HOUSE BILL REPORT

HJR 4202

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

As Reported by House Committee On:

Appropriations

Brief Description: Amending the state Constitution to permit appropriations from the budget stabilization account in certain cases where there has been a breach of information technology systems.

Sponsors: Representatives Hudgins and Stanford.

Brief History:

Committee Activity:

Appropriations: 2/2/17, 2/13/17 [DP].

Brief Summary of Bill

Permits the Legislature to appropriate from the Budget Stabilization Account with a constitutional majority vote of both houses if state expenditures are required to address an information technology security incident.

HOUSE COMMITTEE ON APPROPRIATIONS

Majority Report: Do pass. Signed by 18 members: Representatives Ormsby, Chair; Robinson, Vice Chair; Bergquist, Cody, Fitzgibbon, Hansen, Hudgins, Jinkins, Kagi, Lytton, Pettigrew, Pollet, Sawyer, Senn, Springer, Stanford, Sullivan and Tharinger.

Minority Report: Do not pass. Signed by 14 members: Representatives Chandler, Ranking Minority Member; MacEwen, Assistant Ranking Minority Member; Stokesbary, Assistant Ranking Minority Member; Buys, Caldier, Condotta, Harris, Manweller, Nealey, Schmick, Taylor, Vick, Volz and Wilcox.

Staff: Kristen Fraser (786-7148) and James Mackison (786-7104).

Background:

Budget Stabilization Account.

In 2007 the voters ratified a constitutional amendment that created the Budget Stabilization Account (BSA) as Article VII, section 12 of the state Constitution. Each year, the State Treasurer must deposit 1 percent of general state revenues (GSR) into the constitutionally created BSA. Under a further constitutional amendment ratified in 2011, extraordinary revenue growth in GSR must also be transferred to the BSA. General state revenue is defined in the Constitution and is generally synonymous with the statutory State General Fund. General state revenue is estimated to be $19.851 billion for fiscal year 2018 and $20.632 billion for fiscal year 2019.

In general, appropriations from the BSA require a three-fifths majority in each house of the Legislature. However, the Legislature may appropriate from the BSA by a constitutional majority vote of each house in two cases:

If the employment growth forecast is less than 1 percent; or
The Governor has declared a state of emergency resulting from a catastrophic event that requires government action to protect life or public safety. In that case, the appropriations legislation must be limited to the purpose of the emergency.

Information Technology Systems.

State agencies manage and rely on information technology (IT) systems and infrastructure to deliver services. These systems include online services used by the public, agency applications, communications networks, computer hardware and software, and other infrastructure that stores and transmits data. State agencies are required to maintain an IT security program to protect state systems and infrastructure, and disaster recovery plans for systems that support essential agency functions. Public agencies and private entities within the state also rely on the availability of the Internet and communications infrastructure for operations and electronic commerce.

An IT security incident is an accidental or deliberative event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of communication and information resources.

–––––––––––––––––––––––––––––––––

Summary of Bill:

The Legislature may make appropriations from the Budget Stabilization Account with a constitutional majority vote of both houses if state expenditures are required to address an information security incident, subject to specified conditions. These conditions are met if the Governor declares by proclamation that a security incident affecting one or more state information technology (IT) systems requires significant state expenditures either to repair or protect state IT systems, or to address state liability from the security incident. The appropriations legislation must be limited to either or both of these purposes. "Significant state expenditures" means an amount that exceeds 0.5 percent of general state revenues. (By way of illustration, this amount would be approximately $99.26 million in fiscal year 2018.)

–––––––––––––––––––––––––––––––––

Appropriation: None.

Fiscal Note: Not requested.

Staff Summary of Public Testimony:

(In support) The threshold of 0.5 percent was set to avoid using the Budget Stabilization Account for small breaches. This resolution would allow the state to respond to security events that result in unexpected significant costs, above $100 million. There have been costly breaches in government agencies and the private sector recently—United States Office of Personnel Management, South Carolina Department of Revenue, Maricopa County (Arizona), Home Depot, Chase Bank, and Target. The risk affects more than just information security; critical infrastructure sectors such as dams are at risk as well. The bill would cover unexpected significant costs caused by a security incident.

(Opposed) None.

Persons Testifying: Representative Hudgins, prime sponsor.

Persons Signed In To Testify But Not Testifying: None.