Legislative Update

Pat Burns, CSU and

Jeanette VanGalder, UNC

4/19/2006 Legislative Update 2

Theme

“If you like the law or you like sausage, you should never watch either of them being made.” Otto von Bismark

4/19/2006 Legislative Update 3

Topics

Executive Orders State Legislation Federal Legislation

4/19/2006 Legislative Update 4

Executive Orders

“Refresh” of Governor’s original Executive Order of 12/28/00 that mandated higher ed participate in the MNT Higher ed again mentioned prominently Extends the term of the Order indefinitely However, higher ed still operates under the

exemption granted by Troy Eid to Tim Foster MNT exploring its future

Uncertain what might transpire in this regard

4/19/2006 Legislative Update 5

State Legislation

S 24, H ? – the SASID Requires use of the 10-digit State Assigned

Student ID (SASID) from K-12 to be used for reporting purposes

Goal is greater accountability (?) Do not believe that we need to accept its use for

delivery of services (e.g. COF stipends, web services, etc.)

Rick Beck has a Banner mod queued up

4/19/2006 Legislative Update 6

S 10, H 1157 – CISO Legislation Establishes a CISO, to be appointed by the

Governor Funds the CISO office via State Agency budgets

after year 1 Requires State Agencies to

Implement IT Security policies and procedures developed by the CISO

Gives the CISO authority to suspend services Institutes reporting requirements

Amended to include a section pertaining to higher ed (see next page) Higher ed fiscal note was not included in the legislation?

4/19/2006 Legislative Update 7

Section 24-37.5-404.5. Institutions of higher education…1. By July 1, 2007, each institution shall develop an

IT security plan, in coordination with CCHE

2. Includinga) Periodic risk assessments…

b) Process for providing adequate IT security…

c) Information security awareness training…

d) Periodic testing of the effectiveness…

e) A process for detecting, reporting and responding to security incidents… and reporting them to the CISO

f) Plans and procedures to ensure continuity of operations…

4/19/2006 Legislative Update 8

Section 24-37.5-404.5. Institutions of higher education… (cont’d)3. By July 1, 2007, the plans shell be submitted to

CCHE who will then submit them to the CISO

Comments on HB 1157 IT environments in higher ed are vastly different from

those in state agencies Our focus should be risk management, rather than

adherence to specific policies and procedures Our amendment was accepted with the understanding

that our IT security incidents must stop! Impractical, but we must do our best Monthly meetings queued up (3rd Tuesday, 9 AM to noon)

4/19/2006 Legislative Update 9

Other State Legislation

Pertains to State Agencies, and not higher ed (for now) – multiple bills Strengthens OIT oversight Strengthens IMC oversight Requires formal project management

A new class description in the state personnel system Requires Independent validation and verification

(IV&V) Why? Reaction to large, disastrous state “IT

projects,” incl. CBMS and others

4/19/2006 Legislative Update 10

Comments

Apparently, there is a strong desire to include higher ed under the oversight of both the IMC and OIT Incongruous with the funding MOU between the JBC and

CCHE in the mid-80’s We do not understand this, because we have

universally conducted successful projects Sometimes with expected “burps,” but generally successful

and with very limited resources Julie agreed to have the CCHE CIO Council prepare an

analysis of such oversight this summer, and present it to John Picanso, State CIO

More to come…

4/19/2006 Legislative Update 11

Federal Legislation

S. 1294 – The Community Broadband Act of 2005: McCain-Lautenberg Prevents “a state or political subdivision thereof, any agency,

authority, or instrumentality of a state or political subdivision thereof, or any Indian tribe” from enacting legislation that prohibits local governments and states from providing broadband services, either directly or in partnership with private-sector providers;

Ensures that local governments cannot use their regulatory authority to discriminate against private-sector providers of broadband services; and

Ensures that federal and state telecommunications laws and regulations apply to all providers.

