Existing law authorizes the legislative body of a city for incorporated areas, or county for unincorporated areas, to enact an ordinance that provides for the licensing for regulation of the business of massage when carried on within the city or county.

This bill would make nonsubstantive changes to those provisions.

SENATE COMMITTEE ON

Senator Anthony Portantino, Chair

2023 - 2024 Regular Session

SB 591 (Min) - California Cybersecurity Integration Center: consumer protection: credit reporting

Bill Summary:

SB 591 requires the California Cybersecurity Integration Center (Cal-CSIC) to submit a report to the Legislature on the feasibility, potential benefits and risks, and costs of requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud, as specified, by December 21, 2025.

Fiscal Impact:

The Office of Emergency Services (OES) estimates total costs of $3,492,000 (General Fund). This estimate includes:

• One-time contract cost of $1,400,000.
• Annual cost $1,046,000 for four limited term positions over a 24 month period.

Background:

The Cal-CSIC was created in 2015 by executive order and gained full statutory authority in 2018. Cal-CSIC’s mission is to reduce the number of cyber threats and attacks in California, with a focus on responding to cyber threats and attacks that could damage the economy, its critical infrastructure, or computer networks in the state. Generally, Cal-CSIC is the hub of state government’s cybersecurity events. Cal-CSIC coordinates information sharing at all levels of government agencies, utilities and other service providers, academic institutions, and nongovernmental organizations.

Cal-CSIC's information sharing practices aim to protect individual privacy, civil liberties, and business confidentiality. Cal-CSIC publishes Cyber Threat Alerts and Advisories will supply cybersecurity threat information between federal, state, local, and Tribal government entities. Advisories and Alerts are shared with private sector partners.

In 2021, the California Department of Technology (CDT) and the Office of Information Security (OIS) introduced Cal-Secure, the California Executive Branch’s first five-year information security maturity roadmap. The roadmap was created through a collaborative process with Cal-CSIC and its four critical partners: OES, the California Highway Patrol (CHP), CDT, and the California Military Department (CMD), and the state government security community. It is built on industry-leading best practices and frameworks, and addresses critical gaps in the state’s information and cybersecurity programs. The roadmap is intended to outline capabilities the State must adopt and achieve in a prioritized fashion. The roadmap's ultimate goal is to ensure that California's Executive branch has a world-class cybersecurity workforce, a well-organized and effective federated cybersecurity oversight governance structure, and robust cybersecurity defenses for all technology, including critical infrastructure.

This bill is nearly identical to last year’s SB 1001 (Min, 2022) which was vetoed by Governor Newsom. The Governor’s veto message for SB 1001 read:

This bill would require the CalCSIC to submit a report to the Legislature on the feasibility of, and potential benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud.

I am supportive of efforts to improve cybersecurity. Through the budget process, we have substantially increased the capacity of the CalCSIC in recent years, and in October last year, my administration published Cal Secure, the State's first ever multi-year cybersecurity roadmap that addresses critical gaps in the state's information and cybersecurity programs while enabling the state to manage existing and future threats more effectively. However, this bill would require millions of dollars not accounted for in the budget for the research and industry expertise needed to complete the feasibility studies.

With our state facing lower-than-expected revenues over the first few months of this fiscal year, it is important to remain disciplined when it comes to spending, particularly spending that is ongoing. We must prioritize existing obligations and priorities, including education, health care, public safety and safety-net programs.

The Legislature sent measures with potential costs of well over $20 billion in one-time spending commitments and more than $10 billion in ongoing commitments not accounted for in the state budget. Bills with significant fiscal impact, such as this measure, should be considered and accounted for as part of the annual budget process.

For these reasons, I cannot sign this bill.

