(1)The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law requires the Department of Technology, in consultation with the Office of Emergency Services and in compliance with the information security program required to be established by the Chief of the Office of Information Security, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information.

Existing law requires a person or business conducting business in California that owns or licenses computerized data that includes personal information to disclose expeditiously and without unreasonable delay a breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person where if the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person, and the person or business that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or usable.

This bill would require, on or after January 1, 2019, a critical infrastructure business that experiences a breach of security of critical infrastructure information or critical infrastructure controls and is required by federal law to disclose that breach to also disclose that breach to the Office of Emergency Services. Services, as specified. The bill would deem a critical infrastructure business to be in compliance with this requirement with respect to a breach if it complies with specified requirements related to disclosing that breach to the multistate information sharing and analysis center. The bill would require a critical infrastructure business to disclose breaches in a form and manner provided by the office, and without unreasonable delay, except as provided. The bill would otherwise prohibit public disclosure of the information and reports required by its provisions.

(2)Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. By executive order in 2015, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center (CalSIC) with the primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state.

This bill would state the intent of the Legislature to enact subsequent legislation that would require certain companies to confidentially report cyberattacks to CalSIC, and would impose certain duties on CalSIC with respect to the information submitted.

Date of Hearing: May 17, 2017

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

ABPCA Bill Id:AB 1359

Author:(Chau) – As Amended Ver:April 27, 2017

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires California businesses to report a breach of security of their critical infrastructure controls or information to the Office of Emergency Services (OES) if the breach is already required to be reported to federal authorities under federal law. Specifically, this bill:

1. Requires a critical infrastructure business that experiences a breach of security of critical infrastructure information or controls, and is required to disclose that breach to federal authorities, to disclose that breach to OES within a reasonable amount of time after discovery and in the form and manner required by OES. However, this bill authorizes a critical infrastructure business to delay disclosure to OES for specified reasons.
2. Authorizes and encourages a critical infrastructure business that is not required to disclose that breach under federal law to disclose that breach to OES.
3. Authorizes OES to promulgate regulations to further define the terms used in this bill and to provide guidance as to the types of companies and attacks considered reportable under these provisions.

FISCAL EFFECT:

GF costs of $800,000 to OES, primarily for four cyber intelligence analysts to monitor the reported data breaches.

COMMENTS:

1. Background. Existing law requires a person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose a breach of the security of the system or data to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. In addition, some information about data breaches is required to be reported to the federal government.
2. Purpose. This bill would require that information about data breaches be reported to OES. According to the author, "In the United States in recent years, cyber-attacks have been directed against hospitals, dams, power plants and other elements of the country's 'critical infrastructure' – the systems and assets so vital to the United States that the incapacity or destruction of those systems and assets would have a debilitating impact on security, national economic security, national public health or safety."
   
   The author also states, "Providing adequate protection for all these assets will not be easy because the critical infrastructure sector is so large. One approach to ensuring that the individual businesses in each of those sectors are in the best position to defend against attack is by helping share attack information more quickly with other companies, so the broader community can best organize and respond to identify and defeat a certain line of attack.”

Analysis Prepared by: Jessica Peters / APPR. / (916) 319-2081

Date of Hearing: April 25, 2017

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 1359 (

Author:Chau) – As Amended Ver:April 17, 2017

SUBJECT: California Cybersecurity Integration Center

SUMMARY: Requires California businesses to report a breach of security of their critical infrastructure controls or information to the Office of Emergency Services (OES) if the breach is already required to be reported to federal authorities under federal law. Specifically, this bill:

