Existing law, the Ralph M. Brown Act, generally requires that all meetings of a legislative body of a local agency be open and public and that all persons be permitted to attend and participate. Existing law authorizes a legislative body to hold a closed session with specified individuals on, among other things, matters posing a threat to the security of essential public services, as specified.

This bill would additionally authorize a legislative body to hold a closed session with other law enforcement or security personnel and to hold a closed session on a threat to critical infrastructure controls or critical infrastructure information, as defined, relating to cybersecurity.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers the constitutional requirements relating to this purpose.

This bill would make legislative findings to that effect.

Existing law, the Ralph M. Brown Act, generally requires that all meetings of a legislative body of a local agency be open and public and that all persons be permitted to attend and participate. Existing law authorizes a legislative body to hold a closed session with specified individuals on, among other things, matters posing a threat to the security of essential public services, as specified.

This bill would additionally authorize a legislative body to hold a closed session with other law enforcement or security personnel and to hold a closed session on a threat to critical infrastructure controls or critical infrastructure information, as defined, relating to cybersecurity.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers the constitutional requirements relating to this purpose.

This bill would make legislative findings to that effect.

Existing law, the Ralph M. Brown Act, generally requires that all meetings of a legislative body of a local agency be open and public and that all persons be permitted to attend and participate. Existing law authorizes a legislative body to hold a closed session with specified individuals on, among other things, matters posing a threat to the security of essential public services, as specified.

This bill would additionally authorize a legislative body to hold a closed session to consider or evaluate matters related to cybersecurity, as specified, provided that any action taken on those matters is done in open session. with other law enforcement or security personnel and to hold a closed session on a threat to critical infrastructure controls or critical infrastructure information, as defined, relating to cybersecurity.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers the constitutional requirements relating to this purpose.

This bill would make legislative findings to that effect.

Existing law, the Ralph M. Brown Act, generally requires that all meetings of a legislative body of a local agency be open and public and that all persons be permitted to attend and participate. Existing law authorizes a legislative body to hold a closed session on, among other things, matters posing a threat to the security of essential public services, as specified.

This bill would additionally authorize a closed session to consider or evaluate matters related to cybersecurity, as specified, provided that any action taken on those matters is done in open session.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers the constitutional requirements relating to this purpose.

This bill would make legislative findings to that effect.

 THIRD READING  

Bill No: AB 2715

Author: Boerner (D)

Amended: 4/24/24 in Assembly

Vote: 21

SENATE LOCAL GOVERNMENT COMMITTEE: 7-0, 6/5/24

AYES: Durazo, Seyarto, Dahle, Glazer, Skinner, Wahab, Wiener

SENATE JUDICIARY COMMITTEE: 11-0, 6/25/24

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Niello, Roth, Stern, Wahab

ASSEMBLY FLOOR: 69-0, 5/16/24 - See last page for vote

SUBJECT: Ralph M. Brown Act: closed sessions

SOURCE: City of Carlsbad

DIGEST:

This bill allows a legislative body to discuss a threat to critical infrastructure controls or critical infrastructure information relating to cybersecurity during a closed session.

ANALYSIS:

Existing law:

1. Guarantees, pursuant to Article I, Section 3 of the California Constitution that “the people have the right to instruct their representatives, petition government for redress of grievances, and assemble freely to consult for the common good.” This includes a right to access information concerning the meetings and writings of public officials.
2. Requires, pursuant to the Constitution, local agencies to comply with certain state laws that outline the basic requirements for public access to meetings and public records. If a subsequent bill modifies these laws, it must include findings demonstrating how it furthers the public’s access to local agencies and their officials.
3. Provides, under the Ralph M. Brown Act, guidelines for how local agencies must hold public meetings:
   1. Defines a “meeting” as “any congregation of a majority of the members of a legislative body at the same time and location, including teleconference locations, to hear, discuss, deliberate, or take action on any item that is within the subject matter jurisdiction of the legislative body.”
   2. Requires local agencies to notice meetings in advance, including the posting of an agenda, and requires these meetings to be open and accessible to the public.
   3. Requires members of the public to have an opportunity to comment on agenda items, and generally prohibits deliberation or action on items not listed on the agenda.
   4. If a member of the public, including the respective district attorney, believes a local agency violated the Brown Act, it must first send an order to the local agency to correct the violation. If the local agency disagrees with the complaint and does not correct it, the submitter can pursue the complaint through the courts. If the court agrees with the complaint, outcomes range from invalidating certain actions of the local agency to a misdemeanor.
4. Prohibits private discussions among a majority of a legislative body unless otherwise specified. For example, a legislative body can hold closed session to discuss matters posing a threat to the security of public buildings, a threat to the security of essential public services, including water, drinking water, wastewater treatment, natural gas service, and electric service, or a threat to the public's right of access to public services or public facilities. These discussions can include the Governor, Attorney General, district attorney, agency counsel, sheriff, or chief of police, or their respective deputies, or a security consultant or a security operations manager.
5. Requires, for closed session, the legislative body to:
   1. Briefly describe all closed session items in the posted agenda and describe which exception applies.
   2. Makes an announcement to the public that the body is entering closed session before the session begins.
   3. After closed session, the legislative body must provide an oral or written report on actions taken and the vote of each member of the legislative body.
   4. Provides to any person who has submitted a written request to the legislative body within 24 hours of the posting of the agenda, or to any person who has made a standing request for all documentation as part of a request for notice of meetings, if the requester is present at the time the closed session ends, copies of any contracts, settlement agreements, or other documents that were finally approved or adopted in the closed session. This documentation must be available to any person on the next business day following the meeting or, in the case of substantial amendments, when any necessary retyping is complete.

This bill:

1. Expands the exemption allowing a legislative body to discuss public security issues during a closed session meeting to include discussing a threat to critical infrastructure controls or critical infrastructure information relating to cybersecurity.
2. Expands the list of officials legislative bodies can discuss these threats with to include other law enforcement or security personnel.

Background

Public agencies in California face a variety of cybersecurity threats. For example, in 2023, the San Bernardino Sheriff’s Office was attacked with ransomware, where an intruder pretended to be a trusted individual to “phish” for information. In this case, the intruder impersonated a contractor that was working the County. To regain control of its computer system, the Sheriff’s office paid a $1.1 million ransom in cryptocurrency. It has also had to spend nearly $1 million to upgrade its computer systems to avoid similar problems in the future.

