(1)The California Constitution authorizes cities and counties to make and enforce within their limits all local, police, sanitary, and other ordinances and regulations not in conflict with general laws and further authorizes cities organized under a charter to make and enforce all ordinances and regulations in respect to municipal affairs, which supersede inconsistent general laws.

The California Public Records Act requires a local agency to make public records available for inspection and allows a local agency to comply by posting the record on its internet website and directing a member of the public to the internet website, as specified.

This bill, no later than January 1, 2029, would require a local agency, as defined, that maintains an internet website for use by the public to ensure that the internet website utilizes a .gov top-level domain or a .ca.gov second-level domain and would require a local agency that maintains an internet website that is noncompliant with that requirement to redirect that internet website to a domain name that does utilize a .gov or .ca.gov domain. This bill, no later than January 1, 2029, would also require a local agency that maintains public email addresses to ensure that each email address provided to its employees utilizes a .gov domain name or a .ca.gov domain name. By adding to the duties of local officials, the bill would impose a state-mandated local program.

(2)The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

(1)The California Constitution authorizes cities and counties to make and enforce within their limits all local, police, sanitary, and other ordinances and regulations not in conflict with general laws and further authorizes cities organized under a charter to make and enforce all ordinances and regulations in respect to municipal affairs, which supersede inconsistent general laws.

The California Public Records Act requires a local agency to make public records available for inspection and allows a local agency to comply by posting the record on its internet website and directing a member of the public to the internet website, as specified.

This bill, no later than January 1, 2029, would require a local agency, as defined, that maintains an internet website for use by the public to ensure that the internet website utilizes a .gov top-level domain or a .ca.gov second-level domain and would require a local agency that maintains an internet website that is noncompliant with that requirement to redirect that internet website to a domain name that does utilize a .gov or .ca.gov domain. This bill, no later than January 1, 2029, would also require a local agency that maintains public email addresses to ensure that each email address provided to its employees utilizes a .gov domain name or a .ca.gov domain name. By adding to the duties of local officials, the bill would impose a state-mandated local program.

(2)The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

(1)The California Constitution authorizes cities and counties to make and enforce within their limits all local, police, sanitary, and other ordinances and regulations not in conflict with general laws and further authorizes cities organized under a charter to make and enforce all ordinances and regulations in respect to municipal affairs, which supersede inconsistent general laws.

The California Public Records Act requires a local agency to make public records available for inspection and allows a local agency to comply by posting the record on its internet website and directing a member of the public to the internet website, as specified.

This bill, no later than January 1, 2027, 2029, would require a local agency, as defined, that maintains an internet website for use by the public to ensure that the internet website utilizes a .gov top-level domain or a .ca.gov second-level domain and would require a local agency that maintains an internet website that is noncompliant with that requirement to redirect that internet website to a domain name that does utilize a .gov or .ca.gov domain. This bill, no later than January 1, 2027, 2029, would also require a local agency that maintains public email addresses to ensure that each email address provided to its employees utilizes a .gov domain name or a .ca.gov domain name. By adding to the duties of local officials, the bill would impose a state-mandated local program.

(2)The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

(1)The California Constitution authorizes cities and counties to make and enforce within their limits all local, police, sanitary, and other ordinances and regulations not in conflict with general laws and further authorizes cities organized under a charter to make and enforce all ordinances and regulations in respect to municipal affairs, which supersede inconsistent general laws.

The California Public Records Act requires a local agency to make public records available for inspection and allows a local agency to comply by posting the record on its internet website and directing a member of the public to the internet website, as specified.

This bill, no later than January 1, 2026, 2027, would require a local agency, as defined, that maintains an internet website for use by the public to ensure that the internet website utilizes a .gov top-level domain or a .ca.gov second-level domain and would require a local agency that maintains an internet website that is noncompliant with that requirement to redirect that internet website to a domain name that does utilize a .gov or .ca.gov domain. This bill, no later than January 1, 2026, 2027, would also require a local agency that maintains public email addresses to ensure that each email address provided to its employees utilizes a .gov domain name or a .ca.gov domain name. By adding to the duties of local officials, the bill would impose a state-mandated local program.

(2)The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.

(1)The California Constitution authorizes cities and counties to make and enforce within their limits all local, police, sanitary, and other ordinances and regulations not in conflict with general laws, laws and further authorizes cities organized under a charter to make and enforce all ordinances and regulations in respect to municipal affairs, which supersede inconsistent general laws.

The California Public Records Act requires a local agency to make public records available for inspection and allows a local agency to comply by posting the record on its internet website and directing a member of the public to the internet website, as specified.

This bill, no later than January 1, 2025, 2026, would require a local agency, as defined, that maintains an internet website for use by the public to ensure that the internet website utilizes a .gov top-level domain or a .ca.gov second-level domain, domain and would require a local agency that maintains an internet website that is noncompliant with that requirement to redirect that internet website to a domain name that does utilize a .gov or .ca.gov domain. This bill, no later than January 1, 2025, 2026, would also require a local agency that maintains public email addresses to ensure that each email address provided to its employees utilizes a .gov domain name or a .ca.gov domain name. By adding to the duties of local officials, the bill would impose a state-mandated local program.

(2)The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities.

(3)The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the Information Practices Act of 1977, requires an agency that owns or licenses computerized data that includes personal information, as defined, to disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California, as prescribed. The act defines agency to not include a local agency, as specified.

This bill would express the intent of the Legislature to enact legislation that would relate to the security of information maintained by local governments and special districts.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 1637

Author:(Irwin)

As Amended Ver:June 29, 2023

Majority vote

SUMMARY

Requires cities and counties that maintain websites to utilize a ".gov" or ".ca.gov" domain.

Senate Amendments

Extends the date by which local agencies must comply with the bill's requirements to January 1, 2029.

COMMENTS

1. Cybersecurity and Infrastructure Security Agency. According to the Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency (CISA) leads the Federal Government's effort to understand, manage, and reduce risk to cyber and physical infrastructure. CISA is working to do the following:
   1. Build national critical infrastructure resilience against a growing array of complex threats.
   2. Mobilize risk management efforts around securing the critical infrastructure.
   3. Coordinate national efforts to defend federal and non-federal networks against malicious cyber activity.

CISA works with a range of federal, state, local, tribal, territorial, private sector, and international partners to foster information sharing and collaboration to address risks. CISA uses its domain expertise and delivers regional, national, and enterprise services to stakeholders to help them secure the cyber, physical, and communications critical infrastructure against a dynamic threat environment.

According to CISA, "'.gov' is a 'top-level domain', or TLD, similar to '.com', '.org', or '.us'. Enterprises use a TLD to register a domain name (often simply called a domain) for use in their online services, like a website or email. In many well-known TLDs, anyone can register a domain for a fee, and as long as they pay there are not many questions asked about whether the name they chose corresponds to their real-life name or services. While this can be a useful property for creative communication, it can also make it difficult to know whether the people behind a name are really who they claim to be."

CISA sponsors the ".gov" TLD and makes it available solely to United States based government organizations and publicly controlled entities. A ".gov. domain is available without a fee for those that qualify. Using a ".gov" domain increases security in the following ways:

1. Multi-factor authentication is enforced on all accounts in the ".gov" registrar, which is different than commercial registrars.
2. All new domains are "preloaded." This requires browsers to only use a hypertext transfer protocol secure (HTTPS) connection with a website. This protects a visitor's privacy and ensures the content you publish is exactly what is received.
3. A security contact can be added for the domain, making it easier for the public to report potential security issues with the online services.

Eligibility for a ".gov" domain is attested through a letter signed by the public agency. CISA reviews the letter, may review or request founding documentation, and may review or request additional records to verify the public agency's claim that they are a United States based government organization. There are requirements for choosing a name, and activities that are required and prohibited, among others, for local governments. Requests from non-federal organizations are reviewed in approximately 20 business days, but may take longer in some instances.

1. Department of Technology. According to the California Department of Technology (CDT), "CDT leads the state's drive to deliver clear, fast, dependable, and equitable public services. It provides for the delivery of digital government services through the oversight of statewide IT strategic planning, project delivery, procurement, policy and standards, and enterprise architecture. CDT is tasked with securing statewide information assets by providing oversight and infrastructure for many state departments and serves as the custodian of information for mission-critical and essential business applications. Home to the State Data Center, CDT provides infrastructure services for government customers that include on-premises and cloud-based services. CDT is leading statewide broadband planning and execution to deliver digital equity and reliability for all Californians. The Director of CDT is also the State Chief Information Officer (CIO), and advises the Governor on the strategic management and direction of the state's IT resources and policies."

CDT approval is required for any state entity, city, county, and government group that requests to use the ca.gov web domain. Web domains occupying the "ca.gov" domain zone must comply with specific requirements similar to those for ".gov" domains.

1. Local Agency Websites. As technology advances, the Legislature often amends statutes to capture these advancements and take advantage of any potential public benefits. For example, the Brown Act requires all local agencies to post the agenda for any regular meeting 72 hours in advance in a location that is freely accessible to the public. The agenda must clearly specify the meeting's time, location, and the topics that will be deliberated. Despite this requirement, a local agency's constituents still have to know when the agency plans to meet, where the agenda is posted, and physically travel to the location where the agenda is posted or contact the agency directly to discover what topics the agency is planning to discuss. With the proliferation of Internet access and local agencies utilizing this tool to communicate with their constituents, AB 1344 (Feuer), Chapter 692, Statutes of 2011, required all local agencies that have a website to post their meeting agendas on the website 72 hours in advance, effectively making the agenda more accessible to the public by taking advantage of advancements in technology. Additionally, SB 272 (Hertzberg), Chapter 795, Statutes of 2015, and AB 2040 (Garcia), Chapter 894, Statutes of 2014, required local agencies to post on their websites a list of the agency's enterprise systems and the agency's employee compensation report, respectively.

According to the Author

According to the author, "The public's trust in government is foundational for a healthy democracy. With rising levels of misinformation and fraud perpetrated online, and more sophisticated threat actors intending to confuse and mislead, we can no longer be haphazard about how governments are presented online. California's public agencies should take every effort to safeguard the public's trust in our institutions, especially when they are recommended and offered free of charge by federal and state authorities. AB 1637 requires local agencies to transition their websites and e-mails to the .gov or ca.gov domain, so when Californians look for government information or services, they can know with confidence they are receiving official information."

Arguments in Support

According to the City of Agoura Hills, "AB 1637 creates cybersecurity benefits and gives our community the confidence and assurance that when they are accessing a '.gov' or 'ca.gov' website, that they are viewing official and accurate information, and are not visiting a fake website. While it is possible for a '.gov' or '.ca.gov' website to be hacked, this is much more difficult than setting up a fake website using a '.org' or '.net' top-level domain.

"Specifically, using a '.gov' domain increases security in the following ways: Multi-factor authentication is enforced on all accounts in the '.gov' registrar, which is different than commercial registrars; All new domains are 'preloaded.' This requires browsers to only use a hypertext transfer protocol secure (HTTPS) connection with a website. This protects a visitor's privacy and ensures the content [published on the website] is exactly what is received; A security contact can be added for the domain, making it easier for the public to report potential security issues with the online services. AB 1637 creates safer and accurate website access for our communities by increasing the cyber security of''.gov' and '.ca.gov' website."

Arguments in Opposition

According to a coalition of local agency associations, "Cities and counties take cybersecurity very seriously and continue to be vigilant protecting their technology infrastructure and the information of the public they serve. While AB 1637 seeks to prevent privately held websites portraying themselves as legitimate cities, counties and their respective departments and programs, this measure represents a costly state mandate without any cybersecurity benefits.

"...While applying for and obtaining a .gov domain has no fees, there are significant costs that an agency must budget for to recode, establish corresponding e-mails, network login changes, single sign on/multi-factors authentication, encryption keys, revising and redesign website/url links, updating social media and external entities. All of these costs are increased to co-exist both the previous site to auto direct to the newly acquired .gov domain. Also, the cost and time it would take to migrate may disproportionately impact small-to-mid-sized cities and counties adversely who may have insufficient IT staff or any dedicated IT staff, thus requiring them to contract out to outside vendors. Furthermore, the number and size of the departments will dramatically impact the costs as all fire, police, sheriff, libraries, utilities and municipal energy departments would be required, per AB 1637, to migrate to the new .gov domain. As noted, Sacramento County reported the transition took 15 full-time employees 14 months to complete. The project included changing all the websites, web applications, emails, and active directory accounts of over 12,000 employees and contractors. It also included updated applications and systems access rights to accommodate the change.

