Legislature(2021 - 2022)BUTROVICH 205
02/02/2022 01:30 PM Senate JUDICIARY
Note: the audio ![]()
and video ![]()
recordings are distinct records and are obtained from different sources. As such there may be key differences between the two. The audio recordings are captured by our records offices as the official record of the meeting and will have more accurate timestamps. Use the icons to switch between them.
| Audio | Topic |
|---|---|
| Start | |
| SB119 | |
| HB155 | |
| HB3 | |
| SB31 | |
| SB129 | |
| SB118 | |
| Adjourn |
* first hearing in first committee of referral
+ teleconferenced
= bill was previously heard/scheduled
+ teleconferenced
= bill was previously heard/scheduled
| += | HB 3 | TELECONFERENCED | |
| += | HB 155 | TELECONFERENCED | |
| += | SB 31 | TELECONFERENCED | |
| += | SB 119 | TELECONFERENCED | |
| + | SB 118 | TELECONFERENCED | |
| + | TELECONFERENCED | ||
| += | SB 129 | TELECONFERENCED | |
HB 3-DEFINITION OF "DISASTER": CYBERSECURITY
1:36:08 PM
CHAIR HOLLAND announced the consideration of CS FOR HOUSE BILL
NO. 3(JUD) "An Act relating to the definition of 'disaster.'"
[The committee previously heard HB 3 on January 28, 2022.]
1:36:21 PM
CHAIR HOLLAND opened public testimony on HB 3.
1:37:05 PM
GREGG BRELSFORD, representing self, Anchorage, Alaska, spoke in
support of HB 3. He provided his background, including that he
previously served as the borough manager for the Bristol Bay
Borough (BBB) from 2018 to 2020 and as the interim city manager
for the City of Dillingham in 2021. He emphasized the importance
of HB 3 since it would expand the existing state law definition
of disaster to include cyber attacks.
1:38:44 PM
Mr. BRELSFORD related that he was BBB's manager when cyber
terrorists made ransom demands against the Matanuska-Susitna
Borough (MSB) and the City of Valdez. This was a wake-up call to
Alaskan communities and the Alaska Municipal League due to the
potential harm cyber attacks could cause. The Department of
Health and Social Services (DHSS) and the Alaska Court System
(ACS) also suffered damaging cyber attacks last year. He said
increases in cyber attacks represent a serious concern
throughout the state. HB 3 would provide a reasonable and timely
response by recognizing the scope and seriousness of cyber
attack risks and threats. The bill would allow the state's
system to respond to cyber attacks quickly.
1:39:53 PM
MR. BRELSFORD suggested the committee consider adding the
language "or a political subdivision of the state" to line to
subparagraph (F) on page 2, line 31. He stated that the language
beginning on line 29 would read:
"...; in this subparagraph, "critical infrastructure"
means systems and assets, whether physical or virtual,
so vital to the state or a political subdivision of
the state that the incapacity or destruction of the
systems and assets would have a debilitating effect on
security, state economic security, state public health
or safety, or any combination of those matters;
1:40:43 PM
MR. BRELSFORD explained that all of the proposed preceding
language explicitly reads "or a political subdivision of the
state." He said adding this language to subparagraph (F) would
provide continuity and clarity.
MR. BRELSFORD acknowledged that some people might be concerned
that adding "cyber attack" to the definition of disaster would
expand the governor's power. First, he opined that HB 3 would
not do so because it would merely clarify that the state could
exercise its power to address one of the newest threats to
governmental operations. Second, as borough manager, he served
as the COVID-19 incident commander of the two largest municipal
governments in Bristol Bay during the first two years of COVID-
19. For one month, about 10,000 fishery workers and fishermen
descended into Bristol Bay from all over the world for the
commercial sockeye salmon fishery.
MR. BRELSFORD related that for two summers, Bristol Bay became
the hottest COVID-19 risk zone in the state. His staff worked
with the executive branch's disaster policy cabinet, including
the Alaska Department of Military & Veterans Affairs (DMVA)
Division of Homeland Security and Emergency Management. He
characterized the executive branch's efforts as competent,
tireless, and working in good faith with the BBB and others in
the state to jointly mitigate COVID-19 risks and threats. Based
on his first-hand experience, he was not concerned that the
executive branch might misuse its already existing disaster
response capabilities.
