or department personnel, accept the services of stakeholder organizations, and accept federal, private, or other non-state funding, to operate, manage, or conduct the business of the Task Force.

12. Requires each state department and agency to cooperate with the Task Force and furnish it with information and assistance that is necessary or useful.

13. Declares the provisions enacted by this bill to be inoperative and repealed as of January 1, 2020.

FISCAL EFFECT: According to the Assembly Appropriations Committee, given the numerous functions and responsibilities of the task force, there would be need for two analysts, in addition to the executive director, at an ongoing General Fund cost of around $500,000.

To the extent the result of the task force's work minimizes the state's exposure from cyber attacks and related technology security issues, the state will avoid the costs of such disruptions, which could otherwise be significant.

COMMENTS:

1. Purpose of this bill. This bill is intended to set forth in statute a formal structure and responsibilities for the Task Force, which is currently functioning as an ad hoc advisory body under OES. This bill is author-sponsored.

2. The work of the existing Task Force. OES and CalTech, acting at the direction of Governor Brown, created the Task Force to be "a statewide partnership comprised of key stakeholders, subject matter experts, [federal agencies], and cyber security professionals from California's public sector, private industry, academia, and law enforcement. The Task Force serves as an advisory body to the State of California Senior Administration Officials in matters related to Cybersecurity." The Task Force holds public meetings once per quarter. Its express mission is to "enhance the security of California digital infrastructure and to create a culture of cybersecurity through collaboration, information sharing, and education and awareness."

The Task Force operates as an advisory body only – it has no formal authority, it takes no votes, it has no budget, and its membership is open and voluntary. It is currently comprised of seven subcommittees: risk mitigation; information sharing; workforce development and education; economic development; emergency preparedness; legislation and funding; and high tech and digital forensics.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0000629

Date of Hearing: May 13, 2015

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Jimmy Gomez, Chair

ABPCA Bill Id:AB 1172

Author:(Chau) – As Introduced Ver:February 27, 2015

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill establishes in statute, until January 1, 2020, a California Cyber Security Task Force that was established in 2013 by the Office of Emergency Services (OES) and the California Department of Technology (CalTech). Specifically, this bill:

1. Specifies the task force membership, which is to include the heads of relevant state agencies and cybersecurity experts.

2. Authorizes the task force to convene public and private stakeholders to act in an advisory capacity and compile policy recommendations on cyber security for the State, and to complete and issue an annual report of policy recommendations to the Governor and the Legislature.

3. Requires the Task Force to meet quarterly, or more often as necessitated by emergency circumstances, to ensure that the policy recommendations from the report are implemented and any necessary modifications that may arise are addressed in a timely manner.

4. Establishes within OES the position of State Director of Cyber Security, to serve as the executive director of the task force, provide strategic direction for risk assessments performed with state resources, complete a risk profile of state assets and capabilities for the purpose of compiling statewide contingency plans, and act as a point of contact to the federal government and private entities within the state in the event of a declared emergency.

5. Requires the task force to perform numerous specified functions, including:

   1. Developing cyber prevention, defense, and response strategies and define a hierarchy of command within the state for this purpose.

   2. Compiling and integrating research conducted by academic institutions, federal laboratories, and other cyber security experts into state operations and functions.

   3. Expanding collaboration with the state’s law enforcement apparatus assigned jurisdiction to prevent, deter, investigate, and prosecute cyber-attacks and IT crime.

   4. Proposing potential operational or functional enhancements to the state’s cyber security assessment and response capabilities, as well as investment or spending recommendations and guidance for the state’s IT budget and procurement.

FISCAL EFFECT:

Given the numerous functions and responsibilities of the task force, there would be need for two analysts, in addition to the executive director, at an ongoing GF costs of around $500,000.

To the extent the result of the task force's work minimizes the state's exposure from cyber attacks and related technology security issues, the state will avoid the costs of such disruptions, which could otherwise be significant.

COMMENTS:

1. Purpose. This bill is intended to set forth in statute a formal structure and responsibilities for the Task Force, which is currently functioning as an ad hoc advisory body under OES. OES and CalTech, acting at the direction of Governor Brown, created the Task Force to be "a statewide partnership comprised of key stakeholders, subject matter experts, [federal agencies], and cyber security professionals from California's public sector, private industry, academia, and law enforcement.

2. Related Legislation. AB 670 (Irwin), pending in this committee, requires CalTech to conduct security assessments of the IT resources of every state agency, department or office at least once every two years.