"...AB 1637 leaves local agencies with a considerable mandate that is likely unattainable for many local agencies, particularly in a period of economic decline. Collectively, our organizations and respective members promote safe, recognizable, and trustworthy online services. However, AB 1637 will impose significant costs to local agencies across the state."

FISCAL COMMENTS

According to the Senate Appropriations Committee, unknown significant local costs, likely at least in the tens of millions in the aggregate, for cities and counties that are not currently compliant with the bill's requirements to make administrative and programmatic changes necessary to utilize a ".gov" or ".ca.gov" domain name for websites and email addresses. Local costs imposed by the bill are likely to be reimbursable by the state, subject to a determination by the Commission on State Mandates. (General Fund)

VOTES:

ASM LOCAL GOVERNMENT: 5-0-2

YES: Aguiar-Curry, Dixon, Pacheco, Ramos, Robert Rivas

ABS, ABST OR NV: Waldron, Wilson

ASM PRIVACY AND CONSUMER PROTECTION: 9-0-2

YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Irwin, Lowenthal, Papan, Wicks, Wilson

ABS, ABST OR NV: Essayli, Vince Fong

ASM APPROPRIATIONS: 12-2-2

YES: Holden, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Hart, Lowenthal, Papan, Pellerin, Weber, Ortega

NO: Megan Dahle, Mathis

ABS, ABST OR NV: Robert Rivas, Sanchez

ASSEMBLY FLOOR: 56-4-20

YES: Addis, Aguiar-Curry, Alvarez, Arambula, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Dixon, Mike Fong, Friedman, Gabriel, Gipson, Grayson, Haney, Hart, Holden, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Joe Patterson, Pellerin, Petrie-Norris, Ramos, Reyes, Luz Rivas, Robert Rivas, Blanca Rubio, Santiago, Schiavo, Ting, Villapudua, Ward, Weber, Wicks, Wood, Zbur, Rendon

NO: Megan Dahle, Davies, Gallagher, Mathis

ABS, ABST OR NV: Alanis, Bains, Chen, Connolly, Essayli, Flora, Vince Fong, Garcia, Hoover, Lackey, Jim Patterson, Quirk-Silva, Rodriguez, Sanchez, Soria, Ta, Valencia, Waldron, Wallis, Wilson

UPDATED

VERSION: June 29, 2023

CONSULTANT: Jimmy MacDonald / L. GOV. / (916) 319-3958 FN: 0001937

 THIRD READING  

Bill No: AB 1637

Author: Irwin (D)

Amended: 6/29/23 in Senate

Vote: 21

SENATE GOVERNANCE & FIN. COMMITTEE: 5-2, 6/28/23

AYES: Caballero, Blakespear, Durazo, Skinner, Wiener

NOES: Seyarto, Dahle

NO VOTE RECORDED: Glazer

SENATE APPROPRIATIONS COMMITTEE: 5-2, 9/1/23

AYES: Portantino, Ashby, Bradford, Wahab, Wiener

NOES: Jones, Seyarto

ASSEMBLY FLOOR: 56-4, 5/31/23 - See last page for vote

SUBJECT: Local government: internet websites and email addresses

SOURCE: Author

DIGEST:

This bill requires cities and counties to transition to a “.gov” top-level domain or a “.ca.gov” second-level domain and ensure public employee e-mail addresses are updated accordingly.

ANALYSIS:

Existing law:

1. Establishes the California Department of Technology in the Government Operations Agency, which administers the “.ca.gov” second-level domain.
2. Requires, with exceptions for specified hardships, that every independent special district maintain an Internet website.

This bill:

1. Requires, by January 1, 2029, a city, county, or city and county to ensure that its internet website utilizes a “.gov” top-level domain, or a “.ca.gov.” second-level domain.
2. Permits a city, county, or city and county that does not comply with its top-level domain requirement to instead redirect that website to a domain that complies with its requirements.
3. Requires a city, county, or city and county that maintains public email addresses for its employees to utilize a “.gov” domain name or a “.ca.gov” domain name.
4. Makes legislative findings and declarations supporting its purposes.

Background

The Cybersecurity and Infrastructure Security Agency (CISA), in the Department of Homeland Security, currently administers the “.gov” top-level domain and makes it solely available to United-States based government organizations and publicly controlled entities for no fee. According to CISA, the “.gov” domain name is meant to assure members of the public that they are using a verifiable government website. The California Department of Technology (Department) has established policies and protocols for obtaining a “.ca.gov” domain consistent with federal policy, and there is no annual fee associated with a .ca.gov domain name.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to Senate Appropriations Committee, unknown significant local costs, likely at least in the tens of millions in the aggregate, for cities and counties that are not currently compliant with the bill’s requirements to make administrative and programmatic changes necessary to utilize a “.gov” or “.ca.gov” domain name for websites and email addresses. Local costs imposed by the bill are likely to be reimbursable by the state, subject to a determination by the Commission on State Mandates. (General Fund)

SUPPORT: (Verified 9/1/23)

None received

OPPOSITION: (Verified 9/1/23)

California Airports Council

California Municipal Utilities Association

California State Association of Counties

City Clerks Association of California

City of Beverly Hills

City of Downey

City of Elk Grove

City of Jurupa Valley

City of Lafayette

City of Lakewood

City of Modesto

City of Palo Alto

City of Pico Rivera

City of Placentia

City of Rancho Cucamonga

City of Redwood City

City of Roseville

City of San Marcos

City of Visalia

City of West Hollywood

County of Kern

Kern County Board of Supervisors

League of California Cities

Los Angeles County Division, League of California Cities

Marin County Council of Mayors and Council Members

Northern California Power Agency

Rural County Representatives of California

San Francisco International Airport

Solano County Board of Supervisors

Southern California Public Power Authority

Suisun City

Town of Apple Valley

Urban Counties of California

ARGUMENTS IN SUPPORT: According to the author, “The public’s trust in government is foundational for a healthy democracy. With rising levels of misinformation and fraud perpetrated online, and more sophisticated threat actors intending to confuse and mislead, we can no longer be haphazard about how local governments are presented online. California’s cities and counties should take every effort to safeguard the public’s trust in our institutions, especially when they are recommended and offered free of charge by federal and state authorities. AB 1637 requires cities and counties to transition their websites and e-mails to the .gov or ca.gov domain, so when Californians look for government information or services, they can know with confidence they are receiving official information.”

ARGUMENTS IN OPPOSITION: According to a letter jointly submitted by the League of California Cities, California State Association of Counties, Rural County Representatives of California, Urban Counties of California, and the City Clerks Association of California, “While AB 1637 seeks to prevent privately held websites portraying themselves as legitimate cities, counties and their respective departments and programs, this measure represents a costly state mandate without any cybersecurity benefits. As noted in the Senate Governance and Finance Committee, ‘there aren’t any known examples of fraudsters impersonating local government websites in California. The Committee may wish to consider whether there is sufficient evidence that such fraud exists to justify additional costs and work for local governments, and whether the bill would effectively address such fraud.’ While applying for and obtaining a .gov domain has no fees, there are significant costs that an agency must budget for… As noted, Sacramento County reported the transition took 15 full-time employees 14 months to complete. The project included changing all the websites, web applications, emails, and active directory accounts of over 12,000 employees and contractors… The Department of Homeland Security’s State and Local Cybersecurity Grant Program, indicates that transitioning to a .gov is NOT required for eligibility for funding… Unfortunately, AB 1637 does not contain any state funding as suggested by the grant program, nor contain any of the provisions to adopt evaluations and best practices. AB 1637 leaves local agencies with a considerable mandate that is likely unattainable for many local agencies, particularly in a period of economic decline.”

ASSEMBLY FLOOR: 56-4, 5/31/23

AYES: Addis, Aguiar-Curry, Alvarez, Arambula, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Dixon, Mike Fong, Friedman, Gabriel, Gipson, Grayson, Haney, Hart, Holden, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Joe Patterson, Pellerin, Petrie-Norris, Ramos, Reyes, Luz Rivas, Robert Rivas, Blanca Rubio, Santiago, Schiavo, Ting, Villapudua, Ward, Weber, Wicks, Wood, Zbur, Rendon

NOES: Megan Dahle, Davies, Gallagher, Mathis

NO VOTE RECORDED: Alanis, Bains, Chen, Connolly, Essayli, Flora, Vince Fong, Garcia, Hoover, Lackey, Jim Patterson, Quirk-Silva, Rodriguez, Sanchez,

Soria, Ta, Valencia, Waldron, Wallis, Wilson

Prepared by: Kyle Krueger / GOV. & F. / (916) 651-4119

9/4/23 9:19:19

**** END ****

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anthony Portantino, Chair

2023 - 2024 Regular Session

AB 1637 (Irwin) - Local government: internet websites and email addresses

Bill Summary:

AB 1637 would require cities and counties that maintain a public internet website and use public email addresses for employees to utilize a “.gov” or a “.ca.gov” domain name for their websites and email addresses by January 1, 2029, as specified.

Fiscal Impact:

• Unknown significant local costs, likely at least in the tens of millions in the aggregate, for cities and counties that are not currently compliant with the bill’s requirements to make administrative and programmatic changes necessary to utilize a “.gov” or “.ca.gov” domain name for websites and email addresses. Local costs imposed by the bill are likely to be reimbursable by the state, subject to a determination by the Commission on State Mandates. See Staff Comments. (General Fund)

Background:

The Advanced Research Project Agency Network (ARPANET) designed a new organizational model for internet protocol (IP) addresses in the 1980s known as the domain name system, which translates numeric IP addresses into easy-to-remember names (like www.senate.ca.gov). These names included a restrictive number of top-level domains (TLDs), which initially consisted primarily of “.gov” for governmental entities, “.edu” for educational institutions, “.com” for commercial use, “.org” for nonprofit entities, and “.mil” for the U.S. Department of Defense. Today, there are thousands of top-level domains, and their purpose has also evolved into a branding and marketing mechanism for many companies and organizations.

The Cybersecurity and Infrastructure Security Agency (CISA), in the U.S. Department of Homeland Security, leads the federal government’s actions to understand, manage, and reduce risk to cyber and physical infrastructure. CISA currently administers the “.gov” top-level domain and makes it solely available to U.S.-based government organizations and publicly controlled entities, including state, tribal, interstate, independent intrastate, city, and county governments. According to CISA, the “.gov” domain name is meant to assure members of the public that they are using a verifiable government website. A “.gov” TLD is also associated with a number of additional security features, including:

• Multi-factor authentication, which is enforced by CISA on all “.gov” accounts and prevents domains from being stolen.
• All new domains are “preloaded,” which requires browsers to only use a hypertext transfer protocol secure (HTTPS) connection with a website, and protects visitor privacy.
• A security contact can be added for the domain, making it easier for the public to report potential security issues with the online services.

The California Department of Technology (CDT) administers the “.ca.gov” second-level domain, which may be used by any state entity, county, city, state-recognized tribal government, joint powers authority, or independent local district within the State of California. There is no annual fee associated with a “.gov” or “.ca.gov” domain name.

Proposed Law:

AB 1637 would require specified local agencies that maintain a public website and use public email addresses for employees to utilize a “.gov” or “.ca.gov” domain name by January 1, 2029. Specifically, this bill would:

• Require a local agency (defined as a city, county, or city and county) that maintains an internet website for use by the public to ensure that it utilizes a “.gov” top-level domain or “.ca.gov” second-level domain by January 1, 2029.
• Require a local agency that is not compliant with this requirement by January 1, 2029 to redirect the internet website to a domain name that conforms to the requirement.
• Require a local agency that maintains public email addresses for its employees to ensure that each email address provided to its employees utilizes a “.gov” domain name or a “.ca.gov” domain name by January 1, 2029.

