Legislature(2021 - 2022)BUTROVICH 205
02/02/2022 01:30 PM Senate JUDICIARY
Note: the audio and video recordings are distinct records and are obtained from different sources. As such there may be key differences between the two. The audio recordings are captured by our records offices as the official record of the meeting and will have more accurate timestamps. Use the icons to switch between them.
Audio | Topic |
---|---|
Start | |
SB119 | |
HB155 | |
HB3 | |
SB31 | |
SB129 | |
SB118 | |
Adjourn |
* first hearing in first committee of referral
+ teleconferenced
= bill was previously heard/scheduled
+ teleconferenced
= bill was previously heard/scheduled
+= | HB 3 | TELECONFERENCED | |
+= | HB 155 | TELECONFERENCED | |
+= | SB 31 | TELECONFERENCED | |
+= | SB 119 | TELECONFERENCED | |
+ | SB 118 | TELECONFERENCED | |
+ | TELECONFERENCED | ||
+= | SB 129 | TELECONFERENCED | |
HB 3-DEFINITION OF "DISASTER": CYBERSECURITY 1:36:08 PM CHAIR HOLLAND announced the consideration of CS FOR HOUSE BILL NO. 3(JUD) "An Act relating to the definition of 'disaster.'" [The committee previously heard HB 3 on January 28, 2022.] 1:36:21 PM CHAIR HOLLAND opened public testimony on HB 3. 1:37:05 PM GREGG BRELSFORD, representing self, Anchorage, Alaska, spoke in support of HB 3. He provided his background, including that he previously served as the borough manager for the Bristol Bay Borough (BBB) from 2018 to 2020 and as the interim city manager for the City of Dillingham in 2021. He emphasized the importance of HB 3 since it would expand the existing state law definition of disaster to include cyber attacks. 1:38:44 PM Mr. BRELSFORD related that he was BBB's manager when cyber terrorists made ransom demands against the Matanuska-Susitna Borough (MSB) and the City of Valdez. This was a wake-up call to Alaskan communities and the Alaska Municipal League due to the potential harm cyber attacks could cause. The Department of Health and Social Services (DHSS) and the Alaska Court System (ACS) also suffered damaging cyber attacks last year. He said increases in cyber attacks represent a serious concern throughout the state. HB 3 would provide a reasonable and timely response by recognizing the scope and seriousness of cyber attack risks and threats. The bill would allow the state's system to respond to cyber attacks quickly. 1:39:53 PM MR. BRELSFORD suggested the committee consider adding the language "or a political subdivision of the state" to line to subparagraph (F) on page 2, line 31. He stated that the language beginning on line 29 would read: "...; in this subparagraph, "critical infrastructure" means systems and assets, whether physical or virtual, so vital to the state or a political subdivision of the state that the incapacity or destruction of the systems and assets would have a debilitating effect on security, state economic security, state public health or safety, or any combination of those matters; 1:40:43 PM MR. BRELSFORD explained that all of the proposed preceding language explicitly reads "or a political subdivision of the state." He said adding this language to subparagraph (F) would provide continuity and clarity. MR. BRELSFORD acknowledged that some people might be concerned that adding "cyber attack" to the definition of disaster would expand the governor's power. First, he opined that HB 3 would not do so because it would merely clarify that the state could exercise its power to address one of the newest threats to governmental operations. Second, as borough manager, he served as the COVID-19 incident commander of the two largest municipal governments in Bristol Bay during the first two years of COVID- 19. For one month, about 10,000 fishery workers and fishermen descended into Bristol Bay from all over the world for the commercial sockeye salmon fishery. MR. BRELSFORD related that for two summers, Bristol Bay became the hottest COVID-19 risk zone in the state. His staff worked with the executive branch's disaster policy cabinet, including the Alaska Department of Military & Veterans Affairs (DMVA) Division of Homeland Security and Emergency Management. He characterized the executive branch's efforts as competent, tireless, and working in good faith with the BBB and others in the state to jointly mitigate COVID-19 risks and threats. Based on his first-hand experience, he was not concerned that the executive branch might misuse its already existing disaster response capabilities. 