S.B. 123 Privacy and Cybersecurity Amendments: transcript

Um, There you go. Okay. Over the last, uh, four years, we have had a, uh, grant from the federal government that goes through and, and has aided us in helping cities, counties, local, uh, taxing entities, service providers, um, and other groups, the support that they need to handle the cyber security tax, which, uh, continue to increase, unfortunately, year by year. Um, over the summer. We talked about the way to enhance that, but we also had the, the challenge now is, is that the federal funding has e has, uh, elapsed and we need to go through and replace that with state funding. So this bill does a couple things. It creates a fund that if we appropriate funds, you know, for out of the education fund and the, uh, general fund that it can go into to support cybersecurity, both K through 12 and, um, all political subdivisions. It goes through and, uh, uh, directs that a, uh, cybersecurity plan, strategic plan be developed, uh, adds a couple more people to cybersecurity center in order for everybody be represented, including DEQ and UETN. And then, uh, creates that, uh, restricted account. I think it's a very focused bill in order to make sure that we have the resources and the coordination between all, uh, political entities to make sure that cybersecurity is addressed. And if there's attack on one, generally there's an attack on another city, and it allows all that communication to happen nearly instantaneously. So that's what the bill does.

I have a substitute on this bill. Oh, yeah, I do have substitute on the bill. It was hiding behind the fiscal note. Yes. Um, the change on this was, uh, there was a, there's a couple clarifying words that were added in there, dealing with the membership.

I'll move this move that we replacing, uh, delete entitle embody Senate bill 1 23 and replace it with first substitute Senate bill 1 23.

You? I, I spoke to that and the only other thing was a couple technical fixes and in the, in the definitional sections.

Correct. That is the fiscal note represents the, um, cost to minister the program and, and the changes. I have a separate RFA along with Representative Alrich to ask for the federal funds. So we've created the restricted account with the hope that through our appropriations process, we can actually get the state funds that will need to, to replace the federal.

No. Okay. Thanks.

Represent. Okay, Mr. Chair and committee. I'm Nathan lta, the director for the Division of Drinking Water, um, within the Department of Environmental Quality. And we support this bill. Um, we're listed as a collaborator, and, uh, this just supports the work we're doing to protect our critical infrastructure with our drinking water systems. Um, so this is a great bill and, um, encourage you to pass it. Thank you. Thank You.

Your name for the record. Um, I'm David Bowman with, uh, Jordan School District. So I'm our system and security manager. Um, this bill obviously is a big piece of it is it expands into getting assistance for K 12. I kind of wanted to give just a little bit of perspective on that. Um, in the last 18 months, more than 50% of the students in the state of Utah have been impacted by cyber crime. Um, in just my school district, we put off 4 million attempted attacks a day. Um, so that's a day, not a week, not a month. Um, what we now fight is not kids who want to hack our system and change their grades, rather it's sophisticated nation states who are trying to get the information about our most vulnerable population. Um, right now we have a lot of folks that give a lot of best effort services to try to help us out. Um, for example, we could, um, right now call on a resource that like UETN and say, Hey, we're kind of stuck. We're not sure what to do here. But ultimately, there's a pretty severe limit on what people can do to help us. Um, so we actually have our own K 12 security folks working group, and it's just a bunch of IT folks doing their best to try to make it work. Um, there was a rural school district in September that had an event where they didn't have the expertise or know what to do, and we got a van from Box Elder School District, and they drove along the Wasatch Valley and picked up a couple employees from different school districts. And then we drove up to this rural district and helped them get it taken care of over the weekend to get 'em back up and going. Um, super cool story, really bad situation for us to be in, in terms of needing assistance. Um, when we look at the importance of what, um, the cyber center and the SAC has done to help the cities and the counties and the stuff we're presenting, we just need help. We, we need help to do that. We've seen a significant investment in protecting the physical security of our students. Um, we now, we also need to make sure we're protecting their digital lives just as much as their physical lives. Thank you very much. Thank you.

Phil Bates. I am the CSO, chief Information Security Officer for the state and director of the Cyber Center. Um, we just wanna, uh, express our appreciation to Senator Harper for bringing this bill forward and trying to, to utilize a, a resource that we have in the state that I think is really special and makes us unique and, uh, make that resource available to more of a community, so, and bring more members to it. So we really appreciate this effort and support it wholly.