Staff Comments:

There are 58 counties, including the city and county of San Francisco, and 482 cities in California. Many of these local agencies have already fully or partially migrated the websites and email addresses they administer to a “.gov” or “.ca.gov” domain, including five of the 14 urban counties in the state, and 10 of the largest 13 cities in California. Based on anecdotal data reported by local agencies and their representatives, the actual and estimated costs for individual cities and counties to fully transition to a “.gov” or “.ca.gov” domain would vary greatly, and are largely dependent upon the size of the entity, the number of local agency websites an entity manages, the number of employees, and the overall size and complexity of an entity’s internet presence. Local agency costs to migrate their systems may include IT costs, often for vendors and contracting costs, as well as labor costs and indirect costs, such as changes to outreach and promotional materials, business cards, letterhead, and elections materials. Some agencies may also incur costs for media campaigns to alert the public to the changes.

Staff estimates that costs for an individual local entity to comply with the bill’s requirements could range from minor, for entities that have largely completed the transition, to potentially the low hundreds of thousands of dollars, for smaller cities or counties with a relatively simplistic internet presence, up to the millions of dollars for larger and more sophisticated cities and counties that would need to fully transition to a “.gov” or “.ca.gov” domain. The author’s office notes that multi-year federal grant funding has recently been allocated to California for a number of state and local cybersecurity purposes, including the transition to “.gov” domains, which could partially offset local agency costs imposed by this bill. Ultimately, however, any state costs to reimburse local agencies would depend upon a determination by the Commission on State Mandates regarding what specific duties and costs imposed by the bill would be deemed reimbursable, should an affected local agency file a successful reimbursement claim.

-- END --

SENATE COMMITTEE ON GOVERNANCE AND FINANCE

Senator Anna M. Caballero, Chair

2023 - 2024 Regular

Local government: internet websites and email addresses

Requires cities and counties to transition to a “.gov” top-level domain or “.ca.gov” second-level domain and ensure public employee e-mail addresses are updated accordingly.

Background

Domain Names. The Advanced Research Project Agency Network (ARPANET) designed a new organizational model for internet protocol (IP) addresses in the 1980s known as the domain name system, which translates IP addresses into easy-to-remember names (like www.senate.ca.gov). These names included a restrictive number of ‘top-level domains’, (TLDs) which in the early days of the internet consisted of primarily .gov, .edu, .com, .mil, and .org. Each of these top-level domain names held a particular organizational function (“.org” for nonprofits, for instance, and “.com” for commercial use). Today, there are thousands of top-level domains, and their purpose has also evolved into a branding and marketing mechanism for many companies and organizations.

The Cybersecurity and Infrastructure Security Agency (CISA), in the Department of Homeland Security, leads the federal government’s actions to understand, manage, and reduce risk to cyber and physical infrastructure. According to CISA’s website, “In many well-known TLDs, anyone can register a domain for a fee, and as long as they pay there aren’t many questions asked about whether the name they chose corresponds to their real-life name or services. While this can be a useful property for creative communication, it can also make it difficult to know whether the people behind a name are really who they claim to be.” The cost of a top-level domain name is often in the range of $3-$20 dollars per year

CISA currently administers the “.gov” top-level domain and makes it solely available to United-States based government organizations and publicly controlled entities. According to CISA, the “.gov” domain name is meant to assure members of the public that they are using a verifiable government website. A .gov TLD is also associated with a number of additional security features. These include:

• Multi-factor authentication, which is enforced by CISA on all “.gov” accounts and stops domains from being stolen.
• “Preloaded” domains, requiring browsers to use secure connections with a website.
• A security contact for the domain, so the public can report security issues.

The California Department of Technology (Department) provides oversight of statewide information technology (IT) strategic planning, project delivery, procurement, policy and standards, and enterprise architecture. The Department’s Government Operations Agency oversees the “.ca.gov” second-level domain. The Department has established policies and protocols for obtaining a “.ca.gov” domain consistent with federal policy, and there is no annual fee associated with a .ca.gov domain name.

Cybersecurity Plan. The 2022 federal Infrastructure Investment and Jobs Act established the State and Local Cybersecurity Grant Program (SLCGP) under the Department of Homeland Security (DHS). The program will distribute funds to states over four years to support state and local government efforts to battle cybersecurity risks and threats to information systems. On December 7, 2022, the federal government awarded California $8 million in first-year funding for the SLCGP.

The California Office of Emergency Services (CalOES) will administer the funds. To use 95% of the funds, CalOES must develop a Cybersecurity Plan, which the federal government must approve. The federal government requires the cybersecurity plan to address 16 elements. Element 5 and Element 6 call for the state to follow best cybersecurity practices and promote recognizable online services, respectively. A part of achieving each of these two elements is transitioning government websites to a .gov internet domain. The Cybersecurity Plan must include a plan for how each of the 16 elements will be achieved, but it may also include a brief explanation as to why certain elements are not currently being prioritized. Organizations are not required to immediately pursue each of these 16 elements in order to receive SLCGP funding.

To create the Cybersecurity Plan, CalOES created a Cybersecurity Investment Planning Subcommittee, which completed a survey in May designed to identify gaps in the state’s cybersecurity infrastructure. CalOES intended the survey to inform the plan it will submit to the federal government for approval in September 2023.

Local Governments. According to the California State Association of Counties (CSAC), 9 of California’s 58 counties use a .gov domain (15%), while the League of Cities states 24 of the more than 480 California cities use a .gov domain (5%).

Transitioning to a .gov domain isn’t quick, easy, or inexpensive. According to CSAC, it took Sacramento County 14 months and 15 full-time employees to complete the project. The project included changing all the websites, web applications, emails, and active directory accounts of over 12,000 employees and contractors. It also included updated applications and systems access rights to accommodate the change.

To address elements of the Cybersecurity plan and enhance cybersecurity, the author wants to require all California cities and counties to migrate to a “.gov” or “.ca.gov” domain name.

Proposed Law

Assembly Bill 1637 requires all cities, counties, and cities & counties by January 1, 2027, to:

• Ensure their internet website utilizes a “.gov” top-level domain or a “.ca.gov” second-level domain.
• Redirect a noncompliant internet website to a domain name that utilizes a “.gov” or a “.ca.gov.”
• Ensure each email address provided to employees utilizes a “.gov” domain name or a “.ca.gov” domain name.

The bill makes findings and declarations to further its intent.

State Revenue Impact

No estimate.

Comments

1. Purpose of the bill. According to the author: “The public’s trust in government is foundational for a healthy democracy. With rising levels of misinformation and fraud perpetrated online, and more sophisticated threat actors intending to confuse and mislead, we can no longer be haphazard about how local governments are presented online. California’s cities and counties should take every effort to safeguard the public’s trust in our institutions, especially when they are recommended and offered free of charge by federal and state authorities. AB 1637 requires cities and counties to transition their websites and e-mails to the .gov or ca.gov domain, so when Californians look for government information or services, they can know with confidence they are receiving official information.”

2. What is the cost, exactly...? A primary concern related to the “.gov” transition is what it will cost cities and counties to comply with the bill. Several cities and counties estimate that it would cost them upwards of $900k or even several million dollars. Multiplying 900k by 480+ cities and 58 counties means the total statewide cost could exceed $484M. The costs in city and county estimates primarily include hiring IT personnel or contracting for outside assistance, though they may also include changes to promotional materials and new business cards.

The cost and time it would take to make the transition will depend in large part on the size of the local government, the number of employees it has, and the size of its presence on the internet. As noted above, Sacramento County reported the transition took 15 full-time employees 14 months to complete. At the other end of the spectrum, Ventura County reported to the author’s office that the transition would only require one full time employee and some support efforts, and that it could be done in less than a week and be accomplished within the County’s existing budget. Additionally, CISA must sign a letter attesting eligibility for a “.gov” domain before they provide it, which is a process that requires no fee but may take 20 or more business days. The Committee may wish to consider whether the potential cybersecurity benefits of transition to “.gov” websites outweigh the costs for local agencies to complete the transition.

3. Will local governments be funded for this? One could point to the State and Local Cybersecurity Grant Program itself as a funding mechanism for the cities’ and counties’ .gov transition. About $8 million was awarded for fiscal year 2022, and 80% of those funds will be passed through to local governments for a variety of cybersecurity purposes, which possibly may include the transition to .gov. The federal government will provide $1 billion in total SLCGP funding to states over the next four years, which may include additional funding for California. The Homeland Security Grant Program (HSGP) is an additional federal grant program that allows for funds to be used for a variety of homeland security purposes, including to migrate online services to the .gov internet domain. The program is providing 1.12 billion for fiscal year (FY) 2023, available to state, local, tribal, and territorial governments across the United States. On the other hand, the total costs of the transition could potentially exceed $484M as noted above, based on cities’ and counties’ self-estimates.

4. What problem is the bill addressing? The author’s office states a primary purpose of the bill is to make it easy for the public to verify that a government website is actually a government website. This would make it harder for fraudsters to impersonate government websites and trick members of the public into providing personal information. It is true that it is relatively easy for fraudsters to impersonate a government website with many common top-level domain names such as .com or .net that are relatively easy to obtain. This type of fraud was evidenced during the pandemic, such as when the federal government launched “covidtests.gov” in early 2023. A number of domain names very similar to “covidtests.gov” were subsequently registered (including “covidtestsgov.com” and “covidtestgov.net”). Threat researchers state that such lookalike domain names are often used in cyberattacks. Additional fraud frequently takes place over the phone, through which fraudsters impersonate the government to obtain personal information. However, there aren’t any known examples of fraudsters impersonating local government websites in California. The Committee may wish to consider whether there is sufficient evidence that such fraud exists to justify additional costs and work for local governments, and whether the bill would effectively address such fraud.

5. Will the bill create confusion? While top-level domains such as “.gov,” “.org” and “.com” were established for merely organizational purposes, they have arguably evolved to become an important part of some organizations’ brands. Furthermore, the type of top-level domain sometimes impacts the rest of the website’s name, with a .gov domain requiring a specific naming convention for local governments that may exclude certain acronyms. Some local officials fear a transition to the .gov domain will result in a substantial name change to their local government’s website, creating possible confusion and loss of trust amongst the public. On the other hand, the bill does provide that an old website with another top-level domain could be redirected to the new .gov website, possibly reducing public confusion if executed correctly.

6. Is the timeline sufficient? As discussed, the transition to a “.gov” top-level domain or a “.ca.gov” second-level domain is not without certain financial hurdles and other possible challenges. For example, it took Sacramento County 14 months to complete, and present challenges to local governments, such as fires, flooding, homelessness, and countless others, may make it more difficult for them to make the transition in the immediate future. The Committee may wish to consider amending the bill to increase the amount of time local governments have to comply with the bill’s requirements.

7. Mandate. The California Constitution requires the state to reimburse local governments for the costs of new or expanded state mandated local programs. Because AB 1637 adds to the duties of local officials, Legislative Counsel says that the bill imposes a new state mandate. The measure states that if the Commission on State Mandates determines that the bill imposes a reimbursable mandate, then reimbursement must be made pursuant to existing statutory provisions.

Assembly Actions

Assembly Local Government 5-0

Assembly Privacy and Consumer Protection 9-0

Assembly Appropriations 12-2

Assembly Floor 56-4

Support and Opposition

(6/23/23)

Support: None submitted.

Opposition: California Airports Council
California Municipal Utilities Association
California State Association of Counties
City Clerks Association of California
City of Downey
City of Elk Grove
City of Jurupa Valley
City of Lafayette
City of Lakewood CA
City of Modesto
City of Palo Alto
City of Pico Rivera
City of Rancho Cucamonga
City of Redwood City
City of Roseville
City of West Hollywood
League of California Cities
Los Angeles County Division, League of California Cities
Northern California Power Agency
Rural County Representatives of California
Southern California Public Power Authority (SCPPA)
Urban Counties of California (UCC)

-- END --

ASSEMBLY THIRD READING

ATR Bill Id:AB 1637

Author:(Irwin)

As Amended Ver:May 18, 2023

Majority vote

SUMMARY

Requires cities and counties that maintain websites to utilize a ".gov" or ".ca.gov" domain.