In 2016, the Legislature enacted AB 1841 (Irwin, Chapter 508, Statutes of 2016), which required the California Department of Technology, in conjunction with the Office of Emergency Services, to update its Technology Recovery Plan. The plan is activated immediately after a disaster strikes and focuses on getting critical systems back online. It also includes cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and information. The goal of this effort was to help state and local agencies become more resilient to cyber attacks. The measure defined “critical infrastructure controls” to mean networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof. It defined “critical infrastructure information” to mean information on critical infrastructure not customarily in the public domain, as specified.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 6/27/24)

City of Carlsbad (source)
Association of California School Administrators
California Association of Recreation & Park Districts
California IT in Education
California State Association of Counties
City Clerks Association of California
City of Eastvale
City of Rancho Cucamonga
City of Rancho Palos Verdes
City of Redwood City
City of Thousand Oaks
League of California Cities
Rural County Representatives of California
San Bernardino County District Advocates for Better Schools
Small School Districts Association
Urban Counties of California

OPPOSITION: (Verified 6/27/24)

First Amendment Coalition
Oakland Privacy

ASSEMBLY FLOOR: 69-0, 5/16/24

AYES: Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Chen, Connolly, Davies, Dixon, Mike Fong, Friedman, Gabriel, Gallagher, Garcia, Grayson, Haney, Hart, Holden, Hoover, Jackson, Jones-Sawyer, Kalra, Lackey, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Rendon, Reyes, Luz Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NO VOTE RECORDED: Addis, Wendy Carrillo, Cervantes, Megan Dahle, Essayli, Flora, Vince Fong, Gipson, Irwin, Mathis, Soria

Prepared by: Jonathan Peterson / L. GOV. / (916) 651-4119

6/28/24 13:06:22

**** END ****

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: AB 2715 (Author:Boerner)

Version: April 24, 2024

Hearing Date: June 25, 2024

Fiscal: No

Urgency: No

AMConsultant:

SUBJECT

Ralph M. Brown Act: closed sessions

DIGEST

This bill would authorize a legislative body to hold a closed session with specified governmental officials, law enforcement, and security personnel on matters pertaining to a threat to critical infrastructure controls or critical infrastructure information, as defined, relating to cybersecurity.

EXECUTIVE SUMMARY

The Ralph M. Brown Act (Brown Act) protects public access to meetings of the legislative bodies of local agencies and generally requires all meetings to be open and accessible to the public. Under existing law, local legislative bodies can meet in closed session to discuss certain limited issues, including with certain specified persons on matters posing a threat to the security of public buildings, security of essential public services, or the public’s right of access to public services or public facilities. This bill seeks to expand this authorization to also include a threat to critical infrastructure controls or critical infrastructure information relating to cybersecurity. This bill is sponsored by the City of Carlsbad and is supported by numerous local governments. The bill is opposed by the First Amendment Coalition and Oakland Privacy. The bill passed the Senate Local Government Committee on a vote of 7 to 0.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Affirms that the people have the right of access to information concerning the conduct of the people’s business, and, therefore, the meetings of public bodies and the writings of public officials and agencies shall be open to public scrutiny. (Cal. Const., art. I, § 3(b)(1).)
   1. Requires a statute that limits the public’s right of access to be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. (Cal. const. art. I, § 3(b)(1).)
2. Establishes the Brown Act, which secures public access to the meetings of public commissions, boards, councils, and agencies in the state. (Gov. Code, tit. 5, div. 2, pt. 1, ch. 9, §§ 54950 et seq.)^[1] The Brown Act defines the following relevant terms:
   1. A “local agency” is a county, city, whether general law or chartered, city and county, town, school district, municipal corporation, district, political subdivision, or any board, commission, or agency thereof, or any other local public agency. (§ 54951.)
   2. A “legislative body” is the governing board of a local agency or any other local body created by state or federal statute; a commission, committee, board, or other body of a local agency, as specified; a board, commission, or other multimember body that governs a private corporation, limited liability company, or other entity that is either created by an elected legislative body to exercise delegated authority or receives funds from a local agency and includes a member of the legislative body of the local agency; or the lessee of any hospital leased pursuant to Health and Safety Code section 21131, where the lessee exercises any material authority delegated by the legislative body. (§ 54952.)
3. Requires all meetings of the legislative body of a local agency to be open and public, and all persons are to be permitted to attend any meeting of the legislative body of a local agency, except as otherwise provided in the Brown Act. (§ 54953.)
   1. Provides a legislative body can meet in closed session for various reasons, including, with the Governor, Attorney General, district attorney, agency counsel, sheriff, or chief of police, or their respective deputies, or a security consultant or a security operations manager, on matters posing a threat to the security of public buildings, a threat to the security of essential public services, including water, drinking water, wastewater treatment, natural gas service, and electric service, or a threat to the public’s right of access to public services or public facilities. (§ 54957.)

This bill:

1. Expands the people the legislative body of a local agency can meet in closed session with in 3), above, to include other law enforcement or security personnel.
2. Authorizes the reasons a legislative body of a local agency can meet in closed session under 3), above, to include a threat to critical infrastructure controls or critical infrastructure information relating to cybersecurity.
3. Defines “critical infrastructure controls” as networks and systems controlling assets so vital to the local agency that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof.
4. Defines “critical infrastructure information” as information not customarily in the public domain pertaining to any of the following:
   1. actual, potential, or threatened interference with, or an attack on, compromise of, or incapacitation of critical infrastructure controls by either physical or computer-based attack or other similar conduct, including, but not limited to, the misuse of, or unauthorized access to, all types of communications and data transmission systems, that violates federal, state, or local law or harms public health, safety, or economic security, or any combination thereof;
   2. the ability of critical infrastructure controls to resist any interference, compromise, or incapacitation, including, but not limited to, any planned or past assessment or estimate of the vulnerability of critical infrastructure; or
   3. any planned or past operational problem or solution regarding critical infrastructure controls, including, but not limited to, repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to interference, compromise, or incapacitation of critical infrastructure controls.

COMMENTS

1. Stated need for the bill

The author writes:

Currently, the Brown Act allows local bodies to meet in a closed session for threats to the security of public buildings, the security of essential public services, or the public’s right of access to public services or public facilities. In the digital age, we must ensure that sensitive information is protected and not leaked. AB 2715 is critical to ensuring local agencies can properly protect themselves and their citizens from cyberattacks.

1. Brown Act and authorization to meet in closed session to address matters posing a threat to the security of public buildings, a threat to the security of essential public services, or a threat to the public’s right of access to public services or public facilities

The California Constitution enshrines the rights of the people to instruct their representatives and to access information concerning the conduct of government, and requires the meetings of public bodies to be accessible for public scrutiny.^[2] The Brown Act provides guidelines and requirements for how state and local bodies must guarantee open and public access to their meetings.^[3] The legislative intent of the Brown Act was expressly declared in its original statute, and has remained unchanged despite numerous amendments:

The Legislature finds and declares that the public commissions, boards and councils and other public agencies in this State exist to aid in the conduct of the people’s business. It is the intent of the law that their actions be taken openly and that their deliberations be conducted openly.

