HOUSE BILL NO. 5426
January 30, 2020, Introduced by Reps. Hall,
Schroeder, Webber, VanWoerkom, LaFave and LaGrand and referred to the
Committee on Oversight.
A bill to amend 2017 PA 132, entitled
"Cyber civilian corps act,"
by amending sections 2, 3, 4, 5, 6, and 7 (MCL 18.222, 18.223, 18.224, 18.225, 18.226, and 18.227).
the people of the state of michigan enact:
(a) "Advisory
board" means the Michigan cyber civilian corps advisory board created
under section 9.
(b) "Chief
information officer" means the individual within the department designated
by the governor as the chief information officer for this state.
(c) "Client"
means a municipal, educational, nonprofit, or business critical infrastructure organization that has
requested and is using the rapid response assistance of the Michigan cyber
civilian corps under the direction of the department.
(d) "Cybersecurity
incident" means an event occurring on or conducted through a computer
network that actually or imminently jeopardizes the integrity, confidentiality,
or availability of computers, information or communications systems or
networks, physical or virtual infrastructure controlled by computers or
information systems, or information resident on any of these. Cybersecurity
incident includes, but is not limited to, the existence of a vulnerability in
an information system, system security procedures, internal controls, or
implementation that is subject to exploitation.
(e)
"Department" means the department of technology, management, and
budget.
(f)
"Michigan cyber civilian corps advisor" or "advisor" means
an individual who has entered into a volunteer agreement with the department to
serve as a nondeployable advisor in the Michigan cyber civilian corps.
(g)
(f) "Michigan cyber civilian corps" means the
program established by this act under which civilian volunteers who have
expertise in addressing cybersecurity incidents may volunteer at the invitation
of the department to provide rapid response assistance to a municipal,
educational, nonprofit, or business critical infrastructure organization in
need of expert assistance during a cybersecurity incident.
(h)
(g) "Michigan cyber civilian corps volunteer"
means an individual who has entered into a volunteer agreement with the
department to serve as a deployable volunteer
in the Michigan cyber civilian corps.
(i)
(h) "Volunteer agreement" means the contract
entered into between the department and a Michigan cyber civilian corps
volunteer or advisor under
section 4.
Sec. 3. The department may appoint individuals to
serve as Michigan cyber civilian corps volunteers and Michigan cyber civilian corps advisors for the
purposes of facilitating the responsibilities of the department as provided in
this act.
Sec. 4. The department shall enter into a contract
with any individual who wishes to accept an invitation by the department to
serve as a Michigan cyber civilian corps volunteer or Michigan cyber civilian corps advisor and meets the qualifying
criteria for those positions as determined by the advisory board.
The contract must include, at a minimum, all of the following:
(a) A provision
acknowledging the confidentiality of information relating to this state, state
residents, and clients.
(b) A provision
protecting from disclosure any confidential information of this state, state
residents, or clients acquired by the Michigan cyber civilian corps volunteer or advisor through participation in the
Michigan cyber civilian corps.
(c) A provision requiring
the Michigan cyber civilian corps volunteer to avoid conflicts of interest that
might arise from a particular deployment.
(d) A provision requiring
the Michigan cyber civilian corps volunteer or advisor to comply with all existing department
security policies and procedures regarding information technology resources.
(e) A provision requiring
the Michigan cyber civilian corps volunteer to consent to background screening
considered appropriate by the department under this act, and a section in which
the individual gives that consent as described in section 5.
(f) A provision requiring
the Michigan cyber civilian corps volunteer or advisor to attest that he or she meets any
standards of expertise that may be established by the department.
Sec. 5. (1) When an individual accepts an invitation
to serve as a Michigan cyber civilian corps volunteer or advisor as described in section 4, the department
shall request the department of state police to do both of the following:
(a) Conduct a criminal
history check on the individual.
(b) Conduct a criminal
records check through the Federal Bureau of Investigation on the individual.
(2) An individual who
accepts an invitation to the Michigan cyber civilian corps shall give written
consent in the volunteer agreement for the department of state police to
conduct the criminal history check and criminal records check required under
this section. The department shall require the individual to submit his or her
fingerprints to the department of state police and the Federal Bureau of
Investigation for the criminal records check.
(3) The department shall
request a criminal history check and criminal records check under this section
on all individuals who wish to participate as Michigan cyber civilian corps
volunteers or advisors. The
department shall make the request on a form and in the manner prescribed by the
department of state police.
(4) Within a reasonable
time after receiving a complete request by the department for a criminal history
check and criminal records check on an individual under this section, the
department of state police shall conduct the criminal history check and provide
a report of the results to the department. The report must indicate that the
individual is cleared or not cleared to become a Michigan cyber civilian corps
volunteer or advisor.