Major Provisions

1. Requires, no later than January 1, 2027, a local agency that maintains an internet website for use by the public to ensure that the internet website utilizes a ".gov" top-level domain or a ".ca.gov" second-level domain.
2. Specifies that, if local agency that is subject to 1) above maintains an internet website for use by the public that is noncompliant with 1) above by January 1, 2027, that local agency shall redirect that internet website to a domain name that does comply with 1) above.
3. Requires no later than January 1, 2027, a local agency that maintains public email addresses for its employees to ensure that each email address provided to its employees utilizes a ".gov" domain name or a ".ca.gov" domain name.
4. Defines "local agency" to mean a city, county, or city and county.

COMMENTS

1. Cybersecurity and Infrastructure Security Agency. According to the Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency (CISA) leads the Federal Government's effort to understand, manage, and reduce risk to cyber and physical infrastructure. CISA is working to do the following:
   1. Build national critical infrastructure resilience against a growing array of complex threats.
   2. Mobilize risk management efforts around securing the critical infrastructure.
   3. Coordinate national efforts to defend federal and non-federal networks against malicious cyber activity.

CISA works with a range of federal, state, local, tribal, territorial, private sector, and international partners to foster information sharing and collaboration to address risks. CISA uses its domain expertise and delivers regional, national, and enterprise services to stakeholders to help them secure the cyber, physical, and communications critical infrastructure against a dynamic threat environment.

According to CISA, "'.gov' is a 'top-level domain', or TLD, similar to .com', .org', or .us'. Enterprises use a TLD to register a domain name (often simply called a domain) for use in their online services, like a website or email. In many well-known TLDs, anyone can register a domain for a fee, and as long as they pay there are not many questions asked about whether the name they chose corresponds to their real-life name or services. While this can be a useful property for creative communication, it can also make it difficult to know whether the people behind a name are really who they claim to be."

CISA sponsors the ".gov" TLD and makes it available solely to United States based government organizations and publicly controlled entities. A ".gov. domain is available without a fee for those that qualify. Using a ".gov" domain increases security in the following ways:

1. Multi-factor authentication is enforced on all accounts in the ".gov" registrar, which is different than commercial registrars.
2. All new domains are "preloaded." This requires browsers to only use a hypertext transfer protocol secure (HTTPS) connection with a website. This protects a visitor's privacy and ensures the content you publish is exactly what is received.
3. A security contact can be added for the domain, making it easier for the public to report potential security issues with the online services.

Eligibility for a ".gov" domain is attested through a letter signed by the public agency. CISA reviews the letter, may review or request founding documentation, and may review or request additional records to verify the public agency's claim that they are a United States based government organization. There are requirements for choosing a name, and activities that are required and prohibited, among others, for local governments. Requests from non-federal organizations are reviewed in approximately 20 business days, but may take longer in some instances.

1. Department of Technology. According to the California Department of Technology (CDT), "CDT leads the state's drive to deliver clear, fast, dependable, and equitable public services. It provides for the delivery of digital government services through the oversight of statewide IT strategic planning, project delivery, procurement, policy and standards, and enterprise architecture. CDT is tasked with securing statewide information assets by providing oversight and infrastructure for many state departments and serves as the custodian of information for mission-critical and essential business applications. Home to the State Data Center, CDT provides infrastructure services for government customers that include on-premises and cloud-based services. CDT is leading statewide broadband planning and execution to deliver digital equity and reliability for all Californians. The Director of CDT is also the State Chief Information Officer (CIO), and advises the Governor on the strategic management and direction of the state's IT resources and policies."

CDT approval is required for any state entity, city, county, and government group that requests to use the ca.gov web domain. Web domains occupying the "ca.gov" domain zone must comply with specific requirements similar to those for ".gov" domains.

1. Local Agency Websites. As technology advances, the Legislature often amends statutes to capture these advancements and take advantage of any potential public benefits. For example, the Brown Act requires all local agencies to post the agenda for any regular meeting 72 hours in advance in a location that is freely accessible to the public. The agenda must clearly specify the meeting's time, location, and the topics that will be deliberated. Despite this requirement, a local agency's constituents still have to know when the agency plans to meet, where the agenda is posted, and physically travel to the location where the agenda is posted or contact the agency directly to discover what topics the agency is planning to discuss. With the proliferation of Internet access and local agencies utilizing this tool to communicate with their constituents, AB 1344 (Feuer), Chapter 692, Statutes of 2011, required all local agencies that have a website to post their meeting agendas on the website 72 hours in advance, effectively making the agenda more accessible to the public by taking advantage of advancements in technology. Additionally, SB 272 (Hertzberg), Chapter 795, Statutes of 2015, and AB 2040 (Garcia), Chapter 894, Statutes of 2014, required local agencies to post on their websites a list of the agency's enterprise systems and the agency's employee compensation report, respectively.

According to the Author

According to the author, "The public's trust in government is foundational for a healthy democracy. With rising levels of misinformation and fraud perpetrated online, and more sophisticated threat actors intending to confuse and mislead, we can no longer be haphazard about how governments are presented online. California's public agencies should take every effort to safeguard the public's trust in our institutions, especially when they are recommended and offered free of charge by federal and state authorities. AB 1637 requires local agencies to transition their websites and e-mails to the .gov or ca.gov domain, so when Californians look for government information or services, they can know with confidence they are receiving official information."

Arguments in Support

According to the City of Agoura Hills, "AB 1637 creates cybersecurity benefits and gives our community the confidence and assurance that when they are accessing a '.gov' or 'ca.gov' website, that they are viewing official and accurate information, and are not visiting a fake website. While it is possible for a '.gov' or '.ca.gov' website to be hacked, this is much more difficult than setting up a fake website using a '.org' or '.net' top-level domain.

"Specifically, using a '.gov' domain increases security in the following ways: Multi-factor authentication is enforced on all accounts in the '.gov' registrar, which is different than commercial registrars; All new domains are 'preloaded.' This requires browsers to only use a hypertext transfer protocol secure (HTTPS) connection with a website. This protects a visitor's privacy and ensures the content [published on the website] is exactly what is received; A security contact can be added for the domain, making it easier for the public to report potential security issues with the online services. AB 1637 creates safer and accurate website access for our communities by increasing the cyber security of''.gov' and '.ca.gov' website."

Arguments in Opposition

According to a coalition of local agency associations that are opposed unless amended, "We acknowledge the intended goal of this measure; however, our members have worked hard to establish websites that are known and trusted by the communities they serve. While the measure allows for website redirection, doing so will only add to confusion as residents are redirected from their trusted local agency website to a new landing page that would not comport to the addresses on public facing material including business cards, fleets, letterhead, elections, and other public outreach materials, etc. The result could compromise local communities' trust in their local leaders and would only create frustration in administering a transparent and user-focused government website.

"In short, we remain deeply concerned about the added costs associated with migrating to a new domain and corresponding email addresses; public confusion that will potentially be created; and the absence of any dedicated resources to assist local agencies with this proposed migration.

"Initial sampling of local governments has identified considerable costs and programmatic impacts that would result from AB 1637. Extrapolated to all local agencies throughout the state, cumulative costs to local agencies (cities, counties, special districts, school districts) are likely in the hundreds of millions of dollars. Further, we know that smaller local entities will be challenged to meet the current deadline with existing staff. In this constrained fiscal climate, we are hard-pressed to consider a project of this scope as a statewide, jurisdiction-wide priority among other direct service responsibilities to local communities for which our members are already obligated."

FISCAL COMMENTS

According to the Assembly Appropriations Committee, costs to cities and counties are unknown but likely in the millions of dollars statewide. These costs are potentially reimbursable by the state, subject to a determination by the Commission on State Mandates.

VOTES

ASM LOCAL GOVERNMENT: 5-0-2

YES: Aguiar-Curry, Dixon, Pacheco, Ramos, Robert Rivas

ABS, ABST OR NV: Waldron, Wilson

ASM PRIVACY AND CONSUMER PROTECTION: 9-0-2

YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Irwin, Lowenthal, Papan, Wicks, Wilson

ABS, ABST OR NV: Essayli, Vince Fong

ASM APPROPRIATIONS: 12-2-2

YES: Holden, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Hart, Lowenthal, Papan, Pellerin, Weber, Ortega

NO: Megan Dahle, Mathis

ABS, ABST OR NV: Robert Rivas, Sanchez

UPDATED

VERSION: May 18, 2023

CONSULTANT: Jimmy MacDonald / L. GOV. / (916) 319-3958 FN: 0000905

Date of Hearing: May 17, 2023

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Chris Holden, Chair

ABPCA Bill Id:AB 1637

Author:(Irwin) – As Amended Ver:April 27, 2023

Urgency: No State Mandated Local Program: Yes Reimbursable: No

SUMMARY:

This bill requires a local agency that maintains a website and email addresses accessible to the public to utilize a “.gov” or “.ca.gov” domain no later than January 1, 2026.

Specifically, this bill:

1. Requires, no later than January 1, 2026, any local agency that maintains an internet website for use by the public to ensure that the internet website utilizes a “.gov” top-level domain or a “.ca.gov” second-level domain.
2. Specifies that if a local agency currently maintains a website for use by the public that does not comply with 1) above by January 1, 2026, then that local agency shall redirect that website to a domain name that does comply with 1) above.
3. Requires, no later than January 1, 2026, a local agency that maintains public email addresses for its employees to ensure that each email address provided to its employees utilizes a “.gov” domain name or a “.ca.gov” domain name.
4. Defines “local agency” to mean a county, city, whether general law or chartered, city and county, town, school district, municipal corporation, district, political subdivision, or any board, commission or agency thereof, or other local public agency.

FISCAL EFFECT:

Costs to local agencies, including cities, counties, special districts and school districts, is unknown but likely in the millions of dollars statewide. Although this bill contains local mandate fee disclaimer language, it is unclear on what basis a local agency may charge a fee or other assessment to recover the costs of migrating to a .gov or .ca.gov domain. If this disclaimer does not apply, these costs would be reimbursable by the state, subject to a determination by the Commission on State Mandates.

Local agencies have also raised the concern the disclaimer may be in conflict with Article XIII C (Proposition 26 of 2010); fees cannot be charged for the ability to access a public agency website due to constitutional limitations on local agencies’ authority to impose fees and taxes or they lack fee authority outright.

COMMENTS:

1. Purpose. According to the author:

The public’s trust in government is foundational for a healthy democracy. With rising levels of misinformation and fraud perpetrated online, and more sophisticated threat actors intending to confuse and mislead, we can no longer be haphazard about how governments are presented online. California’s public agencies should take every effort to safeguard the public’s trust in our institutions, especially when they are recommended and offered free of charge by federal and state authorities. [This bill] requires local agencies to transition their websites and e-mails to the .gov or ca.gov domain, so when Californians look for government information or services, they can know with confidence they are receiving official information.

1. Background. The top-level domain “.gov” was originally meant to be used by federal, state, and local government entities. The other original top-level domains each had their own particular functions: “.com” was meant for commercial use; “.org” was for nonprofits; “.edu” was for institutions of higher education; “net” was for internet service providers and other entities providing network infrastructure; and “.mil” was for the U.S. Department of Defense (DOD). Some of the original domain requirements remain strictly enforced; no one but the DOD can get a “.mil” domain, and it is difficult for non-educational institutions to obtain an “.edu” domain. Other requirements have not been strictly enforced; anyone can quickly obtain a “.com,” “.net,” or “.org” domain if it is available.

It is relatively easy for a fraudulent actor to obtain a domain name similar to that of an existing local governmental agency, also using a non-.gov top level domain, and set up a fake website at that domain. If its content is sufficiently similar to a real website, search engines may pick up the fake website and display it when people search for the entity. There is no quick, convenient way for users to verify the authenticity of the website they are visiting. A fake website that lures in real users who believe they are visiting a legitimate government website could then convince those users to share personal information, make payments, and conduct other compromising activities.

The Cybersecurity and Infrastructure Security Agency (CISA), part of the U.S. Department of Homeland Security (DHS), leads the federal government’s effort to understand, manage, and reduce risk to cyber and physical infrastructure. In 2020, administration of the .gov domain program was transferred from the federal General Services Administration to CISA. “.gov” has been reserved for U.S.-based government organizations and publicly controlled entities. This includes state, tribal, interstate, independent intrastate, city, and county governments.