Analysis Prepared by: Chuck Nicol / APPR. / (916) 319-2081

Date of Hearing: April 30, 2015

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Mike Gatto, Chair

ABPCA Bill Id:AB 1172

Author:(Chau) – As Introduced Ver:February 27, 2015

SUBJECT: California cyber security

SUMMARY: Creates a California Cyber Security Task Force (Task Force) within the Governor's Office of Emergency Services (OES) to act in an advisory capacity and make policy recommendations on cyber security for the State of California. Specifically, this bill:

1. Codifies the existence of the Task Force within OES.
   
   
   

2. Specifies that the membership of the Task Force shall consist of:
   
   
   

   1. The Director of OES, or his or her qualified designee;
      
      
      

   2. The Director of the Department of Technology (CalTech), or his or her qualified designee;
      
      
      

   3. The Attorney General, or his or her qualified designee;
      
      
      

   4. The Adjutant General of the Military Department, or his or her qualified designee;
      
      
      

   5. The Commissioner of the California Highway Patrol, or his or her qualified designee;
      
      
      

   6. A qualified representative of the Public Utilities Commission or California Energy Commission, who shall be appointed by the Governor;
      
      
      

   7. An individual with cyber security expertise, who shall be appointed by the Governor;
      
      
      

   8. An individual with cyber security expertise, who shall be appointed by the Senate Committee on Rules; and
      
      
      

   9. An individual with cyber security expertise, who shall be appointed by the Speaker of the Assembly.

3. Authorizes the Task Force to convene public and private stakeholders to act in an advisory capacity and compile policy recommendations on cyber security for the State of California.

4. Requires the Task Force to complete and issue a report of policy recommendations to the Governor’s office and the Legislature on an annual basis, as specified.

5. Requires the Task Force to meet quarterly, or more often as necessitated by emergency circumstances, to ensure that the policy recommendations from the report are implemented and any necessary modifications that may arise are addressed in a timely manner.

6. Authorizes OES and CalTech to conduct the strategic direction of risk assessments performed by the Military Department’s Computer Network Defense Team.
   
   
   

7. Creates within OES the position of a State Director of Cyber Security, who shall:
   
   
   

   1. Serve as the Executive Director of the Task Force;

2. Provide strategic direction for risk assessments performed with state resources;

3. Complete a risk profile of state assets and capabilities for the purpose of compiling statewide contingency plans including, but not limited to, Emergency Function 18 of the State Emergency Plan.

4. Act as a point of contact to the federal government and private entities within the state in the event of a declared emergency.
   
   
   

5. Be the Governor’s OES and CalTech [point person] on cyber security.

8. Requires the Task Force to perform the following functions based on the following priorities:

1. Develop cyber prevention, defense, and response strategies and define a hierarchy of command within the state for this purpose, including:
   
   
   

   1. Ensuring the continual performance of risk assessments on state information technology (IT) systems, including penetration tests, vulnerability scans, and other industry-standard methods that identify potential risk;

2. Creating a risk profile of public assets, critical infrastructure, public networks, and private operations susceptible to cyber-attacks using assessment results and other data; and

3. Developing statewide contingency plans including, but not limited to, Emergency Function 18 of the State Emergency Plan.

2. Partner with the United States Department of Homeland Security to develop an appropriate information sharing system that allows for a controlled and secure process to effectively disseminate cyber threat and response information and data to relevant private and public sector entities;

3. Provide recommendations for IT security standards for all state agencies using, among other things, protocols established by the National Institute for Standards and Technology (NIST);

4. Compile and integrate research conducted by academic institutions, federal laboratories, and other cyber security experts into state operations and functions;

5. Expand the state’s public-private cyber security partnership network;

6. Expand collaboration with the state’s law enforcement apparatus assigned jurisdiction to prevent, deter, investigate, and prosecute cyber-attacks and IT crime, including collaboration with entities like the High-Tech Theft Apprehension Program under the Department of Justice, and its five regional task forces, the Department of the California Highway Patrol, and the Attorney General’s eCrimes unit; and

7. Propose potential operational or functional enhancements to the state’s cyber security assessment and response capabilities, as well as investment or spending recommendations and guidance for the state’s IT budget and procurement.

1. Requires the Task Force to take all necessary steps to protect personal information and privacy, public and private sector data, and the constitutional rights and liberties of individuals, when implementing its duties.

2. Authorizes the Task Force to issue reports to the Governor’s office and the Legislature detailing the activities of the task force.

11. Authorizes the Task Force to engage or accept the services of agency or department personnel, accept the services of stakeholder organizations, and accept federal, private, or other non-state funding, to operate, manage, or conduct the business of the Task Force.

12. Requires each state department and agency to cooperate with the Task Force and furnish it with information and assistance that is necessary or useful.