1:43:43 PM
SENATOR HUGHES referred to page 2, line 31 of HB 3, Version W,
and asked if his suggestion was to add "or political
subdivision" after "state."
MR. BRELSFORD restated his suggested language. On page 2, line
31 of HB 3, Version W, after state, add, "or a political
subdivision of the state ...."
SENATOR HUGHES noted the language uses the phrase "or a
political subdivision of the state ...." She asked whether this
language should also be added to the last page of the bill
regarding the debilitating effect. She noted that Mr. Brelsford
mentioned the Valdez cyber security attack was an attack of a
political subdivision rather than the state.
MR. BRELSFORD agreed with Senator Hughes. He acknowledged that
he considered it, decided that adding the language on page 2,
line 31 would cover it, but now he was unsure. He emphasized
that the goal was to ensure the expanded definition in the bill
would apply to the state and to a political subdivision of the
state.
SENATOR HUGHES suggested that the sponsor or cybersecurity
expert might help the committee sort through this issue.
1:46:00 PM
SENATOR KIEHL recalled speaking with Legislative Legal attorneys
and perhaps the sponsor when the committee considered the bill
last year. He explained that the mentioned provisions relate to
a cyber attack's effect on the state. He referred to the
language on page 2, line 3, "in or against the state ...."
Subsequent language in subparagraph (F) refers to the systems
owned or operated by the state. Thus, subparagraph (F) speaks
not to state systems but to the cyber attack's effect on those
systems. Since subparagraph (F) refers to the broader use of
state, it is comparable to the language on page 2, line [3].
Therefore, he said he believes the language is acceptable.
1:47:16 PM
CHAIR HOLLAND closed public testimony on HB 3.
1:47:20 PM
At ease
1:48:17 PM
CHAIR HOLLAND reconvened the meeting. He related that Senator
Kiehl explained that the language in the bill refers to the all-
encompassing state, so it would not be necessary to add language
to have it apply to a political subdivision.
1:48:42 PM
SENATOR HUGHES asked whether the sponsor was comfortable that
the language in the bill would ensure that the state's economic
security or state's public health or safety would also apply to
a political subdivision.
1:49:18 PM
REPRESENTATIVE DELENA JOHNSON, Alaska State Legislature, Juneau,
Alaska, speaking as sponsor of HB 3, stated that she worked with
the Alaska Municipal League on the language related to a
political subdivision. She related her understanding that when
the bill refers to the state, it means the all-encompassing
state. When the bill refers to political subdivisions, it means
the state's oversight and administration of the political
subdivisions, including cities or municipalities.
1:50:22 PM
SENATOR HUGHES referred to page 2, line 31, to the language
"vital to the state ..." She referred to the language on page 3,
line 1, "would have a debilitating effect" and interpreted it to
mean that it could specifically refer to one borough of the
state being affected. She asked if HB 3 had been in effect when
MSB experienced the cybersecurity attack, whether it would have
allowed a disaster declaration to move forward.
REPRESENTATIVE JOHNSON answered yes. She explained that if a
cyber attack were widespread and critical, it would apply. Even
though the cyber attack affecting the Mat-Su Borough was
widespread and debilitating, lasting for months, the borough
could not independently ask the FBI to investigate the
cybersecurity attack. Eventually, the FBI became involved.
Still, suppose the disaster declaration statute had referred to
a political subdivision. In that case, MSB could have worked
directly with the FBI instead of resorting to a much more
complicated process to get assistance.
1:52:50 PM
SENATOR HUGHES stated that based on the discussion, she
understood that the language on page 2, line 31, and page 3,
line 1 included a political subdivision of the state.
REPRESENTATIVE JOHNSON reiterated that she worked with the
legislative drafters and the Alaska Municipal League to develop
this language. She said she was unsure whether it would be
harmful to add the language but decided that as long as the
record reflects that this language would apply to a political
subdivision of the state, the committee has done its due
diligence.
1:54:23 PM
CHAIR HOLLAND solicited amendments on HB 3.
1:54:30 PM
SENATOR KIEHL moved to adopt Amendment 1, work order 32-
LS20041.W.8.