Proposed Law:

• By December 31, 2025, requires the Cal-CSIC to submit a report to the Legislature on the feasibility, potential benefits and risks, and costs of requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud.
  • Requires the report to include, but not be limited to, an assessment utilizing the following tactics:
    • Requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed.
    • Utilization of statewide alternatives to social security numbers as authenticators in determining an individual’s identity.
    • Requiring credit reporting bureaus or lenders to accept alternatives to social security numbers as authenticators in determining an individual’s identity.
• Repeals the above reporting requirements on January 1, 2028.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: SB 591 (Author:Min)

Version: March 22, 2023

Hearing Date: April 18, 2023

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

California Cybersecurity Integration Center: consumer protection: credit reporting

DIGEST

This bill requires the California Cybersecurity Integration Center to issue a report on the feasibility and benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement certain information security measures.

EXECUTIVE SUMMARY

Within the Office of Emergency Services (OES), the California Cybersecurity Integration Center (Cal-CSIC) stands to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks within the state.

In recent years, California has seen a spike in identity theft and other critical threats to the security of personally identifying information. The impact this has on the lives of Californians, and particularly their financial wellbeing, cannot be understated.

This bill requires Cal-CSIC to develop and submit a report analyzing the feasibility and benefits of placing legal requirements on credit reporting bureaus and lenders to adopt new information security measures. The goal is to protect consumers from financial fraud. The report is required to include assessments of specified methods, including the use of multifactor authentication and the acceptance of alternative authenticators to social security numbers. The report deadline is December 31, 2025.

The bill is author sponsored. There is no known support or opposition. This bill passed out of the Senate Governmental Organization Committee on a vote of 15 to 0.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Establishes Cal-CSIC, within the Office of Emergency Services (OES), to reduce the likelihood and severity of cyber incidents that could damage California’s economy, critical infrastructure, or computer networks in the state. (Gov't Code § 8586.5.)
2. Requires Cal-CSIC to serve as the central organizing hub of state government’s cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations. (Gov't Code § 8586.5.)
3. Specifies that any report required or requested by law to be submitted by a state or local agency to the Members of either house of the Legislature generally to be submitted as a printed copy to the Secretary of the Senate, as an electronic copy to the Chief Clerk of the Assembly, and as an electronic or printed copy to the Legislative Counsel. (Gov’t Code § 9795.)
4. Requires a bill that provides for a state agency to submit a report on any subject to either house of the Legislature generally, a committee or office of either house of the Legislature, or the Legislative Counsel Bureau, to include a provision that repeals the reporting requirement, or makes the requirement inoperative, no later than a date four years following the date upon which the bill, as enacted, becomes operative or four years after the due date of any report required every four or more years. (Gov't Code § 10231.5.)

This bill:

1. Requires the California Cybersecurity Integration Center, on or before December 31, 2025, to submit to the Legislature a report on the feasibility of, and benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud, in accordance with the procedures laid out in Government Code Section 9795.
2. Requires the report to include an assessment of the following tactics:
   1. requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed;
   2. utilization of statewide alternatives to social security numbers as authenticators in determining an individual’s identity; and
   3. requiring credit reporting bureaus or lenders to accept alternatives to social security numbers as authenticators in determining an individual’s identity.
3. Provides that it is repealed as of January 1, 2028, pursuant to Government Code Section 10231.5.

COMMENTS

1. Cybersecurity: The incidence and consequences of data breaches & identity theft

According to the Federal Trade Commission’s (FTC) “Consumer Sentinel Network Data Book 2020,” people filed more reports about identity theft, in its various forms, than any other complaint in 2020.^[1] Nationwide, identity theft has dramatically increased. Ten years ago, the FTC reported a little over 250,000 identity theft complaints. That number jumped to 650,523 in 2019. However, in 2020 alone, the FTC received 1,387,615 such reports from consumers – a doubling of the total in just one year. California accounted for 147,382 of those identity theft reports — more than any other state. For every 100,000 people in California, there were 373 identity theft complaints.