13. Declares the provisions enacted by this bill to be inoperative and repealed as of January 1, 2020.

EXISTING LAW:

1. Establishes CalTech within the Government Operations Agency, headed by the Director of Technology who is also known as the State Chief Information Officer. CalTech is responsible for the approval and oversight of IT projects by, among other things, consulting with agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. (Government Code (GC) Sections 11545, 12803.2)

2. Requires each state agency to have a chief information officer who is appointed by the head of the state entity, and is responsible for supervising all IT, including information security. (GC 11546.1)

3. Establishes the Office of Information Security (OIS) within DOT, which is responsible for ensuring the confidentiality, integrity, and availability of state systems and applications. The law requires the OIS to develop an information security program and establish policies, standards, and procedures directing state agencies to effectively manage security and risk. (GC 11549, et seq.)
   
   

4. Establishes an information security program within OIS, which is responsible for information security and privacy policies for state agencies in the State Administrative Manual, and for policies that pertain to security and risk management, tracking of security and privacy incidents, agency disaster recovery plans, coordination with other agencies, agency compliance, promotion of risk management and privacy programs, and representation of the state on matters related to information security and privacy. (GC 11549.3(a-b))
   
   

5. Authorizes OIS to conduct, or require to be conducted, independent security assessments of any state agency, department, or office, the cost of which shall be funded by the state agency, department or office being assessed. (GC 11549.3(c))

6. Authorizes OIS to require an audit of information security to ensure program compliance, the cost of which shall be funded by the state agency, department, or office being audited, and requires the office to report to CalTech any state agency found to be noncompliant with information security program requirements. (GC 11549.3(d-e))

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of this bill. This bill is intended to set forth in statute a formal structure and responsibilities for the Task Force, which is currently functioning as an ad hoc advisory body under OES. AB 1172 is author-sponsored.

2. Author's statement. According to the author, "As our state’s operations become more digitally connected, [the state] is more vulnerable to both foreign and domestic cyber-attacks. Recent cyber-attacks on private and public entities have shown that these attacks are growing in number and are becoming increasingly sophisticated. These attacks can originate not just from individual hackers, but from crime networks, foreign governments, and even terrorist[s]. Such attacks, if successful, could wreak havoc on the state by shutting down critical infrastructure, crippling public and private industries, and causing widespread economic harm and potentially loss of life.

"Unfortunately, the state’s overall capability to coordinate and respond to cyber-attacks in both the public and private sector is fragmented. Currently, the state’s cybersecurity responsibilities are administered by the Department of Technology’s Information Security Office. In addition, the Office of Emergency Services is responsible for critical infrastructure protection and related emergency response matters.

"AB 1172 would codify the Governor’s existing Cybersecurity Task force under the Governor’s Office of Emergency Services. The bill creates a State Director of Cyber Security to oversee the taskforce. The taskforce will meet quarterly and consist of members from government, private industries, and academia. The taskforce will develop a comprehensive cybersecurity strategy to asses and enhance the state’s preparedness and response capabilities to cyber-attacks."

3. California and the cyber security threat. According to the California Military Department, California's size and prominence makes it vulnerable to cyber incidents that disrupt business, shutdown critical infrastructure, and compromise intellectual property or national security. In 2012, 17 % of the data breaches recorded in the United States took place in California – more than any other state; and the number of reported breaches in California increased by 28 % in 2013. California leads the nation in high tech employment and cyber innovation with 40 % of all U.S. venture capital investment in cyber residing here.
   
   CMD calls cybercrime "a growth industry" causing $400 billion in negative impacts annually on the global economy. Thirty percent of all cyber-attacks and other malicious activity are targeted at the government, making these networks and systems the most vulnerable target of cybercrime.
   
   According to CMD, the State of California is extremely vulnerable to cyber incidents that can disrupt industry, compromise personal information, shutdown critical infrastructure and compromise intellectual property or national security. A targeted attack on critical infrastructure and key resources could cause up to $1 billion dollars of economic impact to California each day until services are restored.

However, successful attacks against state government networks have not been overwhelming, at least not yet. According to a March 5, 2015, article by the Brookings Institute, "[a]t present, government has been less affected by security breaches than the private sector. By late 2014, The Privacy Rights Clearinghouse (which maintains a list of all publicly reported data breaches) recorded only 27 incidents involving government entities which included a data breach involving 800,000 employees and 2.9 million customers at the U.S. Postal Service, 850,000 job seekers in Oregon, and background data on 25,000 underground investigators at the U.S. Department of Homeland Security."

