Existing federal law charges various federal agencies with responsibilities related to the security of critical infrastructure, including election infrastructure. By Executive Order, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state. Existing state law authorizes the Chief of the Office of Information Security in the Department of Technology to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. Existing state law also requires the Secretary of State and county elections official to perform specified tasks related to the security of voting systems, ballots, and other election materials.

This bill would require the Office of Information Security in the Department of Technology, the Office of Emergency Services, and the California Military Department to establish a pilot program to conduct, or require to be conducted, an independent security assessment of election infrastructure that is accessible through an Internet connection in up to 5 counties that voluntarily choose to participate in the pilot program, as specified. The bill would require the Office of Information Security in the Department of Technology, the Office of Emergency Services, and the California Military Department to transmit the complete results of each independent security assessment and recommendations for mitigating system vulnerabilities, if any, to the elections official of the county in which the assessment was conducted and the Secretary of State. The bill would require these agencies to also prepare and submit a joint report to the Legislature regarding any assessments conducted.

The bill would repeal these provisions on January 1, 2023.

Existing federal law charges various federal agencies with responsibilities related to the security of critical infrastructure, including election infrastructure. By Executive Order, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state. Existing state law authorizes the Chief of the Office of Information Security in the Department of Technology to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. Existing state law also requires the Secretary of State and county elections official to perform specified tasks related to the security of voting systems, ballots ballots, and other election materials.

This bill would require the Office of Information Security in the Department of Technology, the Office of Emergency Services, and the California Military Department to establish a pilot program to conduct, or require to be conducted, an independent security assessment of election infrastructure in participating counties, counties that voluntarily choose to participate in the pilot program, as specified. The bill would require the Office of Information Security in the Department of Technology, the Office of Emergency Services, and the California Military Department to transmit the complete results of each independent security assessment and recommendations for mitigating system vulnerabilities, if any, to the applicable county elections officials elections official of the county in which the assessment was conducted and the Secretary of State. The bill would require these agencies to also prepare and submit a joint report to the Legislature regarding any assessments conducted.

The bill would repeal these provisions on January 1, 2023.

Existing law requires the Department of Technology, on or before July 1, 2018, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency, as specified.

This bill would make a nonsubstantive change to that provision.

 THIRD READING  

Bill No: AB 2748

Author:

:

Vote:

SENATE ELECTIONS & C.A. COMMITTEE: 5-0, 6/19/18

AYES: Stern, Anderson, Allen, Hertzberg, Leyva

SENATE GOVERNMENTAL ORG. COMMITTEE: 13-0, 6/26/18

AYES: Dodd, Wilk, Bradford, Cannella, Gaines, Galgiani, Glazer, Hill, Hueso, Lara, Portantino, Vidak, Wiener

SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/16/18

AYES: Portantino, Bates, Beall, Bradford, Hill, Nielsen, Wiener

ASSEMBLY FLOOR: 78-0, 5/31/18 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST:

This bill requires the Office of Information Security (OIS), the Office of Emergency Services (OES), and the California Military Department (CMD) to establish a pilot program to conduct independent security assessments (ISAs) of election infrastructure in up to five counties that voluntarily participate in the pilot program until 2023, if certain conditions are met.

ANALYSIS:

Existing law:

1. Establishes the California Department of Technology (CDT) within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer.
2. Establishes the OIS within the CDT. Specifies that the purpose of OIS is to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.
3. Establishes the OES within the Office of the Governor. Requires OES to be responsible for the state's emergency and disaster response services for natural, technological, or manmade disasters and emergencies, including responsibility for activities necessary to prevent, respond to, recover from, and mitigate the effects of emergencies and disasters to people and property.
4. Establishes the CMD, and provides that it includes the office of the Adjutant General, the California National Guard, the State Military Reserve, the California Cadet Corps, and the Naval Militia. Permits the CMD to perform an ISA of any state agency, department, or office, funded by the agency, department, or office being assessed.
5. Requires OIS to develop an information security program and establish policies, standards, and procedures directing state agencies to effectively manage security and risk.
6. Permits the OIS to conduct, or require to be conducted, an ISA of every state agency, department, or office. Requires the cost of an ISA to be funded by the state agency, department, or office being assessed. Requires the OIS, in consultation with OES, to require no fewer than 35 state entities to perform an ISA each year, as specified.
7. Requires state agencies and entities required to conduct or receive an ISA to transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to the OIS and the OES.
8. Requires the OIS to report any state entity found to be noncompliant with information security program requirements to the CDT and the OES. Provides that information and records concerning an ISA are confidential and shall not be disclosed, except as specified, during the process of conducting the ISA.
9. Provides that the results of a completed ISA are subject to all disclosure and confidentiality provisions pursuant to any state law, including a provision of the California Public Records Act (CPRA) that exempts from disclosure an information security record of a public agency, if, on the facts of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency.
10. Requires CDT to notify the OES, the Department of the California Highway Patrol (CHP), and the Department of Justice (DOJ) regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government.
11. Provides that the Secretary of State (SOS) is the chief elections officer of the state who sees that elections are efficiently conducted and that state election laws are enforced. Permits the SOS to require elections officers to make reports concerning elections in their jurisdictions.
12. Requires the SOS to test and certify or otherwise approve voting systems, remote accessible vote by mail systems, ballot-on-demand systems, and electronic poll books prior to their use in an election in the state.
13. Requires each state, pursuant to the federal Help America Vote Act (HAVA) of 2002, to implement a single, uniform, official, centralized, interactive computerized statewide voter registration list defined, maintained, and administered at the state level that contains the name and registration information of every legally registered voter in the state and assigns a unique identifier to each legally registered voter in the state.

This bill:

1. Requires the OIS within the CDT, OES, and the CMD to conduct an ISA of election infrastructure that is accessible through an internet connection in up to five counties that voluntarily participate in the pilot program until 2023.
2. Requires OIS, OES, and CMD to consult with county elections officials to identify and select counties to participate in the pilot program and requires the first set of ISAs to be completed by January 1, 2020. Permits additional ISAs of election infrastructure following the completion of the first group of ISAs.
3. Establishes criteria when selecting counties to participate in the pilot program to ensure that a diverse and representative group of counties and elections systems are assessed.
4. Requires OIS, OES, and CMD in coordination with the county elections officials in participating counties to determine criteria and rank counties participating in the pilot program based on an information security risk index, as specified, and determine the basic standards of services to be performed as part of ISAs conducted in accordance with this bill.
5. Requires OIS, OES, and CMD to transmit the complete results of each ISA and recommendations for mitigating system vulnerabilities, if any, to the applicable county elections officials and the SOS.
6. Provides that information and records concerning an ISA are confidential and shall not be disclosed, except as specified, during the process of conducting the ISA. Provides that the results of a completed ISA and related information are subject to all disclosure and confidentiality provisions of state law, as specified.
7. Requires OIS, OES, and CMD to notify CHP and DOJ of any criminal or alleged criminal cyber activity affecting a state entity or critical infrastructure.
8. Requires OIS, OES, and CMD to prepare and submit a joint report to the Legislature regarding the assessments conducted by January 1, 2022.
9. Defines "election infrastructure," for the purposes of this bill, as "storage facilities, polling places, and centralized vote tabulation locations used to support the election process, and information and communications technology to include voter registration databases, vote tabulating devices, and other systems to manage the election process and report and display results."
10. Provides that it is the intent of the Legislature to appropriate federal funds dedicated for election cybersecurity to pay for the pilot program and that the pilot program not be implemented until either federal funds of other funds, including state funds, are made available.
11. Contains various findings and declarations.

Background

Joint Informational Hearing on election cybersecurity. On March 7, 2018, the Senate Elections and Constitutional Amendments Committee held a Joint Informational Hearing with the Assembly Committee on Elections and Redistricting focusing on issues related to cybersecurity and California’s elections. As a response to the increased attention to election security since the 2016 elections, the hearing explored California's policies for protecting the security of our elections systems in an environment where the number and sophistication of threats to our election infrastructure continues to increase.

Witnesses at the hearing generally agreed that there was no evidence to suggest that voting machines or vote tallying in California were compromised during the 2016 election. In addition, several recommendations were made by witnesses at the hearing for putting state and county elections officials in the best position to defend against and respond to cyber threats while protecting public confidence in California’s elections. Among the recommendations, several witnesses stressed the importance of coordinating the sharing of cybersecurity information and resources, particularly with smaller counties that have more limited resources. Additional recommendations from witnesses included improving efforts to take advantage of security expertise in the private sector and at academic institutions in the state to ensure that elections officials develop cyber incident response plans.

Critical infrastructure designation. On January 6, 2017, then-Secretary of the federal Department of Homeland Security (DHS) Jeh Johnson announced that he was designating election infrastructure as critical infrastructure, a decision that was later reaffirmed by the Trump administration. According to information from DHS, critical infrastructure is a designation "established by the Patriot Act and given to 'systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.'"

The DHS has prepared a Cybersecurity Services Catalog for Election Infrastructure that outlines the services and other assistance available to the election infrastructure community, including state and local elections officials. Among the services provided are various no-cost cybersecurity assessments, information sharing about cybersecurity threats, cybersecurity training, assistance in cyber incident planning and cyber incident response, and network protection.

Federal election security funding. On March 23, 2018, President Trump signed the Consolidated Appropriations Act of 2018 (Act). Among other provisions, the Act provided $380 million in HAVA funding to the Election Assistance Commission (EAC) to make payments available to states to improve the administration of elections for federal office, including enhancing election technology and making election security improvements.

As noted by the EAC, Congress intends that the funding be used to replace electronic voting equipment that does not have a paper trail, to implement a post-election audit system, to upgrade election-related computer systems to address cyber vulnerabilities, to facilitate cybersecurity training for state and local election officials, to implement established cybersecurity best practices, and to fund other activities that will improve the security of elections for federal office. According to information from the EAC, California’s share of the federal funding is $34,558,874, and the state’s required five percent match totals $1,727,944.

Independent security assessments and existing law. AB 670 (Irwin, Chapter 518, Statutes of 2015) required OIS, in consultation with OES, to conduct no fewer than 35 ISAs of state agencies, departments, or offices annually, as specified. AB 670 also authorized the CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed. The provisions of this bill are modeled after AB 670, though the language has been modified to focus more on elections-related infrastructure with certain other modifications.

In the past, while the state offices, departments, and agencies with cybersecurity responsibilities have conducted ISAs for non-state entities, the framework established by AB 670 focused on ISAs of state agencies, departments, and offices. By creating a framework for ISAs to be conducted on county elections offices, and by establishing clear lines of authority and responsibility for those ISAs, this bill could help make the state's cybersecurity expertise more broadly available in protecting California's election infrastructure.

Funding for independent security assessments. In requiring an ISA to be performed for every state agency, department, or office, AB 670 specifically required each ISA to be funded by the state agency, department, or office being assessed. This bill is silent with respect to the entity that would be responsible for paying for an ISA that is conducted under the pilot program. However, AB 2748 states that it is the intent of the Legislature to appropriate federal funds dedicated for election cybersecurity to pay for the pilot program created by this bill and that the pilot program shall not be implemented until either federal funds or other funds, including state funds, are made available for the purpose of this bill.

Confidentiality of sensitive information. Consistent with the policy developed in AB 670, this bill provides that assessment results, while subject to all disclosure provisions of state law including the CPRA, are also subject to a provision of the CPRA that protects disclosure of any government information security record that "would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency." Thus, under this provision, any part of the result of an ISA that could reveal vulnerabilities is redactable, including potentially the entire assessment.