Identity theft victims’ information can be misused in numerous ways. One of the most common is the creation of new accounts, including credit card, utility, or wireless telephone accounts. But, victims’ information can also be used in other, equally nefarious ways. Once identity thieves have a consumer’s personal information, they can drain bank accounts, run up charges on various accounts, get medical treatment on a consumer’s health insurance, take out auto loans, or even file a tax return and get a consumer’s refund. In some extreme cases, a thief might even give the consumer’s name to the police during an arrest, generating false criminal records.

A vast majority of Californians engage in a wide range of activities online. Even before the pandemic forced many people to drastically shift their lives online, 70 percent of people in the state received financial services online, 39 percent telecommuted, 42 percent accessed sensitive health or insurance records online, and 39 percent communicated with doctors.^[2] In addition, many companies have realized the financial benefits of collecting as much data on consumers as possible, tracking, storing, and selling the details of our everyday lives. Given the amount of activity online and the massive amount of data being collected and switching hands, concerns about data security have skyrocketed.

In 2020 alone, estimates suggest that there were over 1000 data breaches resulting in the exposure of over 155 million records.^[3] According to the Federal Bureau of Investigation’s (FBI) Internet Crime Report, the Internet Crime Complaint Center received “a record number of complaints from the American public in 2020: 791,790, with reported losses exceeding $4.1 billion. This represents a 69% increase in total complaints from 2019.”^[4] A brief look at a few of the larger breaches illustrates the scope of the problem.

The infamous 2017 breach at Equifax lasted at least several months. ”If you have a credit report, there’s a good chance that you’re one of the 143 million American consumers whose sensitive personal information was exposed in a data breach at Equifax, one of the nation’s three major credit reporting agencies.”^[5] The hackers involved were able to access people’s names, Social Security numbers, birth dates, addresses, and driver’s license numbers. Over 200,000 consumers also had their credit card numbers stolen. There is evidence that the massive hack of personal information has led to extensive identity theft with the thieves using the stolen information to apply for mortgages, credit cards, and student loans. The information is also being used to tap into bank accounts, to file insurance claims, and to incur massive debts on behalf of affected consumers.

Even before that, a much larger breach occurred in 2013, when hackers accessed Yahoo’s email system, gathering data on more than 1 billion users.^[6] Several years after the hack, a group began offering the entire database of information for sale on the so-called “dark web” with at least three confirmed buyers paying $300,000 each. The breach was not disclosed by Yahoo until 3 years after it occurred. It came after an earlier breach of 450,000 accounts in 2012 and before a hack in 2014 of 500 million user accounts.

More recently, in 2019, the personal information of over 530 million Facebook users was taken in a breach that exploited a vulnerability in a Facebook feature.^[7] The company indicated it has decided not to notify the individual users affected, but the information remains publicly available after being posted to an online hacking forum. Major breaches have also occurred more recently, with GEICO having driver’s license data on 132,000 customers stolen and a hack of the ParkMobile application resulting in the personal information of 21 million users exposed.^[8]

The market for this unlawfully obtained data is lucrative. In fact, some companies are reported to be selling government agencies access to stolen data creating an “end-run around the usual legal processes.”^[9] Unfortunately, because of the size of its economy and the sheer number of consumers, the data collected and held by California businesses is frequently targeted by cyber criminals, and California accounts for a sizeable share of the nation’s data breaches.^[10] These security breaches are not harmless. The Attorney General reports that 67 percent of breach victims in the United States were also victims of fraud.

1. Existing laws protecting against data breaches and identity theft

The frequency of data breaches and identity theft in California and the threat it poses underscores the crucial need to enact and enforce statutes protecting against and responding to these breaches, and the fraud and identity theft that can result.

California has addressed these issues over the years by requiring specific procedures for notifying individuals of data breaches; requiring certain security procedures and practices to prevent such breaches; and providing a right of action if such requirements are not implemented.