The California Department of Technology (CDT) administers the .ca.gov second-level domain. “.ca.gov” may be used by any state entity, county, city, state-recognized tribal government, joint powers authority, or independent local district within the State of California. There is no annual fee associated with a .gov or .ca.gov domain name.

1. Local Agencies. Of California’s 14 urban counties, five have .gov websites, including the counties of Contra Costa, Los Angeles, San Bernardino, San Diego and San Francisco. Of the state’s 13 largest cities, 10 have a .gov website. These cities include Fresno, Los Angeles, Long Beach, Oakland, Riverside, Sacramento, San Diego, San Francisco, San Jose and Stockton.

Sacramento County recently completed the migration to a .gov domain. It took the county 14 months to complete the project and dedicated staff of at least 15 full-time employees. The project included changing all the websites, web applications, emails, and active directory accounts of over 12,000 employees and contractors. It also included updated applications and systems access rights to accommodate the change.

Cost estimates to migrate to a .gov domain vary widely among local agencies. For small to medium single-focused special districts, an informal sample revealed estimates ranging from $6,000, for a very small sanitary district, to $100,000 for a mosquito and vector control district and several medium-sized water districts. For larger special districts, primarily water and sanitation districts, estimates ranged from $500,000 to $1 million. Estimates for larger counties were generally in the low millions of dollars. One district indicated difficulties obtaining a .gov or .ca.gov designation.

Local agency costs to migrate their systems include IT costs, often for vendors, as well as labor costs and indirect costs, such as changes to outreach and promotional materials, business cards, letter head, and elections materials. Some agencies may also have costs for media campaigns to alert the public to the changes.

In response, the author points to the State and Local Cybersecurity Grant Program (SLCGP). In September 2022, DHS announced the SLCGP funded through the 2022 Infrastructure Investment and Jobs Act to better address cybersecurity risks and threats to information systems to state, local and territorial governments. SLCGP will distribute funds over four years to support projects throughout the period of performance. On December 27, 2022, California was awarded nearly $8 million for SLCGP first-year funding (federal fiscal year 2022) with the California Office of Emergency Services formally accepting the award on January 23, 2022.

According to the author:

Federal amounts are “likely to total $50 million over the 4 year program. Additional state matching fund requirements, increasing year over year (10% up to 40%), will also bring more state funds to the table to achieve local cybersecurity goals. The SLCGP requires certain critical activities of local agencies, this includes the transition to the .gov.

1. Arguments in Support. The bill is supported by the City of Agoura Hills, located in Los Angeles County. The city, who uses the .org domain, writes: “This bill creates cybersecurity benefits and gives our community the confidence and assurance that when they are accessing a “.gov” or “.ca.gov” website, that they are viewing official and accurate information, and are not visiting a fake website.”
2. Arguments in Opposition. A coalition of local agencies, including the League of California Cities, the California State Association of Counties (CSAC), Urban Counties of California, the Rural County Representatives of California (RCRC), the California Special Districts Association (CSDA), the California Association of Recreation and Park Districts, the Association of California School Administrators, and the City Clerks Association of California are opposed unless amended, expressing cost concerns in the absence of dedicated resources. The coalition writes:

Initial sampling of local governments has identified considerable costs and programmatic impacts that would result from [this bill]. Extrapolated to all local agencies throughout the state, cumulative costs to local agencies (cities, counties, special districts, school districts) are likely in the hundreds of millions of dollars. Further, we know that smaller local entities will be challenged to meet the current deadline with existing staff. In this constrained fiscal climate, we are hard-pressed to consider a project of this scope as a statewide, jurisdiction-wide priority among other direct service responsibilities to local communities for which our members are already obligated.

Analysis Prepared by: Jennifer Swenson / APPR. / (916) 319-2081

Date of Hearing:

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Jesse Gabriel, Chair

ABPCA Bill Id:AB 1637 (

Author:Irwin) – As Amended Ver:March 16, 2023

As Proposed to be Amended

SUBJECT: Local government: internet websites and email addresses

SYNOPSIS

This bill would require local governments to ensure that their public-facing internet websites and email addresses use a “.gov” or “.ca.gov” domain name, no later than January 1, 2026.

It would have been helpful for internet cybersecurity if government entities had been legally required to take this step decades ago. Unfortunately, these requirements were not placed into law, meaning that there has been a proliferation of local government entities using .com, .net, and .org addresses.

The problem is that it is a trivial matter for a fraudulent actor to obtain a domain name that is similar to that of an existing local governmental agency, also using a non-.gov top level domain, and set up a fake website at that domain. If its content is sufficiently similar to a real website, search engines may pick up the fake website and display it when people search for the entity.

Because so many local governmental entities don’t have .gov domain names, visitors have no reason to be suspicious of such domains; moreover, there is no quick, convenient way for users to verify the authenticity of the website they are visiting. A fake website that lures in real users who believe they are visiting a legitimate government website could then lure those users into sharing personal information, making payments, and conducting other compromising activities. A fake site could also spread misinformation, such as providing erroneous dates and addresses for voting sites or touting the supposed dangers of vaccines.

As discussed below, there are undoubted cybersecurity benefits from requiring the use of .gov or .ca.gov domain names. Transition difficulties could be addressed by a state-level help desk, perhaps housed at the California Department of Technology.

The bill is author-sponsored. It is opposed by the City Clerks Association of California and two California cities. A coalition of six local government associations, including the California Special Districts Association and the League of California Cities, have taken an “oppose unless amended” position on the bill.

This bill previously passed the Assembly Local Government Committee on a 5-0-2 vote.

SUMMARY: Requires California local agencies that maintain websites and email addresses accessible to the public to utilize a “.gov” or “.ca.gov” domain no later than January 1, 2026. Specifically, this bill:

1. Requires, no later than January 1, 2026, any local agency that maintains an internet website for use by the public to ensure that the internet website utilizes a “.gov” top-level domain or a “.ca.gov” second-level domain.
2. Specifies that if a local agency currently maintains an internet website for use by the public that does not comply with 1) above by January 1, 2026, then that local agency shall redirect that internet website to a domain name that does comply with 1) above.
3. Requires, no later than January 1, 2026, a local agency that maintains public email addresses for its employees to ensure that each email address provided to its employees utilizes a “.gov” domain name or a “.ca.gov” domain name.
4. Defines “local agency” to mean a county, city, whether general law or chartered, city and county, town, school district, municipal corporation, district, political subdivision, or any board, commission or agency thereof, or other local public agency.
5. Makes findings and declarations in support of the foregoing.

EXISTING LAW:

1. Establishes the California Department of Technology in the Government Operations Agency (GovOps). (Gov. Code § 11545.)
2. Requires every independent special district to maintain an Internet website, though provides an exemption for hardship such as inadequate broadband availability, limited financial resources, or insufficient staff resources. (Gov. Code § 53087.8)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS:

1) Need for this bill. When you type a URL like https://www.assembly.ca.gov into a Web browser or email someone at an address such as [email protected], you are implicitly relying on the internet’s domain name system (DNS). The DNS is based on computers, called domain name servers, distributed throughout the global internet to translate human-readable domain names like “assembly.ca.gov” and “asm.ca.gov” into numeric Internet Protocol (IP) addresses. Once the numeric IP address is acquired, data sent on the internet to a particular domain (such as “asm.ca.gov”) can be routed to the computer or network where it is meant to be delivered.

The top-level domain “.gov” was originally meant to be used by federal, state, and local government entities. The other original top-level domains each had their own particular functions: “.com” was meant for commercial use; “.org” was for nonprofits; “.edu” was for institutions of higher education; “net” was for internet service providers and other entities providing network infrastructure; and “.mil” was for the U.S. Department of Defense (DOD). Since then, a plethora of other top-level domains have emerged, such as “.info,” “.biz,” and even “.beer.” Some of the original domain requirements remain strictly enforced; no one but the DOD can get a “.mil” domain, and it is difficult for non-educational institutions to obtain an “.edu” domain. Other requirements have not been strictly enforced; anyone can quickly obtain a “.com,” “.net,” or “.org” domain (to say nothing of “.beer”) if it is available.

It would have been helpful for internet cybersecurity if government entities had been legally required to obtain .gov domain names decades ago. Unfortunately, these requirements were not placed into law, meaning that there has been a proliferation of local government entities using .com, .net, and .org addresses. In part, this is because the process for obtaining a .gov domain can be a bit time-consuming (because the applicant must verify that it is actually a governmental entity), whereas a .com, .net, or .org, domain can be obtained in minutes.

As a result, we now live in a world where the Los Angeles Unified School District uses the domain “lausd.net,” the Metropolitan Water District of Southern California uses the domain “mwdh20.com,” and the City of Norwalk uses the domain “norwalk.org.” Many other local governments have also foregone .gov domains for these quicker-to-obtain alternatives.

The problem is that it is a trivial matter for a fraudulent actor to obtain a domain name that is similar to that of an existing local governmental agency, also using a non-.gov top level domain, and set up a fake website at that domain. If its content is sufficiently similar to a real website, search engines may pick up the fake website and display it when people search for the entity. Take, for example, Los Angeles Unified School District’s “lausd.net” domain. According to the author, as of March 2023, “la-usd.net,” “la-usd.org,” and “lausdca.org” were all available on GoDaddy, a popular, low-cost domain name registrar; each of these would be easy options for setting up a fake L.A. Unified website.

Because so many local governmental entities don’t have .gov domain names, visitors have no reason to be suspicious of such domains; moreover, there is no quick, convenient way for users to verify the authenticity of the website they are visiting. A fake website that lures in real users who believe they are visiting a legitimate government website could then lure those users into sharing personal information, making payments, and conducting other compromising activities. A fake site could also spread misinformation, such as providing erroneous dates and addresses for voting sites or touting the supposed dangers of vaccines.

In response, this bill would require local governments to ensure that their public-facing internet websites and email addresses use a “.gov” or “.ca.gov” domain name, no later than January 1, 2026.

The requirements of this bill would apply to any county, city, whether general law or chartered, city and county, town, school district, municipal corporation, district, political subdivision, or any board, commission or agency thereof, or other local public agency.

2) Author’s statement. According to the author:

The public’s trust in government is foundational for a healthy democracy. With rising levels of misinformation and fraud perpetrated online, and more sophisticated threat actors intending to confuse and mislead, we can no longer be haphazard about how governments are presented online. California’s public agencies should take every effort to safeguard the public’s trust in our institutions, especially when they are recommended and offered free of charge by federal and state authorities. AB 1637 requires local agencies to transition their websites and e-mails to the .gov or ca.gov domain, so when Californians look for government information or services, they can know with confidence they are receiving official information.

3) How local governments can obtain .gov and .ca.gov domains. The Cybersecurity and Infrastructure Security Agency (CISA), part of the U.S. Department of Homeland Security, leads the federal government’s effort to understand, manage, and reduce risk to cyber and physical infrastructure. In 2020, administration of the .gov domain program was transferred from the federal General Services Administration to CISA. “.gov” has been reserved for U.S.-based government organizations and publicly controlled entities. This includes state, tribal, interstate, independent intrastate, city, and county governments. If a local government wishes to obtain a .gov domain, it may follow the instructions available at https://get.gov/registration/requirements/.

The California Department of Technology (CDT) administers the .ca.gov second-level domain. “.ca.gov” may be used by any state entity, county, city, state-recognized tribal government, Joint Powers Authority, or independent local district within the State of California. If a local government wishes to obtain a .ca.gov domain, it can use CDT’s Domain Name Request System, available at https://domainnamerequest.cdt.ca.gov/.

There is no annual fee associated with a .gov or .ca.gov domain name.

4) The contested aspects of this measure are largely in other Committees’ jurisdictions. Most of the opposition’s arguments raise issues that lie in other Committees’ jurisdictions. For example, the City Clerks Association of California writes, “Switching our website and email addresses would create an unnecessary, costly issue for cities and would direct public resources away from serving residents in other ways. This unfunded mandate is not the best use of limited local resources during a time of fiscal instability and uncertainty.” The question of whether this measure would be a worthwhile use of local government resources is a topic for the Assembly Local Government Committee, which heard and passed the bill last week.