The people of this State do not yield their sovereignty to the agencies which serve them. The people, in delegating authority, do not give their public servants the right to decide what is good for the people to know and what is not good for them to know. The people insist on remaining informed so that they may retain control over the instruments they have created.^[4]

The Brown Act generally requires that meetings of the legislative body of a local agency be open and accessible to the public, and requires local agencies to provide notice of the meeting, its agenda, and its location in advance of a meeting to ensure that the people have adequate notice and opportunity to attend. Under the Brown Act, a legislative body is allowed to meet in closed session for various purposes so long as certain requirements are met. One specific authorization relates to meeting with the Governor, Attorney General, district attorney, agency counsel, sheriff, or chief of police, or their respective deputies, or a security consultant or a security operations manager, on matters posing a threat to the security of public buildings, a threat to the security of essential public services, or a threat to the public’s right of access to public services or public facilities.

The Brown Act provides various requirements that must be met when meeting in closed session. The legislative body must briefly describe all closed session items in the posted agenda and describe which exception applies. (§ 54954.2(a) & 54954.5(a).) The legislative body must announce to the public that the body is entering closed session before the closed session begins. (§ 54954.5.) Upon the end of the closed session, the legislative body is required to publicly report any action taken in closed session and the vote or abstention on that action of every member present. (§ 54957.1(a).) They must also provide to any person who has submitted a written request to the legislative body within 24 hours of the posting of the agenda, or to any person who has made a standing request for all documentation as part of a request for notice of meetings, if the requester is present at the time the closed session ends, copies of any contracts, settlement agreements, or other documents that were finally approved or adopted in the closed session. (Id. at (b).) This documentation must be available to any person on the next business day following the meeting or, in the case of substantial amendments, when any necessary retyping is complete. (Id. at (c).)

This bill is sponsored by the City of Carlsbad. The city argues that this “bill is necessary because, although current law allows for the discussion of a pending specific threat during closed session, it does not expressly permit nonspecific cybersecurity matters to be discussed.” The City of Carlsbad states that this will allow local public agencies “to be more informed about potential threats and the extent of agency vulnerabilities.” Cyber security threats have become an ever present problem for public and private entities alike. In 2023, the San Bernardino Sheriff’s Office was attacked with ransomware, and to regain control of its computer system, the Sheriff’s office paid a $1.1 million ransom in cryptocurrency. ^[5] In 2020, the University of California paid $1 million in ransom following a cyber attack.^[6]

The Legislature enacted AB 1841 (Irwin, Ch. 508, Stats 2016) in 2016 to require the California Department of Technology, in combination with the Office of Emergency Services, to update the Technology Recovery Plan, which is activated immediately after a disaster strikes and focuses on getting critical systems back online. The plan includes cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and information. AB 1841 defined the terms “critical infrastructure controls” and “critical infrastructure information.” This bill uses the same definition for those terms.

1. Statements in support

The League of California Cities writes in support, stating:

In an age of continuously evolving technology and growing cyber security threats, it is important that state law is abundantly clear that local governments can discuss general cybersecurity risks, vulnerabilities, and threats facing the agency with the appropriate personnel in closed session. As targets of cybercrime, local governments are especially at risk of threatened interference to both economic security and overall public safety. A digital attack to a local government’s network could compromise operational functions that local agencies are responsible for providing, including emergency response services that are essential to keeping individuals and our communities safe.

Local officials must be able to be informed about potential threats and agency vulnerabilities in a secure manner in line with existing open meeting laws. For these reasons, Cal Cities supports AB 2715. Section 54954.2 of the Government Code requires a public local agency to describe all closed session items in the posted agenda and describe which exception applies.

1. Statements in opposition

The First Amendment Coalition and Oakland Privacy write in opposition unless amended, stating:

We appreciate proponents’ stated goal of achieving greater clarity in the Brown Act’s closed-session provisions related to cybersecurity threats. We do not dispute that legislative bodies may need to meet in closed session with law enforcement or security personnel to discuss specific threats to critical infrastructure controls or an agency’s vulnerabilities when a cybersecurity attack is not imminent. But this need for confidentiality must be balanced with the public’s right to be informed about official decision-making, including on the subject of whether public agencies are adequately prepared for and competently addressing cybersecurity threats.

Specifically, we seek 1) language to confirm that final decisions that could properly be made in closed session will be reported out in public session, and that decisions requiring a discussion and vote in open session, such as adding additional budget or staff or awarding a contract to an outside vendor or consultant will in fact be made in open session, consistent with existing Brown Act protections; 2) language requiring the identities and titles of all security or other personnel who attend the closed session to be named on the agenda; and 3) a requirement that agencies cite in the agenda the specific provision of Government Code Section 54957 that is the basis for the closed session, which requires amending Section 54954.5’s agenda requirements. Finally, to aid the public in its understanding of the intent of the bill and to guide the courts in the event there is a dispute over whether a given closed session was proper, we urge you to include a statement of intent consistent with the narrow purpose of this bill.

Existing law seems to address some of the concerns raised by the opposition. Section 54954.2 of the Government Code requires an agenda to describe all closed session items in the posted agenda and describe which exception applies. Additionally, Section 54954.5 provides that its provisions apply to the requirement in Section 54954.2 and requires the name of the law enforcement agency and title of any officer or representative be included. The opposition would like this section expanded to require the name and title of all individuals in the closed session, including those of security consultants or security operations managers.

The Brown Act currently requires an action taken in closed session and the vote or abstention on that action of every member present to be publically reported and requires reports to be provided to those who request them on specified matters, including, among others:

• • • • • approval given to its legal counsel to defend, or seek or refrain from seeking appellate review or relief, or to enter as an amicus curiae in any form of litigation;
        • approval given to its legal counsel of a settlement of pending litigation
        • action taken to appoint, employ, dismiss, accept the resignation of, or otherwise affect the employment status of a public employee in closed session under the provision of the bill;

The opposition wants information on actions taken pursuant to the bill’s provisions to be reported out, and clarification that that decisions related to budget, staff, or awarding a contract to an outside vendor or consultant will in fact be made in open session.

SUPPORT

Association of California School Administrators

California Association of Recreation & Park Districts

California IT in Education

City Clerks Association of California

City of Carlsbad

City of Eastvale

City of Rancho Cucamonga

City of Rancho Palos Verdes

City of Redwood City

City of Thousands Oaks

League of California Cities

Small School Districts Association

OPPOSITION

First Amendment Coalition
Oakland Privacy

RELATED LEGISLATION

Pending Legislation: AB 1852 (Pacheco, 2024) extends the sunset on the authority of the Clean Power Alliance of Southern California to adopt a policy authorizing the legislative body of a local agency that is a member of the Clean Power Alliance to designate an alternate member to represent the local agency, even if that alternate member is not a member of the local legislative body, until January 1, 2030. AB 1852 is currently pending on the Senate Floor.