In 2003, California’s first-in-the-nation security breach notification law went into effect.^[11] Since that time, all but three states have enacted similar security breach notification laws, and governments around the world have or are considering enacting such laws. California’s data breach notification law requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. This notification requirement ensures that residents are made aware of a breach, thus allowing them to take appropriate action to mitigate or prevent potential financial losses due to fraudulent activity.

In 2004, AB 1950 (Wiggins, Ch. 877, Stats. 2004) added Section 1798.81.5 to the Civil Code. The stated intent of that section is “to ensure that personal information about California residents is protected” and “to encourage businesses that own, license, or maintain personal information about Californians to provide reasonable security for that information.” Section 1798.81.5 currently requires businesses that own, license, or maintain certain personal information to implement and maintain reasonable security procedures and practices, appropriate to the nature of the information, to protect that information from unauthorized access, destruction, use, modification, or disclosure.

Businesses that disclose personal information about a California resident pursuant to a contract with a nonaffiliated third party, that is not covered by the requirement above, must require by contract that the third party implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.^[12]

In order to better prepare the state for cyber attacks, Governor Brown established Cal-CSIC by executive order, Executive Order B-34-15. Eventually, in 2018, the center was codified by AB 2813 (Irwin, Ch. 768, Stats. 2018). Cal-CSIC’s primary mission is to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state. It serves as the central organizing hub of the state’s cybersecurity activities and coordinates information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.

1. Tasking Cal-CSIC to chart paths forward

To address the rise of identity thefts and the growing number of credit crimes, this bill promotes the research of tools to protect consumers from increasingly sophisticated attacks specifically in the credit reporting and consumer lending industry. On or before December 31, 2025, Cal-CSIC is required to submit to the Legislature a report on the feasibility of, and benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud.

Specifically, the report must include an assessment of the feasibility, benefits, risks, and costs of utilizing the following tactics:

• requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed;
• utilization of statewide alternatives to social security numbers as authenticators in determining an individual’s identity; and
• requiring credit reporting bureaus or lenders to accept alternatives to social security numbers as authenticators in determining an individual’s identity.

According to the author:

It is no longer a matter of if your identifying information will be stolen, but rather when. Identity theft is on the rise in the United States, as during the COVID-19 pandemic. In 2021, the Federal Trade Commission received nearly 2.8 million identity theft incident reports, which was up from the 2.1 million received the year prior. Identity theft crimes come at a high financial and personal cost to individuals and families, and we must be doing more to research technological protections.

SB 591 will provide the government with much-needed data on possible solutions they can use in partnership with credit reporting bureaus to protect consumers from identity crime. From multi-factor authentication to alternative authenticators, there are multiple crime prevention tools at our fingertips. This bill promotes comprehensive evaluation of cyber protections that will ultimately protect consumers from needless identity theft attacks in the future.

SB 1001 (Min, 2022) was nearly identical to this bill and it passed both houses of the Legislature. Governor Newsom vetoed the bill, explaining his reasoning in his veto message:

I am supportive of efforts to improve cybersecurity. Through the budget process, we have substantially increased the capacity of the CalCSIC in recent years, and in October last year, my administration published Cal Secure, the State's first ever multi-year cybersecurity roadmap that addresses critical gaps in the state's information and cybersecurity programs while enabling the state to manage existing and future threats more effectively. However, this bill would require millions of dollars not accounted for in the budget for the research and industry expertise needed to complete the feasibility studies.

With our state facing lower-than-expected revenues over the first few months of this fiscal year, it is important to remain disciplined when it comes to spending, particularly spending that is ongoing. We must prioritize existing obligations and priorities, including education, health care, public safety and safety-net programs.

SUPPORT

None known

OPPOSITION

None known

RELATED LEGISLATION

Pending Legislation:

SB 265 (Hurtado, 2023) requires Cal OES to direct Cal-CSIC to prepare, and Cal OES to submit to the Legislature on or before January 1, 2025, a strategic, multiyear outreach plan to assist critical infrastructure sectors, as defined, in their efforts to improve cybersecurity and an evaluation of options for providing grants or alternative forms of funding to, and potential voluntary actions that do not require funding and that assist, that sector in their efforts to improve cybersecurity preparedness. SB 265 is currently in the Senate Appropriations Committee.