.If passed by this Committee, the bill will next be heard by the Assembly Appropriations Committee, which will consider its costs. Accordingly, the sole focus of this Committee’s analysis are the bill’s impacts on cybersecurity.

5) What are the benefits of this measure for cybersecurity? As discussed above under “Need for this bill,” the main benefit of this measure will be to ensure that members of the public know that when they access a California local governmental website with an internet address ending with “.gov” or “.ca.gov,” or email a government employee at such an address, that they are not going to be the victim of a hacker’s fake website.

While it is of course possible for a “.gov” or “.ca.gov” website to be hacked, this is much more difficult than setting up a fake website using a “.org” or “.net” top-level domain. Moreover, as noted in the Assembly Local Government Committee analysis:

Using a “.gov” domain increases security in the following ways:

1. Multi-factor authentication is enforced on all accounts in the “.gov” registrar, which is different than commercial registrars.
2. All new domains are “preloaded.” This requires browsers to only use a hypertext transfer protocol secure (HTTPS) connection with a website. This protects a visitor’s privacy and ensures the content [published on the website] is exactly what is received.
3. A security contact can be added for the domain, making it easier for the public to report potential security issues with the online services.

Eligibility for a “.gov” domain is attested through a letter signed by the public agency. CISA reviews the letter, may review or request founding documentation, and may review or request additional records to verify the public agency’s claim that they are a United States based government organization. There are requirements for choosing a name, and activities that are required and prohibited, among others, for local governments. Requests from non-federal organizations are reviewed in approximately 20 business days, but may take longer in some instances.

The City Clerks Association of California objects on the grounds that public trust could be weakened during the transition to the new domain, writing:

[T]he impacts of the measure go beyond websites and email addresses to include the need to convert all public facing branding, including fleets, outreach, materials, ballots, etc. While these do have natural turnover, waiting to transition current supply could take many years and create confusion in branding and ultimately compromise the trust of the public. Although the measure allows for website redirection, this only adds to the confusion as residents are redirected from our current website, the one they have checked for many years, to a new landing page that wouldn’t comport to the addresses on public facing material. The result could compromise local communities’ trust in their local leaders and would only add to the frustration in transparent and user-focused government administration.

But this issue—potential resident confusion during the transition to a .gov domain—will never go away. It always take time and money to migrate to a .gov or .ca.gov domain. To accept this as a reason not to make the transition would mean never making the transition.

6) How burdensome is it to migrate domains to .gov and .ca.gov? Local governments report vast discrepancies as to the time, effort, and expense required to transition to using “.gov” and “.ca.gov” domains.

The Chief Information Officer of Ventura County (population 847,000) was asked by the author to provide feedback on what this bill would require, as the county uses a “ventura.org” domain name. He responded that the county operates over 70 websites that use the “ventura.org” domain name. Here is how he explained the migration process:

We would start with our home site and once that is complete, move to the others.

1. [C]lone the site

2. [M]ass change all ventura.org references to the new .gov name

3. Internal test for some weeks

4. Add Domain to DNS (local and outside)

5. Redirect .org to .gov. Both sites kept in synch and both active.

6. Press release

7. Decommission .org site.

[Ventura County’s hosting provider] can convert a site very quickly (hours). A small number of days to convert all our sites.

Only one [full time employee] would be required in addition to [the hosting provider’s] efforts…with some misc support for less than a week for the technical efforts. This is within our budget.

By contrast, an opposition coalition consisting of six local government associations reports:

[O]ne large local government that recently went through the process of migrating to a .gov domain required 15 full-time information technology professionals and over 14 months to complete the project. This included changing all websites, web applications, emails, and active directory accounts for over 12,000 employees and contractors–a considerable endeavor and exactly what is required, should AB 1637 be enacted as currently drafted. One suburban local government ran preliminary estimates that suggested that the costs for migration to .gov could range from $750,000 to $1 million. Another large urban local government itemized costs of about $6.3 million and anticipates that most of the work that would be required would have to be completed by contract labor due to the large number of high-priority projects that information technology staff are currently completing.

Given these discrepancies, one wonders if there is some fundamental misunderstanding as to what is required to implement this bill. Perhaps there are easy steps that could be taken by all, or most, local governments to facilitate an efficient transition to a .gov domain.

To that end, one possible amendment discussed by the author would be to set up help desk functionality at an appropriate state agency in order to provide technical assistance and advice on best practice to local governments transitioning to .gov and .ca.gov domains. A state-level help desk could possibly be paid for through federal grant funding. According to the author, the bipartisan Infrastructure Investment and Jobs Act (Pub. L. 117-58) created the State and Local Cybersecurity Grant Program (SLCGP), which allocated $1 billion over four years to states for cybersecurity initiatives, with a requirement of 80% pass through to local governments. It may be possible for an SLCGP grant to fund a state-level help desk, perhaps housed at CDT. According to the author, total SLCGP grant funding for California could amount to $50 million over the four years. More information about the SLGCP can be found at https://www.cisa.gov/sites/default/files/publications/SLCGP_FAQ-FINAL_508c.pdf; migration to a .gov domain is among the seven best practices listed therein.

7) Committee amendment—extending implementation deadline by one year. The bill in print would have required migration to a “.gov” or “.ca.gov” domain by January 1, 2025. An amendment agreed upon in the Assembly Local Government Committee permits local government agencies an additional year to comply with this measure, as follows:

Government Code 50034.

(a) (1) No later than January 1, 2025 2026, a local agency that maintains an internet website for use by the public shall ensure that the internet website utilizes a “.gov” top-level domain or a “.ca.gov” second-level domain.

(2) If local agency that is subject to paragraph (1) maintains an internet website for use by the public that is noncompliant with paragraph (1) by January 1, 2025 2026, that local agency shall redirect that internet website to a domain name that does comply with paragraph (1).

(b) No later than January 1, 2025 2026, a local agency that maintains public email addresses for its employees shall ensure that each email address provided to its employees utilizes a “.gov” domain name or a “.ca.gov” domain name.

8) Related legislation. SB 386 (Newman, 2023), as originally introduced, would have required a county elections internet website to have a .gov domain. That provision has been amended out of the bill. Status: Senate Appropriations.

SB 929 (McGuire, Chap. 408, Stats. 2020) required every independent special district to maintain an internet website by January 1, 2020, but permitted a hardship exemption for districts without sufficient resources or broadband connectivity.

AB 1344 (Feuer, Chap. 692, Stats. 2011) required all local agencies that have a website to post their meeting agendas on the website 72 hours in advance.

ARGUMENTS IN OPPOSITION: A coalition of six local government associations, including California Special Districts Association and League of California Cities, summarizes its opposition to the bill:

While we appreciate the intended goal of this measure and the perceived benefits that some believe utilizing a new domain may provide, we remain deeply concerned about the added costs associated with migrating to a new domain and corresponding email addresses; confusion that will be created by forcing a new website to be utilized; and the absence of any resources to better assist local agencies with this proposed migration.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Oppose unless Amended

Association of California School Administrators

California Special Districts Association

California State Association of Counties (CSAC)

League of California Cities

Rural County Representatives of California (RCRC)

Urban Counties of California (UCC)

Opposition

City Clerks Association of California

City of Redwood City

City of San Marcos

Analysis Prepared by: Jith Meganathan / P. & C.P. / (916) 319-2200

Date of Hearing:

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Jesse Gabriel, Chair

ABPCA Bill Id:AB 1637 (

Author:Irwin) – As Amended Ver:March 16, 2023

As Proposed to be Amended

SUBJECT: Local government: internet websites and email addresses

SYNOPSIS

This bill would require local governments to ensure that their public-facing internet websites and email addresses use a “.gov” or “.ca.gov” domain name, no later than January 1, 2026.

It would have been helpful for internet cybersecurity if government entities had been legally required to take this step decades ago. Unfortunately, these requirements were not placed into law, meaning that there has been a proliferation of local government entities using .com, .net, and .org addresses.

The problem is that it is a trivial matter for a fraudulent actor to obtain a domain name that is similar to that of an existing local governmental agency, also using a non-.gov top level domain, and set up a fake website at that domain. If its content is sufficiently similar to a real website, search engines may pick up the fake website and display it when people search for the entity.

Because so many local governmental entities don’t have .gov domain names, visitors have no reason to be suspicious of such domains; moreover, there is no quick, convenient way for users to verify the authenticity of the website they are visiting. A fake website that lures in real users who believe they are visiting a legitimate government website could then lure those users into sharing personal information, making payments, and conducting other compromising activities. A fake site could also spread misinformation, such as providing erroneous dates and addresses for voting sites or touting the supposed dangers of vaccines.

As discussed below, there are undoubted cybersecurity benefits from requiring the use of .gov or .ca.gov domain names. Transition difficulties could be addressed by a state-level help desk, perhaps housed at the California Department of Technology.

The bill is author-sponsored. It is opposed by the City Clerks Association of California and two California cities. A coalition of six local government associations, including the California Special Districts Association and the League of California Cities, have taken an “oppose unless amended” position on the bill.

This bill previously passed the Assembly Local Government Committee on a 13-0-2 vote.

SUMMARY: Requires California local agencies that maintain websites and email addresses accessible to the public to utilize a “.gov” or “.ca.gov” domain no later than January 1, 2026. Specifically, this bill:

1. Requires, no later than January 1, 2026, any local agency that maintains an internet website for use by the public to ensure that the internet website utilizes a “.gov” top-level domain or a “.ca.gov” second-level domain.
2. Specifies that if a local agency currently maintains an internet website for use by the public that does not comply with 1) above by January 1, 2026, then that local agency shall redirect that internet website to a domain name that does comply with 1) above.
3. Requires, no later than January 1, 2026, a local agency that maintains public email addresses for its employees to ensure that each email address provided to its employees utilizes a “.gov” domain name or a “.ca.gov” domain name.
4. Defines “local agency” to mean a county, city, whether general law or chartered, city and county, town, school district, municipal corporation, district, political subdivision, or any board, commission or agency thereof, or other local public agency.
5. Makes findings and declarations in support of the foregoing.

EXISTING LAW:

1. Establishes the California Department of Technology in the Government Operations Agency (GovOps). (Gov. Code § 11545.)
2. Requires every independent special district to maintain an Internet website, though provides an exemption for hardship such as inadequate broadband availability, limited financial resources, or insufficient staff resources. (Gov. Code § 53087.8)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS:

1) Need for this bill. When you type a URL like https://www.assembly.ca.gov into a Web browser or email someone at an address such as [email protected], you are implicitly relying on the internet’s domain name system (DNS). The DNS is based on computers, called domain name servers, distributed throughout the global internet to translate human-readable domain names like “assembly.ca.gov” and “asm.ca.gov” into numeric Internet Protocol (IP) addresses. Once the numeric IP address is acquired, data sent on the internet to a particular domain (such as “asm.ca.gov”) can be routed to the computer or network where it is meant to be delivered.

The top-level domain “.gov” was originally meant to be used by federal, state, and local government entities. The other original top-level domains each had their own particular functions: “.com” was meant for commercial use; “.org” was for nonprofits; “.edu” was for institutions of higher education; “net” was for internet service providers and other entities providing network infrastructure; and “.mil” was for the U.S. Department of Defense (DOD). Since then, a plethora of other top-level domains have emerged, such as “.info,” “.biz,” and even “.beer.” Some of the original domain requirements remain strictly enforced; no one but the DOD can get a “.mil” domain, and it is difficult for non-educational institutions to obtain an “.edu” domain. Other requirements have not been strictly enforced; anyone can quickly obtain a “.com,” “.net,” or “.org” domain (to say nothing of “.beer”) if it is available.

It would have been helpful for internet cybersecurity if government entities had been legally required to obtain .gov domain names decades ago. Unfortunately, these requirements were not placed into law, meaning that there has been a proliferation of local government entities using .com, .net, and .org addresses. In part, this is because the process for obtaining a .gov domain can be a bit time-consuming (because the applicant must verify that it is actually a governmental entity), whereas a .com, .net, or .org, domain can be obtained in minutes.