Additionally, during the process of conducting the assessment, this bill provides that information and records concerning ISAs are confidential and shall not be disclosed except to specified entities as necessary to receive the information and records to perform the ISA, subsequent remediation activity, or monitoring of remediation activity. This provision also is based off existing public policy approved under AB 670.

Comments

According the author, free and fair elections are the cornerstone of our democracy. Ensuring that our election processes and voting systems are secure is vital to the integrity of our elections. There has been growing concern about the impact that cyberattacks may have on our election process and democratic institutions. In the aftermath of the 2016 elections, numerous states, including California, were found to be the targets of election interference by Russian hackers. In response to the similarly growing threat of cyberattacks on government systems, California enacted into law AB 670 to require the CDT, in partnership with the CMD and OES, to annually conduct no fewer than 35 ISAs of state agencies, departments or offices. These assessments evaluate the agency on how effectively it protects personally identifiable information, health information, and confidential financial information along with assessing information security management and incident management and response. AB 2748 builds upon AB 670 by requiring CDT, CMD, and OES to establish a pilot program to conduct an ISA of election infrastructure in up to five participating counties so that these counties can have the resources to proactively review their systems to ensure they are as secure as possible.

Related/Prior Legislation

AB 670 (Irwin, Chapter 518, Statutes of 2015) required the CDT to conduct, or require to be conducted, no fewer than 35 independent security assessments of state agencies, departments or offices annually.

AB 3075 (Berman, 2018) establishes the Office of Elections Cybersecurity (OEC) under the SOS to coordinate efforts to reduce the likelihood and severity of cyber incidents that interfere with election security or integrity. Among the provisions of AB 3075, the OEC would coordinate the sharing of information with federal, state, and local agencies on threats to election cybersecurity, risk assessment, and threat mitigation in a timely manner.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee, this bill would result in new costs, likely in the low millions of dollars and from the General Fund, for new positions at the various state departments that would implement the ISAs. As an example, CMD has estimated a first-year need for five positions and up to one year of related training at a cost of up to $1 million. Likewise, CDT has estimated the need for six positions costing about $650,000 in the first year. Additionally, this bill would result in unknown, potentially significant costs to complete the ISAs. The actual cost would depend on the number of participating counties, and would likely be from the General Fund.

SUPPORT: (Verified 8/13/18)

California Association of Clerk and Election Officials

OPPOSITION: (Verified 8/13/18)

None received

ASSEMBLY FLOOR: 78-0, 5/31/18

AYES: Acosta, Aguiar-Curry, Travis Allen, Arambula, Baker, Berman, Bigelow, Bloom, Bonta, Brough, Burke, Caballero, Calderon, Carrillo, Cervantes, Chau, Chávez, Chen, Chiu, Choi, Chu, Cooley, Cooper, Cunningham, Dahle, Daly, Eggman, Flora, Fong, Frazier, Friedman, Gallagher, Cristina Garcia, Eduardo Garcia, Gipson, Gloria, Gonzalez Fletcher, Gray, Grayson, Harper, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Patterson, Quirk, Quirk-Silva, Reyes, Rodriguez, Rubio, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon

Prepared by:

8/18/18 13:12:20

**** END ****

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anthony Portantino, Chair

2017 - 2018 Regular Session

AB 2748 (Chau) - Election infrastructure: independent security assessments

This bill meets the criteria for referral to the Suspense File.

Bill Summary:

AB 2748 would establish a pilot program under which up to five participating counties would have an independent security assessment (ISA) of their election infrastructure conducted by specified state government agencies.

Fiscal Impact:

This bill would result in new costs, likely in the low millions of dollars and from the General Fund, for new positions at the various state departments that would implement the ISAs. As an example, the California Military Department (CMD) has estimated a first-year need for five positions and up to one year of related training at a cost of up to $1 million. Likewise, the California Department of Technology (CDT) has estimated the need for six positions costing about $650,000 in the first year. Additionally, the bill would result in unknown, potentially significant costs to complete the ISAs. The actual cost would depend on the number of participating counties, and would likely be from the General Fund.

Background:

Last March, the Legislature’s two elections committees held a joint informational hearing focusing on issues related to cybersecurity and California’s elections. As a response to the increased attention to election security since the 2016 election, the hearing explored the State’s policies for protecting the security of its elections systems in an environment where the number and sophistication of threats to its election infrastructure continue to increase. Witnesses at the hearing generally agreed that there was no evidence to suggest that voting machines or vote tallying in California was compromised during the 2016 election. However, all of the witnesses stressed the importance of continuing to evaluate cyber and other security threats to the State’s election infrastructure. In addition, the witnesses also discussed the significance of being able to regularly evaluate processes and procedures to protect against cyber threats to promote voter confidence in the accuracy of election results.

Proposed Law:

This bill would, among other things, do the following:

• Require the Office of Information Security (OIS) within CDT, the Office of Emergency Services (OES), and CMD to conduct an ISA of election infrastructure that is accessible through an internet connection in up to five counties that voluntarily choose to participate in the pilot program.
• Require OIS, OES, and CMD to consult with county elections officials to identify and select counties to participate in the pilot program and require the first set of ISAs to be completed by January 1, 2020. Permit additional ISAs of election infrastructure following the completion of the first group of ISAs.
• Require that when selecting counties to participate in the pilot program, specified criteria be used.
• Require OIS, OES, and CMD in coordination with the county elections officials in participating counties to (1) determine criteria and rank counties participating in the pilot program based on an information security risk index that may include analysis of the relative amount of specified factors within counties, and (2) determine the basic standards of services to be performed as part of ISAs conducted in accordance with this bill.
• Require OIS, OES, and CMD to transmit the complete results of each ISA and recommendations for mitigating system vulnerabilities, if any, to the applicable county elections officials and SOS.
• Provide that information and records concerning an ISA are confidential and shall not be disclosed, except as specified, during the process of conducting the ISA.
• Provide that the results of a completed ISA and related information are subject to all disclosure and confidentiality provisions of state law, as specified.
• Require OIS, OES, and CMD to notify CHP and DOJ of any criminal or alleged criminal cyber activity affecting a state entity or critical infrastructure of state government.
• Require OIS, OES, and CMD to prepare and submit a joint report containing specified information to the Legislature regarding the assessments conducted by January 1, 2022.
• Define "election infrastructure," for the purposes of this bill, as "storage facilities, polling places, and centralized vote tabulation locations used to support the election process, and information and communications technology to include voter registration databases, vote tabulating devices, and other systems to manage the election process and report and display results."
• Include a January 1, 2023 sunset date.

Related Legislation:

• AB 3075 (Berman) would create the Office of Elections Cybersecurity within SOS and charge it with coordinating efforts to reduce the likelihood and severity of cyber incidents that interfere with election security or integrity. The bill is currently pending on the Senate Floor.
• AB 670 (Irwin, Chapter 518, Statutes of 2015) requires OIS, in consultation with OES, to conduct no fewer than 35 ISAs of state agencies, departments, or offices annually, as specified. It also authorizes the CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed.

Staff Comments:

As noted above, AB 670 (Irwin, 2015) requires OIS, in consultation with OES, to conduct no fewer than 35 ISAs of state agencies, departments, or offices annually, as specified. AB 670 also authorizes the CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed. The provisions of this bill are modeled after AB 670, though the language has been modified to focus more on elections-related infrastructure with certain other modifications.

In requiring an ISA to be performed for every state agency, department, or office, AB 670 specifically required each ISA to be funded by the state agency, department, or office being assessed. This bill is silent with respect to the entity that would be responsible for paying for an ISA that is conducted under the pilot program. However, the bill does state that it is the intent of the Legislature to appropriate federal funds dedicated for election cybersecurity to pay for the pilot program created by this bill and that the pilot program shall not be implemented until either federal funds or other funds, including state funds, are made available. Absent any other available funding, the result would be a General Fund cost pressure.

-- END --

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Bill Dodd

Chair

2017 - 2018 Regular

Bill No: 2748 Hearing Date: 6/26/2018

SUBJECT: Election infrastructure: independent security assessments

DIGEST: This bill establishes a pilot program under which up to five participating counties would have an independent security assessment (ISA) of their election infrastructure conducted by specified government agencies.

ANALYSIS:

Existing law:

1. Federal law charges various federal agencies with responsibilities related to the security of critical infrastructure, including election infrastructure.
2. Federal law requires each state to implement a single, uniform, official, centralized, interactive computerized statewide voter registration list that contains the name and registration information of every legally registered voter in the state and assigns a unique identifier to each legally registered voter in the state.
3. Establishes the Office of Emergency Services (OES) in the office of the Governor, and provides that OES is responsible for the state’s emergency and disaster response services for natural, technological, or manmade disasters and emergencies.
4. Executive Order B-34-15 establishes the California Cybersecurity Integration Center (Cal-CSIC), within OES, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
5. Establishes the California Department of Technology (CDT) under the supervision of the Director of Technology, also known as the Chief Information Officer, and establishes the Office of Information Security (OIS), within CDT, for the purposes of ensuring the confidentiality, integrity, and availability of state systems and applications.
6. Establishes the California Military Department (CMD), and provides that it includes the office of the Adjutant General, the California National Guard, the State Military Reserve, the California Cadet Corps, and the Naval Militia.
7. Permits OIS to conduct, or require to be conducted, an ISA of every state agency, department, or office, as specified.
8. Requires the Secretary of State (SOS) and county elections officials to perform specified tasks related to the security of voting systems, ballots, and other materials.
9. Specifies that any report required or requested by law to be submitted to the members of either house, or the Legislature generally, shall be submitted as a printed copy to the Secretary of State, as an electronic copy to the Chief Clerk of the Assembly, and as an electronic or printed copy to the Legislative Counsel.

This bill:

1. Requires OIS, OES, and CMD to establish a pilot program to conduct, or require to be conducted, an ISA of election infrastructure that is accessible through an Internet connection in up to five counties that voluntarily choose to participate.
2. Requires OIS, OES, and CMD to consult with county elections officials to identify and select counties to participate in the pilot program. In selecting the counties, the following criteria shall be considered to ensure a diverse and representative group are assessed:
   1. The type and election management system used by the county.
   2. The election cybersecurity resources available to the county.
   3. Whether the county election department has dedicated information technology (IT) or cybersecurity staff, or whether that department shares staff with other county departments.
   4. Whether the county has undergone, or will undergo, a cybersecurity evaluation performed by the United States Department of Homeland Security.
   5. The size of the voting population of the county.
3. Provides that the ISAs for the first group of participating counties shall be completed no later than January 1, 2020, and that after completion of those ISAs, additional ISAs of other counties may be conducted.
4. Requires OIS, OES, and CMD, in coordination with the county elections officials in the participating counties to do all of the following:
   1. Determine criteria and rank counties participating based on an information security risk index that may include analysis of the following factors: personally identifiable information protected by law; voter registration information; information on voted ballots; self-certification of compliance and indicators of unreported noncompliance with security provisions in information asset management, risk management, information security program management, information security incident management, and technology recovery planning; and, other information identified by OIS, OES, and CMD, in coordination with the county election officials, that may present a security risk.
   2. Determine the basic standards of services to be performed as part of the ISAs.
5. Requires OIS, OES, and CMD to transmit the complete results of each ISA and recommendations for mitigating system vulnerabilities, if any, to the elections official of the county in which the assessment was conducted by the SOS.
6. Provides that during the process of conducting an ISA, information and records concerning the ISA are confidential and shall not be disclosed, except that the information and records may be transmitted to state and county employees, and state and county contractors who have been approved as necessary to receive the information and records, as specified.
7. Specifies that the results of a completed ISA, and any related information, shall be subject to all disclosure and confidentially provisions pursuant to any state law.
8. Requires OIS, OES, and CMD to notify the California Highway Patrol (CHP) and the Department of Justice (DOJ) regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government, and to notify the district attorney of the county regarding any criminal cyber activity affecting any county entity or critical infrastructure of the county government.
9. Provides if one or more ISAs are conducted as a part of the pilot program that OIS, OES, and CMD shall prepare and submit a joint report to the Legislature regarding the assessments conducted, as specified.
10. Requires OIS, OES, and CMD to develop the report in consultation with the counties in which the assessments were performed, and specifies that the report shall include, but not be limited to, all of the following:
    1. An identification of the counties in which assessments were performed.
    2. Information about the costs of the assessments.
    3. A summary of relevant performance metrics, including county satisfaction with the performance of the assessments and a summary of the results of completed assessments, as specified.
    4. Any legislative recommendations.
11. Defines “election infrastructure” to mean storage facilities, polling places, and centralized vote tabulation locations used to support the election process, and information and communications technology to include voter registration databases, vote tabulating devices, and other systems to manage the election process and report and display results.
12. Declares that it is the intent of the Legislature to appropriate federal funds dedicated for election cybersecurity to pay for the pilot program, and that the pilot program shall not be implemented until either federal funds or other funds, including state funds, are made available for the purpose of this section.
13. Includes findings and declarations relating to the major risk posed by cyberattacks to the state’s critical infrastructure, and the potential disruption to our election system.
14. Includes a sunset date of January 1, 2023.