Prior Legislation: AB 1841 (Irwin, Ch. 508, Stats 2016), see Comment 2, above.

PRIOR VOTES

Senate Local Government Committee (Ayes 7, Noes 0)

Assembly Floor (Ayes 69, Noes 0)

Assembly Local Government Committee (Ayes 8, Noes 0)

**************

1. All further references are to the Government Code unless specified otherwise. ↑

2. Cal. Const., art. I, § 3(a) & (b)(1). ↑

3. Ed. Code, tit. 3, div. 8, pt. 55, ch. 3, art. 1.5, §§ 89305 et seq.; Gov Code, tit. 2, div. 3, art. 9, §§ 11120 et seq., & tit. 5, div. 2, pt. 1, ch. 9, §§ 54950 et seq. ↑

4. Id., § 54950. ↑

5. Brian Rokos, San Bernardino County paid $1.1 million ransom to hacker of Sheriff’s Department computers, The Sun, (May 5, 2023), available at https://www.sbsun.com/2023/05/04/san-bernardino-county-paid-1-1-million-ransom-to-hacker-of-sheriffs-department-computers/. ↑

6. Davey Winder, The University of California Pays $1 Million in Ransom Following a Cyber Attack, Forbes, Jun. 29, 2020, available at https://www.forbes.com/sites/daveywinder/2020/06/29/the-university-of-california-pays-1-million-ransom-following-cyber-attack/. ↑

SENATE COMMITTEE ON LOCAL GOVERNMENT

Senator María Elena Durazo, Chair

2023 - 2024 Regular

Ralph M. Brown Act: closed sessions

Allows a legislative body to discuss a threat to critical infrastructure controls or critical infrastructure information relating to cybersecurity during a closed session.

Background

Public access. Article I, Section Three of the California Constitution guarantees “the people have the right to instruct their representatives, petition government for redress of grievances, and assemble freely to consult for the common good.” This includes a right to access information concerning the meetings and writings of public officials. To ensure the right to openly scrutinize public agencies is maintained, the Constitution requires local agencies to comply with certain state laws that outline the basic requirements for public access to meetings and public records. If a subsequent bill modifies these laws, it must include findings demonstrating how it furthers the public’s access to local agencies and their officials.

Brown Act. The Ralph M. Brown Act provides guidelines for how local agencies must hold public meetings. Among other provisions, the Act requires meetings of the legislative body of a local agency be open and public. The Legislature originally enacted the Brown Act in 1953 and has since amended it numerous times. The Legislature expressly declared the intent of the Brown Act in its original statute, which remains unchanged today:

The Legislature finds and declares that the public commissions, boards and councils and other public agencies in this State exist to aid in the conduct of the people’s business. It is the intent of the law that their actions be taken openly and that their deliberations be conducted openly. The people of this State do not yield their sovereignty to the agencies which serve them. The people, in delegating authority, do not give their public servants the right to decide what is good for the people to know and what is not good for them to know. The people insist on remaining informed so that they may retain control over the instruments they have created.

The Brown Act generally requires local agencies to notice meetings in advance, including the posting of an agenda, and requires these meetings to be open and accessible to the public. The Brown Act defines a “meeting” as “any congregation of a majority of the member of a legislative body at the same time and location, including teleconference locations, to hear, discuss, deliberate, or take action on any item that is within the subject matter jurisdiction of the legislative body.” The Brown Act only allows local agencies to take actions, meaning a majority vote of the legislative body unless otherwise specified, on items that appear on the posted agenda.

If a member of the public, including the respective district attorney, believes a local agency violated the Brown Act, it must first send an order to the local agency to correct the violation. If the local agency disagrees with the complaint and does not correct it, the submitter can pursue the complaint through the courts. If the court agrees with the complaint, outcomes range from invalidating certain actions of the local agency to a misdemeanor criminal conviction.

Closed session. The Brown Act prohibits private discussions among a majority of a legislative body unless that discussion is to:

• Discuss and determine whether an applicant for a license who has a criminal record is sufficiently rehabilitated to obtain the license;
• Discuss how to respond to an audit report from the State Auditor;
• Discuss the purchase, sale, exchange, or lease of real property;
• Consider the purchase or sale of particular pension fund investments;
• Hear a complaint from member enrolled in its health plan if they do not want their medical information disclosed;
• Negotiate contracts with health care providers;
• Confer with, or receive advice from, its legal counsel regarding pending litigation;
• Discuss a claim for the payment of liabilities;
• Evaluate a public employee or hear complaints brought against the employee by another person or employee unless the employee requests a public session; and
• Discuss matters posing a threat to the security of public buildings, a threat to the security of essential public services, including water, drinking water, wastewater treatment, natural gas service, and electric service, or a threat to the public's right of access to public services or public facilities. These discussions can include the Governor, Attorney General, district attorney, agency counsel, sheriff, or chief of police, or their respective deputies, or a security consultant or a security operations manager.

The legislative body must briefly describe all closed session items in the posted agenda and describe which exception applies. The legislative body must make an announcement to the public that the body is entering closed session before the session begins. After closed session, the legislative body must provide an oral or written report on actions taken and the vote of each member of the legislative body. They must also provide to any person who has submitted a written request to the legislative body within 24 hours of the posting of the agenda, or to any person who has made a standing request for all documentation as part of a request for notice of meetings, if the requester is present at the time the closed session ends, copies of any contracts, settlement agreements, or other documents that were finally approved or adopted in the closed session. This documentation must be available to any person on the next business day following the meeting or, in the case of substantial amendments, when any necessary retyping is complete.

If a legislative body does not follow these requirements, a court could decide it violated the Brown Act, and invalidate the action taken during closed session.

Cybersecurity threats. Public agencies in California face a variety of cybersecurity threats. For example, in 2023, the San Bernardino Sheriff’s Office was attacked with ransomware, where an intruder pretended to be a trusted individual to “phish” for information. In this case, the intruder impersonated a contractor that was working the County. To regain control of its computer system, the Sheriff’s office paid a $1.1 million ransom in cryptocurrency. It has also had to spend nearly $1 million to upgrade its computer systems to avoid similar problems in the future.

