Legislative Update Pat Burns, CSU and Jeanette VanGalder, UNC

4/19/2006 Legislative Update 2 Theme “If you like the law or you like sausage, you should never watch either of them being made.” Otto von Bismark

4/19/2006 Legislative Update 3 Topics Executive Orders State Legislation Federal Legislation

4/19/2006 Legislative Update 4 Executive Orders “Refresh” of Governor’s original Executive Order of 12/28/00 that mandated higher ed participate in the MNT  Higher ed again mentioned prominently  Extends the term of the Order indefinitely  However, higher ed still operates under the exemption granted by Troy Eid to Tim Foster MNT exploring its future  Uncertain what might transpire in this regard

4/19/2006 Legislative Update 5 State Legislation S 24, H ? – the SASID  Requires use of the 10-digit State Assigned Student ID (SASID) from K-12 to be used for reporting purposes  Goal is greater accountability (?)  Do not believe that we need to accept its use for delivery of services (e.g. COF stipends, web services, etc.)  Rick Beck has a Banner mod queued up

4/19/2006 Legislative Update 6 S 10, H 1157 – CISO Legislation Establishes a CISO, to be appointed by the Governor Funds the CISO office via State Agency budgets after year 1 Requires State Agencies to  Implement IT Security policies and procedures developed by the CISO  Gives the CISO authority to suspend services  Institutes reporting requirements Amended to include a section pertaining to higher ed (see next page)  Higher ed fiscal note was not included in the legislation?

4/19/2006 Legislative Update 7 Section Institutions of higher education… 1. By July 1, 2007, each institution shall develop an IT security plan, in coordination with CCHE 2. Including a) Periodic risk assessments… b) Process for providing adequate IT security… c) Information security awareness training… d) Periodic testing of the effectiveness… e) A process for detecting, reporting and responding to security incidents… and reporting them to the CISO f) Plans and procedures to ensure continuity of operations…

4/19/2006 Legislative Update 8 Section Institutions of higher education… (cont’d) 3. By July 1, 2007, the plans shell be submitted to CCHE who will then submit them to the CISO Comments on HB 1157  IT environments in higher ed are vastly different from those in state agencies  Our focus should be risk management, rather than adherence to specific policies and procedures  Our amendment was accepted with the understanding that our IT security incidents must stop! Impractical, but we must do our best Monthly meetings queued up (3 rd Tuesday, 9 AM to noon)

4/19/2006 Legislative Update 9 Other State Legislation Pertains to State Agencies, and not higher ed (for now) – multiple bills  Strengthens OIT oversight  Strengthens IMC oversight  Requires formal project management A new class description in the state personnel system  Requires Independent validation and verification (IV&V)  Why? Reaction to large, disastrous state “IT projects,” incl. CBMS and others

4/19/2006 Legislative Update 10 Comments Apparently, there is a strong desire to include higher ed under the oversight of both the IMC and OIT  Incongruous with the funding MOU between the JBC and CCHE in the mid-80’s We do not understand this, because we have universally conducted successful projects  Sometimes with expected “burps,” but generally successful and with very limited resources  Julie agreed to have the CCHE CIO Council prepare an analysis of such oversight this summer, and present it to John Picanso, State CIO  More to come…

4/19/2006 Legislative Update 11 Federal Legislation S – The Community Broadband Act of 2005:  McCain-Lautenberg  Prevents “a state or political subdivision thereof, any agency, authority, or instrumentality of a state or political subdivision thereof, or any Indian tribe” from enacting legislation that prohibits local governments and states from providing broadband services, either directly or in partnership with private-sector providers;  Ensures that local governments cannot use their regulatory authority to discriminate against private-sector providers of broadband services; and  Ensures that federal and state telecommunications laws and regulations apply to all providers.

4/19/2006 Legislative Update 12 Federal Legislation (cont’d) CALEA  FCC ruling that it pertains to our WAN connections  If approached, put a “sniffer” on the traffic, assist as best you can S – Identity Theft Protection Act (from 2005)  Originally, significant bipartisan support, but now in limbo  Corrects and codifies the California Legislation  See the following for a detailed summary

4/19/2006 Legislative Update 13 U.S. Senate Bill S. 1408, the Identity Theft Protection Act Patterned after California legislation, with “fixes”  The California legislation required notification in the event of identity theft, and “opened the flood gates”  Observation: identity theft has been much more prevalent than we had thought Significant bi-partisan support References  

4/19/2006 Legislative Update 14 High-level Summary of S Covered entities:  All entities, including schools, that collect social security numbers or any other sensitive personal information that the FTC determines can be used for identity theft. Sensitive Personal Information: an individual’s name, address, or telephone number with: 1. Social security number, taxpayer ID number, or employer identification number derived from social security number; 2. Financial account/credit card number combined with password or access code; and/or 3. Driver’s license identification number.

4/19/2006 Legislative Update 15 Summary of S (cont’d) Requirements 1. Security Program - Develop and enforce a written security program for personal information to protect against anticipated threats to or unauthorized access. 1. Compliance with the GLBA is sufficient 2. Reports - Report any security breach to the FTC and—for breaches affecting 1,000 or more individuals—report as well to consumer credit reporting agencies. 3. Investigation - Investigate the security breach to determine whether or not it poses a reasonable risk of identity theft.

4/19/2006 Legislative Update 16 Summary of S (cont’d) Requirements (cont’d) 4. Notification - to each individual affected by the breach, if the investigation shows there is a reasonable risk of identity theft.  Notice may be provided in either written or electronic form and must be provided within 45 days of the discovery of the security breach.  If done electronically, the notice must be consistent with the Electronic Signatures in Global and National Commerce Act.  See bin/getdoc.cgi?dbname=106_cong_public_laws&docid=f:publ pdf. bin/getdoc.cgi?dbname=106_cong_public_laws&docid=f:publ pdf  A substitute notice may be provided in cases where either the cost exceeds $250,000; the number of individuals to be notified exceeds 500,000; or the entity does not have sufficient contact information for the affected individuals. Such may be via ((if the entity has e- mail addresses for the affected individuals); and must also include:  Conspicuous posting on the entity’s Web site; and  Notification to State-wide media.

4/19/2006 Legislative Update 17 Summary of S (cont’d) Requirements (cont’d) 5. Contents of Notice 1. Individual’s name; 2. Entity where the breach occurred; 3. Dates of the security breach and of its discovery; 4. Categories of personal information subject to the breach; and 5. Toll-free numbers for the entity subject to the breach, all nationwide credit reporting agencies, and the FTC.

4/19/2006 Legislative Update 18 Summary of S (cont’d) Penalties: Entities that fail to provide the require notification are subject to fines  Up to $11,000 per individual subject to a breach  Capped at $11 million for a single breach Social Security Numbers: A school or other covered entity may not  Obtain a social security number from any individual unless there is a specific use for it and no other identifier can reasonably be used.  Social security numbers (or derivatives) may not be displayed on student or employee identification cards. No Private Right of Action; Pre-emption of State and Local Laws: The legislation prohibits a private right of action and also pre-empts State and local laws in this area.

4/19/2006 Legislative Update 19 Comments on S Not well defined what constitutes:  An investigation, or  A reasonable risk of identity theft Permits collection of SSN’s  For resolving identities, if no other reasonable means of so doing are available  At CSU, we have adopted this stance: we will continue to collect SSNs for all of our constituents, and to protect them diligently

4/19/2006 Legislative Update 20 Questions Are more than welcome.