HB5426: SUMMARY OF HOUSE-PASSED BILL IN COMMITTEE (Date Completed: 11-12-20)

CONTENT

House Bill 5426 (H-1) would amend the Cyber Civilian Corps Act to do the following:

-- Allow the Department of Technology, Management and Budget (DTMB) to appoint individuals to serve as Michigan Cyber Civilian Corps (MiC3) advisors to facilitate the DTMB's responsibilities under the Act.

-- Require the DTMB to enter into a contract with any individual who wished to accept an invitation from the DTMB to serve as a MiC3 volunteer or advisor and met the qualifying criteria for those positions as determined by the Michigan Cyber Civilian Corps Advisory Board.

-- Modify requirements related to volunteer contracts, background checks, liabilities, and protections for an MiC3 volunteer to apply to an MiC3 advisor.

-- Specify that if a background check resulted in previous criminal history, an individual could appeal to the Director of the DTMB or his or her designee for nondeployable MiC3 advisor status.

-- Prohibit the MiC3 volunteers or advisors from engaging in training until either the background check or appeal regarding the background check's process had been completed.

-- Modify various terms and definitions.

House Bill 5427 (H-1) would amend the Cyber Civilian Corps Act to do the following:

-- Require the MiC3 Advisory Board to meet at least twice annually and to review and make recommendations on individuals applying for nondeployable advisor status.

-- Require the State's Chief Information Officer (CIO), after consultation with the Advisory Board, to establish and maintain a formal process to track volunteer and advisor training and compliance with certain standards as determined by the DTMB.

-- Require the DTMB, after consultation with the Advisory Board, to publish an explanation of the process by which the MiC3 would select and prioritize which prospective clients should receive assistance.

-- Allow the DTMB to provide appropriate training to existing MiC3 advisors.

The bills are tie-barred.

House Bill 5426 (H-1)

Critical Infrastructure

Under the Act, "Michigan Cyber Civilian Corps" means the program established by the Act under which civilian volunteers who have expertise in addressing cybersecurity incidents may volunteer at the invitation of the DTMB to provide rapid response assistance to municipal, educational, nonprofit, or business organization in need of expert assistance during a cybersecurity incident. The bill would delete the reference to a "business organization" and replace it with the term "critical infrastructure". "Critical infrastructure" would mean systems and assets, whether physical or virtual, so vital to the United States or Michigan that the incapacity or destruction of that system or asset would have a debilitating impact on security, economic security, public health or safety, or any combination of these as determined by the DTMB.

Volunteers & Advisors

The Act allows the DTMB to appoint individuals to serve as MiC3 volunteers to facilitate the DTMB's responsibilities as provided in the Act. Under the bill, the DTMB also could appoint individuals to serve as MiC3 advisors for the same purpose.

The Act defines "Michigan Cyber Civilian Corps volunteer" as an individual who has entered into a volunteer agreement with the DTMB to serve as a volunteer in the MiC3. The bill would modify this definition to refer to a deployable volunteer. In addition, the bill would define "Michigan Cyber Civilian Corps advisor" as an individual who had entered into a volunteer agreement with the DTMB to serve as a nondeployable advisor in the MiC3.

"Volunteer agreement" as the contract entered into between the DTMB and a Michigan Cyber Civilian Corps volunteer under the Act. Under the bill, the term also would mean the contract entered into between the DTMB and a MiC3 advisor.

Contract

Under the Act, the DTMB must enter into a contract with any individual who wishes to accept an invitation to serve as a MiC3 volunteer. The bill would require the DTMB to enter into a contract with any individual who wished to accept an invitation from the DTMB to serve as a MiC3 volunteer or advisor and met the qualifying criteria for those positions as determined by the Advisory Board.

The Act requires the contract to include certain provisions, including the following:

-- A provision protecting from disclosure any confidential information of the State, State residents, or clients acquired by the volunteer through participation in the MiC3.

-- A provision requiring the MiC3 volunteer to comply with all existing DTMB security policies and procedures regarding information technology resources.

-- A provision requiring the MiC3 volunteer to consent to background screening, and a section in which the individual consents to the screening.

-- A provision requiring the MiC3 volunteer to attest that he or she meets any standards of expertise that may be established by the DTMB.

Under the bill, these provisions also would apply to an MiC3 advisor.

The Act defines "client" as a municipal, educational, nonprofit, or business organization that has requested and is using the rapid response assistance of the MiC3 under the direction of the DTMB. The bill would delete the reference to a "business organization" and replace it with the term "critical infrastructure".

Background Check

Under the Act, when an individual accepts an invitation to serve as an MiC3 volunteer, the DTMB must request the Department of State Police (MSP) to conduct a criminal history check and a criminal records check through the Federal Bureau of Investigation (FBI) on the individual. Within a reasonable time after receiving a request by the DTMB for a criminal history and records check on an individual, the MSP must conduct the criminal history check and provide a report of the results to the DTMB. The report must indicate that the individual is cleared or not cleared to become an MiC3 volunteer. In addition, within a reasonable time after receiving a request, the MSP must initiate the criminal records check with the FBI, and after receiving the results, the MSP must provide a report to the DTMB that indicates that the individual is cleared or not cleared to become an MiC3 volunteer. Under the bill, these requirements also would apply to individuals who wished to participate as MiC3 advisors.