AB 1023 (Papan, 2023) explicitly includes school districts, county offices of education, and charter schools among the specified entities with which Cal-CSIC coordinates information sharing, including cyber threat information. AB 1023 is currently in the Assembly Emergency Management Committee.

Prior Legislation:

SB 844 (Min, Ch. 505, Stats. 2022) requires the California Cybersecurity Integration Center (Cal-CSIC) to create an annual report for four years on all expenditures made by the state within a single fiscal year pursuant to the federal State and Local Cybersecurity Improvement Act.

SB 1001 (Min, 2022) See Comment 3.

AB 430 (Grayson, Ch. 265, Stats. 2021) allows the use of a Federal Trade Commission identity theft report, in lieu of a police report, when a victim of identity theft seeks civil protections pursuant to the Rosenthal Fair Debt Collection Practices Act, the Identity Theft Law, and the Penal Code, as specified.

AB 825 (Levine, Ch. 527, Stats. 2021) added “genetic information” to the definition of personal information for purposes of the laws requiring certain businesses to implement and maintain reasonable security procedures and practices to protect personal information they own, license, or maintain. It requires businesses and agencies that maintain personal information to disclose a breach of genetic information.

AB 1391 (Chau, Ch. 594, Stats. 2021) makes it unlawful for a person to sell data, or sell access to data, that the person has obtained or accessed pursuant to the commission of a crime. It further makes it unlawful for a person, who is not an authorized person, to purchase or use data from a source that the person knows or reasonably should know has obtained or accessed that data through the commission of a crime.

AB 2813 (Irwin, Ch. 768, Stats. 2018) See Comment 2.

AB 1950 (Wiggins, Ch. 877, Stats. 2004) See Comment 2.

PRIOR VOTES:

Senate Governmental Organization Committee (Ayes 15, Noes 0)

**************

1. Federal Trade Commission, Consumer Sentinel Network Data Book 2020 (February 2021) https://www.ftc.gov/system/files/documents/reports/consumer-sentinel-network-data-book-2020/csn_annual_data_book_2020.pdf. All internet citations are current as of April 12, 2023. ↑

2. Niu Gao & Joseph Hayes, California’s Digital Divide (February 2021) Public Policy Institute of California, https://www.ppic.org/publication/californias-digital-divide/. ↑

3. Joseph Johnson, Cyber crime: number of breaches and records exposed 2005-2020 (March 3, 2021) Statista, https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/#:~:text=In%202020%2C%20the%20number%20of,%2Dthan%2Dadequate%20information%20security. ↑

4. Internet Crime Complaint Center, 2020 Internet Crime Report (March 17, 2021) FBI, https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf. ↑

5. Seena Gressin, The Equifax Data Breach: What to Do (Sep. 9, 2017) Federal Trade Commission, https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do. ↑

6. Vindu Goel & Nicole Perlroth, Hacked Yahoo Data Is for Sale on Dark Web (December 15, 2016) The New York Times, https://www.nytimes.com/2016/12/15/technology/hacked-yahoo-data-for-sale-dark-web.html. ↑

7. Emma Bowman, After Data Breach Exposes 530 Million, Facebook Says It Will Not Notify Users (April 9, 2021) NPR, https://www.npr.org/2021/04/09/986005820/after-data-breach-exposes-530-million-facebook-says-it-will-not-notify-users. ↑

8. Zack Whittaker, Geico admits fraudsters stole customers’ driver’s license numbers for months (April 19, 2021) TechCrunch, https://techcrunch.com/2021/04/19/geico-driver-license-numbers-scraped/; Joe Marusak, If you find parking spots with this popular app, your data may have been stolen (April 16, 2021) Charlotte Observer, https://www.charlotteobserver.com/news/local/article250666434.html. ↑