(5) Within a reasonable
time after receiving a proper request by the department for a criminal records
check on an individual under this section, the department of state police shall
initiate the criminal records check with the Federal Bureau of Investigation.
After receiving the results of the criminal records check from the Federal
Bureau of Investigation, the department of state police shall provide a report
to the department that indicates that the individual is cleared or not cleared
to become a Michigan cyber civilian corps volunteer or advisor.
(6) If a criminal arrest
fingerprint is subsequently submitted to the department of state police and
matches against a fingerprint that was submitted pursuant to this act and
stored in its automated fingerprint identification system (AFIS) database, the
department of state police shall notify the department that the individual is
still cleared or is no longer cleared to continue as a Michigan cyber civilian
corps volunteer. When the department of state police is able to participate
with the Federal Bureau of Investigation automatic notification system, then
any subsequent arrest fingerprint submitted to the Federal Bureau of Investigation
must also be reviewed by the department of state police. The department of
state police shall provide a report to the department that indicates that the
individual is still cleared or is no longer cleared to continue as a Michigan
cyber civilian corps volunteer or advisor.
(7)
If a background check results in previous criminal history, the individual may
appeal to the director or his or her designee for nondeployable Michigan cyber
civilian corps advisor status.
(8)
Michigan cyber civilian corps volunteers or advisors may not engage in training
until either the background check or appeal regarding the background check
process has been completed.
Sec. 6. (1) A Michigan cyber civilian corps volunteer or advisor is not an agent, employee, or
independent contractor of this state for any purpose and has no authority to
bind this state with regard to third parties.
(2) This state is not
liable to a Michigan cyber civilian corps volunteer or advisor for personal injury or property damage
suffered by the Michigan cyber civilian corps volunteer through participation
in the Michigan cyber civilian corps.
Sec. 7. (1) Except as otherwise provided in this
section, the department and this state are immune from tort liability for acts
or omissions by a Michigan cyber civilian corps volunteer or advisor under this act.
(2) Except as otherwise
provided in this section, and without regard to discretionary or ministerial
nature of the conduct of a Michigan cyber civilian corps volunteer or advisor, each Michigan cyber civilian
corps volunteer or advisor is immune
from tort liability for an injury to a person or damage to property that
occurred while deployed and acting on behalf of the department if all of the
following are met:
(a) The Michigan cyber
civilian corps volunteer or advisor is
acting or reasonably believes that he or she is acting within the scope of his
or her authority.
(b) The Michigan cyber
civilian corps volunteer's or advisor's conduct
does not amount to gross negligence that is the proximate cause of the injury
or damage.
(c) The Michigan cyber
civilian corps volunteer's or advisor's conduct
is not a material breach of the volunteer agreement during that deployment.
(3) If a claim is made or
a civil action is commenced against a Michigan cyber civilian corps volunteer or advisor for
injuries to persons or property caused by negligence of a Michigan cyber
civilian corps volunteer or advisor that
occurred while in the course of his or her deployment on behalf of the
department and while acting within the scope of his or her authority, the
department may pay for, engage, or furnish the services of an attorney to
advise the Michigan cyber civilian corps volunteer or advisor as to the claim and to appear for and
represent the Michigan cyber civilian corps volunteer or advisor in the action. The department may
compromise, settle, and pay the claim before or after the commencement of a
civil action. Whenever a judgment for damages is awarded against a Michigan
cyber civilian corps volunteer or advisor
as a result of a civil action for personal injuries or property damage caused
by the Michigan cyber civilian corps volunteer or advisor while in the course of his or her
deployment and while acting within the scope of his or her authority, the
department may indemnify the Michigan cyber civilian corps volunteer or advisor or pay, settle, or compromise
the judgment.
(4) If a criminal action
is commenced against a Michigan cyber civilian corps volunteer or advisor based upon the conduct of the
Michigan cyber civilian corps volunteer or advisor in the course of his or her deployment,
if the Michigan cyber civilian corps volunteer or advisor had a reasonable basis for believing that
he or she was acting within the scope of his or her authority at the time of
the alleged conduct, the department may pay for, engage, or furnish the
services of an attorney to advise the Michigan cyber civilian corps volunteer or advisor as to the action, and to
appear for and represent the Michigan cyber civilian corps volunteer or advisor in the action. A Michigan
cyber civilian corps volunteer or advisor who
has incurred legal expenses for conduct prescribed in this subsection may
obtain reimbursement for those expenses under this subsection.
(5) This section does not
impose liability on this state or the department.
(6) As used in this
section, "gross negligence" means conduct so reckless as to
demonstrate a substantial lack of concern for whether an injury results.