HB5398 101ST GENERAL ASSEMBLY

LRB101 16599 CPF 65983 b

101ST GENERAL ASSEMBLY
State of Illinois
2019 and 2020
HB5398

Introduced , by Rep. Grant Wehrli - Avery Bourne - Amy Grant - Dan Ugaste

SYNOPSIS AS INTRODUCED:

New Act

Creates the Illinois Cyber Reserve Act. Establishes the Illinois Cyber Reserve, to be administered by the Illinois Emergency Management Agency, in order to deploy volunteers upon the occurrence of a cybersecurity incident. Contains provisions regarding volunteer requirements, criminal history checks, and civil liability. Requires volunteers to provide assistance for 6 years from the time of deployment or for the time required under the Agency's record retention policies, whichever is longer, and assistance to be for 7 days unless a different period is specified in writing. Creates the Illinois Cyber Reserve Advisory Board as an advisory body within the Agency and tasks it with reviewing and making recommendations regarding the policies and procedures used in implementing the Act. Requires the Agency to publish guidelines for the operation of the Illinois Cyber Reserve program and provides minimum requirements for the guidelines. Allows the Agency to enter into contracts with clients, provide training to individuals, and establish a fee schedule for clients. Provides that specified information given to the Illinois Cyber Reserve or obtained under the Act is exempt from disclosure under the Freedom of Information Act. Provides that the Agency shall adopt any rules necessary for the implementation and administration of the Act.

A BILL FOR

AN ACT concerning safety.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Illinois Cyber Reserve Act.

Section 5. Definitions. In this Act:

"Advisory Board" means the Illinois Cyber Reserve Advisory Board created under Section 40.

"Agency" means the Illinois Emergency Management Agency.

"Chief information officer" means the individual within the Agency designated by the Governor as the chief information officer for this State.

"Client" means a municipal, educational, nonprofit, or business organization that has requested and is using the rapid response assistance of the Illinois Cyber Reserve under the direction of the Agency.

"Cybersecurity incident" means an event occurring on or conducted through a computer network that actually or imminently jeopardizes the integrity, confidentiality, or availability of computers, information or communications systems or networks, physical or virtual infrastructure controlled by computers or information systems, or information resident on any of these. "Cybersecurity incident" includes, but is not limited to, the existence of a vulnerability in an information system, system security procedures, internal controls, or implementation that is subject to exploitation.

"Illinois Cyber Reserve" means the program established under this Act under which civilian volunteers who have expertise in addressing cybersecurity incidents may volunteer at the invitation of the Agency to provide rapid response assistance to a municipal, educational, nonprofit, or business organization in need of expert assistance during a cybersecurity incident.

"Illinois Cyber Reserve volunteer" means an individual who has entered into a volunteer agreement with the Agency to serve as a volunteer in the Illinois Cyber Reserve.

"Volunteer agreement" means the contract entered into between the Agency and an Illinois Cyber Reserve volunteer under Section 15.

Section 10. Appointment of volunteers. The Agency may appoint individuals to serve as Illinois Cyber Reserve volunteers for the purposes of facilitating the responsibilities of the Agency as provided under this Act.

Section 15. Volunteer agreement.The Agency shall enter into a contract with any individual who wishes to accept an invitation by the Agency to serve as an Illinois Cyber Reserve volunteer. The contract must include, at a minimum, all of the following:

(1) A provision acknowledging the confidentiality of information relating to this State, State residents, and clients.

(2) A provision protecting from disclosure any confidential information of this State, State residents, or clients acquired by the Illinois Cyber Reserve volunteer through participation in the Illinois Cyber Reserve.

(3) A provision requiring the Illinois Cyber Reserve volunteer to avoid conflicts of interest that might arise from a particular deployment.

(4) A provision requiring the Illinois Cyber Reserve volunteer to comply with all existing Agency security policies and procedures regarding information technology resources.

(5) A provision requiring the Illinois Cyber Reserve volunteer to consent to background screening considered appropriate by the Agency under this Act, and a provision in which the individual gives that consent as described in Section 20.

(6) A provision requiring the Illinois Cyber Reserve volunteer to attest that he or she meets any standards of expertise that may be established by the Agency.

Section 20. Clearance to become a volunteer; requirements.

(a) When an individual accepts an invitation to serve as an Illinois Cyber Reserve volunteer as described in Section 15 the Agency shall request the Illinois State Police to do both of the following:

(1) Conduct a criminal history check on the individual.

(2) Conduct a criminal records check through the Federal Bureau of Investigation on the individual.

(b) An individual who accepts an invitation to the Illinois Cyber Reserve shall give written consent in the volunteer agreement for the Illinois State Police to conduct the criminal history check and criminal records check required under subsection (a). The Agency shall require the individual to submit his or her fingerprints to the Illinois State Police and the Federal Bureau of Investigation for the criminal records check.

(c) The Agency shall request a criminal history check and criminal records check under this Section on all individuals who wish to participate as Illinois Cyber Reserve volunteers. The Agency shall make the request on a form and in the manner prescribed by the Illinois State Police.

(d) Within a reasonable time after receiving a complete request by the Agency for a criminal history check and criminal records check on an individual under this Section, the Illinois State Police shall conduct the criminal history check and provide a report of the results to the Agency. The report must indicate that the individual is cleared or not cleared to become an Illinois Cyber Reserve volunteer.