1. Requires a critical infrastructure business that experiences a breach of security of critical infrastructure information or controls, and is required to disclose that breach to federal authorities, to disclose that breach to OES within a reasonable amount of time after discovery.
2. Authorizes and encourages a critical infrastructure business that is not required to disclose that breach under federal law to disclose that breach to OES.
3. Requires a critical infrastructure business to disclose a breach to OES in the form and manner required by OES, in the most expedient way possible.
4. Authorizes a critical infrastructure business to delay disclosure to OES for either of the following reasons:
   1. A law enforcement agency determines that the notification will impede a criminal investigation, provided that the notification is made promptly after the law enforcement agency determines that it will not impede the investigation; or,
   2. The delay is necessary to determine the scope of the breach and to restore the reasonable integrity of the data system.
5. Authorizes OES to promulgate regulations to further define the terms used in this bill and to provide guidance as to the types of companies and attacks considered reportable under these provisions.
6. Declares that the information and reports required by this bill are confidential and shall not be disclosed pursuant to any state law, including but not limited to, the California Public Records Act.
7. Defines the terms "breach of security," "critical infrastructure," "critical infrastructure business," "critical infrastructure controls," "critical infrastructure information," and "critical infrastructure sector."
8. Makes findings and declarations relative to the importance of preventing public disclosure of the cybersecurity preparations and critical infrastructure information.

EXISTING LAW:

1. Requires a person or business conducting business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, a breach of the security of the system or data, as defined, following discovery or notification of the security breach, to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. (Civil Code) Section 1798.82)
2. Authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The Act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The Act creates within the office of the Governor the OES, which is responsible for the state’s emergency and disaster response services, as specified. (Government Code Sections 8550-8668, et seq.; 8569; 8585)
3. Requires, by Executive Order in 2015, OES to establish and lead the California Cybersecurity Integration Center (Cal-CSIC), with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state. (Executive Order B-34-15)
4. Requires, by Executive Order, that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. (Executive Order B-34-15)

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of this bill: This bill is intended to increase awareness at the state level of electronic breaches of security for businesses operating "critical infrastructure" in California, which in turn would facilitate threat information sharing within those sectors. AB 1359 is author-sponsored.
2. Author's statement: According to the author, "[i]n the United States in recent years, cyber-attacks have been directed against hospitals, dams, power plants and other elements of the country's 'critical infrastructure' – the systems and assets so vital to the United States that the incapacity or destruction of those systems and assets would have a debilitating impact on security, national economic security, national public health or safety."
   
   "Providing adequate protection for all these assets will not be easy because the critical infrastructure sector is so large. One approach to ensuring that the individual businesses in each of those sectors are in the best position to defend against attack is by helping share attack information more quickly with other companies, so the broader community can best organize and respond to identify and defeat a certain line of attack.
   
   "Public-private partnerships will be necessary to make information sharing work. However, the usefulness of this system and others is hampered by the fact that critical infrastructure businesses are not required to report threat information to the California Cybersecurity Integration Center. Some are required to report certain types of attacks to federal agencies, but there is no state requirement that a cyber-attack that does not cause the loss of personally identifiable information be reported to a state agency – and other businesses in that sector that may not be alerted in time could suffer as a result.

"AB 1359 aims to increase awareness at the state level of electronic breaches of security for businesses operating 'critical infrastructure' in California. Cyber-attacks that lead to unauthorized access to critical infrastructure controls or unauthorized acquisition of critical infrastructure information that compromises the security, confidentiality or integrity of critical infrastructure and are already reported to the Federal Government, must be reported to the state's Office of Emergency Services (OES), unless otherwise exempted."

1. Understanding "critical infrastructure": Critical infrastructure is broadly defined in the federal Patriot Act as those "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters." (42 U.S.C. 5195c(e), section 1016(e))

Recognizing the need to coordinate with the nation's owners and operators of critical infrastructure in order to ensure its security, in 2013 President Obama issued Executive Order 13636: Improving Critical Infrastructure Cybersecurity (EO 13636) and Presidential Policy Directive-21 Critical Infrastructure Security and Resilience (PPD-21). EO 13636 directed the Executive Branch to develop a cybersecurity framework for critical infrastructure protection. PPD-21 replaced an earlier directive, and laid out an updated National Infrastructure Protection Plan (NIPP).

PPD-21 identifies 16 critical infrastructure sectors as the basis of the NIPP, subject to change by the Secretary of Homeland Security: Chemical; Commercial Facilities; Communications; Critical Manufacturing; Dams; Defense Industrial Base; Emergency Services; Energy; Financial Services; Food and Agriculture; Government Facilities; Healthcare and Public Health; Information Technology; Nuclear Reactors, Materials, and Waste; Transportation Systems; Water and Wastewater Systems.