1:43:43 PM SENATOR HUGHES referred to page 2, line 31 of HB 3, Version W, and asked if his suggestion was to add "or political subdivision" after "state." MR. BRELSFORD restated his suggested language. On page 2, line 31 of HB 3, Version W, after state, add, "or a political subdivision of the state ...." SENATOR HUGHES noted the language uses the phrase "or a political subdivision of the state ...." She asked whether this language should also be added to the last page of the bill regarding the debilitating effect. She noted that Mr. Brelsford mentioned the Valdez cyber security attack was an attack of a political subdivision rather than the state. MR. BRELSFORD agreed with Senator Hughes. He acknowledged that he considered it, decided that adding the language on page 2, line 31 would cover it, but now he was unsure. He emphasized that the goal was to ensure the expanded definition in the bill would apply to the state and to a political subdivision of the state. SENATOR HUGHES suggested that the sponsor or cybersecurity expert might help the committee sort through this issue. 1:46:00 PM SENATOR KIEHL recalled speaking with Legislative Legal attorneys and perhaps the sponsor when the committee considered the bill last year. He explained that the mentioned provisions relate to a cyber attack's effect on the state. He referred to the language on page 2, line 3, "in or against the state ...." Subsequent language in subparagraph (F) refers to the systems owned or operated by the state. Thus, subparagraph (F) speaks not to state systems but to the cyber attack's effect on those systems. Since subparagraph (F) refers to the broader use of state, it is comparable to the language on page 2, line [3]. Therefore, he said he believes the language is acceptable. 1:47:16 PM CHAIR HOLLAND closed public testimony on HB 3. 1:47:20 PM At ease 1:48:17 PM CHAIR HOLLAND reconvened the meeting. He related that Senator Kiehl explained that the language in the bill refers to the all- encompassing state, so it would not be necessary to add language to have it apply to a political subdivision. 1:48:42 PM SENATOR HUGHES asked whether the sponsor was comfortable that the language in the bill would ensure that the state's economic security or state's public health or safety would also apply to a political subdivision. 1:49:18 PM REPRESENTATIVE DELENA JOHNSON, Alaska State Legislature, Juneau, Alaska, speaking as sponsor of HB 3, stated that she worked with the Alaska Municipal League on the language related to a political subdivision. She related her understanding that when the bill refers to the state, it means the all-encompassing state. When the bill refers to political subdivisions, it means the state's oversight and administration of the political subdivisions, including cities or municipalities. 1:50:22 PM SENATOR HUGHES referred to page 2, line 31, to the language "vital to the state ..." She referred to the language on page 3, line 1, "would have a debilitating effect" and interpreted it to mean that it could specifically refer to one borough of the state being affected. She asked if HB 3 had been in effect when MSB experienced the cybersecurity attack, whether it would have allowed a disaster declaration to move forward. REPRESENTATIVE JOHNSON answered yes. She explained that if a cyber attack were widespread and critical, it would apply. Even though the cyber attack affecting the Mat-Su Borough was widespread and debilitating, lasting for months, the borough could not independently ask the FBI to investigate the cybersecurity attack. Eventually, the FBI became involved. Still, suppose the disaster declaration statute had referred to a political subdivision. In that case, MSB could have worked directly with the FBI instead of resorting to a much more complicated process to get assistance. 1:52:50 PM SENATOR HUGHES stated that based on the discussion, she understood that the language on page 2, line 31, and page 3, line 1 included a political subdivision of the state. REPRESENTATIVE JOHNSON reiterated that she worked with the legislative drafters and the Alaska Municipal League to develop this language. She said she was unsure whether it would be harmful to add the language but decided that as long as the record reflects that this language would apply to a political subdivision of the state, the committee has done its due diligence. 1:54:23 PM CHAIR HOLLAND solicited amendments on HB 3. 1:54:30 PM SENATOR KIEHL moved to adopt Amendment 1, work order 32- LS20041.W.8. 