(e) Within a reasonable time after receiving a proper request by the Agency for a criminal records check on an individual under this Section, the Illinois State Police shall initiate the criminal records check with the Federal Bureau of Investigation. After receiving the results of the criminal records check from the Federal Bureau of Investigation, the Illinois State Police shall provide a report to the Agency that indicates that the individual is cleared or not cleared to become an Illinois Cyber Reserve volunteer.

(f) If a criminal arrest fingerprint is subsequently submitted to the Illinois State Police and matches against a fingerprint that was submitted under this Act and stored in its automated fingerprint identification system database, the Illinois State Police shall notify the Agency that the individual is still cleared or is no longer cleared to continue as an Illinois Cyber Reserve volunteer. When the Illinois State Police is able to participate with the Federal Bureau of Investigation automatic notification system, then any subsequent arrest fingerprint submitted to the Federal Bureau of Investigation must also be reviewed by the Illinois State Police. The Illinois State Police shall provide a report to the Agency that indicates that the individual is still cleared or is no longer cleared to continue as an Illinois Cyber Reserve volunteer.

Section 25. Nature of the conduct of volunteers.

(a) An Illinois Cyber Reserve volunteer is not an agent, employee, or independent contractor of this State for any purpose and has no authority to bind this State with regard to third parties.

(b) This State is not liable to an Illinois Cyber Reserve volunteer for personal injury or property damage suffered by the Illinois Cyber Reserve volunteer through participation in the Illinois Cyber Reserve.

Section 30. Civil liability. Any Illinois Cyber Reserve volunteer who in good faith provides professional services in response to a cybersecurity incident shall not be liable for civil damages as a result of his or her acts or omissions in providing the professional services, except for willful and wanton misconduct. This immunity applies to services that are provided during or within the time of deployment for a cybersecurity incident.

Section 35. Initiation of deployment.

(a) On the occurrence of a cybersecurity incident that affects a client, the client may request the Agency to deploy one or more Illinois Cyber Reserve volunteers to provide rapid response assistance under the direction of the Agency.

(b) The Agency, in its discretion, may initiate deployment of Illinois Cyber Reserve volunteers upon the occurrence of a cybersecurity incident and the request of a client.

(c) Acceptance of a deployment by an Illinois Cyber Reserve volunteer for a particular cybersecurity incident must be made in writing. An Illinois Cyber Reserve volunteer may decline to accept deployment for any reason.

(d) To initiate the deployment of an Illinois Cyber Reserve volunteer for a particular cybersecurity incident, the Agency shall indicate in writing that the Illinois Cyber Reserve volunteer is authorized to provide the assistance. A single writing may initiate the deployment of more than one Illinois Cyber Reserve volunteer.

(e) The Agency shall maintain a writing initiating the deployment of an Illinois Cyber Reserve volunteer to provide assistance to a client for 6 years from the time of deployment or for the time required under the Agency's record retention policies, whichever is longer.

(f) The deployment of an Illinois Cyber Reserve volunteer to provide assistance to a client must be for 7 days unless the writing initiating the deployment contains a different period.

(g) At the direction of the Agency, the deployment of an Illinois Cyber Reserve volunteer may be extended in writing in the same manner as the initial deployment.

Section 40. Illinois Cyber Reserve Advisory Board.

(a) The Illinois Cyber Reserve Advisory Board is created as an advisory body within the Agency.

(b) The Advisory Board is composed of the adjutant general, the Director of the Agency, the Director of State Police, and the Director of the Department of Commerce and Economic Opportunity or their designees.

(c) The Advisory Board shall review and make recommendations to the Agency regarding the policies and procedures used by the Agency in implementing this Act.

Section 45. Powers and duties of the Agency.

(a) After consultation with the Advisory Board, the chief information officer shall do both of the following:

(1) Approve the set of tools that the Illinois Cyber Reserve may use in response to a cybersecurity incident.

(2) Determine the standards of expertise necessary for an individual to become a member of the Illinois Cyber Reserve.

(b) After consultation with the Advisory Board, the Agency shall publish guidelines for the operation of the Illinois Cyber Reserve program. At a minimum, the published guidelines must include the following:

(1) An explanation of the standard the Agency will use to determine whether an individual may serve as an Illinois Cyber Reserve volunteer and an explanation of the process by which an individual may become an Illinois Cyber Reserve volunteer.

(2) An explanation of the requirements the Agency will impose for a client to receive the assistance of the Illinois Cyber Reserve and an explanation of the process by which a client may request and receive the assistance of the Illinois Cyber Reserve.

(c) The Agency may enter into contracts with clients as a condition to providing assistance through the Illinois Cyber Reserve.

(d) The Agency may provide appropriate training to individuals who wish to participate in the Illinois Cyber Reserve and to existing Illinois Cyber Reserve volunteers.

(e) The Agency may provide compensation for actual and necessary travel and subsistence expenses incurred by Illinois Cyber Reserve volunteers on a deployment, at the discretion of the Agency.

(f) The Agency may establish a fee schedule for clients who wish to use the assistance of the Illinois Cyber Reserve. The Agency may recoup expenses through the fees but may not generate a profit.

(g) Information voluntarily given to the Illinois Cyber Reserve or obtained under this Act that would identify or provide a means of identifying a person that may, as a result of disclosure of the information, become a victim of a cybersecurity incident or that would disclose a person's cybersecurity plans or cybersecurity-related practices, procedures, methods, results, organizational information system infrastructure, hardware, or software is exempt from disclosure under the Freedom of Information Act.

(h) The Agency shall adopt any rules necessary for the implementation and administration of this Act.