The California Emergency Services Act requires the Governor to coordinate the State Emergency Plan and any programs necessary for the mitigation of the effects of an emergency in this state, as specified. The act also establishes, within the office of the Governor, the Office of Emergency Services and requires it to perform various duties with respect to specified emergency preparedness, mitigation, and response activities in the state.

This bill would authorize the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information, as those terms are defined, to the Office of Emergency Services, or any other designee, for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information, as provided.

The California Public Records Act requires state and local agencies to make their records available for public inspection, unless an exemption from disclosure applies. The act exempts from these disclosure requirements, among other documents, critical infrastructure information, as defined, that is voluntarily submitted to the Office of Emergency Services for use by that office.

This bill would provide that critical infrastructure information obtained pursuant to its provisions would be confidential and not subject to disclosure under the California Public Records Act, subpoena, or discovery, or admissible as evidence in any private civil action.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Isadore Hall, III

Chair

2015 - 2016 Regular

Bill No: SB Hearing Date: 4/12/2016

SUBJECT:

DIGEST: This bill authorizes the Governor to require owners and operators of critical infrastructure, as defined, to submit critical infrastructure information, as defined, to the California Office of Emergency Services, or any other designee, for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information, as provided.

ANALYSIS:

Existing law:

1. Requires, under the California Emergency Services Act, the Governor to coordinate the State Emergency Plan and any programs necessary for the mitigation of the effects of an emergency in this state, as specified.
2. Establishes, within the office of the Governor, the Office of Emergency Services (OES) and requires it to perform various duties with respect to specified emergency preparedness, mitigation, and response activities in the state.
3. Requires, under the California Public Records Act, state and local agencies to make their records available for public inspection, unless an exemption from disclosure applies. The act exempts from these disclosure requirements, among other documents, critical infrastructure information, as defined, that is voluntarily submitted to OES.
4. Requires that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill:

1. Authorizes the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to OES, or any other designee, for the following purposes:
   1. To gather and analyze critical infrastructure information in order to better understand security problems and interdependencies related to critical infrastructure, so as to ensure the availability, integrity, and reliability of that critical infrastructure.
   2. To communicate or disclose critical infrastructure information to help prevent, detect, mitigate, or recover from the effects of interference, compromise, or incapacitation problem related to critical infrastructure.
2. Provides that critical infrastructure information obtained pursuant to this bill shall be confidential and privileged and shall not be subject to disclosure pursuant to the California Public Records Act, subpoena, or discovery, or admissible as evidence in any private civil action.
3. Defines “critical infrastructure” as systems and assets so vital to the state that the incapacity or destruction of those systems or assets would have a debilitating impact on security, economic security, public health and safety, or any combination of those matters.
4. Defines “critical infrastructure information” as information not customarily in the public domain pertaining to any of the following:
   1. Actual, potential, or threatened interference, or an attack on, compromise of, or incapacitation of critical infrastructure by either physical or computer-based attack or other similar conduct, including the misuse of, or unauthorized access to, all types of communications and data transmission systems, that violates federal, state, or local laws, harms economic security, or threatens public health or safety.
   2. The ability of critical infrastructure to resist any interference, compromise, or incapacitation, including any planned or past assessment or estimate of the vulnerability of critical infrastructure, including security testing, risk evaluation, risk management planning, or risk audits.
   3. Any planned or past operational problem or solution regarding critical infrastructure, including repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to interference, compromise, or incapacitation of critical infrastructure.
5. Makes legislative findings demonstrating the interest protected by the limitation and the need for protecting that interest.

Background

Purpose of the bill. According to the author, “In recent years, critical infrastructure in the United States has been subject to a number of attacks by cybercriminals, including a 2014 incident where an overseas hacker gained access to systems regulating the flow of natural gas. These incidents have prompted state and federal leaders to warn operators of critical infrastructure of the need to bolster cyber defenses to protect against debilitating attacks that threaten our public safety and economic well-being.”