In 2016, the Legislature enacted AB 1841 (Irwin), which required the California Department of Technology, in conjunction with the Office of Emergency Services, to update its Technology Recovery Plan. The plan is activated immediately after a disaster strikes and focuses on getting critical systems back online. It also includes cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and information. The goal of this effort was to help state and local agencies become more resilient to cyber attacks. The measure defined “critical infrastructure controls” to mean networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof. It defined “critical infrastructure information” to mean information not customarily in the public domain pertaining to any of the following:

• Actual, potential, or threatened interference with, or an attack on, compromise of, or incapacitation of critical infrastructure controls by either physical or computer-based attack or other similar conduct, including, the misuse of, or unauthorized access to, all types of communications and data transmission systems, that violates federal, state, or local law or harms public health, safety, or economic security;
• The ability of critical infrastructure controls to resist any interference, compromise, or incapacitation, including, but not limited to, any planned or past assessment or estimate of the vulnerability of critical infrastructure; and
• Any planned or past operational problem or solution regarding critical infrastructure controls, including, but not limited to, repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to interference, compromise, or incapacitation of critical infrastructure controls.

While the Brown Act also local agencies to hold closed session meetings to discuss matters posing a threat to the security of public buildings or the security of essential public services, the City of Carlsbad does not believe this clearly includes cybersecurity threats. So, it wants to expand the public security exception to include cybersecurity threats.

Proposed Law

Assembly Bill 2715 expands the exemption allowing a legislative body to discuss public security issues during a closed session meeting to include discussing a threat to critical infrastructure controls or critical infrastructure information relating to cybersecurity.

AB 2715 also expands the list of officials legislative bodies can discuss these threats with to include other law enforcement or security personnel.

The measure also includes findings and declarations to further its intent.

Comments

1. Purpose of the bill. According to the author, “Currently, the Brown Act allows local bodies to meet in a closed session for threats to the security of public buildings, the security of essential public services, or the public’s right of access to public services or public facilities. In the digital age, we must ensure that sensitive information is protected and not leaked. AB 2715 is critical to ensuring local agencies can properly protect themselves and their citizens from cyberattacks.”

2. Public access. AB 2715 includes a finding that its provisions impose a limitation on the public’s constitutional right of access to public meetings. In such a case, the Constitution requires the legislation to demonstrate the interest this limitation protects and the need for protecting that interest. AB 2715’s findings and declarations state:

By authorizing closed sessions of legislative bodies relating to cybersecurity, this bill allows a legislative body to receive, confidentially discuss, and learn about cybersecurity risks, vulnerabilities, and threats facing the agency, thereby enabling the legislative body to make fully informed cybersecurity-related decisions in open session. The bill protects information and deliberations related to an agency’s cybersecurity in order to protect against current or future cybersecurity attacks on the agency that can damage public facilities and services.

In other words, AB 2715 argues the purported benefits of allowing local agencies to discuss cybersecurity threats confidentially outweigh the loss of additional public scrutiny that discussing these threats in an open meeting provides. The Brown Act already requires the legislative body to describe which exception applies, make an announcement to the public, and provide a report on actions taken and the vote of each member. Opponents of the bill, the First Amendment Coalition and Oakland Privacy, argue the bill does not adequately ensure public access, does not clearly identify which actions can be taken in a closed session meeting on cybersecurity, and suggest disclosing additional information to the public when a local agency meets to discuss cybersecurity threats. However, the Brown Act already requires local agencies to disclose the actions taken in closed session. Specific to closed session to discuss security of public facilities and services, they must also disclose information on the law enforcement officials with whom they discussed the threat. Does AB 2715 adequately balance public access with the ability for local agencies to keep cybersecurity threats confidential?

3. Parade isn’t over. The Legislature is considering numerous proposals to amend the Brown Act:

• AB 817 (Pacheco) allows subsidiary bodies of a local agency to teleconference meetings without having to notice and make publicly accessible each teleconference location, or have at least a quorum participate from locations within the boundaries of the agency. The measure is also scheduled for the Committee’s June 5^th meeting.
• AB 1852 (Pacheco), which the Committee approved on a 7-0 vote at its May 29^th meeting, extends until January 1, 2030, the existing sunset date on provisions of law authorizing the Clean Power Alliance of Southern California to allow specified alternate members of its legislative body to attend closed sessions of the agency.
• AB 1855 (Arambula), which the Committee approved on a 5-2 vote at its May 29^th meeting, allows community college student body associations to teleconference meetings without having to notice and make publicly accessible each teleconference location.
• AB 2302 (Addis) recasts existing limits on the number of times members of a legislative body can participate remotely in meetings for just cause or emergency circumstances. The measure is also scheduled for the Committee’s June 5^th meeting.
• AB 2350 (Hoover) allows notifications for emergency meetings required by the Brown Act to be sent via email, instead of given by telephone, for an emergency meeting held by a school board. The measure is also scheduled for the Committee’s June 5^th meeting.
• AB 2748 (Flora) , which the Committee approved on a 7-0 vote at its May 29^th meeting, allows the Board of Directors of the Tri-Dam Project to hold no more than four regular meetings annually at a Tri-Dam Project office that is located in Sonora, California, or Strawberry, California, or within 30 miles of either city.

4. Coming and going. The Senate Rules Committee has ordered a double referral of AB 2715: first to the Senate Local Government Committee to hear issues related to local government, and second to the Senate Judiciary Committee.

Assembly Actions

Assembly Local Government Committee: 8-0
Assembly Floor: 69-0

Support and Opposition

(5/31/24)

Support: City of Carlsbad (Sponsor)
Association of California School Administrators
California Association of Recreation & Park Districts
California It in Education
City Clerks Association of California
City of Eastvale
City of Rancho Cucamonga
City of Rancho Palos Verdes
City of Redwood City
League of California Cities
Small School Districts Association

Opposition: First Amendment Coalition
Oakland Privacy

-- END --

ASSEMBLY THIRD READING

ATR Bill Id:AB 2715

Author:(Boerner)

As Amended Ver:April 24, 2024

Majority vote

SUMMARY

Allows the legislative body of a local agency to hold closed sessions pursuant to the Ralph M. Brown Act (Brown Act) on matters pertaining to a threat to cybersecurity.

Major Provisions

Adds "other law enforcement or security personnel" to the list of persons with whom a legislative body of a local agency may hold closed sessions on matters pertaining to specified threats, and adds "a threat to critical infrastructure controls or critical infrastructure information relating to cybersecurity" to those matters.

Provides the following definitions:

1. "Critical infrastructure controls" means networks and systems controlling assets so vital to the local agency that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof.
2. "Critical infrastructure information" means information not customarily in the public domain pertaining to any of the following:
   1. Actual, potential, or threatened interference with, or an attack on, compromise of, or incapacitation of critical infrastructure controls by either physical or computer-based attack or other similar conduct, including, but not limited to, the misuse of, or unauthorized access to, all types of communications and data transmission systems, that violates federal, state, or local law or harms public health, safety, or economic security, or any combination thereof.
   2. The ability of critical infrastructure controls to resist any interference, compromise, or incapacitation, including, but not limited to, any planned or past assessment or estimate of the vulnerability of critical infrastructure.
   3. Any planned or past operational problem or solution regarding critical infrastructure controls, including, but not limited to, repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to interference, compromise, or incapacitation of critical infrastructure controls.