Background

Purpose of the bill. According to the author, “free and fair elections are the cornerstone of our democracy. Ensuring that our election processes and voting systems are secure is vital to the integrity of our elections. There has been growing concern about the impact that cyberattacks may have on our election process and democratic institutions. In the aftermath of the 2016 elections, numerous states, including California, were found to be the targets of election interference by Russian hackers. In response to the similarly growing threat of cyberattacks on government systems, the State of California previously enacted into law AB 670 (Irwin, Chapter 518, Statutes of 2015 ) to require CDT, in partnership with CMD, and OES, to annually conduct no fewer than 35 ISAs of state agencies, departments or offices.”

Further, the author states that, “AB 2748 builds upon AB 670 by requiring CDT, CMD, and OES to establish a pilot program to conduct an ISA of election infrastructure in up to five participating counties so that these counties can have the resources to proactively review their systems to ensure they are as secure as possible.”

Joint informational hearing on election cybersecurity. On March 7, the Assembly Elections & Redistricting Committee and the Senate Committee on Elections & Constitutional Amendments held a joint informational hearing titled Cybersecurity and California Elections. In light of the increased focus on election security since the 2016 elections, the purpose of the hearing was to explore California's policies for protecting the security of elections systems in an environment where the number and sophistication of threats to election infrastructure continues to increase.

Witnesses that participated in the hearing included the SOS, a member of the United States Election Assistance Commission, three California county elections officials, the former Senior Director for Cybersecurity Policy at The White House, and a Senior Advisor and Past President to a nonprofit organization that advocates for legislation and regulation that promotes accuracy, transparency and verifiability of elections.

Witnesses at the hearing generally agreed that there was no evidence to suggest that voting machines or vote tallying in California were compromised during the 2016 election. Nonetheless, all of the witnesses stressed the importance of continuing to evaluate cyber and other security threats to election infrastructure and to regularly evaluate processes and procedures to protect against those threats and to promote voter confidence in the accuracy of election results.

There were several common recommendations made by witnesses at the hearing for putting state and county elections officials in the best position to defend against and respond to cyber threats, and to protect public confidence in California elections. Many witnesses stressed the importance of funding elections and expressed support for the $134 million included in the Governor's proposed 2018-19 budget to assist counties with the costs of replacing their voting systems (the budget adopted by the Legislature on June 14 included all $134 million, as well as $3 million to the SOS for election cybersecurity and to combat false and misleading information about the time, place, and manner of elections).

Other recommendations included improving efforts to take advantage of security expertise in the private sector and at academic institutions in the state, ensuring that elections officials develop cyber incident response plans that include considerations of how to recover from cyber incidents, and working with third-party validators to help disseminate accurate information about elections as a way to counter bad information that could negatively impact elections and voter confidence.

Critical infrastructure designation. As reflected in this bill’s findings and declarations, in January 2017, the Obama administration announced that it had designated the country’s election infrastructure as “critical,” thus bringing added federal protections to voting systems, a decision that was later reaffirmed by the Trump administration.

According to information from the Department of Homeland Security, critical infrastructure is a designation “established by the Patriot Act and given to 'systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”

In his announcement, then-Secretary Johnson noted that the designation generally gives the Department of Homeland Security the ability to provide additional cybersecurity assistance to state and local elections officials but does not mean that there will be new or additional federal regulation or oversight of the conduct of elections by state and local governments.

Extending cybersecurity expertise to assist county election officials. Cal-CSIC is required to serve as the central organizing hub of the state government’s cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities, and other service providers, academic institutions, and non-governmental organizations. As partners who serve on Cal-CSIC; OIS, OES, and CMD can not only assist officials with ISAs provided for in the pilot program in this bill, but also help county officials take better advantage of the resources available to them.

Under this bill, OIS, OES, and CMD would work with county election officials to identify counties that would participate in a pilot program wherein the state entities responsible for conducting ISAs for state agencies, departments and offices, could conduct similar ISAs for county election infrastructure to help counties best prepare for current and future cybersecurity threats which are constantly evolving.

In doing so, this bill recognizes the unique resources and expertise at the disposal of the State which can be of assistance to the counties which may not have as extensive of tools or knowledge as they otherwise might if pooled together with CDT, OES, and CMD and the rest of the Cal-CSIC partners in this arena.

California Cybersecurity Integration Center. On August 31, 2015, Governor Brown signed Executive Order B-34-15 with the goal to “bolster California’s preparedness and response to destructive cyber-attacks.”

According to OES, since April of 2016, Cal-CSIC representatives from OES, CDT, CMD, and the CHP have been pooling resources to implement cyber vulnerability assessments and develop intuitive cyber threat alerts for the end-user. This committee will also be considering AB 2813 (Irwin), which would codify Cal-CSIC in statute.

Independent security assessments and existing law. AB 670 (Irwin) requires OIS, in consultation with OES, to conduct no fewer than 35 ISAs of state agencies, departments, or offices annually, as specified. AB 670 also authorizes CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed. The provisions of this bill are modeled after AB 670, though the language has been modified to focus more squarely on elections-related infrastructure, and certain other adjustments have been made.

By creating a framework for ISAs to be conducted on county elections offices, and by establishing clear lines of authority and responsibility for those ISAs, this bill could help make the state’s cybersecurity expertise more broadly available in protecting California’s election infrastructure.

Funding for independent security assessments. In requiring an ISA to be performed for every state agency, department, or office, AB 670 specifically required each ISA to be funded by the state agency, department, or office being assessed. This bill states that it is the intent of the Legislature to appropriate federal funds dedicated for election cybersecurity to pay for the pilot program, and that the pilot program shall not be implemented until either federal funds or other funds, including state funds, are made available.

As mentioned above, the recently adopted budget includes $134 million to assist counties with the costs of replacing their voting systems, and $3 million to the SOS for election cybersecurity and to combat false and misleading information about the time, place, and manner of elections.

On March 23, 2018, President Trump signed the Consolidated Appropriations Act of 2018—the omnibus spending bill for the federal fiscal year ending on September 30, 2018. Among other provisions, the spending includes $380 million in Help America Vote Act funding to the Election Assistance Commission (EAC) intended to make payments to states for activities to improve the administration of elections for Federal office, including enhancing election technology and making election security improvements. States that receive federal funds are required to provide a match of five percent of the funds received within two years of receiving the federal funds.

According to information from the EAC, California’s share of the federal funding is $34,558,876, and the state’s required five percent match totals $1,727,944. The EAC notes that a joint explanatory statement prepared by Congress to indicate congressional intent on how the funds may be spent specifies that states may use the funds to replace electronic voting equipment that does not have a paper trail; to implement a post-election audit system; to upgrade election-related computer systems to address cyber vulnerabilities; to facilitate cybersecurity training for state and local election officials; to implement established cybersecurity best practices; and to fund other activities that will improve the security of elections for federal office.

Prior/Related Legislation

AB 2813 (Irwin, 2018) codifies in statute Cal-CSIC, within OES, and requires Cal-CSIC to develop a cybersecurity strategy for California, as specified. (Pending in the Senate Governmental Organization Committee)

AB 3075 (Berman, 2018) establishes the Office of Elections Cybersecurity, within SOS, to coordinate efforts to reduce the likelihood and severity of cyber incidents that interfere with election security and integrity. (Pending in the Senate Appropriations Committee)

AB 668 (Gonzalez-Fletcher, 2017) would have placed a $450 million bond act on the June 5, 2018, statewide primary election ballot and authorizes the use of those funds for the purchase of specified voting equipment and related technology. (On the Senate Inactive File)

SB 532 (Dodd, 2017) adds “cyberterrorism” to the list of conditions that are named in the California Emergency Services Act that may be cited to support the proclamation of a state of emergency or local emergency. (Pending in the Assembly Governmental Organization Committee)

AB 670 (Irwin, Chapter 518, Statutes of 2015) required CDT, in consultation with OES, to conduct no fewer than 35 ISAs of state agencies, departments, or offices annually, as specified

SB 360 (Padilla, Chapter 602, Statutes of 2013) made significant changes to procedures and criteria for the certification and approval of a voting system.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT:

None received

OPPOSITION:

None received

DUAL REFERRAL: Senate Elections and Constitutional Amendments Committee (5-0)

SENATE COMMITTEE ON

ELECTIONS AND CONSTITUTIONAL AMENDMENTS

Senator Henry Stern, Chair

2017 - 2018 Regular

Bill No: AB Hearing Date: 6/19/18

Subject: Election infrastructure: independent security assessments.

DIGEST

This bill requires the Office of Information Security (OIS), The Office of Emergency Services (OES), and the California Military Department (CMD) to establish a pilot program to conduct independent security assessments (ISAs) of election infrastructure in up to five counties that voluntarily participate in the pilot program until 2023, if certain conditions are met.

ANALYSIS

Existing law:

1. Establishes the California Department of Technology (CDT) within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer. Establishes the OIS within the CDT.
2. Specifies that the purpose of OIS is to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.
3. Establishes the OES within the Office of the Governor. Requires OES to be responsible for the state's emergency and disaster response services for natural, technological, or manmade disasters and emergencies, including responsibility for activities necessary to prevent, respond to, recover from, and mitigate the effects of emergencies and disasters to people and property.
4. Establishes the CMD, and provides that it includes the office of the Adjutant General, the California National Guard, the State Military Reserve, the California Cadet Corps, and the Naval Militia.
5. Requires OIS to develop an information security program and establish policies, standards, and procedures directing state agencies to effectively manage security and risk.
6. Permits the OIS to conduct, or require to be conducted, an ISA of every state agency, department, or office. Requires the cost of an ISA to be funded by the state agency, department, or office being assessed. Requires the OIS, in consultation with OES, to require no fewer than 35 state entities to perform an ISA each year, as specified.
7. Permits the CMD to perform an ISA of any state agency, department, or office, funded by the agency, department, or office being assessed.
8. Requires state agencies and entities required to conduct or receive an ISA to transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to the OIS and the OES.
9. Requires the OIS to report any state entity found to be noncompliant with information security program requirements to the CDT and the OES.
10. Provides that information and records concerning an ISA are confidential and shall not be disclosed, except as specified, during the process of conducting the ISA.
11. Provides that the results of a completed ISA are subject to all disclosure and confidentiality provisions pursuant to any state law, including a provision of the California Public Records Act (CPRA) that exempts from disclosure an information security record of a public agency, if, on the facts of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency.
    
