Florida Senate - 2016 COMMITTEE AMENDMENT Bill No. CS for SB 776 Ì639920*Î639920 LEGISLATIVE ACTION Senate . House Comm: RCS . 02/16/2016 . . . . ————————————————————————————————————————————————————————————————— ————————————————————————————————————————————————————————————————— The Committee on Governmental Oversight and Accountability (Hays) recommended the following: 1 Senate Amendment 2 3 Delete lines 36 - 95 4 and insert: 5 2. Information related to the security of existing or 6 proposed information technology systems or industrial control 7 technology systems of a utility owned or operated by a unit of 8 local government, which, if disclosed, would facilitate 9 unauthorized access to, and alteration or destruction of, such 10 systems in a manner that would adversely impact the safe and 11 reliable operation of the systems and the utility. 12 (b) This exemption applies to such information held by a 13 utility owned or operated by a unit of local government before, 14 on, or after the effective date of this exemption. 15 (c) This subsection is subject to the Open Government 16 Sunset Review Act in accordance with s. 119.15 and shall stand 17 repealed on October 2, 2021, unless reviewed and saved from 18 repeal through reenactment by the Legislature. 19 Section 3. (1) The Legislature finds that it is a public 20 necessity that the following information held by a utility owned 21 or operated by a unit of local government be exempt from s. 22 119.07(1), Florida Statutes, and s. 24(a), Article I of the 23 State Constitution: 24 (a) Information related to the security of the technology, 25 processes, or practices of a utility owned or operated by a unit 26 of local government that are designed to protect the utility’s 27 networks, computers, programs, and data from attack, damage, or 28 unauthorized access, which information, if disclosed, would 29 facilitate the alteration, disclosure, or destruction of such 30 data or information technology resources. 31 (b) Information related to the security of existing or 32 proposed information technology systems or industrial control 33 technology systems of a utility owned or operated by a unit of 34 local government, which, if disclosed, would facilitate 35 unauthorized access to, and alteration or destruction of, such 36 systems in a manner that would adversely impact the safe and 37 reliable operation of the systems and the utility. 38 (2) The Legislature finds that, as utility system 39 infrastructure becomes more connected and integrated through 40 information and communications technology, the exposure to 41 damage from attacks through such technology continues to grow. 42 These attacks may result in the disruption of utility services 43 and damage to utility systems. Maintaining safe and reliable 44 utility systems is vital to protecting the public health and 45 safety and ensuring the economic well-being of the state. 46 Accordingly, many utilities have adopted technologies, 47 processes, and practices designed to secure data, information 48 technology systems, and industrial control technology systems. 49 Disclosure of sensitive information related to these security 50 measures could result in the identification of vulnerabilities 51 that allow a security breach that damages utility systems and 52 disrupts the safe and reliable operation of such systems, 53 adversely impacting the public health and safety and the 54 economic well-being of the state. Because of the interconnected 55 nature of utility systems, a security breach may also impact 56 national security concerns. As a result, the Legislature finds 57 that the public and private harm in disclosing the information 58 made exempt by this act outweighs any public benefit derived 59 from disclosure of such information. The protection of 60 information made exempt by this act will ensure that utilities 61 have greater safeguards to protect against security threats and 62 will bolster efforts to develop more resilient information 63 technology systems and industrial control technology systems. 64 For these reasons, the Legislature finds that is a public 65 necessity to make such information exempt from public records 66 requirements, and to provide for retroactive application of the 67 public records exemption.