COMMENTS

Background. The Brown Act was enacted in 1953 and has been amended numerous times since then. The legislative intent of the Brown Act was expressly declared in its original statute, which remains unchanged:

"The Legislature finds and declares that the public commissions, boards and councils and other public agencies in this State exist to aid in the conduct of the people's business. It is the intent of the law that their actions be taken openly and that their deliberations be conducted openly. The people of this State do not yield their sovereignty to the agencies which serve them. The people, in delegating authority, do not give their public servants the right to decide what is good for the people to know and what is not good for them to know. The people insist on remaining informed so that they may retain control over the instruments they have created."

The Brown Act generally requires meetings to be noticed in advance, including the posting of an agenda, and generally requires meetings to be open and accessible to the public. The Brown Act also generally requires members of the public to have an opportunity to comment on agenda items, and generally prohibits deliberation or action on items not listed on the agenda.

The Brown Act defines a "meeting" as "any congregation of a majority of the member of a legislative body at the same time and location, including teleconference locations, to hear, discuss, deliberate, or take action on any item that is within the subject matter jurisdiction of the legislative body."

Closed Sessions and the Brown Act. Pursuant to the Brown Act, private discussions among a majority of a legislative body are prohibited, unless expressly authorized. Closed session items must be briefly described on the posted agenda and the description must identify the specific statutory exemption. The agenda must reference the authority for holding the closed session, and the body must make a public announcement before the closed session begins. After a closed session, the legislative body must provide an oral or written report on certain actions taken and the vote of every elected member present.

Legislative bodies are authorized to meet in closed sessions only for specified reasons, such as litigation, real estate negotiations, personnel issues, labor negotiations, certain disciplinary matters related to schools, grand jury testimony, license applicants with criminal histories, multi-jurisdictional drug cases, hospital peer reviews and related trade secrets, and threats to public security.

The "public security" exemption permits the legislative body to hold closed sessions with "the Governor, Attorney General, district attorney, agency counsel, sheriff, or chief of police, or their respective deputies, or a security consultant or a security operations manager, on matters posing a threat to the security of public buildings, a threat to the security of essential public services, including water, drinking water, wastewater treatment, natural gas service, and electric service, or a threat to the public's right of access to public services or public facilities."

According to the Author

Currently, the Brown Act allows local bodies to meet in a closed session for threats to the security of public buildings, the security of essential public services, or the public's right of access to public services or public facilities. In the digital age, we must ensure that sensitive information is protected and not leaked. AB 2715 is critical to ensuring local agencies can properly protect themselves and their citizens from cyberattacks.

Arguments in Support

The City of Carlsbad, sponsor of this bill, writes, "This bill is necessary because although current law allows for the discussion of a pending specific threat during closed session, it does not expressly permit nonspecific cybersecurity matters to be discussed. Legislative bodies of local agencies therefore currently have no method of confidentially discussing general cybersecurity risks, vulnerabilities, and threats facing the agency. AB 2715 would allow for a legislative body to be more informed about potential threats and the extent of agency vulnerabilities.

"AB 2715 adds cybersecurity to the list of closed session exemptions so that the law is clear on allowing such discussions to occur, which will enable legislative bodies of local agencies to make fully informed decisions related to cybersecurity. The bill preserves local agency transparency and the intent of the Brown Act by providing that any action taken on cybersecurity matters be done in open session.

"The City's legislative platform supports this proposal and includes the following statement: Support legislation that would allow cities to conduct closed sessions on matters posing a threat to cybersecurity. It is for the reasons listed above that the City of Carlsbad is pleased to SPONSOR your AB 2715 to allow cybersecurity matters to be discussed during closed session."

Arguments in Opposition

The First Amendment Coalition and Oakland Privacy, with an "oppose, unless amended" position, write, "We appreciate proponents' stated goal of achieving greater clarity in the Brown Act's closed-session provisions related to cybersecurity threats. We do not dispute that legislative bodies may need to meet in closed session with law enforcement or security personnel to discuss specific threats to critical infrastructure controls or an agency's vulnerabilities when a cybersecurity attack is not imminent. But this need for confidentiality must be balanced with the public's right to be informed about official decision-making, including on the subject of whether public agencies are adequately prepared for and competently addressing cybersecurity threats.

"Specifically, we seek language to confirm that final decisions that could properly be made in closed session will be reported out in public session, and that decisions requiring a discussion and vote in open session, such as adding additional budget or staff or awarding a contract to an outside vendor or consultant will in fact be made in open session, consistent with existing Brown Act protections.

"Additionally, the identities and titles of all security or other personnel who attend the closed session must be named on the agenda, and the agenda must cite to the specific provision of Government Code Section 54957 that is the basis for the closed session, which requires amending Section 54954.5's agenda requirements. Finally, to aid the public in its understanding of the intent of the bill and to guide the courts in the event there is a dispute over whether a given closed session was proper, we urge you to include a statement of intent consistent with the narrow purpose of this bill."

FISCAL COMMENTS

None.

VOTES

ASM LOCAL GOVERNMENT: 8-0-1

YES: Juan Carrillo, Waldron, Haney, Kalra, Pacheco, Ramos, Ward, Wilson

ABS, ABST OR NV: Essayli

UPDATED

VERSION: April 24, 2024

CONSULTANT: Angela Mapp / L. GOV. / (916) 319-3958 FN: 0002846

Date of Hearing: May 1, 2024

ASSEMBLY COMMITTEE ON LOCAL GOVERNMENT

Juan Carrillo, Chair

ABPCA Bill Id:AB 2715 (

Author:Boerner) – As Amended Ver:April 24, 2024

SUBJECT: Ralph M. Brown Act: closed sessions.