12. Requires CDT to notify the OES, the Department of the California Highway Patrol (CHP), and the Department of Justice (DOJ) regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government.
13. Provides that the Secretary of State (SOS) is the chief elections officer of the state. Requires the SOS to administer the provisions of the Elections Code. Requires the SOS to see that elections are efficiently conducted and that state election laws are enforced. Permits the SOS to require elections officers to make reports concerning elections in their jurisdictions.
14. Requires the SOS to test and certify or otherwise approve voting systems, remote accessible vote by mail systems, ballot-on-demand systems, and electronic poll books prior to their use in an election in the state.
15. Requires each state, pursuant to the federal Help America Vote Act (HAVA) of 2002, to implement a single, uniform, official, centralized, interactive computerized statewide voter registration list defined, maintained, and administered at the state level that contains the name and registration information of every legally registered voter in the state and assigns a unique identifier to each legally registered voter in the state.

This bill:

1. Requires the OIS within the CDT, OES, and the CMD to conduct an ISA of election infrastructure that is accessible through an internet connection in up to five counties that voluntarily choose to participate in the pilot program.
2. Requires OIS, OES, and CMD to consult with county elections officials to identify and select counties to participate in the pilot program and requires the first set of ISAs to be completed by January 1, 2020. Permits additional ISAs of election infrastructure following the completion of the first group of ISAs.
3. Requires that when selecting counties to participate in the pilot program, the following criteria be considered to ensure that a diverse and representative group of counties and elections systems are assessed:
   1. The type of election management system used by the county.
   2. The election cybersecurity resources available to the county.
   3. Whether the county election department has dedicated information technology or cybersecurity staff or whether the election department shares information technology or cybersecurity staff with other county departments.
   4. Whether the county has undergone, or will undergo, a cybersecurity evaluation performed by the United States Department of Homeland Security.
   5. The size of the voting population of the county.
4. Requires OIS, OES, and CMD in coordination with the county elections officials in participating counties to do all of the following:
   1. Determine criteria and rank counties participating in the pilot program based on an information security risk index that may include analysis of the relative amount of the following factors within counties:
      1. Personally identifiable information protected by law.
      2. Voter registration information.
      3. Information on voted ballots.
      4. Self-certification of compliance and indicators of unreported noncompliance with security provisions in the following areas:
         1. Information asset management.
         2. Risk management.
         3. Information security program management.
         4. Information security incident management.
         5. Technology recovery planning.
      5. In coordination with county elections officials, other information identified by OIS, OES, and CMD that may present a security risk.
   2. Determine the basic standards of services to be performed as part of ISAs conducted in accordance with this bill.
5. Requires OIS, OES, and CMD to transmit the complete results of each ISA and recommendations for mitigating system vulnerabilities, if any, to the applicable county elections officials and the SOS.
6. Provides that information and records concerning an ISA are confidential and shall not be disclosed, except as specified, during the process of conducting the ISA.
7. Provides that the results of a completed ISA and related information are subject to all disclosure and confidentiality provisions of state law, as specified.
8. Requires OIS, OES, and CMD to notify CHP and DOJ of any criminal or alleged criminal cyber activity affecting a state entity or critical infrastructure of state government.
9. Requires OIS, OES, and CMD to prepare and submit a joint report to the Legislature regarding the assessments conducted by January 1, 2022. The report is required to include, but not be limited to, all of the following:
   1. The counties in which assessments were performed.
   2. Information regarding the costs of the assessments.
   3. A summary of relevant performance metrics, including county satisfaction with the performance of the assessments and a summary of the results of completed assessments, as specified.
   4. Any legislative recommendations.
10. Defines "election infrastructure," for the purposes of this bill, as "storage facilities, polling places, and centralized vote tabulation locations used to support the election process, and information and communications technology to include voter registration databases, vote tabulating devices, and other systems to manage the election process and report and display results."
11. Includes a January 1, 2023 sunset date.
12. Contains various findings and declarations, and declares the intent of the Legislature to do both of the following:
    1. Leverage the state's cybersecurity resources to assist county elections officials in their assessments of election infrastructure in order to be best prepared for future cybersecurity threats
    2. Recognize election infrastructure as critical infrastructure and an important subsector within the Government Facilities Sector identified by the federal government and California.
13. Provides that it is the intent of the Legislative to appropriate federal funds dedicated for election cybersecurity to pay for the pilot program and that the pilot program not be implemented until either federal funds of other funds, including state funds, are made available.

BACKGROUND

Joint Informational Hearing on Election Cybersecurity. On March 7, 2018, this committee held a Joint Informational Hearing with the Assembly Committee on Elections & Redistricting focusing on issues related to cybersecurity and California’s elections. As a response to the increased attention to election security since the 2016 elections, the purpose of the hearing was to explore California's policies for protecting the security of our elections systems in an environment where the number and sophistication of threats to our election infrastructure continues to increase. Witnesses that participated in the hearing included the SOS, a member of the United States Election Assistance Commission (EAC), three California county elections officials, the former Senior Director for Cybersecurity Policy at The White House, and a Senior Advisor and Past President to a nonprofit organization that advocates for legislation and regulation that promotes accuracy, transparency, and verifiability of elections.

Witnesses at the hearing generally agreed that there was no evidence to suggest that voting machines or vote tallying in California were compromised during the 2016 election. However, all of the witnesses stressed the importance of continuing to evaluate cyber and other security threats to election infrastructure. In addition, the witnesses also discussed the significance of being able to regularly evaluate processes and procedures to protect against cyber threats to promote voter confidence in the accuracy of election results.

There were several common recommendations made by witnesses at the hearing for putting state and county elections officials in the best position to defend against and respond to cyber threats, and to protect public confidence in California elections. Many witnesses stressed the importance of funding elections, and expressed support for the Governor’s proposed 2018-19 budget to assist counties with the costs of replacing their voting systems. Witnesses also noted that the lack of reimbursement by the state for elections-related state mandates and for the costs of special elections for filling vacancies in the Legislature and Congress had the effect of limiting resources that were available at the local level for election security. Several witnesses also stressed the importance of coordinating the sharing of cybersecurity information and resources, particularly with smaller counties that have more limited resources, and of developing robust post-election auditing procedures—including risk-limiting audits—to improve voter confidence in the accuracy of election results. Other recommendations included improving efforts to take advantage of security expertise in the private sector and at academic institutions in the state, ensuring that elections officials develop cyber incident response plans that include considerations of how to recover from cyber incidents, and working with third-party validators to help disseminate accurate information about elections as a way to counter bad information that could negatively impact elections and voter confidence.

Critical Infrastructure Designation. On January 6, 2017, then-Secretary of the federal Department of Homeland Security (DHS) Jeh Johnson announced that he was designating election infrastructure in the country as critical infrastructure, a decision that was later reaffirmed by the Trump administration. According to information from DHS, critical infrastructure is a designation "established by the Patriot Act and given to 'systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.'" In his announcement, Secretary Johnson noted that the designation generally gives DHS the ability to provide additional cybersecurity assistance to state and local elections officials, but does not mean that there will be new or additional federal regulation or oversight of the conduct of elections by state and local governments.

The DHS has prepared a Cybersecurity Services Catalog for Election Infrastructure that outlines the services and other assistance available to the election infrastructure community, including state and local elections officials. Among the services provided are various no-cost cybersecurity assessments, information sharing about cybersecurity threats, cybersecurity training, assistance in cyber incident planning and cyber incident response, and network protection.

Federal Election Security Funding. On March 23, 2018, President Trump signed the Consolidated Appropriations Act of 2018 (Act). The Act was an omnibus spending bill for the federal fiscal year ending on September 30, 2018. Among other provisions, the Act provided $380 million in HAVA funding to the EAC to make payments to states for activities to improve the administration of elections for Federal office, including enhancing election technology and making election security improvements. States that receive federal funds are required to provide a match of five percent of the funds received within two years of receiving the federal funds.

According to information from the EAC, California’s share of the federal funding is $34,558,874, and the state’s required five percent match totals $1,727,944. The EAC notes that a joint explanatory statement prepared by Congress to indicate congressional intent on how the funds may be spent specifies that states may use the funds to replace electronic voting equipment that does not have a paper trail, to implement a post-election audit system, to upgrade election-related computer systems to address cyber vulnerabilities, to facilitate cybersecurity training for state and local election officials, to implement established cybersecurity best practices, and to fund other activities that will improve the security of elections for federal office.

Independent Security Assessments and Existing Law. AB 670 (Irwin), Chapter 518, Statutes of 2015, requires OIS, in consultation with OES, to conduct no fewer than 35 ISAs of state agencies, departments, or offices annually, as specified. AB 670 also authorizes the CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed. The provisions of this bill are modeled after AB 670, though the language has been modified to focus more on elections-related infrastructure with certain other modifications.

In the past, while the state offices, departments, and agencies with cybersecurity responsibilities have conducted ISAs for non-state entities, the framework established by AB 670 focused on ISAs of state agencies, departments, and offices. By creating a framework for ISAs to be conducted on county elections offices, and by establishing clear lines of authority and responsibility for those ISAs, this bill could help make the state's cybersecurity expertise more broadly available in protecting California's election infrastructure.

Funding for Independent Security Assessments. In requiring an ISA to be performed for every state agency, department, or office, AB 670 specifically required each ISA to be funded by the state agency, department, or office being assessed. This bill is silent with respect to the entity that would be responsible for paying for an ISA that is conducted under the pilot program. However, AB 2748 states that it is the intent of the Legislature to appropriate federal funds dedicated for election cybersecurity to pay for the pilot program created by this bill and that the pilot program shall not be implemented until either federal funds or other funds, including state funds, are made available for the purpose of this bill.

Confidentiality of Sensitive Information. Consistent with the policy developed in AB 670, this bill provides that assessment results, while subject to all disclosure provisions of state law including the CPRA, are also subject to a provision of the CPRA that protects disclosure of any government information security record that "would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency." Thus, under this provision, any part of the result of an ISA that could reveal vulnerabilities is redactable, including potentially the entire assessment.

Additionally, during the process of conducting the assessment, this bill provides that information and records concerning ISAs are confidential and shall not be disclosed except to specified entities as necessary to receive the information and records to perform the ISA, subsequent remediation activity, or monitoring of remediation activity. This provision also is based off existing public policy approved under AB 670.

COMMENTS

1. According the author: Free and fair elections are the cornerstone of our democracy. Ensuring that our election processes and voting systems are secure is vital to the integrity of our elections. There has been growing concern about the impact that cyberattacks may have on our election process and democratic institutions. In the aftermath of the 2016 elections, numerous states, including California, were found to be the targets of election interference by Russian hackers. In response to the similarly growing threat of cyberattacks on government systems the State of California previously enacted into law AB 670 (Irwin) to require the California CDT, in partnership with the CMD and OES, to annually conduct no fewer than 35 independent security assessments of state agencies, departments or offices. These assessments evaluate the agency on how effectively it protects personally identifiable information, health information, and confidential financial information along with assessing information security management and incident management and response. AB 2748 builds upon AB 670 by requiring CDT, CMD, and OES to establish a pilot program to conduct an independent security assessment of election infrastructure in up to five participating counties so that these counties can have the resources to proactively review their systems to ensure they are as secure as possible.
2. Double Referral. The Senate Rules Committee ordered a double-referral of AB 2748, first to this committee, and second to the Committee on Governmental Organization.