Nevertheless, there have substantial efforts at the federal level and across the country to better prepare for cyber-attacks. In February 2013, President Obama signed Executive Order 13636, which calls for the development of what NIST called "a voluntary risk-based Cybersecurity Framework – a set of industry standards and best practices to help organizations manage cybersecurity risks. The resulting Framework, created through collaboration between government and the private sector, uses a common language to address and manage cybersecurity risk in a cost-effective way based on business needs without placing additional regulatory requirements on businesses." In response, NIST issued its policy recommendations in February 2014.

Shortly after the release of EO 13636, Governor Brown convened the California Cyber Security Task Force in May 2013 to assess departmental technology systems and assemble key stakeholders to discuss cyber security issues to ensure that the state was adequately prepared to protect and respond to potential cyber-attacks on the state’s systems. The Task Force was created by executive action with no corresponding basis in statute, and remains in operation today.

4. The work of the existing Task Force. OES and CalTech, acting at the direction of Governor Brown, created the Task Force to be "a statewide partnership comprised of key stakeholders, subject matter experts, [federal agencies], and cyber security professionals from California's public sector, private industry, academia, and law enforcement. The Task Force serves as an advisory body to the State of California Senior Administration Officials in matters related to Cybersecurity." The Task Force holds public meetings once per quarter. Its express mission is to "enhance the security of California digital infrastructure and to create a culture of cybersecurity through collaboration, information sharing, and education and awareness."
   
   The Task Force operates as an advisory body only – it has no formal authority, it takes no votes, it has no budget, and its membership is open and voluntary. It is currently comprised of seven subcommittees: risk mitigation; information sharing; workforce development and education; economic development; emergency preparedness; legislation and funding; and high tech and digital forensics.
   
   According to an October 2013 article in Techwire, "[i]n the few months since the task force formed, approximately 50 entities have joined the effort, including representatives from the National Fusion Center Association (NFCA), the FBI, the Sacramento Utility District, Cyber Watch West (CWW), and private companies such as Verizon, Bank of America and Symantec."
   
   

5. Practical considerations for the Committee. Practically speaking, this bill would codify a structure and set of responsibilities for a Cyber Security Task Force that are slightly different from the way the Task Force currently operates.
   
   As noted above, the major provisions of this bill are the specification of the membership; the creation of a State Director of Cyber Security; explication of seven major sets of responsibilities, meeting and report requirements; and a sunset date of January 1, 2020.

This bill does not grant the Task Force specific powers vis-à-vis other executive agencies, and the question of voting power is not addressed. Presumably then, the Task Force would remain advisory in nature and without authority to take action beyond what is delegated to it by other agencies. However, this point is not entirely clear, as the bill does require state agencies and departments to "cooperate" with the Task Force and "furnish it with information and assistance that is necessary or useful to further the purposes" of the bill.

Furthermore, if the Task Force does not exercise power or take votes, then there is some question as to the utility of specifying membership, which would appear to exclude other parties from being formal members of the Task Force (the current Task Force has over 300 members ranging from representatives of state and federal agencies to private individuals).

It is important to note that this bill is not sponsored by any executive branch agency associated with the existing Task Force, and no executive-branch agency has taken a formal position on the bill. There is also no formal support or opposition, although the California State Sheriffs' Association (CSSA) has taken a 'support if amended' position if the bill is changed to add a representative to the Task Force who is selected by CSSA.

6. Related legislation. AB 670 (Irwin) would require CalTech to conduct security assessments of the IT resources of every state agency, department or office at least once every two years. AB 670 is currently pending in the Assembly Appropriations Committee.

AB 739 (Irwin) would require the Attorney General to create a registry of private entities that intend to engage in communication of cyber security-threat information, and would further provide that there is no civil or criminal liability for a registered entity based upon its communication of cyber security-threat information to another public or private entity. AB 739 is currently pending in the Assembly Judiciary Committee.

7. Prior legislation. AB 2200 (Perez) of 2014 would have created a thirteen member California Cyber Security Steering Committee within OES, and would have continued the existence of the California Cyber Security Task Force until January 1, 2020. This bill was held at the Assembly Desk.

SB 1286 (Corbett) of 2014 would have raised from $35 million to $65 million the amount that the Public Utilities Commission may devote to research and development projects for the purposes of cyber security and grid integration. This bill was held in the Senate Rules Committee.

AB 1620 (Rodriguez) of 2014 would have established in state government the California Emergency Management and Disaster Preparedness Commission as a statewide executive-level commission to assess and improve the condition of the state’s emergency preparedness, management, and disaster recovery capabilities. This bill was vetoed by Governor Brown.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Opposition

None on file.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200