Legislative Update: Recent Changes in Laws and Executive Orders

1. Legislative Update Pat Burns, CSU and Jeanette VanGalder, UNC

2. Theme • “If you like the law or you like sausage, you should never watch either of them being made.” Otto von Bismark Legislative Update

3. Topics • Executive Orders • State Legislation • Federal Legislation Legislative Update

4. Executive Orders • “Refresh” of Governor’s original Executive Order of 12/28/00 that mandated higher ed participate in the MNT • Higher ed again mentioned prominently • Extends the term of the Order indefinitely • However, higher ed still operates under the exemption granted by Troy Eid to Tim Foster • MNT exploring its future • Uncertain what might transpire in this regard Legislative Update

5. State Legislation • S 24, H ? – the SASID • Requires use of the 10-digit State Assigned Student ID (SASID) from K-12 to be used for reporting purposes • Goal is greater accountability (?) • Do not believe that we need to accept its use for delivery of services (e.g. COF stipends, web services, etc.) • Rick Beck has a Banner mod queued up Legislative Update

6. S 10, H 1157 – CISO Legislation • Establishes a CISO, to be appointed by the Governor • Funds the CISO office via State Agency budgets after year 1 • Requires State Agencies to • Implement IT Security policies and procedures developed by the CISO • Gives the CISO authority to suspend services • Institutes reporting requirements • Amended to include a section pertaining to higher ed (see next page) • Higher ed fiscal note was not included in the legislation? Legislative Update

7. Section 24-37.5-404.5. Institutions of higher education… • By July 1, 2007, each institution shall develop an IT security plan, in coordination with CCHE • Including • Periodic risk assessments… • Process for providing adequate IT security… • Information security awareness training… • Periodic testing of the effectiveness… • A process for detecting, reporting and responding to security incidents… and reporting them to the CISO • Plans and procedures to ensure continuity of operations… Legislative Update

8. Section 24-37.5-404.5. Institutions of higher education… (cont’d) • By July 1, 2007, the plans shell be submitted to CCHE who will then submit them to the CISO • Comments on HB 1157 • IT environments in higher ed are vastly different from those in state agencies • Our focus should be risk management, rather than adherence to specific policies and procedures • Our amendment was accepted with the understanding that our IT security incidents must stop! • Impractical, but we must do our best • Monthly meetings queued up (3rd Tuesday, 9 AM to noon) Legislative Update

9. Other State Legislation • Pertains to State Agencies, and not higher ed (for now) – multiple bills • Strengthens OIT oversight • Strengthens IMC oversight • Requires formal project management • A new class description in the state personnel system • Requires Independent validation and verification (IV&V) • Why? Reaction to large, disastrous state “IT projects,” incl. CBMS and others Legislative Update

10. Comments • Apparently, there is a strong desire to include higher ed under the oversight of both the IMC and OIT • Incongruous with the funding MOU between the JBC and CCHE in the mid-80’s • We do not understand this, because we have universally conducted successful projects • Sometimes with expected “burps,” but generally successful and with very limited resources • Julie agreed to have the CCHE CIO Council prepare an analysis of such oversight this summer, and present it to John Picanso, State CIO • More to come… Legislative Update

11. Federal Legislation • S. 1294 – The Community Broadband Act of 2005: • McCain-Lautenberg • Prevents “a state or political subdivision thereof, any agency, authority, or instrumentality of a state or political subdivision thereof, or any Indian tribe” from enacting legislation that prohibits local governments and states from providing broadband services, either directly or in partnership with private-sector providers; • Ensures that local governments cannot use their regulatory authority to discriminate against private-sector providers of broadband services; and • Ensures that federal and state telecommunications laws and regulations apply to all providers. Legislative Update

12. Federal Legislation (cont’d) • CALEA • FCC ruling that it pertains to our WAN connections • If approached, put a “sniffer” on the traffic, assist as best you can • S. 1408 – Identity Theft Protection Act (from 2005) • Originally, significant bipartisan support, but now in limbo • Corrects and codifies the California Legislation • See the following for a detailed summary Legislative Update

13. U.S. Senate Bill S. 1408, the Identity Theft Protection Act • Patterned after California legislation, with “fixes” • The California legislation required notification in the event of identity theft, and “opened the flood gates” • Observation: identity theft has been much more prevalent than we had thought • Significant bi-partisan support • References • http://commerce.senate.gov/pdf/s1408-asreported.pdf. • http://commerce.senate.gov/newsroom/printable.cfm?id=242027. Legislative Update

14. High-level Summary of S. 1408 • Covered entities: • All entities, including schools, that collect social security numbers or any other sensitive personal information that the FTC determines can be used for identity theft. • Sensitive Personal Information: an individual’s name, address, or telephone number with: • Social security number, taxpayer ID number, or employer identification number derived from social security number; • Financial account/credit card number combined with password or access code; and/or • Driver’s license identification number. Legislative Update

15. Summary of S. 1408 (cont’d) • Requirements • Security Program - Develop and enforce a written security program for personal information to protect against anticipated threats to or unauthorized access. • Compliance with the GLBA is sufficient • Reports - Report any security breach to the FTC and—for breaches affecting 1,000 or more individuals—report as well to consumer credit reporting agencies. • Investigation -Investigate the security breach to determine whether or not it poses a reasonable risk of identity theft. Legislative Update

16. Summary of S. 1408 (cont’d) • Requirements (cont’d) • Notification - to each individual affected by the breach, if the investigation shows there is a reasonable risk of identity theft. • Notice may be provided in either written or electronic form and must be provided within 45 days of the discovery of the security breach. • If done electronically, the notice must be consistent with the Electronic Signatures in Global and National Commerce Act. • See http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=106_cong_public_laws&docid=f:publ229.106.pdf. • A substitute notice may be provided in cases where either the cost exceeds $250,000; the number of individuals to be notified exceeds 500,000; or the entity does not have sufficient contact information for the affected individuals. Such may be via email ((if the entity has e-mail addresses for the affected individuals); and must also include: • Conspicuous posting on the entity’s Web site; and • Notification to State-wide media. Legislative Update

17. Summary of S. 1408 (cont’d) • Requirements (cont’d) • Contents of Notice • Individual’s name; • Entity where the breach occurred; • Dates of the security breach and of its discovery; • Categories of personal information subject to the breach; and • Toll-free numbers for the entity subject to the breach, all nationwide credit reporting agencies, and the FTC. Legislative Update

18. Summary of S. 1408 (cont’d) • Penalties: Entities that fail to provide the require notification are subject to fines • Up to $11,000 per individual subject to a breach • Capped at $11 million for a single breach • Social Security Numbers: A school or other covered entity may not • Obtain a social security number from any individual unless there is a specific use for it and no other identifier can reasonably be used. • Social security numbers (or derivatives) may not be displayed on student or employee identification cards. • No Private Right of Action; Pre-emption of State and Local Laws: The legislation prohibits a private right of action and also pre-empts State and local laws in this area. Legislative Update

19. Comments on S. 1408 • Not well defined what constitutes: • An investigation, or • A reasonable risk of identity theft • Permits collection of SSN’s • For resolving identities, if no other reasonable means of so doing are available • At CSU, we have adopted this stance: we will continue to collect SSNs for all of our constituents, and to protect them diligently Legislative Update

20. Questions • Are more than welcome. Legislative Update