RELATED/PRIOR LEGISLATION

AB 670 (Irwin), Chapter 518, Statutes of 2015, requires the CDT to conduct, or require to be conducted, no fewer than 35 independent security assessments of state agencies, departments or offices annually.

AB 3075 (Berman) of 2018, would establish the Office of Elections Cybersecurity (OEC) under the SOS to coordinate efforts to reduce the likelihood and severity of cyber incidents that interfere with election security or integrity. Among the provisions of AB 3075, the OEC would coordinate the sharing of information on threats to election cybersecurity, risk assessment, and threat mitigation in a timely manner and in a manner that protects sensitive information with federal, state, and local agencies. This bill is currently pending the Senate Appropriations Committee.

PRIOR ACTION

POSITIONS

Sponsor: Author

Support: None Received

Oppose: None Received

-- END --

ASSEMBLY THIRD READING

ATR Bill Id:AB 2748

Author:(Chau)

As Amended Ver:

Majority vote

SUMMARY: This bill provides for the ability of state cybersecurity resources to be leveraged to assist county election officials in their assessments of election infrastructure, as specified. This bill would create a limited pilot program modeled off of existing law requiring information security assessments (ISAs) of state entities, as specified, subject to specific funding provisions, a five year sunset date, and to a reporting requirement to the Legislature. Specifically, this bill:

1. Requires the Office of Information Security (OIS), the Office of Emergency Services (Cal OES), and the California Military Department (CMD), to establish a pilot program to conduct, or require to be conducted, an ISA of election infrastructure that is accessible through an internet connection in up to five counties that voluntarily choose to participate in the pilot program. OIS, Cal OES, and CMD must, in doing so, consult with county elections officials to identify and select counties to participate in the pilot program and the ISAs for the first group of participating counties must be completed no later than January 1, 2020, after which further ISAs may be conducted.
2. Specifies the criteria to be considered in selecting the counties to participate in the pilot program in order to ensure that a diverse and representative group of counties and election systems are assessed through the pilot program, including:
   1. the type of election management system used by the county;
   2. the election cybersecurity resources available to the county; and
   3. whether the county election department has dedicated information technology (IT) staff or shares IT or cybersecurity staff with other county departments.
3. Requires OIS, Cal OES, and CMD, in coordination with the county elections officials in the participating counties, to determine criteria and rank counties participating in the pilot program based on an information security risk index that may include analysis of the relative amount of the specified factors within counties. These factors include personally identifiable information protected by law, voter registration information, information on voted ballots, and other information identified by these offices in coordination with the county elections officials that may present a security risk, among other things.
4. Requires OIS, Cal OES, and CMD to transmit the complete results of each independent security assessment and recommendations for mitigating system vulnerabilities, if any, to the elections official of the county in which the assessment was conducted and the Secretary of State.
5. Provides that information and records concerning ISAs are confidential and shall not be disclosed during the process of conducting ISAs, notwithstanding any other law, except that the information and records may be transmitted to state employees, state contractors, county employees, and county contractors who have been approved as necessary to receive the information and records to perform that independent security assessment, subsequent remediation activity, or monitoring of remediation activity. Further, provides that the results of the ISA performed and related information are subject to the California Public Records Act (CPRA), including a specified exemption under the CPRA for information security records that would reveal vulnerabilities, as specified.
6. Requires OIS, Cal OES, and CMD to notify the Department of the California Highway Patrol (CHP) and the Department of Justice (DOJ) regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government, and notify the district attorney of the county regarding any criminal or alleged criminal cyber activity affecting any county entity or critical infrastructure of the county government.
7. Requires OIS, OES, and CMD, if one or more ISAs are conducted pursuant to this bill, to prepare a joint report to the Legislature on the pilot program, by January 1, 2022, as specified, regarding the assessments conducted.
8. Codifies the intent of the Legislature to appropriate federal funds dedicated for election cybersecurity to pay for the pilot program created by this section and specifies that the program shall not be implemented until either a) federal funds or b) other funds, including state funds, are made available for these purposes.
9. Defines various terms for these purposes, including “election infrastructure” to mean storage facilities, polling places, and centralized vote tabulation locations used to support the election process, and information and communications technology to include voter registration databases, vote tabulating devices, and other systems to manage the election process and report and display results.
10. Provides various findings and declarations, including, among other things, that information technology networks and critical infrastructure are threatened by increasingly sophisticated cyberattacks. These cyberattacks present a major cybersecurity risk and increase the state's vulnerability to economic disruption, critical infrastructure damage, potential disruption to our election systems, and violations of individuals' rights.
11. Includes a January 1, 2023 sunset date.

EXISTING LAW:

1. Establishes CDT within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer. (Government Code Section (GOV) 11545(a)) Establishes OIS within CDT to ensure the confidentiality, integrity, and availability of state systems and applications. OIS must develop an information security program and establish policies, standards, and procedures directing state agencies to effectively manage security and risk. (GOV 11549 et seq.)
2. Authorizes OIS to conduct, or require to be conducted, an ISA of every state agency, department, or office. Requires the cost of an independent security assessment to be funded by the state agency, department, or office being assessed. (GOV 11549.3(c)(1).)
3. Requires OIS, in consultation with Cal OES, to perform all the following duties:
   1. Annually require no fewer than 35 state entities to perform an ISA, the cost of which shall be funded by the state agency, department, or office being assessed.
   2. Determine criteria and rank state entities based on an information security risk index that may include, but not be limited to, consideration of the following factors:
      1. Personally identifiable information protected by law.
      2. Health information protected by law.
      3. Confidential financial data.
      4. Self-certification of compliance and indicators of unreported noncompliance with security provisions related to information asset management, risk management, information security program management, information security incident management and technology recovery planning.
   3. Determine the basic standards of services to be performed as part of an ISA. (GOV 11549.3(c)(2).)
4. Authorizes CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed. (GOV 11549.3(c)(3).)
5. Requires state agencies and entities required to conduct or receive an ISA to transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to OIS and Cal OES. (GOV 11549.3(d).)
6. Requires OIS to report to CDT and Cal OES any state entity found to be noncompliant with information security program requirements. (GOV 11549.3(e).)
7. Specifies, notwithstanding any other law, that during the process of conducting an independent security assessment, information and records concerning the assessment are confidential and shall not be disclosed, except to approved state employees and state contractors. (GOV 11549.3(f)(1).)
8. Declares the results of a completed ISA and any related information to be subject to all disclosure and confidentiality provisions under state law, including the CPRA and the CPRA exemption pertaining to information security records that may reveal vulnerabilities, as specified. (GOV 11549.3(f)(2).)
9. Requires CDT to notify Cal OES, the CHP, and the DOJ regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government. (GOV 11549.3(h).)
10. Requires, by Executive order in 2015, Cal OES to establish and lead the California Cybersecurity Integration Center (Cal-CSIC), with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California's economy, its critical infrastructure, or public and private sector computer networks in the state. (Executive Order B-34-15.)
11. Requires, by Executive order, that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. (Executive Order B-34-15.)

FISCAL EFFECT: According to the Assembly Appropriations Committee:

1. Significant general fund (GF) costs, in the low millions of dollars for new state staff positions at the various departments that will implement the ISAs. For example, CMD estimates the need for five positions and six months to one year of training for those positions at a cost of $750,000 to $1 million in the first year. CDT estimates the need for 6 positions costing about $650,000 in the first year.
2. Significant GF costs, likely in the hundreds of thousands of dollars to low millions of dollars, to complete ISAs for county elections systems. Actual costs will depend on the number of ISAs conducted under this pilot program.

COMMENTS:

1. Purpose of this bill: This bill seeks to provide assistance to county election officials in their assessments of internet-connected election infrastructure by extending the cyber expertise and knowledge retained in specified state entities that are in the Cal-CSIC partnership to counties that voluntarily choose to participate in the bill's limited pilot program. This is an author-sponsored bill.
2. Author's statement: According to the author:

Free and fair elections are the cornerstone of our democracy. Ensuring that our election processes and voting systems are secure is vital to the integrity of our elections. Yet, with the rise in cyberattacks there has been growing concern about the impact they may have on our election process and democratic institutions.

[…] Cyberattacks are not only a threat to election systems, but there are growing concerns about cyberattacks on our governmental institutions, whether they be city, county, or state level agencies and departments. The recent ransomware attack on the City of Atlanta, where city systems were shut down for 5 days, is a prime example of this threat. To avert incidents like those experienced in Atlanta, the State of California previously enacted into law AB 670 (Irwin), Chapter 518, Statutes of 2015 to require the California Department of Technology (CDT), in partnership with the California Military Department (CMD) and the Office of Emergency Services (OES), to annually conduct no fewer than 35 independent security assessments of state agencies, departments or offices. These assessments evaluate the agency on how effectively it protects personally identifiable information, health information, and confidential financial information, along with considering self-certification of compliance and indicators of unreported noncompliance with security provisions related to information asset management, risk management, information security program management, information security incident management and technology recovery planning. The same steps we are taking to review and protect state agencies, departments and offices would be beneficial to reviewing and protecting our local election systems.

AB 2748 builds upon AB 670 by requiring CDT, CMD, and OES to establish a pilot program to conduct an independent security assessment of election infrastructure in participating counties so that these counties can have the resources to proactively review their systems to ensure they are as secure as possible.

Analysis Prepared by: Ronak Daylami / P. & C.P. / (916) 319-2200 FN: 0003420

Date of Hearing: May 9, 2018

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

ABPCA Bill Id:AB 2748

Author:(Chau) – As Amended Ver:April 30, 2018

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill establishes a pilot program, until January 1, 2023, requiring specified state entities to conduct an independent security assessment (ISA) of election infrastructure for participating counties. Specifically, this bill:

1. Requires the Office of Information Security (OIS) within the California Department of Technology (CDT), the Office of Emergency Services (OES), and the California Military Department (CMD) to conduct an ISA of election infrastructure in counties that voluntarily choose to participate. Requires OIS, OES, and CMD to consult with county elections officials to identify and select counties to participate in the pilot program and requires the first set of ISAs to be completed by January 1, 2020.
2. Requires OIS, OES, and CMD to transmit the complete results of each ISA and recommendations for mitigating system vulnerabilities, if any, to the applicable county elections officials and the Secretary of State (SOS).
3. Requires OIS, OES, and CMD to notify the Department of the California Highway Patrol (CHP) and the Department of Justice (DOJ) of any criminal or alleged criminal cyber activity affecting a state entity or critical infrastructure of state government.
4. Requires OIS, OES, and CMD to report to the Legislature by January 1, 2022, regarding ISAs conducted under the pilot program.

FISCAL EFFECT:

1. Significant GF costs, in the low millions of dollars for new state staff positions at the various departments that will implement the ISAs. For example, CMD estimates the need for five positions and six months to one year of training for those positions at a cost of $750,000 to $1 million in the first year. CDT estimates the need for 6 positions costing about $650,000 in the first year.
2. Significant GF costs, likely in the hundreds of thousands of dollars to low millions of dollars, to complete ISAs for county elections systems. Actual costs will depend on the number of ISAs conducted under this pilot program.