9. Joseph Cox, Police Are Buying Access to Hacked Website Data (July 8, 2020) Vice, https://www.vice.com/en/article/3azvey/police-buying-hacked-data-spycloud. ↑

10. California Department of Justice, California Data Breach Report (February 2016) https://oag.ca.gov/sites/all/files/agweb/pdfs/dbr/2016-data-breach-report.pdf. ↑

11. See Civ. Code §§ 1798.29, 1798.82. ↑

12. Civ. Code § 1798.81.5. ↑

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Bill Dodd

Chair

2023 - 2024 Regular

Bill No: SB Hearing Date: 4/11/2023

SUBJECT:

DIGEST: This bill requires the California Cybersecurity Integration Center (Cal-CSIC) to submit a report to the Legislature on the feasibility, benefits, risks, and costs of requiring credit reporting bureaus and lenders to implement new information security tactics, as specified, by December 31, 2025.

ANALYSIS:

Existing law:

1. Establishes Cal-CSIC, within the Office of Emergency Services (OES), with the primary mission of reducing the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or computer networks in the state.
2. Requires Cal-CSIC to serve as the central organizing hub of state government cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
3. Provides that any report required or requested by law to be submitted by a state or local agency to the Members of either house of the Legislature, shall, generally, instead be submitted as a printed copy to the Secretary of the Senate, as an electronic copy to the Chief Clerk of the Assembly, and as an electronic or printed copy to the Legislative Counsel.

This bill:

1. This bill requires Cal-CSIC, on or before December 31, 2025, to submit a report to the Legislature on the feasibility of, and the potential benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud.
2. Requires the report to include, but not be limited to, an assessment of the feasibility of, and the potential benefits, risks, and costs of, utilizing all of the following tactics:
   1. Requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed.
   2. Utilization of statewide alternatives to social security numbers as authenticators in determining an individual’s identity.
   3. Requiring credit reporting bureaus or lenders to accept alternatives to social security numbers as authenticators in determining an individual’s identity.
3. Includes a sunset date of January 1, 2028.

Background

Purpose of the Bill. According to the author’s office, “it is no longer a matter of if your identifying information will be stolen, but rather when. Identity theft is on the rise in the United States, as during the COVID-19 pandemic. In 2021, the Federal Trade Commission received nearly 2.8 million identity theft incident reports, which was up from the 2.1 million received the year prior. Identity theft crimes come at a high financial and personal cost to individuals and families, and we must be doing more to research technological protections.”

Further, the author’s office notes that, “SB 591 will provide the government with much-needed data on possible solutions they can use in partnership with credit reporting bureaus to protect consumers from identity crime. From multi-factor authentication to alternative authenticators, there are multiple crime prevention tools at our fingertips. This bill promotes comprehensive evaluation of cyber protections that will ultimately protect consumers from needless identity theft attacks in the future.”

Catch Me if You Can: Investigating Fraud and Identify Theft in California. In March of 2022, the Senate Select Committee on Cybersecurity and Identity Theft Prevention held an informational hearing titled “Catch Me if You Can: Investigating Fraud and Identify Theft in California.” According to background provided for the hearing, state governments are stepping up their efforts to combat the growing scourge of identity theft. The National Conference of State Legislatures’ 2021 report on consumer data protection legislation found that states are increasingly taking a more active role in promoting personal privacy safety legislation.

In 2021, 38 states introduced over 160 bills related to privacy protections, compared to 20 states in 2020 and 25 in 2019. Of the introduced bills, comprehensive privacy legislation was the most common with 25 states introducing, and 13 states successfully enacting legislation.