Under the Act, when the MSP is able to participate with the FBI automatic notification system, then any subsequent arrest fingerprint submitted to the FBI also must be reviewed by the MSP, and the MSP must provide a report to the DTMB that indicated that the individual remains clear or is no longer clear to continue as an MiC3 volunteer. The bill specifies that this requirement also would apply to an MiC3 advisor.

Under the bill, if a background check resulted in previous criminal history, the individual could appeal to the Director of the DTMB or his or her designee for nondeployable MiC3 advisor status. In addition, the bill would prohibit the MiC3 volunteers or advisors from engaging in training until either the background check or appeal regarding the background check's process had been completed.

Liability

Under the Act, an MiC3 volunteer is not an agent, employee, or independent contractor of the State for any purpose and has no authority to bind the State regarding third parties. The Act also specifies that the State is not liable to an MiC3 volunteer for personal injury or property damage suffered by the MiC3 volunteer through participation in the MiC3. Under the bill, these provisions also would apply to MiC3 advisors.

The Act specifies that, except as otherwise provided, the DTMB and the State are immune from tort liability for acts or omissions by an MiC3 volunteer. Except as otherwise provided, and without regard to discretionary or ministerial nature of the conduct or an MiC3 volunteer, each MiC3 volunteer is immune from tort liability for an injury to a person or damage to property that occurred while deployed and acting on behalf of the DTMB if all the following are met:

-- The MiC3 volunteer is acting or reasonably believes that he or she is acting within the scope of his or her authority.

-- The MiC3 volunteer's conduct does not amount to gross negligence that is the proximate cause of the injury or damage.

-- The MiC3 volunteer's conduct is not a material breach of the volunteer agreement during the deployment.

The bill specifies that these provisions would apply to an MiC3 advisor.

Under the Act, if a claim is made or a civil action is commenced against an MiC3 volunteer for injuries to entities or property cause by negligence of an MiC3 volunteer that occurred while in the course of his or her deployment on behalf of the DTMB and while acting within the scope of his or her authority, the DTMB may pay for, engage, or furnish the services of an attorney to advise the MiC3 volunteer as to the claim and to appear for and represent the volunteer in the action. The DTMB may compromise, settle, and pay the claim before or after the commencement of a civil action. Whenever a judgment for damages is awarded against an MiC3 volunteer as a result of a civil action for personal injuries or property damage caused by the MiC3 volunteer while in the course of his or her authority, the DTMB may indemnify the MiC3 volunteer or pay, settle, or compromise the judgment. Under the bill, these provisions would apply to an MiC3 advisor.

The Act specifies that if a criminal action is commenced against an MiC3 volunteer based upon the conduct of the MiC3 volunteer in the course of his or her deployment, if the MiC3 volunteer had a reasonable basis for believing that he or she was acting within the scope of his or her authority at the time of the alleged conduct, the DTMB may pay for, engage, or furnish services of an attorney to advise the MiC3 as to the action, and to appear for and represent the MiC3 volunteer in the action. An MiC3 volunteer who has incurred legal expenses for conduct prescribed above may obtain reimbursement for those expenses. Under the bill, these provisions would apply to an MiC3 advisor.

House Bill 5427 (H-1)

The Act creates the MiC3 Advisory Board as an advisory body within the DTMB that consists of the Adjutant General, the Director of the DTMB, the Director of the MSP, and the Director of the Department of Labor and Economic Opportunity (LEO) or their designees. The bill would require the Advisory Board to meet at least twice annually and to review and make recommendations on individuals applying for nondeployable advisor status.

Under the Act, after consultation with the Advisory Board, the CIO must do the following:

-- Approve the set of tools that the MiC3 may use in response to a cybersecurity incident.

-- Determine the standards of expertise necessary for an individual to become a member of the MiC3.

Under the bill, the CIO also would have to establish and maintain a formal process to track volunteer and advisor training and compliance with standards as determined by the DTMB. (The Act defines "Chief Information Officer" as the individual within the DTMB designated by the Governor as the CIO for the State.)

The Act also requires the DTMB, after consultation with the Advisory Board, to publish guidelines for the operation of the MiC3 program. At a minimum, the published guidelines must include the following:

-- An explanation of the standard the DTMB will use to determine whether an individual may serve as an MiC3 volunteer and an explanation of the process by which an individual may become an MiC3 volunteer.

-- An explanation of the requirements the DTMB will impose for a client to receive the assistance of the MiC3 and an explanation of the process by which a client may request and receive the assistance of the MiC3.

Under the bill, the published guidelines also would have to include an explanation of the process by which the MiC3 would select and prioritize which prospective clients should receive assistance.