The author further argues that, “however, since many of these actors are hesitant to admit to weaknesses in their defenses, getting sufficient information to accurately assess California’s critical infrastructure cyber defenses has proven difficult.”

Snapshot of California’s Critical Infrastructure. According to OES, the following represents a snapshot of California’s critical infrastructure:

• Water: 1468 dams, of which 140 have capacities greater than 10,000 acre-fee; 701 miles of canals and pipelines; and 1.595 miles of levees.
• Electrical Power: 1,008 in state power plants, nearly 70,000 megawatts install generation capacity, and substations and transmission lines deliver over 200 billion kilowatt hours to customers annually.
• Oil and Natural Gas: over 115,000 miles of oil and natural gas pipelines, 20 refineries and over 100 oil and natural gas terminal facilities, and more than a dozen of the U.S.’s largest oil fields.
• Transportation: over 170,000 miles of public roads; over 50,000 lane miles of highways; over 12,000 bridges; 246 public use airports, 30 of which provide scheduled passenger service. Los Angeles Airport is the seventh busiest worldwide.
• California has 11 seaports handling more than half of all the US shipping freight. Three of the country’s largest container ports are in California: Los Angeles, Long Beach and Oakland. Nationally, Los Angeles is the busiest container volume, internationally the eight busiest, and when combined with Long Beach is the fifth busiest.
• Public Health: 450 acute care hospitals.
• Emergency Services: 1,974 fire stations.
• Chemical: Approximately 95 “high risk” facilities
• Agriculture: 81,500 farms; more than 400 commodities; in 2012 total agriculture-related sales for output was $44.7 billion, representing 11.3% of the national total.
• Finance: 7,374 commercial banks with deposits totaling $753 billion; 410 credit unions with assets totaling $115 billion.

Critical Infrastructure Protection Division. The Critical Infrastructure Protection Division’s (CIP), within OES, focus is to better protect, secure, and reduce vulnerabilities to the state’s critical infrastructure assets using risk-based methodologies, vulnerability and security assessments, and information sharing practices and tools among different critical infrastructure sectors.

The CIP assesses risk to California’s critical infrastructure, fulfills federal data requests for homeland security and emergency management programs, and develops related guidelines and/or policies. Additionally, the CIP develops and implements California’s Critical Infrastructure Protection Program to include risk management and analyses for the identification, prioritization and protection of California’s critical assets from natural and technological hazards, human caused threats, and for situational awareness and emergency management/incident response and planning. In addition, The CIP and partner assessors provide infrastructure owners and managers with risk reductions options, as well as tools and training to help manage risk to their assets, systems, and networks.

Critical Infrastructure Information Act of 2002. Enacted as part of the Homeland Security Act of 2002, the Critical Infrastructure Act of 2002 created a framework, known as the Protected Critical Infrastructure Information (PCII) Program, that enables members of the private sector and others to voluntarily submit sensitive information regarding the nation’s critical infrastructure to the Department of Homeland Security (DHS) with the assurance that the information, if it satisfies certain requirements, will be protected from public disclosure.

The Act specifies that if an individual will be working with PCII, the individual would have to be a federal, state, tribal, or local government employee, complete training on the proper handling and safeguarding of PCII, have homeland security responsibilities, and sign a non-disclosure agreement. Once an individual becomes an authorized user, their access to individual items of PCII will be determined by a need-to-known basis. Becoming an authorized user is a necessary step to accessing PCII, but it is not the only requirement.

Staff Comments: While the committee must first determine the merits of allowing the Governor the power to request critical infrastructure information from private businesses, the author may wish to consider amendments to the bill to require Cal OES to develop a training program similar to the federal PCII Program including restrictions on who can access PCII and training on the proper handling and safeguarding of PCII. This should include requirements that if an individual will be working with PCII, the individual would have to be a federal, state, tribal, or local government employee, complete training on the proper handling and safeguarding of PCII, have homeland security responsibilities, and sign a non-disclosure agreement.