As a result, we now live in a world where the Los Angeles Unified School District uses the domain “lausd.net,” the Metropolitan Water District of Southern California uses the domain “mwdh20.com,” and the City of Norwalk uses the domain “norwalk.org.” Many other local governments have also foregone .gov domains for these quicker-to-obtain alternatives.

The problem is that it is a trivial matter for a fraudulent actor to obtain a domain name that is similar to that of an existing local governmental agency, also using a non-.gov top level domain, and set up a fake website at that domain. If its content is sufficiently similar to a real website, search engines may pick up the fake website and display it when people search for the entity. Take, for example, Los Angeles Unified School District’s “lausd.net” domain. According to the author, as of March 2023, “la-usd.net,” “la-usd.org,” and “lausdca.org” were all available on GoDaddy, a popular, low-cost domain name registrar; each of these would be easy options for setting up a fake L.A. Unified website.

Because so many local governmental entities don’t have .gov domain names, visitors have no reason to be suspicious of such domains; moreover, there is no quick, convenient way for users to verify the authenticity of the website they are visiting. A fake website that lures in real users who believe they are visiting a legitimate government website could then lure those users into sharing personal information, making payments, and conducting other compromising activities. A fake site could also spread misinformation, such as providing erroneous dates and addresses for voting sites or touting the supposed dangers of vaccines.

In response, this bill would require local governments to ensure that their public-facing internet websites and email addresses use a “.gov” or “.ca.gov” domain name, no later than January 1, 2026.

The requirements of this bill would apply to any county, city, whether general law or chartered, city and county, town, school district, municipal corporation, district, political subdivision, or any board, commission or agency thereof, or other local public agency.

2) Author’s statement. According to the author:

The public’s trust in government is foundational for a healthy democracy. With rising levels of misinformation and fraud perpetrated online, and more sophisticated threat actors intending to confuse and mislead, we can no longer be haphazard about how governments are presented online. California’s public agencies should take every effort to safeguard the public’s trust in our institutions, especially when they are recommended and offered free of charge by federal and state authorities. AB 1637 requires local agencies to transition their websites and e-mails to the .gov or ca.gov domain, so when Californians look for government information or services, they can know with confidence they are receiving official information.

3) How local governments can obtain .gov and .ca.gov domains. The Cybersecurity and Infrastructure Security Agency (CISA), part of the U.S. Department of Homeland Security, leads the federal government’s effort to understand, manage, and reduce risk to cyber and physical infrastructure. In 2020, administration of the .gov domain program was transferred from the federal General Services Administration to CISA. “.gov” has been reserved for U.S.-based government organizations and publicly controlled entities. This includes state, tribal, interstate, independent intrastate, city, and county governments. If a local government wishes to obtain a .gov domain, it may follow the instructions available at https://get.gov/registration/requirements/.

The California Department of Technology (CDT) administers the .ca.gov second-level domain. “.ca.gov” may be used by any state entity, county, city, state-recognized tribal government, Joint Powers Authority, or independent local district within the State of California. If a local government wishes to obtain a .ca.gov domain, it can use CDT’s Domain Name Request System, available at https://domainnamerequest.cdt.ca.gov/.

There is no annual fee associated with a .gov or .ca.gov domain name.

4) The contested aspects of this measure are largely in other Committees’ jurisdictions. Most of the opposition’s arguments raise issues that lie in other Committees’ jurisdictions. For example, the City Clerks Association of California writes, “Switching our website and email addresses would create an unnecessary, costly issue for cities and would direct public resources away from serving residents in other ways. This unfunded mandate is not the best use of limited local resources during a time of fiscal instability and uncertainty.” The question of whether this measure would be a worthwhile use of local government resources is a topic for the Assembly Local Government Committee, which heard and passed the bill last week.

.If passed by this Committee, the bill will next be heard by the Assembly Appropriations Committee, which will consider its costs. Accordingly, the sole focus of this Committee’s analysis are the bill’s impacts on cybersecurity.

5) What are the benefits of this measure for cybersecurity? As discussed above under “Need for this bill,” the main benefit of this measure will be to ensure that members of the public know that when they access a California local governmental website with an internet address ending with “.gov” or “.ca.gov,” or email a government employee at such an address, that they are not going to be the victim of a hacker’s fake website.

While it is of course possible for a “.gov” or “.ca.gov” website to be hacked, this is much more difficult than setting up a fake website using a “.org” or “.net” top-level domain. Moreover, as noted in the Assembly Local Government Committee analysis:

Using a “.gov” domain increases security in the following ways:

1. Multi-factor authentication is enforced on all accounts in the “.gov” registrar, which is different than commercial registrars.
2. All new domains are “preloaded.” This requires browsers to only use a hypertext transfer protocol secure (HTTPS) connection with a website. This protects a visitor’s privacy and ensures the content [published on the website] is exactly what is received.
3. A security contact can be added for the domain, making it easier for the public to report potential security issues with the online services.

Eligibility for a “.gov” domain is attested through a letter signed by the public agency. CISA reviews the letter, may review or request founding documentation, and may review or request additional records to verify the public agency’s claim that they are a United States based government organization. There are requirements for choosing a name, and activities that are required and prohibited, among others, for local governments. Requests from non-federal organizations are reviewed in approximately 20 business days, but may take longer in some instances.

The City Clerks Association of California objects on the grounds that public trust could be weakened during the transition to the new domain, writing:

[T]he impacts of the measure go beyond websites and email addresses to include the need to convert all public facing branding, including fleets, outreach, materials, ballots, etc. While these do have natural turnover, waiting to transition current supply could take many years and create confusion in branding and ultimately compromise the trust of the public. Although the measure allows for website redirection, this only adds to the confusion as residents are redirected from our current website, the one they have checked for many years, to a new landing page that wouldn’t comport to the addresses on public facing material. The result could compromise local communities’ trust in their local leaders and would only add to the frustration in transparent and user-focused government administration.

But this issue—potential resident confusion during the transition to a .gov domain—will never go away. It always take time and money to migrate to a .gov or .ca.gov domain. To accept this as a reason not to make the transition would mean never making the transition.

6) How burdensome is it to migrate domains to .gov and .ca.gov? Local governments report vast discrepancies as to the time, effort, and expense required to transition to using “.gov” and “.ca.gov” domains.

The Chief Information Officer of Ventura County (population 847,000) was asked by the author to provide feedback on what this bill would require, as the county uses a “ventura.org” domain name. He responded that the county operates over 70 websites that use the “ventura.org” domain name. Here is how he explained the migration process:

We would start with our home site and once that is complete, move to the others.

1. [C]lone the site

2. [M]ass change all ventura.org references to the new .gov name

3. Internal test for some weeks

4. Add Domain to DNS (local and outside)

5. Redirect .org to .gov. Both sites kept in synch and both active.

6. Press release

7. Decommission .org site.

[Ventura County’s hosting provider] can convert a site very quickly (hours). A small number of days to convert all our sites.

Only one [full time employee] would be required in addition to [the hosting provider’s] efforts…with some misc support for less than a week for the technical efforts. This is within our budget.

By contrast, an opposition coalition consisting of six local government associations reports:

[O]ne large local government that recently went through the process of migrating to a .gov domain required 15 full-time information technology professionals and over 14 months to complete the project. This included changing all websites, web applications, emails, and active directory accounts for over 12,000 employees and contractors–a considerable endeavor and exactly what is required, should AB 1637 be enacted as currently drafted. One suburban local government ran preliminary estimates that suggested that the costs for migration to .gov could range from $750,000 to $1 million. Another large urban local government itemized costs of about $6.3 million and anticipates that most of the work that would be required would have to be completed by contract labor due to the large number of high-priority projects that information technology staff are currently completing.

Given these discrepancies, one wonders if there is some fundamental misunderstanding as to what is required to implement this bill. Perhaps there are easy steps that could be taken by all, or most, local governments to facilitate an efficient transition to a .gov domain.

To that end, one possible amendment discussed by the author would be to set up help desk functionality at an appropriate state agency in order to provide technical assistance and advice on best practice to local governments transitioning to .gov and .ca.gov domains. A state-level help desk could possibly be paid for through federal grant funding. According to the author, the bipartisan Infrastructure Investment and Jobs Act (Pub. L. 117-58) created the State and Local Cybersecurity Grant Program (SLCGP), which allocated $1 billion over four years to states for cybersecurity initiatives, with a requirement of 80% pass through to local governments. It may be possible for an SLCGP grant to fund a state-level help desk, perhaps housed at CDT. According to the author, total SLCGP grant funding for California could amount to $50 million over the four years. More information about the SLGCP can be found at https://www.cisa.gov/sites/default/files/publications/SLCGP_FAQ-FINAL_508c.pdf; migration to a .gov domain is among the seven best practices listed therein.

7) Committee amendment—extending implementation deadline by one year. The bill in print would have required migration to a “.gov” or “.ca.gov” domain by January 1, 2025. An amendment agreed upon in the Assembly Local Government Committee permits local government agencies an additional year to comply with this measure, as follows:

Government Code 50034.

(a) (1) No later than January 1, 2025 2026, a local agency that maintains an internet website for use by the public shall ensure that the internet website utilizes a “.gov” top-level domain or a “.ca.gov” second-level domain.

(2) If local agency that is subject to paragraph (1) maintains an internet website for use by the public that is noncompliant with paragraph (1) by January 1, 2025 2026, that local agency shall redirect that internet website to a domain name that does comply with paragraph (1).

(b) No later than January 1, 2025 2026, a local agency that maintains public email addresses for its employees shall ensure that each email address provided to its employees utilizes a “.gov” domain name or a “.ca.gov” domain name.

8) Related legislation. SB 386 (Newman, 2023), as originally introduced, would have required a county elections internet website to have a .gov domain. That provision has been amended out of the bill. Status: Senate Appropriations.

SB 929 (McGuire, Chap. 408, Stats. 2020) required every independent special district to maintain an internet website by January 1, 2020, but permitted a hardship exemption for districts without sufficient resources or broadband connectivity.

AB 1344 (Feuer, Chap. 692, Stats. 2011) required all local agencies that have a website to post their meeting agendas on the website 72 hours in advance.

ARGUMENTS IN OPPOSITION: A coalition of six local government associations, including California Special Districts Association and League of California Cities, summarizes its opposition to the bill:

While we appreciate the intended goal of this measure and the perceived benefits that some believe utilizing a new domain may provide, we remain deeply concerned about the added costs associated with migrating to a new domain and corresponding email addresses; confusion that will be created by forcing a new website to be utilized; and the absence of any resources to better assist local agencies with this proposed migration.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Oppose unless Amended

Association of California School Administrators

California Special Districts Association

California State Association of Counties (CSAC)

League of California Cities

Rural County Representatives of California (RCRC)

Urban Counties of California (UCC)

Opposition

City Clerks Association of California

City of Redwood City

City of San Marcos

Analysis Prepared by: Jith Meganathan / P. & C.P. / (916) 319-2200

Date of Hearing: April 19, 2023

ASSEMBLY COMMITTEE ON LOCAL GOVERNMENT

Cecilia Aguiar-Curry, Chair

ABPCA Bill Id:AB 1637 (

Author:Irwin) – As Amended Ver:March 16, 2023

SUBJECT: Local government: internet websites and email addresses.

SUMMARY: Requires local agencies that maintain websites to utilize a “.gov” or “.ca.gov” domain. Specifically, this bill:

1. Requires, no later than January 1, 2025, a local agency that maintains an internet website for use by the public to ensure that the internet website utilizes a “.gov” top-level domain or a “.ca.gov” second-level domain.
2. Specifies that, if local agency that is subject to 1) above, maintains an internet website for use by the public that is noncompliant with 1) above, by January 1, 2025, that local agency shall redirect that internet website to a domain name that does comply with 1) above.
3. Requires no later than January 1, 2025, a local agency that maintains public email addresses for its employees to ensure that each email address provided to its employees utilizes a “.gov” domain name or a “.ca.gov” domain name.
4. Defines “local agency” to mean a county, city, whether general law or chartered, city and county, town, school district, municipal corporation, district, political subdivision, or any board, commission or agency thereof, or other local public agency.
5. Contains findings and declarations to support its purposes, including that this bill address a matter of statewide concern and is not a municipal affair as that term is used in Section 5 of Article XI of the California Constitution. Therefore, Section 1 of this bill adding 50034 to the Government Code applies to all cities, including charter cities.
6. Provides that no reimbursement is required by this bill because a local agency or school district has the authority to levy service charges, fees, or assessments sufficient to pay for the program or level of service mandated by this bill.