32-LS0041\W.8 Dunmire 5/11/21 AMENDMENT 1 OFFERED IN THE SENATE BY SENATOR KIEHL TO: CSHB 3(JUD) Page 2, line 17, following "attack": Insert "or serious cyber incident" Page 2, line 22: Delete "cyber event" Insert "serious cyber incident" Page 2, line 29, through page 3, line 2: Delete ""critical infrastructure" means systems and assets, whether physical or virtual, so vital to the state that the incapacity or destruction of the systems and assets would have a debilitating effect on security, state economic security, state public health or safety, or any combination of those matters;" Insert "(i) "critical infrastructure" means systems and assets, whether physical or virtual, so vital to the state that the incapacity or destruction of the systems and assets would have a debilitating effect on security, state economic security, state public health or safety, or any combination of those matters; (ii) "serious cyber incident" means an incident that has a confirmed effect on the confidentiality, integrity, or availability of systems and data, has legal or privacy implications, affects other agencies, or requires security experience or resources not otherwise available;" CHAIR HOLLAND objected for discussion purposes. 1:55:00 PM SENATOR KIEHL related that the bill addresses cyber attacks and cyber events. Amendment 1 would delete "cyber event" and replace it with "serious cyber incident" and define it. He explained that the National Institute for Standards and Technology and the federal General Services Administration have definitions for "serious cyber incidents." He related that the bill would define both terms, consistent with federal agency definitions. He said the sponsor did not object. He reminded members that a cyber attack or serious incident must meet the current statutory definition of a disaster. He referred to page 1, lines 4-5 of HB 3, which read, "(2) "disaster" means the occurrence or imminent threat of widespread or severe damage, injury, loss of life or property, or shortage of food, water, or fuel resulting from ...." He said the definition of "cyber incident" means "an incident that has a confirmed effect on the confidentiality, integrity, or availability of systems and data ...." He cautioned that this definition would not apply to a personal account being hacked or if BASIS were to go down and the legislature could not use it. 1:56:29 PM SENATOR SHOWER asked the sponsor to state their view of Amendment 1. REPRESENTATIVE D. JOHNSON said that she was "okay" with Amendment 1; the definition would add clarification. 1:57:52 PM CHRIS LETTERMAN, Chief Information Security Officer, Department of Administration, Juneau, Alaska, stated that the administration reviewed Amendment 1 and did not have any concerns. He said Amendment 1 provides helpful, clarifying language. 1:58:42 PM CHAIR HOLLAND removed his objection; heard no further objection, and Amendment 1 was adopted. 1:59:05 PM SENATOR MYERS stated that he was initially skeptical when HB 3 was brought to the committee, since the Alaska Disaster Act has such broad powers. He wondered how to constrain the language to ensure that it only applies to events that warranted a disaster declaration, including a pipeline, electrical grid, or a bank attack that disabled those systems. In the past 24 months, the Division of Elections and the Alaska Court System suffered terrible attacks but they did not rise to a disaster declaration level. He acknowledged that his concerns were not related to HB 3 but to the Alaska Disaster Act, which should be updated. He recognized that such an undertaking would likely not happen this year. Still, he said it was important to remember that disaster declarations must be applied appropriately. 2:01:20 PM CHAIR HOLLAND solicited the will of the committee. 2:01:29 PM SENATOR SHOWER moved to report HB 3, work order 31-LS0041\W, as amended, from committee with individual recommendations and attached fiscal notes. CHAIR HOLLAND heard no objection, and SCS CSHB 3(JUD) was reported from the Senate Judiciary Standing Committee.
Document Name | Date/Time | Subjects |
---|---|---|
SB 119 Sponsor's Statement.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 119 |
SB 119 Sectional Final.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 119 |
SB 31 - Sectional Analysis.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 31 |
SB 31 - Sponsor Statement.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 31 |
HB 3 Amendment (SJUD).pdf |
SJUD 2/2/2022 1:30:00 PM |
HB 3 |
SB 129 SJUD Amendment O.3.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 129 |
SB 129 SJUD Amendment O.4.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 129 |
SB 129 SJUD Amendment O.2.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 129 |
SJC - SB 119 Testimony, 2022-2-1.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 119 |
HB 3 Public Testimony.pdf |
SJUD 2/2/2022 1:30:00 PM |
HB 3 |
SB 119 SJUD Public Testimony through 2.12.22.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 119 |