The directive also delegates to certain federal agencies the task of deciding what constitutes critical infrastructure within their specific sector: “…all Federal department and agency heads are responsible for the identification, prioritization, assessment, remediation, and security of their respective internal critical infrastructure that supports primary mission essential functions.”

In practice, the definition of a critical infrastructure business affected by the requirements of this bill would be based on what businesses are identified as critical infrastructure in the sector-specific plans issued by the federal agencies under the NIPP.

1. Understanding threat information-sharing: According to the U.S. Department of Homeland Security (DHS), "information sharing is essential to the protection of critical infrastructure and to furthering cybersecurity for the nation. As the lead federal department for the protection of critical infrastructure and the furthering of cybersecurity, DHS has developed and implemented numerous information sharing programs. Through these programs, DHS develops partnerships and shares substantive information with the private sector, which owns and operates the majority of the nation’s critical infrastructure."
   Threat information-sharing is based on the idea that the faster individual entities share information about cyberattacks discovered on their networks, the faster other entities can prepare more effective defenses – thereby reducing vulnerability to cyberattack across the entire system.
   
   Coordinated information-sharing as a defensive tactic is not new. One well-established example is the creation of the Information Sharing and Analysis Centers (ISAC) for the financial services industry by Presidential Decision Directive 63 in 1998. The directive requested the public and private sector to create a partnership to share information about physical and cyber threats, vulnerabilities, and events to help protect the critical infrastructure of the United States. After analysis by industry experts, alerts are delivered to participants based on their level of service. ISACs are non-profit, member-driven organizations formed by critical infrastructure owners and operators to share information between government and industry. Today there are ISACs for 14 critical infrastructures, such as financial services, electric, energy and surface transportation.
   
   The Multi-State Information Sharing and Analysis Center (MS-ISAC) is the designated ISAC for state, local, tribal and territorial governments. The MS-ISAC provides services and information sharing that significantly enhances state and local governments’ ability to prevent, protect against, respond to and recover from cyberattacks and compromises. DHS maintains operational-level coordination with the MS-ISAC through the presence of MS-ISAC analysts in the National Cybersecurity and Communications Integration Center to coordinate directly with its own 24x7 operations center that connects with state and local government stakeholders on cybersecurity threats and incidents. California is a member of MS-ISAC and also represented on the executive committee, and 74 cities and counties within the state are listed as members.
   
   This bill would exempt from the breach reporting requirement any disclosure made to the MS-ISAC.
2. The creation of Cal-CSIC: In April 2016, OES stood up the Cal-CSIC alongside the State Threat Assessment Center (STAC), California’s information-sharing clearinghouse of strategic threat analysis and situational awareness reporting. This co-location ensured immediate collaboration across the State Threat Assessment System, California’s intelligence community.
   
   One of the major functions of Cal-CSIC is information sharing: facilitating the sharing of cyber threat information, providing warnings of cyberattacks to public and private sector entities, assessment of risks to critical infrastructure and computer networks, prioritization of threats and supporting public and private-sector partners, sharing of best practices, and supporting cybersecurity assessments, audits and accountability programs. Related to that responsibility, Cal-CSIC is also charged with developing a statewide cybersecurity strategy and a Cyber Incident Response Team.

According to OES, since April of 2016, "Cal-CSIC representatives from Cal OES, the California Department of Technology, the California Military Department, and the California Highway Patrol [have been] pooling resources to implement cyber vulnerability assessments and develop intuitive cyber threat alerts for the end-user. California receives a great deal of cyber threat information from other local, state, and national partners, but rarely receive a strategic look at the motivations behind these threats and the techniques to prevent, mitigate, or respond to them. The Cal-CSIC endeavors to provide useful information that will help protect California’s residents and infrastructure."

1. Critical infrastructure breach reporting requirements: This bill imposes a breach reporting requirement on critical infrastructure businesses that already have some form of federal reporting requirement. However, because the 16 sectors that constitute "critical infrastructure" are so broad, it is difficult to know which types of business already have such reporting requirements and would be covered by this bill.