32-LS0041\W.8
Dunmire
5/11/21
AMENDMENT 1
OFFERED IN THE SENATE BY SENATOR KIEHL
TO: CSHB 3(JUD)
Page 2, line 17, following "attack":
Insert "or serious cyber incident"
Page 2, line 22:
Delete "cyber event"
Insert "serious cyber incident"
Page 2, line 29, through page 3, line 2:
Delete ""critical infrastructure" means systems
and assets, whether physical or virtual, so vital to
the state that the incapacity or destruction of the
systems and assets would have a debilitating effect on
security, state economic security, state public health
or safety, or any combination of those matters;"
Insert "(i) "critical infrastructure" means
systems and assets, whether physical or virtual, so
vital to the state that the incapacity or destruction
of the systems and assets would have a debilitating
effect on security, state economic security, state
public health or safety, or any combination of those
matters;
(ii) "serious cyber incident" means an
incident that has a confirmed effect on the
confidentiality, integrity, or availability of systems
and data, has legal or privacy implications, affects
other agencies, or requires security experience or
resources not otherwise available;"
CHAIR HOLLAND objected for discussion purposes.
1:55:00 PM
SENATOR KIEHL related that the bill addresses cyber attacks and
cyber events. Amendment 1 would delete "cyber event" and replace
it with "serious cyber incident" and define it. He explained
that the National Institute for Standards and Technology and the
federal General Services Administration have definitions for
"serious cyber incidents." He related that the bill would define
both terms, consistent with federal agency definitions. He said
the sponsor did not object. He reminded members that a cyber
attack or serious incident must meet the current statutory
definition of a disaster. He referred to page 1, lines 4-5 of HB
3, which read, "(2) "disaster" means the occurrence or imminent
threat of widespread or severe damage, injury, loss of life or
property, or shortage of food, water, or fuel resulting from
...." He said the definition of "cyber incident" means "an
incident that has a confirmed effect on the confidentiality,
integrity, or availability of systems and data ...." He
cautioned that this definition would not apply to a personal
account being hacked or if BASIS were to go down and the
legislature could not use it.
1:56:29 PM
SENATOR SHOWER asked the sponsor to state their view of
Amendment 1.
REPRESENTATIVE D. JOHNSON said that she was "okay" with
Amendment 1; the definition would add clarification.
1:57:52 PM
CHRIS LETTERMAN, Chief Information Security Officer, Department
of Administration, Juneau, Alaska, stated that the
administration reviewed Amendment 1 and did not have any
concerns. He said Amendment 1 provides helpful, clarifying
language.
1:58:42 PM
CHAIR HOLLAND removed his objection; heard no further objection,
and Amendment 1 was adopted.
1:59:05 PM
SENATOR MYERS stated that he was initially skeptical when HB 3
was brought to the committee, since the Alaska Disaster Act has
such broad powers. He wondered how to constrain the language to
ensure that it only applies to events that warranted a disaster
declaration, including a pipeline, electrical grid, or a bank
attack that disabled those systems. In the past 24 months, the
Division of Elections and the Alaska Court System suffered
terrible attacks but they did not rise to a disaster declaration
level. He acknowledged that his concerns were not related to HB
3 but to the Alaska Disaster Act, which should be updated. He
recognized that such an undertaking would likely not happen this
year. Still, he said it was important to remember that disaster
declarations must be applied appropriately.
2:01:20 PM
CHAIR HOLLAND solicited the will of the committee.
2:01:29 PM
SENATOR SHOWER moved to report HB 3, work order 31-LS0041\W, as
amended, from committee with individual recommendations and
attached fiscal notes.
CHAIR HOLLAND heard no objection, and SCS CSHB 3(JUD) was
reported from the Senate Judiciary Standing Committee.
| Document Name | Date/Time | Subjects |
|---|---|---|
| SB 119 Sponsor's Statement.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 119 |
| SB 119 Sectional Final.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 119 |
| SB 31 - Sectional Analysis.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 31 |
| SB 31 - Sponsor Statement.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 31 |
| HB 3 Amendment (SJUD).pdf |
SJUD 2/2/2022 1:30:00 PM |
HB 3 |
| SB 129 SJUD Amendment O.3.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 129 |
| SB 129 SJUD Amendment O.4.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 129 |
| SB 129 SJUD Amendment O.2.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 129 |
| SJC - SB 119 Testimony, 2022-2-1.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 119 |
| HB 3 Public Testimony.pdf |
SJUD 2/2/2022 1:30:00 PM |
HB 3 |
| SB 119 SJUD Public Testimony through 2.12.22.pdf |
SJUD 2/2/2022 1:30:00 PM |
SB 119 |