COMMENTS:

1. Background. AB 670 (Irwin), Chapter 518, Statutes of 2015, requires OIS, in consultation with OES, to conduct no fewer than 35 ISAs of state agencies, departments, or offices annually, as specified. AB 670 also authorizes the CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed.
2. Purpose. This bill is modeled after AB 670 to extend ISAs to county election systems. According to the author:

In the aftermath of the 2016 elections, numerous states, including California, were found to be the targets of election interference by Russian hackers. In response to the similarly growing threat of cyberattacks on government systems the State of California previously enacted into law AB 670 (Irwin) to require CDT, in partnership with CMD and OES, to annually conduct no fewer than 35 independent security assessments of state agencies, departments or offices. These assessments evaluate the agency on how effectively it protects personally identifiable information, health information, and confidential financial information along with assessing information security management and incident management and response. AB 2748 builds upon AB 670 by requiring CDT, CMD, and OES to establish a pilot program to conduct an independent security assessment of election infrastructure in participating counties so that these counties can have the resources to proactively review their systems to ensure they are as secure as possible.

1. Related legislation. AB 3075 (Berman), of the current legislative session, creates the Office of Elections Cybersecurity within the Secretary of State’s office and charges it with coordinating efforts to reduce the likelihood and severity of cyber incidents that interfere with election security or integrity. AB 3075 is currently pending on the Assembly floor.

Analysis Prepared by: Jessica Peters / APPR. / (916) 319-2081

Date of Hearing: April 25, 2018

ASSEMBLY COMMITTEE ON ELECTIONS AND REDISTRICTING

Marc Berman, Chair

ABPCA Bill Id:AB 2748 (

Author:Chau) – As Amended Ver:March 23, 2018

SUBJECT: Election infrastructure: independent security assessments.

SUMMARY: Establishes a pilot program until 2023 under which participating counties would have an independent security assessment (ISA) of their election infrastructure conducted by specified state government entities. Specifically, this bill:

1. Requires the Office of Information Security (OIS) within the California Department of Technology (CDT), the Office of Emergency Services (OES), and the California Military Department (CMD) to conduct an ISA of election infrastructure in participating counties. Requires OIS, OES, and CMD to consult with county elections officials to identify and select counties to participate in the pilot program and requires the first set of ISAs to be completed by January 1, 2020.
2. Requires OIS, OES, and CMD to do all of the following in coordination with the county elections officials in participating counties:
   1. Determine criteria and rank counties based on an information security risk index that may include analysis of the relative amount of the following factors within counties:
      1. Personally identifiable information protected by law;
      2. Voter registration information;
      3. Information on voted ballots;
      4. Self-certification of compliance and indicators of unreported noncompliance with security provisions in the following areas:
         1. Information asset management;
         2. Risk management;
         3. Information security program management;
         4. Information security incident management; and,
         5. Technology recovery planning; and,
      5. Other information identified by OIS, OES, and CMD, in coordination with county elections officials, that may present a security risk.
   2. Determine the basic standards of services to be performed as part of ISAs conducted in accordance with this bill.
3. Requires OIS, OES, and CMD to transmit the complete results of each ISA and recommendations for mitigating system vulnerabilities, if any, to the applicable county elections officials and the Secretary of State (SOS).
4. Provides that information and records concerning an ISA are confidential and shall not be disclosed, except as specified, during the process of conducting the ISA.
5. Provides that the results of a completed ISA and related information are subject to all disclosure and confidentiality provisions of state law, including a provision of state law that exempts from disclosure an information security record of a public agency, if, on the facts of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency.
6. Requires OIS, OES, and CMD to notify the Department of the California Highway Patrol (CHP) and the Department of Justice (DOJ) of any criminal or alleged criminal cyber activity affecting a state entity or critical infrastructure of state government.
7. Defines "election infrastructure," for the purposes of this bill, as "storage facilities, polling places, and centralized vote tabulation locations used to support the election process, and information and communications technology to include voter registration databases, vote tabulating devices, and other systems to manage the election process and report and display results."
8. Contains various findings and declarations, and declares the intent of the Legislature to do both of the following:
   1. Leverage the state's cybersecurity resources to assist county elections officials in their assessments of election infrastructure in order to be best prepared for future cybersecurity threats; and,
   2. Recognize election infrastructure as critical infrastructure and an important subsector within the Government Facilities Sector identified by the federal government and California.
9. Includes a January 1, 2023 sunset date.

EXISTING LAW:

1. Establishes the CDT within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer. Establishes the OIS within the CDT. Specifies that the purpose of OIS is to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.
2. Establishes the OES within the office of the Governor. Requires OES to be responsible for the state's emergency and disaster response services for natural, technological, or manmade disasters and emergencies, including responsibility for activities necessary to prevent, respond to, recover from, and mitigate the effects of emergencies and disasters to people and property.
3. Establishes the CMD, and provides that it includes the office of the Adjutant General, the California National Guard, the State Military Reserve, the California Cadet Corps, and the Naval Militia.
4. Requires OIS to develop an information security program and establish policies, standards, and procedures directing state agencies to effectively manage security and risk.
5. Permits the OIS to conduct, or require to be conducted, an ISA of every state agency, department, or office. Requires the cost of an ISA to be funded by the state agency, department, or office being assessed. Requires the OIS, in consultation with OES, to require no fewer than 35 state entities to perform an ISA each year, as specified.
6. Permits the Military Department to perform an ISA of any state agency, department, or office, funded by the agency, department, or office being assessed.
7. Requires state agencies and entities required to conduct or receive an ISA to transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to the OIS and the OES.
8. Requires the OIS to report any state entity found to be noncompliant with information security program requirements to the CDT and the OES.
9. Provides that information and records concerning an ISA are confidential and shall not be disclosed, except as specified, during the process of conducting the ISA. Provides that the results of a completed ISA are subject to all disclosure and confidentiality provisions pursuant to any state law, including a provision of the California Public Records Act (CPRA) that exempts from disclosure an information security record of a public agency, if, on the facts of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency.
   
10. Requires CDT to notify the OES, the CHP, and the DOJ regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government.
11. Provides that the SOS is the chief elections officer of the state. Requires the SOS to administer the provisions of the Elections Code. Requires the SOS to see that elections are efficiently conducted and that state election laws are enforced. Permits the SOS to require elections officers to make reports concerning elections in their jurisdictions.
12. Requires the SOS to test and certify or otherwise approve voting systems, remote accessible vote by mail systems, ballot-on-demand systems, and electronic poll books prior to their use in an election in the state.
13. Requires each state, pursuant to the federal Help America Vote Act (HAVA) of 2002, to implement a single, uniform, official, centralized, interactive computerized statewide voter registration list defined, maintained, and administered at the state level that contains the name and registration information of every legally registered voter in the state and assigns a unique identifier to each legally registered voter in the state.

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of the Bill: According to the author:

Free and fair elections are the cornerstone of our democracy. Ensuring that our election processes and voting systems are secure is vital to the integrity of our elections. There has been growing concern about the impact that cyberattacks may have on our election process and democratic institutions. In the aftermath of the 2016 elections, numerous states, including California, were found to be the targets of election interference by Russian hackers. In response to the similarly growing threat of cyberattacks on government systems the State of California previously enacted into law AB 670 (Irwin) to require [CDT], in partnership with [CMD] and [OES], to annually conduct no fewer than 35 independent security assessments of state agencies, departments or offices. These assessments evaluate the agency on how effectively it protects personally identifiable information, health information, and confidential financial information along with assessing information security management and incident management and response. AB 2748 builds upon AB 670 by requiring CDT, CMD, and OES to establish a pilot program to conduct an independent security assessment of election infrastructure in participating counties so that these counties can have the resources to proactively review their systems to ensure they are as secure as possible.

1. Joint Informational Hearing on Election Cybersecurity: On March 7, this committee held a Joint Informational Hearing with the Senate Committee on Elections & Constitutional Amendments on the topic of Cybersecurity and California Elections. In light of the increased focus on election security since the 2016 elections, the purpose of the hearing was to explore California's policies for protecting the security of elections systems in an environment where the number and sophistication of threats to election infrastructure continues to increase. Witnesses that participated in the hearing included the SOS, a member of the United States Election Assistance Commission (EAC), three California county elections officials, the former Senior Director for Cybersecurity Policy at The White House, and a Senior Advisor and Past President to a nonprofit organization that advocates for legislation and regulation that promotes accuracy, transparency and verifiability of elections.
   
   Witnesses at the hearing generally agreed that there was no evidence to suggest that voting machines or vote tallying in California were compromised during the 2016 election. Nonetheless, all of the witnesses stressed the importance of continuing to evaluate cyber and other security threats to election infrastructure and to regularly evaluate processes and procedures to protect against those threats and to promote voter confidence in the accuracy of election results.
   
   There were several common recommendations made by witnesses at the hearing for putting state and county elections officials in the best position to defend against and respond to cyber threats, and to protect public confidence in California elections. Many witnesses stressed the importance of funding elections and expressed support for the $134 million included in the Governor's proposed 2018-19 budget to assist counties with the costs of replacing their voting systems. Witnesses also noted that the lack of reimbursement by the state for elections-related state mandates and for the costs of special elections for filling vacancies in the Legislature and Congress had the effect of limiting resources that were available at the local level for election security. Several witnesses also stressed the importance of coordinating the sharing of cybersecurity information and resources, particularly with smaller counties that have more limited resources, and of developing robust post-election auditing procedures—including risk-limiting audits—to improve voter confidence in the accuracy of election results. Other recommendations included improving efforts to take advantage of security expertise in the private sector and at academic institutions in the state, ensuring that elections officials develop cyber incident response plans that include considerations of how to recover from cyber incidents, and working with third-party validators to help disseminate accurate information about elections as a way to counter bad information that could negatively impact elections and voter confidence.
2. Critical Infrastructure Designation: On January 6, 2017, then-Secretary of the federal Department of Homeland Security (DHS) Jeh Johnson announced that he was designating election infrastructure in the country as critical infrastructure, a decision that was later reaffirmed by the Trump administration. According to information from DHS, critical infrastructure is a designation "established by the Patriot Act and given to 'systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.'" In his announcement, Secretary Johnson noted that the designation generally gives DHS the ability to provide additional cybersecurity assistance to state and local elections officials but does not mean that there will be new or additional federal regulation or oversight of the conduct of elections by state and local governments.
   
   The DHS has prepared a Cybersecurity Services Catalog for Election Infrastructure that outlines the services and other assistance available to the election infrastructure community, including state and local elections officials. Among the services provided are various no-cost cybersecurity assessments, information sharing about cybersecurity threats, cybersecurity training, assistance in cyber incident planning and cyber incident response, and network protection.
   