Thank you, Mr. Chair. Spencer Jenkins from the Utah Education and Telehealth Network. Just, uh, adding, put on the record our appreciation also to Senator Harper, to, to put forth this unified effort between, uh, the cyber center, the Utah Education and Telehealth network, local governments, and really anyone as, and as he stated, the threats that exist among one entity will exist with others. And so we look forward to the opportunity to bolster the efforts collectively, uh, because the impact, I think, will have a collective, uh, very efficient way by which we can, uh, work together in addressing these threats that continue to grow and continue to get more complex. So, thank you.

Thank you, Mr. Chair. I'd like to, um, recommend s Senate Bill 1 23 Privacy and Cybersecurity Amendments out with a Favorable recommendation.

Thank you. One thing I'd like to call out in, um, in this bill, it allows us if there are federal funds to still receive those private grants funding from other public entities as well as state dollars that puts in a fund. And the biggest change in the sub one is that we're making that the funds and that account non lapsing, besides other technical changes. Yep.

We're doing really well. Thank you, Mr. Committee, chair and all the committee. Uh, this bill. As you know, one of the issues that we are dealing with on free, you know, too frequently and unfortunately is the, uh, attack on privacy and cybersecurity and all the hacks that are going on. We have a very good, uh, Utah cyber, uh, center that has, uh, been able to help a lot of, uh, local governments with the work on, on preventing hacks and addressing ransomware and things of that nature. Nature. Uh, we've had federal funding for that program and we've had a lot of federal support, but that now is expiring. This bill goes through and adds a couple, uh, entities to the, uh, to the cybersecurity commission, goes through and expands the role and clarifies that they're also responsible to help the educational institutions, all governmental entities within the state. And it creates a cyber center restricted account. So when we get, uh, appropriations from the state to continue this program, which I'm anticipating will happen this session to keep that going, federal, uh, any federal funds that might come in, grants, uh, gifts, donations to do that, we have a place to do that. Um, this bill really enhances, uh, cooperation, collaboration, and I think it's a simple bill to move forward to ensure that we maintain, um, dominance in our cybersecurity responses.

Thank you, Mr. Chair. I did notice that LEAs were included in this, and I'm just curious to know how that will be done. We have all, we have some large LEAs that are doing this well on their, on their own. We have some smaller ones that are struggling. UETN help helps them out. Utah educational tele, tell us something, whatever it is, UETN.

Thank you. My friends will tell me in the back. Mm-hmm. I could tell so many, so many acronyms, but what it is, it allows with the addition of A-U-E-T-N person and DEQ person to go through and start working more collaboratively and bring those issues back to the commission so that those needs and the things they're saying are dealt with, and we can go through and implement the best response and, and predictive preventative measures. So it's just incorporating them and allowing this group to help out more with the locals.

Thank you, Mr. Chair. My name is Jason Air. I live in Saratoga Springs and I'm here today representing myself. I do work in K 12 education. I've worked in rural, and I've also, uh, worked now in an urban district. Uh, I'm very pleased to see this bill and would encourage you all to vote for it. The, there is a need inside of K 12 education for us to have people on our side helping defend our students. We've seen earlier in the meeting today, some of the terrible things that happens when a child or even an employee or worker's information or pictures may get out that should not get out. And this is a step we can take to fortify ourselves and, and help against these situations. Uh, this bill is great because the cyber center provides services with detection, with looking and understanding at things that we don't have access to as school districts, but they do in their role. It also allows them to help us if something is detected, to take the appropriate steps. And I appreciate the wording and the recent substitutes and the clarification there. So I'd encourage you to vote for it. And I'm very grateful for those who have worked hard to bring this to us today. Thank you.