In addition, the current definition of “critical infrastructure” includes “systems and assets so vital to the state that the incapacity or destruction of those systems or assets would have a debilitating impact on security, economic security, public health, and safety, or any combination of those matters.” While this definition mirrors the definition used by DHS, it is quite vague and could include most businesses throughout the state as long as the Governor determines that those businesses fall under the definition of critical infrastructure. The author may wish to amend the bill to narrow the definition of “critical infrastructure” to more closely reflect the intention of the bill.

Prior/Related Legislation

AB 1841 (Irwin, 2016) would require OES to transmit to the Legislature, on or before July 1, 2017, the Cyber Security Annex to the State Emergency Plan and would require OES to develop a comprehensive cybersecurity strategy setting standards for state agencies. (Pending in the Assembly Governmental Organization Committee)

SB 1444 (Hertzberg, 2016) would require an agency that owns or licenses computerized data that includes personal information to prepare a computerized personal information security plan that details the agency’s strategy to respond to a security breach of computerized personal information and associated consequences caused by the disclosed personal information. (Pending in Senate Judiciary Committee)

AB 670 (Irwin, Chapter 518, Statutes of 2015) requires the Office of Information Security, in consultation with OES, to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of an independent security assessment.

AB 1172 (Chau, 2015) would continue in existence the California Cyber Security Task Force which is tasked with developing a comprehensive cyber-security strategy to assess and enhance the state’s preparedness and response capabilities to cyber-attacks. (Pending on the Senate Inactive File)

SB 573 (Pan, 2015) would create the position of Chief Data Officer to be appointed by the Governor on or before June 1, 2016, who is tasked with creating a statewide open data portal to provide public access to data sets from state agencies. (Held in the Assembly Appropriations Committee)

AB 2091 (Conway, Chapter 205, Statutes of 2010) exempts from disclosure under the California Public Records Act information security records that would reveal vulnerabilities of an information technology system or increase the potential for cyber-attacks.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT:

Los Angeles County Professional Peace Officers Association

OPPOSITION:

American Insurance Association

California Cable & Telecommunications Association

California Chamber of Commerce

California Hospital Association

California Manufacturers and Technology Association

California Railroad Industry

Computing Technology Industry Association – Comp TIA

CTIA – The Wireless Association

Silicon Valley Leadership Group

State Privacy and Security Coalition, Inc.

ARGUMENTS IN SUPPORT: The Los Angeles County Professional Peace Officers Association argues that, “in recent years, critical infrastructure in the United States has been subject to a number of attacks by cybercriminals, including a 2014 incident where an overseas hacker gained access to systems regulating the flow of natural gas. These incidents have prompted state and federal leaders to warn operators of critical infrastructure of the need to bolster cyber defenses to protect against debilitating attacks that threaten our public safety and economic well-being. Recognizing the sensitive nature of the information disclosed to OES, this bill protects critical infrastructure information from public disclosure or from being used in private litigation.”

ARGUMENTS IN OPPOSITION: The California Chamber of Commerce argues that, “SB 949 increases security risks by tasking state agencies with protecting private industry’s security information collected under the new authority. Housing this sensitive information within the state creates a high value target to hackers; they can acquire massive amounts of information effectuating a few breaches. Compounding this security issue is a recent state audit and legislative hearing that revealed issues with the State’s cybersecurity strategies, systems and protocols. Specifically, the audit found that 73 of 77 state agencies audited did not meet cybersecurity standards.”

The California Cable & Telecommunications Association believes that “the Cybersecurity Act and the Critical Infrastructure Information Act provide for the essential exchange of information with federal, state, and local governments, to protect our national security with appropriate safeguards. SB 949 would create similar requirements without providing any of the protections offered at the federal level and could subject critical infrastructure providers to the very risks that the federal law’s voluntary reporting mechanism sought to avoid.”

DUAL REFERRAL: Senate Judiciary Committee