   The most thorough and extensive cybersecurity assessment offered by the DHS to the election infrastructure community is a Risk and Vulnerability Assessment (RVA), a no-cost service described by DHS as an "offering that combines national threat and vulnerability information with data collected and discovered through onsite assessment activities to provide customers with actionable remediation recommendations prioritized by risk. Engagements are designed to determine whether and by what methods an adversary can defeat network security controls. Components of the assessment can include scenario-based network penetration testing, web application testing, social engineering testing, wireless testing, configuration reviews of servers and databases, and evaluation of an [organization's] detection and response capabilities." Because of the extensive nature of the assessment and the fact that DHS is offering it at no-cost, there can be a long wait between the time that a jurisdiction applies for an RVA and the time that one is conducted. DHS indicates that the wait time to receive an RVA typically is at least 90 days, and an article last December reported that the wait could be as long as nine months (Starks, T. "The latest 2018 election-hacking threat: 9-month wait for government help." Politico, 29 December 2017, www.politico.com/story/2017/12/29/2018-election-hacking-threat-government-help-231512. Accessed April 2018), though DHS subsequently has said that they are prioritizing requests for RVAs from state and local elections officials in an effort to get those assessments completed more quickly.
3. Independent Security Assessments and Existing Law: AB 670 (Irwin), Chapter 518, Statutes of 2015, requires OIS, in consultation with OES, to conduct no fewer than 35 ISAs of state agencies, departments, or offices annually, as specified. AB 670 also authorizes the CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed. The provisions of this bill are modeled after AB 670, though the language has been modified to focus more squarely on elections-related infrastructure, and certain other adjustments have been made.
   
   While the state offices, departments, and agencies with cybersecurity responsibilities have conducted ISAs for non-state entities in the past, the framework established by AB 670 focused on ISAs of state agencies, departments, and offices. By creating a framework for ISAs to be conducted on county elections offices, and by establishing clear lines of authority and responsibility for those ISAs, this bill could help make the state's cybersecurity expertise more broadly available in protecting California's election infrastructure.
4. Funding for Independent Security Assessments: In requiring an ISA to be performed for every state agency, department, or office, AB 670 specifically required each ISA to be funded by the state agency, department, or office being assessed. This bill is silent with respect to the entity that would be responsible for paying for an ISA that is conducted under the pilot program.
   
   As detailed above, a number of witnesses at this committee's joint informational hearing testified about the need to increase the resources that are available for election security. While many county elections officials may appreciate the opportunity to have an ISA performed by OIS, OES, and CMD, it is unclear how many counties would be able to take advantage of that opportunity if they are required to pay the full costs of the ISA. In particular, counties with more limited resources may find it particularly challenging to cover the costs of an ISA conducted by the state.
5. Confidentiality of Sensitive Information: Consistent with the policy developed in AB 670, this bill provides that assessment results, while subject to all disclosure provisions of state law including the CPRA, are also subject to a provision of the CPRA that protects disclosure of any government information security record that "would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency." Thus, under this provision, any part of the result of an ISA that could reveal vulnerabilities is redactable, including potentially the entire assessment.
   
   Additionally, during the process of conducting the assessment, this bill provides that information and records concerning ISAs are confidential and shall not be disclosed except to specified entities as necessary to receive the information and records to perform the ISA, subsequent remediation activity, or monitoring of remediation activity. This provision also is based off existing public policy approved under AB 670.
6. Federal Election Security Funding: On March 23, 2018, President Trump signed the Consolidated Appropriations Act of 2018 (Act)—the omnibus spending bill for the federal fiscal year ending on September 30, 2018. Among other provisions, the Act provided $380 million in HAVA funding to the EAC to make payments to states for activities to improve the administration of elections for Federal office, including to enhance election technology and make election security improvements. States that receive federal funds are required to provide a match of five percent of the funds received within two years of receiving the federal funds.
   
   According to information from the EAC, California's share of the federal funding is $34,558,876, and the state's required five percent match totals $1,727,944. The EAC notes that a joint explanatory statement prepared by Congress to indicate congressional intent on how the funds may be spent specifies that states may use the funds to replace electronic voting equipment that does not have a paper trail; to implement a post-election audit system; to upgrade election-related computer systems to address cyber vulnerabilities; to facilitate cybersecurity training for state and local election officials; to implement established cybersecurity best practices; and to fund other activities that will improve the security of elections for federal office.
7. Suggested Amendments: To ensure that this bill accurately reflects the author's intent and to tailor the language of the bill more closely to the types of assessments that would be conducted, committee staff recommends the following amendments to this bill:
   1. Voluntary Participation: According to information from the author's office, the intent of this bill is to conduct ISAs in counties that voluntarily have agreed to participate in the pilot program that this bill creates. Certain language in this bill, however, could be interpreted to permit the OIS to require an ISA of a county that did not want to participate in the pilot program. To clarify the intent of the bill, committee staff recommends the following amendments:
      
      On page 4, lines 4 and 5 of the bill, strike out "participating counties" and insert:
      
      counties that voluntarily choose to participate in the pilot program
   2. Sharing Information with Relevant County Officials: As detailed above, the language of this bill is based off an existing law that provides for ISAs of state agencies, departments, and offices. Because this bill provides for ISAs of county elections infrastructure, however, committee staff recommends that this bill be amended in a number of areas to ensure that relevant county officials receive information about the ISAs that are conducted, and the results of those ISAs. Additionally, committee staff recommends amendments to clarify that the results of an ISA conducted in a county will be shared only with the elections official in that county, and will not be shared with the elections officials in other counties in which ISAs were conducted as part of the pilot program. Specifically, committee staff recommends the following amendments:
      
      On page 5, lines 1 and 2 of the bill, strike out "applicable county elections officials" and insert:
      
      elections official of the county in which the assessment was conducted
      
      On page 5, line 8, strike out "employees and state contractors" and insert:
      
      employees, state contractors, county employees, and county contractors
      
      On page 5, line 23, strike out "government." and insert:
      
      government, and shall notify the district attorney of the county regarding any criminal or alleged criminal cyber activity affecting any county entity or critical infrastructure of the county government.
   3. Reporting Requirement: While this bill authorizes a four-year pilot program for conducting ISAs of county election infrastructure, it does not include a means for evaluating that program. Bills that authorize pilot programs commonly include a requirement that a report be prepared and be submitted to the relevant legislative committees in order to inform future discussion over extension or expansion of the program. Committee staff recommends that this bill be amended to require the OIS, OES, and CMD, if one or more ISAs are conducted pursuant to this bill, to prepare a report on the pilot program. Specifically, committee staff recommends the following amendments:
      
      On page 5, between lines 33 and 34, insert:
      
      (g) If one or more independent security assessments are conducted pursuant to this section, the office, the Office of Emergency Services, and the California Military Department shall prepare a joint report to the Legislature regarding the assessments conducted as part of the program on or before January 1, 2022, and shall submit that report in compliance with Section 9795. The office, the Office of Emergency Services, and the California Military Department shall develop the report in consultation with the counties in which the independent security assessments were performed. The report shall include, but not be limited to, all of the following:
      (1) An identification of the counties in which independent security assessments were performed pursuant to this section.

(2) Information about the costs of independent security assessments performed pursuant to this section.

(3) A summary of relevant performance metrics, including county satisfaction with the performance of the assessments and a summary of the results of completed assessments, subject to all confidentiality provisions pursuant to any state law, including, but not limited to, Section 6254.19.

(4) Any legislative recommendations.

On page 5, line 34, strike out "(g)" and insert:

(h)

1. Related Legislation: AB 3075 (Berman), which is pending in the Assembly Appropriations Committee, creates the Office of Elections Cybersecurity within the Office of the SOS, and charges it with coordinating efforts to reduce the likelihood and severity of cyber incidents that interfere with election security or integrity. AB 3075 was heard in this committee on April 11, 2018 and was approved on a 6-0 vote.
   
2. Double-Referral: On April 17, 2018, this bill was approved by the Assembly Privacy & Consumer Protection Committee on a 10-0 vote.
   

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Opposition

None on file.

Analysis Prepared by: Ethan Jones / E. & R. / (916) 319-2094

Date of Hearing: April 17, 2018

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 2748 (

Author:Chau) – As Amended Ver:March 23, 2018

SUBJECT: Election infrastructure: independent security assessments

SUMMARY: This bill would provide for the ability of state cybersecurity resources to be leveraged to assist county election officials in their assessments of election infrastructure, as specified. This bill would create a pilot program modeled off of existing law requiring information security assessments (ISAs) of state entities, as specified, with a five year sunset date. Specifically, this bill would:

1. State the Legislature’s intent to: (1) leverage the state’s cybersecurity resources to assist county elections officials in their assessments of election infrastructure in order to be best prepared for future cybersecurity threats; and (2) to recognize election infrastructure as critical infrastructure and an important subsector within the existing Government Facilities Sector identified by the federal government and this state.
2. Require the Office of Information Security (OIS), the Office of Emergency Services (Cal OES), and the California Military Department (CMD), to establish a pilot program to conduct, or require to be conducted, an ISA of election infrastructure in participating counties. OIS, Cal OES, and CMD must, in doing so, consult with county elections officials to identify and select counties to participate in the pilot program and the ISAs for the first group of participating counties must be completed no later than January 1, 2020, after which further ISAs may be conducted.
3. Require OIS, Cal OES, and CMD, in coordination with the county elections officials in the participating counties, to determine criteria and rank counties based on an information security risk index that may include analysis of the relative amount of the specified factors within counties. These factors include personally identifiable information protected by law, voter registration information, information on voted ballots, and other information identified by these offices in coordination with the county elections officials that may present a security risk, among other things.
4. Require OIS, Cal OES, and CMD to transmit the complete results of each independent security assessment and recommendations for mitigating system vulnerabilities, if any, to the applicable county elections officials and the Secretary of State.
5. Provide that information and records concerning ISAs are confidential and shall not be disclosed during the process of conducting ISAs, notwithstanding any other law, except that the information and records may be transmitted to state employees and state contractors who have been approved as necessary to receive the information and records to perform that independent security assessment, subsequent remediation activity, or monitoring of remediation activity. Further, would provide that the results of the ISA performed and related information are subject to the California Public Records Act (CPRA), including a specified exemption under the CPRA for information security records that would reveal vulnerabilities, as specified.
6. Require OIS, Cal OES, and CMD to notify the Department of the California Highway Patrol (CHP) and the Department of Justice (DOJ) regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government.
7. Define various terms for these purposes, including “election infrastructure” to mean storage facilities, polling places, and centralized vote tabulations locations used to support the election process, and information and communications technology to include voter registration databases, vote tabulating devices, and other systems to manage the election process and report and display results.
8. Provide various findings and declarations, including, among other things, that information technology networks and critical infrastructure are threatened by increasingly sophisticated cyber attacks. These cyber attacks present a major cybersecurity risk and increase the state’s vulnerability to economic disruption, critical infrastructure damage, potential disruption to our election systems, and violations of individuals’ rights.
9. Include a January 1, 2023 sunset date.