Um, my name is, uh, David Bowman. I'm with, uh, Jordan School District. I'm our systems and security manager. Um, so as we've talked about a few things like this, just to give some scope, um, in the last two years, um, more than half of the students in the K 12 space in Utah have been been impacted by cyber threat or cyber crime. Um, right now, the way we attempt to mitigate that is a lot of best effort. Why we're still trying to teach and help things keep going. Um, anecdotally the way this works is we all kind of email each other and say, Hey, we're stuck. And what would you do in this scenario or in that scenario? Um, the students are some of the most vulnerable population that we have to protect in our state. And right now we have a resource that is built and they're helping to protect very key resources and systems. And we need that same help to protect those, um, key individuals and citizens within our purview. And I'd urge you to, um, support this bill.

Thank you. Uh, Mr. Chair. I would make a motion. Now, the sub is already adopted. Is that correct, Senator? Or do we have to adopt a sub here?

So, uh, my motion then is to, uh, pass out with a favorable recommendation, SB 1 23, privacy and cybersecurity amendments sub two. That motion is in order.

Yeah, I'll speak to this one because I've been involved with the Cyber center this year, uh, in fact, the last two years as we crafted HB 19 with the, uh, water system cybersecurity. And, uh, and what this cyber center is doing is, is critical for our state, uh, um, state companies like the education and, but all the other, uh, subdivision entities that use computers, which I think is all of them. So thank you. I recommend this bill.

I, I, I just wanna say that I believe that psych, uh, that cybersecurity for schools should be handled locally or, um, like my constituent who spoke, I'm so proud of, I mean, I, I, I would love to have him just take care of our area because I think he's amazing. Um, but this does make me a little bit uncomfortable.

Thank you. Um, no single public entity can operate in isolation with what's going on with all the attacks. Those are international, they're pretty sophisticated right now. The nature and purpose of this is to get everybody together to collaborate that when something hits one entity, an LEA or a, or a water district that are generally going after others. So, so this, so they can share that information and really respond in a timely manner. So we're all in this together, and I'd urge your support of this bill.

Thank you, Mr. Chair. I would, I would also underline the fact that, uh, the state has set up a lot of subdivisions of the state, counties, cities, they have departments, school districts, all of those. And they're all under our responsibility and the cybersecurity, which, uh, is necessary for all of those because in case there are people who didn't know, we are in actively participating in World War iii and it's a cyber war, and they're actively, we have Enemy Nation states who are actively trying to turn off the power and the water and our banking and, and all of the other things that we have in modern life. And this is, this is our duty to do this. Thank you.

No, thank you. Thank you, Senator.

Yeah, there was a, uh, uh, one, there was one section that needed to be repealed that was not included in the bill and the substitute, uh, brings in that repeal.

This bill goes through and clarifies who's on the cybersecurity board adds, uh, department of Environmental Quality and the, uh, UETN, and then creates a restricted account for funds that the legislature may appropriate for cybersecurity. And it's a coordinating bill because we're losing federal funds and we need to make sure this is a state program.

Thank you. And move that second substitute Senate Bill 1 23.

Thank you President, just off the floor for a moment. And, uh, one of my bills got cycle, uh, circled. I'm wondering if I could get, um, motion to Uncer Senate bill 2 0 2.

Thank you. Uh, this bill goes through and clarifies the, uh, practices of cybersecurity and how we deal with that. Creates restricted fund and makes technical amendments.

for a motion. Thank You. I'd move the second substitute Senate bill 1 23 pass.

Thank you Mr. President. Uh, I'll keep this brief

Motion is to circle. We'd like to speak to it. Yeah. We're, we're working on a few potential changes.

Thank you Mr. Speaker. Motion to adopt amendment number one in my name.

I would. Mr. Speaker, this is the amendment we were waiting for. Um, it clarifies that are the cybersecurity standards and best practices for government entities and local education entities are in alignment with the controls published by the Center for Internet Security. And that, uh, is what resolved the conflict.

Thank you, Mr. Speaker. Representative Senate 1 23, uh, strengthens our cybersecurity posture by expanding the role of the Utah Cyber Center to include local education agencies and adding the Department of Environmental Quality as a focused partner, a formal partner, I should say, updating the membership to include Utah Education and Telehealth network as we seek to create the infrastructure needed to support not just our municipalities and, and local political subdivisions, but also our education network.

Very exciting, but very important. Thank you, Mr. Speaker. Please vote for it. Thank

There was a slight change to a definition.