Cal-Secure Strategic Plan. In 2021, the California Department of Technology (CDT) and the Office of Information Security (OIS) introduced Cal-Secure, the California Executive Branch’s first five-year information security maturity roadmap. The roadmap was created through a collaborative process with Cal-CSIC and its four critical partners: OES, the California Highway Patrol (CHP), CDT, and the California Military Department (CMD), and the state government security community. It is built on industry-leading best practices and frameworks, and addresses critical gaps in the state’s information and cybersecurity programs. The roadmap is intended to outline capabilities the State must adopt and achieve in a prioritized fashion. The roadmap's ultimate goal is to ensure that California's Executive branch has a world-class cybersecurity workforce, a well-organized and effective federated cybersecurity oversight governance structure, and robust cybersecurity defenses for all technology, including critical infrastructure.

California Cybersecurity Integration Center. Created by executive order in 2015, and gaining full statutory authority in 2018, Cal-CSIC is a unique, interdisciplinary and inter-department organization poised to become a leader in cybersecurity innovation. As envisioned by the Legislature, Cal-CSIC’s responsibilities are broad, and include: developing a statewide cybersecurity strategy; overseeing a Cyber Incident Response Team, which serves as California’s primary unit in cyber threat detection, reporting, and response for the public and private sectors; assisting law enforcement partners in criminal investigations of cyber-related incidents; collecting and sharing cyber threat information among state agencies, utilities, academic institutions, private companies, and other throughout the state; providing warnings of cyberattacks to government agencies and nongovernmental partners; supporting public and private sector partners in protecting their vulnerable infrastructure and information technology networks; and, assessing risks to critical infrastructure and information technology networks.

Cal-CSIC's mission is to reduce the number of cyber threats and attacks in California by focusing on responding to those that could harm the economy, critical infrastructure, or computer networks in the state. Its focus is to respond to cyber threats and attacks that could damage the economy, its critical infrastructure, or computer networks in the state. Cal-CSIC is the hub of state government’s cybersecurity events, and coordinates information sharing at all levels of government agencies, utilities and other service providers, academic institutions, and nongovernmental organizations.

Cal-CSIC’s statewide cybersecurity strategy takes recommendations from the California Task Force on Cybersecurity and follows state and federal requirements. The cybersecurity strategy will improve how cyber threats are found, understood, and shared. The strategy strengthens cyber emergency preparedness and response, standardize data protection measures, enhance digital forensics, and increase cyber investigative capabilities, supply lessons learned to California’s workforce of cybersecurity professionals, and expands cybersecurity awareness.

The Cyber Incident Response Team aids law enforcement agencies with jurisdiction for cyber-related criminal investigations and work with agencies responsible for advancing information security within state government. Cal-CSIC's information sharing practices aim to protect individual privacy, civil liberties, and business confidentiality. Cal-CSIC publishes Cyber Threat Alerts and Advisories will supply cybersecurity threat information between federal, state, local, and Tribal government entities. Advisories and Alerts are shared with private sector partners.

Cal-CSIC analysts collect and analyze phishing emails to document relevant information about the attacker and the Indicators of Compromise (IOC). These IOCs are added to the California Automated Indicator Exchange and is accessible to all partner entities.

This bill requires Cal-CSIC to submit a report to the Legislature, by December 31, 2025, on the feasibility of, and potential benefits, risks, and costs of requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud. The report will include an assessment of requiring credit bureaus and lenders to use multifactor authentication, statewide alternatives to social security numbers, and accepting alternatives to social security numbers as authenticators.

Specifically, the report will assess the feasibility of implementing the following three tactics:

• Requiring credit reporting bureaus or lenders to use multifactor authentication each time a new line of credit is opened or a credit report is accessed.
• Utilization of statewide alternatives to social security numbers as authenticators in determining an individual’s identity.
• Requiring credit reporting bureaus or lenders to accept alternatives to social security numbers as authenticators in determining and individual’s identity.