However, one example of federal reporting requirements would be those for the utility industry. Currently, the North American Electric Reliability Corporation Critical Infrastructure Protection standards require large cyber incidents be reported to the ISAC for the energy industry and/or the Department of Energy if they are of a particular size (such as gas releases that cause death, injury, substantial property damage, or total more than 3 million cubic feet).

This bill also encourages voluntary threat information sharing, for which the federal government has already instituted the Protected Critical Infrastructure Information Program (PCII). The protections offered by the PCII Program are intended to enhance the voluntary sharing of critical infrastructure information between infrastructure owners and operators and the government, and give homeland security partners confidence that sharing their information with the government will not expose sensitive or proprietary data.

1. Arguments in opposition: A coalition of business organizations led by the California Chamber of Commerce writes that AB 1359 "imposes vague and excessive data breach reporting requirements on critical infrastructure businesses, thereby putting sensitive information at risk."
   
   "AB 1359 requires a critical infrastructure business in California that has a breach of security of critical infrastructure information or controls, and is required by federal law to disclose that breach, to also disclose the breach to the Office of Emergency Services (OES). By expanding the entities required to receive this notification, AB 1359 significantly increases the exposure risk for this sensitive information. This would counter the bill’s intended purpose by causing a greater threat to public safety. Federal protections already exist to safeguard critical infrastructure. [EO13636] seeks to strengthen the nation’s cyber defenses by increasing information sharing and protecting national security and Americans’ privacy. In response to the needs and goals of this effort, the federal government has worked toward similar aims. We are supportive of this effort but we believe it is unnecessary for the state to mandate a separate, duplicative reporting requirement on critical infrastructure businesses.
   
   "Further, the safe harbor provisions in AB 1359 deeming businesses to be in compliance if they disclose a breach to the “multistate information sharing ad analysis center” are vague, as are the provisions specifying how a business would report a breach to OES. In addition, AB 1359 gives overly-broad regulatory power to the state, allowing OES to “further define the terms used in (AB 1359) and provide guidance as to the types of companies and attacks considered reportable” under the bill. This would create too much uncertainty, and such policy determinations should be made via the legislative process.

"Finally, as written, AB 1359 would compel critical infrastructure businesses in California to report breaches that occur outside of the state – so, if a breach occurred in Vermont, it would have to reported here in California. Mandating the reporting of information that is extraneous to the state’s security is unnecessary and cumbersome, resulting in senseless costs and distracting from relevant security threats."

1. Question for the Committee: It should be noted that the reporting requirements of this bill do not clearly address cases where only a breach of personally identifiable information (PII) has occurred. Given that protection of critical infrastructure was the intention of the bill, the author and Committee may wish to consider adding a clarifying amendment stating that any breach reported to the Department of Justice under the state's existing data breach law would be exempt from reporting under this bill.

Add to Section 8669.1:

(f) Notwithstanding subdivision (a), a person or business that experiences a breach of security that results only in the loss of personal information, and reports that breach to the Attorney General in compliance with Section 1798.82(f) of the Civil Code, shall be deemed to be in compliance with the notification requirements of this section.

1. Related legislation: AB 1306 (Obernolte) would establish Cal-CSIC, require it to develop a cybersecurity strategy for California, and require the Director of Emergency Services to administer federal grant money for cybersecurity prevention measures. This bill is pending in the Assembly Appropriations Committee.

AB 1116 (Grayson) would establish the Peer Support and Crisis Referral Services Act, which is unrelated to cybersecurity, but would occupy the same new section in the Government Code as AB 1359. This bill is currently pending in the Assembly Appropriations Committee.

1. Prior legislation: SB 949 (Jackson) of 2016 would have authorized the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to OES for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information. This bill was held in the Senate Governmental Organization Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

California Bankers Association

California Cable and Telecommunications Association

California Chamber of Commerce

California Hospital Association

California Manufacturers and Technology Association

TechNet

Analysis Prepared by: Hank Dempsey / P. & C.P. /