SUMMARY: Allows the legislative body of a local agency to hold closed sessions pursuant to the Ralph M. Brown Act (Brown Act) on matters pertaining to a threat to cybersecurity. Specifically, this bill:

1. Adds “other law enforcement or security personnel” to the list of persons with whom a legislative body of a local agency may hold closed sessions on matters pertaining to specified threats, and adds “a threat to critical infrastructure controls or critical infrastructure information relating to cybersecurity” to those matters.
2. Provides the following definitions:
   1. “Critical infrastructure controls” means networks and systems controlling assets so vital to the local agency that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof.
   2. “Critical infrastructure information” means information not customarily in the public domain pertaining to any of the following:
      1. Actual, potential, or threatened interference with, or an attack on, compromise of, or incapacitation of critical infrastructure controls by either physical or computer-based attack or other similar conduct, including, but not limited to, the misuse of, or unauthorized access to, all types of communications and data transmission systems, that violates federal, state, or local law or harms public health, safety, or economic security, or any combination thereof.
      2. The ability of critical infrastructure controls to resist any interference, compromise, or incapacitation, including, but not limited to, any planned or past assessment or estimate of the vulnerability of critical infrastructure.
      3. Any planned or past operational problem or solution regarding critical infrastructure controls, including, but not limited to, repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to interference, compromise, or incapacitation of critical infrastructure controls.
3. Finds and declares that Section 1 of this bill imposes a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:

By authorizing closed sessions of legislative bodies relating to cybersecurity, this bill allows a legislative body to receive, confidentially discuss, and learn about cybersecurity risks, vulnerabilities, and threats facing the agency, thereby enabling the legislative body to make fully informed cybersecurity-related decisions in open session. The bill protects information and deliberations related to an agency’s cybersecurity in order to protect against current or future cybersecurity attacks on the agency that can damage public facilities and services.

1. Finds and declares that Section 1 of this bill furthers, within the meaning of paragraph (7) of subdivision (b) of Section 3 of Article I of the California Constitution, the purposes of that constitutional section as it relates to the right of public access to the meetings of local public bodies or the writings of local public officials and local agencies. Pursuant to paragraph (7) of subdivision (b) of Section 3 of Article I of the California Constitution, the Legislature makes the following findings:

By authorizing closed sessions of legislative bodies relating to cybersecurity, this bill allows a legislative body to receive, confidentially discuss, and learn about cybersecurity risks, vulnerabilities, and threats facing the agency, thereby enabling the legislative body to make fully informed cybersecurity-related decisions in open session. The bill protects information and deliberations related to an agency’s cybersecurity in order to protect against current or future cybersecurity attacks on the agency that can damage public facilities and services.

EXISTING LAW:

1. Provides, pursuant to Article I, Section 3 of the California Constitution, the following:
   1. The people have the right to instruct their representatives, petition government for redress of grievances, and assemble freely to consult for the common good.
   2. The people have the right of access to information concerning the conduct of the people’s business, and, therefore, the meetings of public bodies and the writings of public officials and agencies shall be open to public scrutiny.
   3. In order to ensure public access to the meetings of public bodies and the writings of public officials and agencies, as specified in b), above, each local agency is required to comply with the California Public Records Act, the Brown Act, and with any subsequent statutory enactment amending either act, enacting a successor act, or amending any successor act that contains findings demonstrating that the statutory enactment furthers the purposes of these constitutional provisions.
2. Provides, pursuant to the Brown Act, requirements for local agency meetings. [Government Code (GOV) §§ 54950 – 54963]
3. Requires, under the Brown Act, each legislative body of a local agency to provide the time and place for holding regular meetings and requires that all meetings of a legislative body be open and public and all persons be permitted to attend unless a closed session is authorized. (GOV § 54953 and GOV § 54954)
4. Defines, for purposes of the Brown Act, a meeting to mean any congregation of a majority of the members of a legislative body at the same time and location, including teleconference, to hear, discuss, deliberate, or take action on any item that is within the subject matter jurisdiction of the legislative body. (GOV § 54952.2)
5. Requires, at least 72 hours before a regular meeting, the legislative body of the local agency, or its designee, to post an agenda containing a brief general description of each item of business to be transacted or discussed at the meeting, including items to be discussed in closed session. (GOV § 54954.2 and GOV § 54954.50)
6. Authorizes a legislative body of a local agency to meet in closed session for a number of specified matters including litigation, real estate negotiations, personnel issues, labor negotiations, certain disciplinary matters related to schools, grand jury testimony, multi-jurisdictional drug cases, hospital peer reviews and related trade secrets. (GOV §§ 54956.5 – 54956.98, GOV § 4957.6, GOV § 54957.8, and GOV § 54957.10)
7. Authorizes the legislative body to hold closed sessions with the Governor, Attorney General, district attorney, agency counsel, sheriff, or chief of police, or their respective deputies, or a security consultant or a security operations manager, on matters posing a threat to the security of public buildings, a threat to the security of essential public services, including water, drinking water, wastewater treatment, natural gas service, and electric service, or a threat to the public's right of access to public services or public facilities. (GOV §54957)
8. Requires the legislative body of any local agency to publicly report any action taken in closed session and the vote or abstention on that action of every member present, orally or in writing. (GOV § 54957.1)
9. Requires the legislative body to provide to any person who has submitted a written request to the legislative body within 24 hours of the posting of the agenda, or to any person who has made a standing request for all documentation as part of a request for notice of meetings, if the requester is present at the time the closed session ends, copies of any contracts, settlement agreements, or other documents that were finally approved or adopted in the closed session, as specified. This documentation shall be available to any person on the next business day following the meeting or, in the case of substantial amendments, when any necessary retyping is complete. (GOV § 54957.1)
10. Requires, prior to holding any closed session, the legislative body of a local agency to disclose, in an open meeting, the item or items to be discussed in the closed session and requires the legislative body to consider only those matters covered in its statement, as specified. (GOV § 54957.7)
11. Requires, after any closed session, the legislative body to reconvene into open session prior to adjournment and make any disclosures required by 8) and 9), above, of action taken in the closed session, as specified. (GOV § 54957.7)
12. 54960. Allows a court to order a legislative body to audio record its closed sessions, as specified. (GOV § 54960)

FISCAL EFFECT: None

COMMENTS:

1. Bill Summary. This bill allows the legislative body of a local agency to hold closed sessions on matters pertaining to a threat to critical infrastructure controls or critical infrastructure information relating to cybersecurity.

“Critical infrastructure controls” means networks and systems controlling assets so vital to the local agency that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof.

“Critical infrastructure information” means information not customarily in the public domain pertaining to any of the following:

• 1. Actual, potential, or threatened interference with, or an attack on, compromise of, or incapacitation of critical infrastructure controls by either physical or computer-based attack or other similar conduct, including, but not limited to, the misuse of, or unauthorized access to, all types of communications and data transmission systems, that violates federal, state, or local law or harms public health, safety, or economic security, or any combination thereof.
  2. The ability of critical infrastructure controls to resist any interference, compromise, or incapacitation, including, but not limited to, any planned or past assessment or estimate of the vulnerability of critical infrastructure.
  3. Any planned or past operational problem or solution regarding critical infrastructure controls, including, but not limited to, repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to interference, compromise, or incapacitation of critical infrastructure controls.

This bill is sponsored by the City of Carlsbad.