EXISTING LAW:

1. Establishes CDT within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer. (Gov. Code Sec. 11545(a).) Establishes OIS within CDT to ensure the confidentiality, integrity, and availability of state systems and applications. OIS must develop an information security program and establish policies, standards, and procedures directing state agencies to effectively manage security and risk. (Gov. Code Sec. 11549 et seq.)
2. Authorizes OIS to conduct, or require to be conducted, an ISA of every state agency, department, or office. Requires the cost of an independent security assessment to be funded by the state agency, department, or office being assessed. (Gov. Code Sec. 11549.3(c)(1).)
3. Requires OIS, in consultation with Cal OES, to perform all the following duties:
   • Annually require no fewer than 35 state entities to perform an ISA, the cost of which shall be funded by the state agency, department, or office being assessed.
   • Determine criteria and rank state entities based on an information security risk index that may include, but not be limited to, consideration of the following factors:
     • Personally identifiable information protected by law.
     • Health information protected by law.
     • Confidential financial data.
     • Self-certification of compliance and indicators of unreported noncompliance with security provisions related to information asset management, risk management, information security program management, information security incident management and technology recovery planning.
   • Determine the basic standards of services to be performed as part of an ISA. (Gov. Code Sec. 11549.3(c)(2).)
4. Authorizes CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed. (Gov. Code Sec. 11549.3(c)(3).)
5. Requires state agencies and entities required to conduct or receive an ISA to transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to OIS and Cal OES. (Gov. Code Sec. 11549.3(d).)
6. Requires OIS to report to CDT and Cal OES any state entity found to be noncompliant with information security program requirements. (Gov. Code Sec. 11549.3(e).)
7. Specifies, notwithstanding any other law, that during the process of conducting an independent security assessment, information and records concerning the assessment are confidential and shall not be disclosed, except to approved state employees and state contractors. (Gov. Code Sec. 11549.3(f)(1).)
8. Declares the results of a completed ISA and any related information to be subject to all disclosure and confidentiality provisions under state law, including the CPRA and the CPRA exemption pertaining to information security records that may reveal vulnerabilities, as specified. (Gov. Code Sec. 11549.3(f)(2).)
9. Requires CDT to notify Cal OES, the CHP, and the DOJ regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government. (Gov. Code Sec. 11549.3(h).)
10. Requires, by Executive order in 2015, Cal OES to establish and lead the California Cybersecurity Integration Center (Cal-CSIC), with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state. (Executive Order B-34-15.)
11. Requires, by Executive order, that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. (Executive Order B-34-15.)

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of this bill: This bill seeks to assist county election officials in their assessments of election infrastructure by extending the cyber expertise and knowledge retained in specified state entities, including the CMD, CDT, and others state partners in the Cal-CSIC. This is an author-sponsored bill.
2. Author’s statement: According to the author, “[f]ree and fair elections are the cornerstone of our democracy. Ensuring that our election processes and voting systems are secure is vital to the integrity of our elections. Yet, with the rise in cyberattacks there has been growing concern about the impact they may have on our election process and democratic institutions.

[…] Cyberattacks are not only a threat to election systems, but there are growing concerns about cyberattacks on our governmental institutions, whether they be city, county, or state level agencies and departments. The recent ransomware attack on the City of Atlanta, where city systems were shut down for 5 days, is a prime example of this threat. To avert incidents like those experienced in Atlanta, the State of California previously enacted into law AB 670 (Irwin, Chapter 518, Statutes of 2015) to require the California Department of Technology (CDT), in partnership with the California Military Department (CMD) and the Office of Emergency Services (OES), to annually conduct no fewer than 35 independent security assessments of state agencies, departments or offices. These assessments evaluate the agency on how effectively it protects personally identifiable information, health information, and confidential financial information, along with considering self-certification of compliance and indicators of unreported noncompliance with security provisions related to information asset management, risk management, information security program management, information security incident management and technology recovery planning. The same steps we are taking to review and protect state agencies, departments and offices would be beneficial to reviewing and protecting our local election systems.

AB 2748 builds upon AB 670 by requiring CDT, CMD, and OES to establish a pilot program to conduct an independent security assessment of election infrastructure in participating counties so that these counties can have the resources to proactively review their systems to ensure they are as secure as possible.”

1. Recognition of election infrastructure as critical infrastructure: As reflected in this bill’s findings and declarations, in January 2017, the Obama administration announced that it had designated the country’s election infrastructure as “critical,” thus bringing added federal protections to voting systems. As stated by the then-Secretary of the Department of Homeland Security (DHS): “Given the vital role elections play in this country, it is clear that certain systems and assets of election infrastructure meet the definition of critical infrastructure, in fact and in law.” The new designation covers storage facilities, polling places, and centralized vote tabulations locations used to support the election process, as well as information and communications technology like voter registration databases, voting machines, and other systems used to manage the election process and report results. At the same time, some election officials argued against the designation, believing that they would have more flexibility without the designation despite the fact that it was made clear that the federal designation did nothing to change the role of state and local governments in administering and running elections and that the designation did not signal any sort of federal takeover, regulation, oversight, or intrusion concerning elections. The designation merely allows DHS “to prioritize cybersecurity assistance to officials who request it and serve as deterrent to foreign interference.” As stated by the DHS Secretary at the time: “The designation makes clear both domestically and internationally that election infrastructure enjoys all the benefits and protections of critical infrastructure that the U.S. government has to offer.” (Williams, the Hill, DHS designates election systems as ‘critical infrastructure’ (Jan. 6, 2017).) In other words, the classification operates to institutionalize the federal government’s role in helping state and local organizations secure the country’s elections, and makes it easier for DHS to offer them resources and intelligence information to that end. That designation has been upheld under the current administration. (Volz, Reuters, Trump administration will uphold election system's designation as critical infrastructure (Feb. 7, 2017).)

As a result of this designation, DHS offers a catalog of cybersecurity services to election officials, including cybersecurity assessments. The Cyber Resilience Review (CRR) is a no-cost, voluntary, interview-based assessment to evaluate an organization’s operational resilience and cybersecurity practices. Through the CRR, an organization will develop an understanding of its cybersecurity posture and its ability to manage cyber risk during normal operations and times of operational stress and crisis. The CRR specifically evaluates the maturity of an organization’s capacities and capabilities in performing, planning, managing, measuring, and defining cybersecurity capabilities across 10 domains: asset management; controls management; configuration and change management; vulnerability management; incident management; service continuity management; risk management; external dependency management; training and awareness; and situational awareness. The CRR report is created exclusively for the organization’s internal use. All data collected and analysis performed during a CRR assessment is protected under the DHS Protected Critical Infrastructure Information (PCII) Program, meaning that DHS employees are trained in the safeguarding and handling of PCII, DHS cannot publicly disclose PCII, and PCII cannot be used for regulatory purposes. Other cybersecurity assessments available on the DHS catalog include an external dependencies management assessment; cyber infrastructure survey (a no-cost, voluntary survey that evaluates the effectiveness of organizational security controls, cybersecurity preparedness, and overall resilience); phishing campaign assessment; risk and vulnerability assessment; vulnerability scanning; validated architecture design review; and cybersecurity evaluation tool. (See DHS, DHS Cybersecurity Services Catalog for Election Infrastructure <https://www.eac.gov/assets/1/6/DHS_Cybersecurity_Services_Catalog_ for_Election_Infrastructure.pdf > [as of Mar. 31, 2018] p. 5.)

As recognized by this bill’s findings and declarations, the federal Critical Infrastructures Protection Act of 2001 defines critical infrastructure as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.” By declaring the intent of the Legislature to follow suit of the federal government and add election infrastructure to the list of critical infrastructure sectors recognized by California, this bill effectively states that that protecting California’s election infrastructure from cybersecurity threats is of vital importance to this state and to our national interests. Notably, California has already recognized all other 16 critical infrastructure categories identified by the federal government. (See Cal OES, Critical Infrastructure Protection < http://www.caloes.ca.gov/for-businesses-organizations/plan-prepare/critical-infrastructure-protection> [as of Mar. 31, 2018].)

1. Extending cybersecurity expertise to assist county election officials: This bill states the Legislature’s intent to: (1) recognize election infrastructure as critical infrastructure and an important subsector within the existing Government Facilities Sector identified by the federal government and this state; and (2) leverage the state’s cybersecurity resources to assist county elections officials in their assessments of election infrastructure in order to be best prepared for future cybersecurity threats. Such resources include the state’s Cal-CSIC, created by way of a governor’s Executive order, with the primary mission to reduce the likelihood and severity of cyber incidents that could damage this state’s economy, its critical infrastructure, or the public and private sector computer networks in this state. Cal-CSIC is required to serve as the central organizing hub of the state government’s cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities, and other service providers, academic institutions, and non-governmental organizations. As partners who serve on Cal-CSIC, OIS, OES, and CMD can not only assist count officials with the AB 670-like ISAs provided for in the pilot program in this bill, but also help county officials take better advantage of the resources available to them as a result of the critical infrastructure designation by DHS given the state and federal partnerships struck by Cal-CSIC.

Under this bill, OIS, Cal OES, and CMD would work with county election officials to identify counties that would participate in a pilot program wherein the state entities responsible for conducting ISAs for state agencies, departments and offices, could conduct similar ISAs for county election infrastructure to help counties best prepare for current and future cybersecurity threats which are constantly evolving. In doing so, this bill recognizes the unique resources and expertise at the disposal of the State which can be of assistance to the counties which may not have as extensive of tools or knowledge as they otherwise might if pooled together with CDT, Cal OES, and CMD and the rest of the Cal-CSIC partners in this arena. As learned by this Committee in conducting its joint cybersecurity oversight hearing in February of this year with the Select Committee on Cybersecurity, the shift from a siloed, disjointed approach toward a partnership-based approach to address cybersecurity issues on the state level has made a critical difference in better addressing cybersecurity concerns in state government when compared to the last oversight hearing on this topic. This proposal reflects a recognition that this partnership approach toward cybersecurity can be equally effective if applied to bridge resources from the state level to local officials as well. Importantly, the bill is not a statement of any current status of existing infrastructure; merely, it is an effort to apply the state’s resources to its utmost advantage in critical areas, including elections. As currently drafted, the bill seeks to provide for sufficient flexibility for the state partners to coordinate with election officials to determine not just the best counties to participate first in the pilot (to which the list can be added upon completion of the first ISAs), but to also determine what elements the ISA will serve to provide results in to be most helpful to the counties.

1. Exemption from open records laws: Modeled after the AB 670 (Irwin, Ch. 518, Stats. 2015) ISAs, this bill provides that assessment results, while subject to the CPRA, are also subject to a provision of the CPRA which specifically protects disclosure any government information security record that “would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency.” Thus, under this provision, any part of the result that could reveal vulnerabilities is redactable, including potentially the entire assessment. Additionally, during the process of conducting the assessment as well, the bill would also provide that information and records concerning ISAs are confidential and shall not be disclosed, notwithstanding any other law, except that the information and records may be transmitted to state employees and state contractors who have been approved as necessary to receive the information and records to perform that independent security assessment, subsequent remediation activity, or monitoring of remediation activity. This, too, is based off existing public policy approved under AB 670 for when ISAs are conducted for state entities.
2. Additional considerations: As currently drafted, the bill provides that OIS, Cal OES, and CMD would work with county election officials to identify counties that would participate in the pilot program and that the program would sunset by January 1, 2023. On the one hand, the author may wish to consider whether this program is worth expanding into a longer term project to ensure the cybersecurity of these programs into the future; on the other hand, the option to remove the sunset would, of course, remain available after testing the efficacy of the pilot for a period of time. The author may also wish to consider whether it might be helpful to place certain criteria around the selection of the participating counties, to take into consideration the counties’ resources, voting population, or other relevant criteria. To this end, however, staff notes that this bill, if approved, would be heard next in the Assembly Elections & Redistricting Committee, which may have additional expertise in what those should be based on, to best serve county official needs in a fair manner. Finally, as the bill moves through the legislative process and the scope of the pilot is further refined, there may be a need to provide for some language addressing how these departments are to prioritize their duties to conduct assessments for state agencies versus the participating pilot counties.
3. Prior legislation: AB 670 (Irwin, Ch. 518, Stats. 2015) requires CDT, in consultation with OES, to conduct no fewer than 35 ISAs of entities annually, as specified. AB 670 also authorizes the CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed. See also Comment 5.
4. Double-referral: This bill is double-referred to the Assembly Elections & Redistricting Committee, where it will be heard if passed by this Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

None on file

Analysis Prepared by: Ronak Daylami / P. & C.P. / (916) 319-2200