Supporters of the bill argue that its purpose aligns with California's ongoing cybersecurity initiatives by aiming to strengthen consumer protection against identity theft. By exploring the feasibility of implementing new information security tactics, the bill seeks to build upon the progress made by existing initiatives. The findings of the required feasibility report could be integrated into the state's cybersecurity strategy, and Cal-CSIC, along with other stakeholders, could play a crucial role in implementing any recommended security measures.

Meet the New Bill, Same as the Old Bill. This bill is virtually identical to SB 1001 (Min, 2022) which this Committee approved last year. The changes include pushing back the report due date and the sunset date by one calendar year. SB 1001 was ultimately vetoed by Governor Newsom who wrote the following:

I am supportive of efforts to improve cybersecurity. Through the budget process, we have substantially increased the capacity of the CalCSIC in recent years, and in October last year, my administration published Cal Secure, the State's first ever multi-year cybersecurity roadmap that addresses critical gaps in the state's information and cybersecurity programs while enabling the state to manage existing and future threats more effectively. However, this bill would require millions of dollars not accounted for in the budget for the research and industry expertise needed to complete the feasibility studies.

With our state facing lower-than-expected revenues over the first few months of this fiscal year, it is important to remain disciplined when it comes to spending, particularly spending that is ongoing. We must prioritize existing obligations and priorities, including education, health care, public safety and safety-net programs.

The Legislature sent measures with potential costs of well over $20 billion in one-time spending commitments and more than $10 billion in ongoing commitments not accounted for in the state budget. Bills with significant fiscal impact, such as this measure, should be considered and accounted for as part of the annual budget process.

Prior/Related Legislation

SB 74 (Dodd, 2023) requires state entities to prohibit high-risk applications for social media platforms from being downloaded or installed on those entities’ state-owned or state-issued devices, as specified. (Pending in the Senate Governmental Organization Committee)

SB 265 (Hurtado, 2023) requires OES to direct Cal-CSIC to prepare, and OES to submit to the Legislature, a strategic, multi-year outreach plan to assist critical infrastructure sectors in their efforts to improve cybersecurity and an evaluation of options for providing grants to those sectors in their efforts to improve cybersecurity preparedness, as specified. (Pending in the Senate Appropriations Committee)

AB 569 (E. Garcia, 2023) requires the Chancellor of the California State University (CSU) to report to the Legislature, on or before July 1, 2028, on the Cybersecurity Regional Alliances and Multistakeholder Partnerships Pilot Program, as specified. (Pending in the Assembly Higher Education Committee)

AB 1023 (Papa, 2023) adds a representative from the State Department of Education to Cal-CSIC and explicitly includes school districts, county offices of education, and charter schools among the specified entities with which Cal-CSIC coordinate information sharing, including cyber threat information. (Pending in the Assembly Emergency Management Committee)

SB 892 (Hurtado, Chapter 820, Statutes of 2022) requires OES to direct Cal-CSIC to prepare and submit a strategic, multiyear outreach plan to assist the food and agriculture sector and the water and wastewater sector in their efforts to improve cybersecurity, as specified.

SB 1001 (Min, 2022) would have required Cal-CSIC to submit a report to the Legislature on the feasibility of, and potential benefits, risks, and costs of, requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud, as specified, by December, 31, 2024. (Vetoed by Governor Newsom)

AB 2135 (Irwin, Chapter 773, Statutes of 2022) requires state agencies not under direct authority of the Governor to adopt and implement certain information security and privacy policies, standards, and procedures meeting specified federally-established criteria; and, requires those agencies to perform a comprehensive independent security assessment (ISA) every two years, as specified.

AB 2355 (Salas, Chapter 498, Statutes of 2022) requires a Local Educational Agency (LEA) to report a cyberattack impacting 500 or more pupils or personnel to report to Cal-CSIC and requires the Cal-CSIC to annually report to the Governor and relevant policy committees of the Legislature with specified information related to the cyberattack.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT:

None received

OPPOSITION:

None received

DUAL REFERRAL: Senate Governmental Organization Committee & Senate Judiciary Committee