1. Author’s Statement. According to the author, “Currently, the Brown Act allows local bodies to meet in a closed session for threats to the security of public buildings, the security of essential public services, or the public’s right of access to public services or public facilities. In the digital age, we must ensure that sensitive information is protected and not leaked. AB 2715 is critical to ensuring local agencies can properly protect themselves and their citizens from cyberattacks.”
2. Background. The Brown Act was enacted in 1953 and has been amended numerous times since then. The legislative intent of the Brown Act was expressly declared in its original statute, which remains unchanged:

“The Legislature finds and declares that the public commissions, boards and councils and other public agencies in this State exist to aid in the conduct of the people’s business. It is the intent of the law that their actions be taken openly and that their deliberations be conducted openly. The people of this State do not yield their sovereignty to the agencies which serve them. The people, in delegating authority, do not give their public servants the right to decide what is good for the people to know and what is not good for them to know. The people insist on remaining informed so that they may retain control over the instruments they have created.”

The Brown Act generally requires meetings to be noticed in advance, including the posting of an agenda, and generally requires meetings to be open and accessible to the public. The Brown Act also generally requires members of the public to have an opportunity to comment on agenda items, and generally prohibits deliberation or action on items not listed on the agenda.

The Brown Act defines a “meeting” as “any congregation of a majority of the member of a legislative body at the same time and location, including teleconference locations, to hear, discuss, deliberate, or take action on any item that is within the subject matter jurisdiction of the legislative body.”

1. Closed Sessions and the Brown Act. Pursuant to the Brown Act, private discussions among a majority of a legislative body are prohibited, unless expressly authorized. Closed session items must be briefly described on the posted agenda and the description must identify the specific statutory exemption. The agenda must reference the authority for holding the closed session, and the body must make a public announcement before the closed session begins. After a closed session, the legislative body must provide an oral or written report on certain actions taken and the vote of every elected member present.

Legislative bodies are authorized to meet in closed sessions only for specified reasons, such as litigation, real estate negotiations, personnel issues, labor negotiations, certain disciplinary matters related to schools, grand jury testimony, license applicants with criminal histories, multi-jurisdictional drug cases, hospital peer reviews and related trade secrets, and threats to public security.

The “public security” exemption permits the legislative body to hold closed sessions with “the Governor, Attorney General, district attorney, agency counsel, sheriff, or chief of police, or their respective deputies, or a security consultant or a security operations manager, on matters posing a threat to the security of public buildings, a threat to the security of essential public services, including water, drinking water, wastewater treatment, natural gas service, and electric service, or a threat to the public's right of access to public services or public facilities.”

1. Related Legislation. AB 817 (Pacheco) allows, until January 1, 2026, a subsidiary body of a local agency to use teleconferencing for its meetings without posting agendas at each teleconference location, identifying each teleconference location in the notice and agenda, making each teleconference location accessible to the public, and requiring at least a quorum of the subsidiary body to participate from within the local agency’s jurisdiction, subject to certain conditions. AB 817 is pending in the Senate.

AB 1855 (Arambula) allows, until January 1, 2026, a community college student body association to teleconference without meeting all of the teleconferencing requirements of the Brown Act. AB 1855 is pending in the Senate.

AB 2302 (Addis) revises the limits on the number of teleconference meetings specified in AB 2449 that any member of a legislative body can participate within a given period of time. AB 2302 is pending on the Assembly Floor.

AB 2350 (Hoover) allows notifications for emergency meetings required by Brown Act to be sent via email, instead of given by telephone, for an emergency meeting held by a school board. AB 2350 is pending in the Assembly Appropriations Committee.

1. Previous Legislation. AB 246 (Bradford), Chapter 11, Statutes of 2013, included the Governor in the list of individuals and agencies with which a local agency’s legislative body may meet in closed session pursuant to the ‘public security’ exemption of the state’s open meetings law.

AB 1736 (Smyth) of 2012 was substantially similar to AB 246. AB 1736 failed passage on the Senate Floor.

1. Arguments in Support. The City of Carlsbad, sponsor of this bill, writes, “This bill is necessary because although current law allows for the discussion of a pending specific threat during closed session, it does not expressly permit nonspecific cybersecurity matters to be discussed. Legislative bodies of local agencies therefore currently have no method of confidentially discussing general cybersecurity risks, vulnerabilities, and threats facing the agency. AB 2715 would allow for a legislative body to be more informed about potential threats and the extent of agency vulnerabilities.

“AB 2715 adds cybersecurity to the list of closed session exemptions so that the law is clear on allowing such discussions to occur, which will enable legislative bodies of local agencies to make fully informed decisions related to cybersecurity. The bill preserves local agency transparency and the intent of the Brown Act by providing that any action taken on cybersecurity matters be done in open session.

“The City’s legislative platform supports this proposal and includes the following statement: Support legislation that would allow cities to conduct closed sessions on matters posing a threat to cybersecurity. It is for the reasons listed above that the City of Carlsbad is pleased to SPONSOR your Assembly Bill 2715 to allow cybersecurity matters to be discussed during closed session.”

1. Arguments in Opposition. The First Amendment Coalition and Oakland Privacy write, “We appreciate proponents’ stated goal of achieving greater clarity in the Brown Act’s closed-session provisions related to cybersecurity threats. We do not dispute that legislative bodies may need to meet in closed session with law enforcement or security personnel to discuss specific threats to critical infrastructure controls or an agency’s vulnerabilities when a cybersecurity attack is not imminent. But this need for confidentiality must be balanced with the public’s right to be informed about official decision-making, including on the subject of whether public agencies are adequately prepared for and competently addressing cybersecurity threats.

“Specifically, we seek language to confirm that final decisions that could properly be made in closed session will be reported out in public session, and that decisions requiring a discussion and vote in open session, such as adding additional budget or staff or awarding a contract to an outside vendor or consultant will in fact be made in open session, consistent with existing Brown Act protections.

“Additionally, the identities and titles of all security or other personnel who attend the closed session must be named on the agenda, and the agenda must cite to the specific provision of Government Code Section 54957 that is the basis for the closed session, which requires amending Section 54954.5’s agenda requirements. Finally, to aid the public in its understanding of the intent of the bill and to guide the courts in the event there is a dispute over whether a given closed session was proper, we urge you to include a statement of intent consistent with the narrow purpose of this bill.”

REGISTERED SUPPORT / OPPOSITION:

Support

City of Carlsbad [SPONSOR]

Association of California School Administrators

California Association of Recreation & Park Districts

California State Association of Counties (CSAC)

City Clerks Association of California

City of Eastvale

City of Rancho Cucamonga

City of Redwood City

Rural County Representatives of California (RCRC)

San Diego County Water Authority

Torrance Unified School District

Urban Counties of California (UCC)

Ventura County Employees' Retirement Association

Opposition

First Amendment Coalition

Oakland Privacy

Analysis Prepared by: Angela Mapp / L. GOV. / (916) 319-3958