4/19/2006 Legislative Update 12

Federal Legislation (cont’d)

CALEA FCC ruling that it pertains to our WAN connections If approached, put a “sniffer” on the traffic, assist as best

you can S. 1408 – Identity Theft Protection Act (from 2005)

Originally, significant bipartisan support, but now in limbo Corrects and codifies the California Legislation See the following for a detailed summary

4/19/2006 Legislative Update 13

U.S. Senate Bill S. 1408, the Identity Theft Protection Act Patterned after California legislation, with “fixes”

The California legislation required notification in the event of identity theft, and “opened the flood gates”

Observation: identity theft has been much more prevalent than we had thought

Significant bi-partisan support References

http://commerce.senate.gov/pdf/s1408-asreported.pdf. http://commerce.senate.gov/newsroom/printable.cfm?id=24

2027.

4/19/2006 Legislative Update 14

High-level Summary of S. 1408 Covered entities:

All entities, including schools, that collect social security numbers or any other sensitive personal information that the FTC determines can be used for identity theft.

Sensitive Personal Information: an individual’s name, address, or telephone number with:

1. Social security number, taxpayer ID number, or employer identification number derived from social security number;

2. Financial account/credit card number combined with password or access code; and/or

3. Driver’s license identification number.

4/19/2006 Legislative Update 15

Summary of S. 1408 (cont’d) Requirements

1. Security Program - Develop and enforce a written security program for personal information to protect against anticipated threats to or unauthorized access. 1. Compliance with the GLBA is sufficient

2. Reports - Report any security breach to the FTC and—for breaches affecting 1,000 or more individuals—report as well to consumer credit reporting agencies.

3. Investigation - Investigate the security breach to determine whether or not it poses a reasonable risk of identity theft.

4/19/2006 Legislative Update 16

Summary of S. 1408 (cont’d) Requirements (cont’d)

4. Notification - to each individual affected by the breach, if the investigation shows there is a reasonable risk of identity theft.

Notice may be provided in either written or electronic form and must be provided within 45 days of the discovery of the security breach.

If done electronically, the notice must be consistent with the Electronic Signatures in Global and National Commerce Act.

See http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=106_cong_public_laws&docid=f:publ229.106.pdf.

A substitute notice may be provided in cases where either the cost exceeds $250,000; the number of individuals to be notified exceeds 500,000; or the entity does not have sufficient contact information for the affected individuals. Such may be via email ((if the entity has e-mail addresses for the affected individuals); and must also include:

Conspicuous posting on the entity’s Web site; and Notification to State-wide media.

4/19/2006 Legislative Update 17

Summary of S. 1408 (cont’d) Requirements (cont’d)

5. Contents of Notice1. Individual’s name;

2. Entity where the breach occurred;

3. Dates of the security breach and of its discovery;

4. Categories of personal information subject to the breach; and

5. Toll-free numbers for the entity subject to the breach, all nationwide credit reporting agencies, and the FTC.

4/19/2006 Legislative Update 18

Summary of S. 1408 (cont’d) Penalties: Entities that fail to provide the require notification are

subject to fines Up to $11,000 per individual subject to a breach Capped at $11 million for a single breach

Social Security Numbers: A school or other covered entity may not Obtain a social security number from any individual unless there

is a specific use for it and no other identifier can reasonably be used.

Social security numbers (or derivatives) may not be displayed on student or employee identification cards.

No Private Right of Action; Pre-emption of State and Local Laws: The legislation prohibits a private right of action and also pre-empts State and local laws in this area.

4/19/2006 Legislative Update 19

Comments on S. 1408

Not well defined what constitutes: An investigation, or A reasonable risk of identity theft

Permits collection of SSN’s For resolving identities, if no other reasonable

means of so doing are available At CSU, we have adopted this stance: we will

continue to collect SSNs for all of our constituents, and to protect them diligently

4/19/2006 Legislative Update 20

Questions

Are more than welcome.