FISCAL EFFECT: This bill is keyed fiscal and contains a state-mandated local program.

COMMENTS:

1. Bill Summary and Author’s Statement. This bill requires local agencies that have a website or maintain public email addresses for their employees, by January 1, 2025, to utilize a “.gov” or a “.ca.gov” domain. This bill also requires a local agency that maintains an internet website that is noncompliant with the requirement to utilize a “.gov” or “.ca.gov” domain to redirect that internet website to a domain name that does utilize a “.gov” or “.ca.gov” domain. The requirements of this bill apply to any county, city, whether general law or chartered, city and county, town, school district, municipal corporation, district, political subdivision, or any board, commission or agency thereof, or other local public agency. This bill is sponsored by the author.

According to the author, “The public’s trust in government is foundational for a healthy democracy. With rising levels of misinformation and fraud perpetrated online, and more sophisticated threat actors intending to confuse and mislead, we can no longer be haphazard about how governments are presented online. California’s public agencies should take every effort to safeguard the public’s trust in our institutions, especially when they are recommended and offered free of charge by federal and state authorities. AB 1637 requires local agencies to transition their websites and e-mails to the .gov or ca.gov domain, so when Californians look for government information or services, they can know with confidence they are receiving official information.”

1. Cybersecurity and Infrastructure Security Agency. According to the Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency (CISA) leads the Federal Government’s effort to understand, manage, and reduce risk to cyber and physical infrastructure. CISA is working to do the following:
   1. Build national critical infrastructure resilience against a growing array of complex threats.
   2. Mobilize risk management efforts around securing the critical infrastructure.
   3. Coordinate national efforts to defend federal and non-federal networks against malicious cyber activity.

CISA works with a range of federal, state, local, tribal, territorial, private sector, and international partners to foster information sharing and collaboration to address risks. CISA uses its domain expertise and delivers regional, national, and enterprise services to stakeholders to help them secure the cyber, physical, and communications critical infrastructure against a dynamic threat environment.

According to CISA, “’.gov’ is a ‘top-level domain’, or TLD, similar to ‘.com’, ‘.org’, or ‘.us’. Enterprises use a TLD to register a domain name (often simply called a domain) for use in their online services, like a website or email. In many well-known TLDs, anyone can register a domain for a fee, and as long as they pay there are not many questions asked about whether the name they chose corresponds to their real-life name or services. While this can be a useful property for creative communication, it can also make it difficult to know whether the people behind a name are really who they claim to be.”

CISA sponsors the “.gov” TLD and makes it available solely to United States based government organizations and publicly controlled entities. A “.gov. domain is available without a fee for those that qualify. Using a “.gov” domain increases security in the following ways:

1. Multi-factor authentication is enforced on all accounts in the “.gov” registrar, which is different than commercial registrars.
2. All new domains are “preloaded.” This requires browsers to only use a hypertext transfer protocol secure (HTTPS) connection with a website. This protects a visitor’s privacy and ensures the content you publish is exactly what is received.
3. A security contact can be added for the domain, making it easier for the public to report potential security issues with the online services.

Eligibility for a “.gov” domain is attested through a letter signed by the public agency. CISA reviews the letter, may review or request founding documentation, and may review or request additional records to verify the public agency’s claim that they are a United States based government organization. There are requirements for choosing a name, and activities that are required and prohibited, among others, for local governments. Requests from non-federal organizations are reviewed in approximately 20 business days, but may take longer in some instances.

1. Department of Technology. According to the California Department of Technology (CDT), “CDT leads the state’s drive to deliver clear, fast, dependable, and equitable public services. It provides for the delivery of digital government services through the oversight of statewide IT strategic planning, project delivery, procurement, policy and standards, and enterprise architecture. CDT is tasked with securing statewide information assets by providing oversight and infrastructure for many state departments and serves as the custodian of information for mission-critical and essential business applications. Home to the State Data Center, CDT provides infrastructure services for government customers that include on-premises and cloud-based services. CDT is leading statewide broadband planning and execution to deliver digital equity and reliability for all Californians. The Director of CDT is also the State Chief Information Officer (CIO), and advises the Governor on the strategic management and direction of the state’s IT resources and policies.”

CDT approval is required for any state entity, city, county, and government group that requests to use the ca.gov web domain. Web domains occupying the “ca.gov” domain zone must comply with specific requirements similar to those for “.gov” domains.

1. Local Agency Websites. As technology advances, the Legislature often amends statutes to capture these advancements and take advantage of any potential public benefits. For example, the Brown Act requires all local agencies to post the agenda for any regular meeting 72 hours in advance in a location that is freely accessible to the public. The agenda must clearly specify the meeting’s time, location, and the topics that will be deliberated. Despite this requirement, a local agency’s constituents still have to know when the agency plans to meet, where the agenda is posted, and physically travel to the location where the agenda is posted or contact the agency directly to discover what topics the agency is planning to discuss. With the proliferation of Internet access and local agencies utilizing this tool to communicate with their constituents, AB 1344 (Feuer), Chapter 692, Statutes of 2011, required all local agencies that have a website to post their meeting agendas on the website 72 hours in advance, effectively making the agenda more accessible to the public by taking advantage of advancements in technology. Additionally, SB 272 (Hertzberg), Chapter 795, Statutes of 2015, and AB 2040 (Garcia), Chapter 894, Statutes of 2014, required local agencies to post on their websites a list of the agency’s enterprise systems and the agency’s employee compensation report, respectively.

Additionally, in order to spur special districts to create and maintain a website, SB 929 (McGuire), Chapter 408, Statutes of 2018, required every independent special district, by January 1, 2020, to maintain a website. However, in recognition that California’s special districts come in many shapes and sizes, SB 929 allowed for those districts that do not have sufficient resources or broadband connectivity to adopt a resolution declaring a specific hardship to obtain an exemption. Also, understanding that circumstances change, SB 929 required a district to renew the hardship resolution annually in order to qualify for the exemption.

1. Policy Considerations. The committee may wish to consider the following:
   
   1. Cost vs. Benefit. Concerns have been raised by a coalition of local agencies stating that, “While applying for and obtaining a .gov domain has no fees, there are significant costs that an agency must budget for to recode, establish corresponding e-mail, and network login changes, single sign on/multi-factors authentication, encryption keys, revising and redesign website/url links, updating social media and external entities. All of these costs are increased two-fold to co-exist both the previous and newly acquired domains.” The coalition of local agencies offer a few examples of the costs associated with complying with AB 1637’s requirements, including one large urban local government anticipating costs of $6.3 million. The opposition also identifies a few instances of websites using the “.gov” domain being compromised in recent years, including BART.gov, OaklandCA.gov, USMarshals.gov, FBI.gov, and the California Department of Finance’s website.

However, the author has offered arguments in response, stating:

• • 1. “That multi-year federal funding for state and local cybersecurity is already being awarded. The State and Local Cybersecurity Grant Program (SLCGP) awarded California $9 million in FY’22 with federal amounts likely to total $50 million over the 4 year program. Additional state matching fund requirements, increasing year over year (10% up to 40%), will also bring more state funds to the table to achieve local cybersecurity goals. The SLCGP requires certain critical activities of local agencies, this includes the transition to the .gov.”
       
    2. “While registering a .gov domain does provide additional technical protections to some vulnerabilities — namely domain name service (DNS) attacks which involves the credentials of domain administrator being stolen and the website being rerouted to a malicious website— it does not protect against every vulnerability. The author’s office doesn’t contend the .gov to be a silver bullet. It is only one of the 16 required elements of the SLCGP State Cybersecurity Plans. The hacks mentioned in the letter were not even related to these public agencies’ domain names. The threat vectors of those attacks are listed below, but none of them were DNS attacks, they were almost entirely ransomware attacks which encrypted the agencies systems. This made their websites unavailable to the public because everything on their network was encrypted and unavailable for the DNS service to pull from to display a webpage, the equivalent of unplugging the server.”
       

In light of the differing points of view between the author and the opposition coalition, the committee may wish to consider if this bill strikes the right balance between the potential cost to local agencies and the benefits of the additional security provided to the local agencies and their constituents.

• 1. Timeline. The size and sophistication of local agencies varies widely in California. Some have budgets that range in the billions of dollars to as little as tens of thousands. The opponents argue that while this bill could require local agencies to shift resources away from critical services, smaller, and often rural, areas do not have sufficient resources to redirect staff and funding. The Committee may wish to consider if this bill provides sufficient time for all local agencies to comply with its requirements.
     

1. Committee Amendments. In order to address the above policy considerations, the Committee may wish to amend the bill as follows:

50034. (a) (1) No later than January 1, 2026 2025, a local agency that maintains an internet website for use by the public shall ensure that the internet website utilizes a “.gov” top-level domain or a “.ca.gov” second-level domain.
(2) If a local agency that is subject to paragraph (1) maintains an internet website for use by the public that is noncompliant with paragraph (1) by January 1, 2026 2025, that local agency shall redirect that internet website to a domain name that does comply with paragraph (1).
(b) No later than January 1, 2026 2025, a local agency that maintains public email addresses for its employees shall ensure that each email address provided to its employees utilizes a “.gov” domain name or a “.ca.gov” domain name.
(c) For purposes of this section, “local agency” has the same meaning as that term is defined in Section 54951.

Due to timing constraints, these amendments should be adopted in the Privacy and Consumer Protection Committee.

1. Arguments in Support. None on file.
2. Arguments in Opposition. According to a coalition of local agency associations, “While we appreciate the intended goal of this measure and the perceived benefits that some believe utilizing a new domain may provide, we remain deeply concerned about the added costs associated with migrating to a new domain and corresponding email addresses; confusion that will be created by forcing a new website to be utilized; and the absence of any resources to better assist local agencies with this proposed migration.

“To secure and register a .gov domain, an authorization letter must be submitted to the Cybersecurity and Infrastructure Security Agency (CISA). Competing domain names are not processed on a first come, first served basis, but rather by a review process to determine which agency most closely related will receive it. As a result, this process can take long periods of time with some applicants citing weeks, if not months, to have CISA process and approve a domain. CISA’s registrar manages .gov domain hosts and by requiring thousands of California-based local governments (cities, counties, special districts, water authorities, parks, fire, police, sheriff, county hospitals, school districts/students, etc.) to migrate to a .gov domain, it will cause interruptions to support lines, thus creating interruptions and confusion for constituents trying to access critical information on a local government website.

“Also, it should be noted that not all federal governments use the .gov domains. Some U.S. government-related websites use non-.gov domain names, including the United States Postal Service (e.g., usps.com) and various recruiting websites for armed services (e.g., goarmy.com), as well as the United States Department of Defense and its subsidiary organizations typically use the .mil top-level domain instead of .gov...

“For these reasons, we propose that AB 1637 narrow its scope to permissively encourage local governments to acquire .gov domains and provide state resources to match available federal grants, as well as establish technical assistance resources for applicants seeking to utilize the .gov domain. Furthermore, we recommend that Cal OES and the California Cybersecurity Integration Center utilize a series of surveys and information requests administered through newly established working groups composed of representatives of local agencies to collect data on the cybersecurity needs around the State and to provide a report summarizing those needs to the Governor and the Legislature. Collectively, our organizations and respective members promote safe, recognizable, and trustworthy online services; however, AB 1637 goes too far, too soon, and contains no resources to help local authorities comply with the proposed mandate.”

1. Double-Referral. This bill is double-referred to the Assembly Committee on Privacy and Consumer Protection.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

Association of California School Administrators (unless amended)
California Special Districts Association (unless amended)

California State Association of Counties (unless amended)

City Clerks Association of California

City of Redwood City

City of San Marcos

League of California Cities (unless amended)

Rural County Representatives of California (unless amended)

Urban Counties of California (unless amended)

Analysis Prepared by: Jimmy MacDonald / L. GOV. / (916) 319-3958