SB 1694 — Public Records and Public Meetings/Cybersecurity

(a) Coverage limits and deductible or self-insurance amounts of insurance or other risk mitigation coverages acquired for the protection of information technology systems, operational technology systems, or data of an agency.

(b) Information relating to critical infrastructure.

(c) Network schematics, hardware and software configurations, or encryption information or information that identifies detection, investigation, or response practices for suspected or confirmed cybersecurity incidents, including suspected or confirmed breaches, if the disclosure of such information would facilitate unauthorized access to or unauthorized modification, disclosure, or destruction of:

Information technology resources, whichincluding, includebut annot agency’slimited existingto, orthe proposedfollowing: information technology systems.

(3)a. Any portion of a meeting that would reveal information made confidential and exempt under subsection (2) is exempt from s.

Information relating to the security of the local government’s technologies, processes, and practices designed to protect networks, computers, data processing software, and data from attack, damage, or unauthorized access.

b.

Security information, whether physical or virtual, which relates to the local government’s existing or proposed information technology systems.

(b) Information made confidential and exempt under paragraph (a) may be disclosed by a political subdivision or state agency:

1.

In the furtherance of its official duties and responsibilities.

2.

To another governmental entity in the furtherance of its statutory duties and responsibilities.

(c) Any portion of a meeting that would reveal information made confidential and exempt under paragraph (a) is exempt from s.

(4)(d) TheThis publicsubsection recordsis exemptionssubject contained in this section apply to informationthe heldOpen byGovernment anPage agency2 before,of on,4 orCODING: after July 1, 2022.

(5)(a) Information made confidential and exempt pursuant to this section shall be made available to a law enforcement Page 3 of 10 CODING:

Florida Senate - 2022 CS for CS for SB 1694 576-03524-22583-02824-22 20221694c220221694c1 agency,Sunset theReview AuditorAct General,in theaccordance Cybercrimewith Offices. of the Department of Law Enforcement, the Florida Digital Service within the Department of Management Services, and, for agencies under the jurisdiction of the Governor, the Chief Inspector General.

(b) Such confidential and exempt information may be disclosed by an agency in the furtherance of its official duties and responsibilities or to another agency or governmental entity in the furtherance of its statutory duties and responsibilities.

(6) Agencies may report information about cybersecurity incidents in the aggregate.

(7) This section is subject to the Open Government Sunset Review Act in accordance with s.

SubsectionThe (13)Legislature offinds sectionthat 98.015,it Floridais Statutes,a ispublic amendednecessity that information related to read:a cybersecurity incident or ransomware incident held by a political subdivision or state agency be made confidential and exempt from s.

98.015 Supervisor of elections;

election, tenure of office, compensation, custody of registration-related documents, office hours, successor, seal;

appointment of deputy supervisors;

duties;

public records exemption.— (13)(a) Portions of records held by a supervisor of elections which contain network schematics, hardware and software configurations, or encryption, or which identify detection, investigation, or response practices for suspected or confirmed information technology security incidents, including suspected or confirmed breaches, are confidential and exempt from s.

119.07(1) and s.

24(a), Art.

I of the State Constitution, if the disclosure of such records would facilitate Page 4 of 10 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2022 CS for CS for SB 1694 576-03524-22 20221694c2 unauthorized access to or the unauthorized modification, disclosure, or destruction of:

1.

Data or information, whether physical or virtual;

or 2.

Information technology resources as defined in s.

119.011(9), which includes:

a.

Information relating to the security of a supervisor of elections’ technology, processes, and practices designed to protect networks, computers, data processing software, and data from attack, damage, or unauthorized access;

or b.

Security information, whether physical or virtual, which relates to a supervisor of elections’ existing or proposed information technology systems.

(b) The portions of records made confidential and exempt in paragraph (a) shall be available to the Auditor General and may be made available to another governmental entity for information technology security purposes or in the furtherance of the entity’s official duties.

(c) The public record exemption in paragraph (a) applies to records held by a supervisor of elections before, on, or after the effective date of the exemption.

(d) This subsection is subject to the Open Government Sunset Review Act in accordance with s.

119.15 and shall stand repealed on October 2, 2026, unless reviewed and saved from repeal through reenactment by the Legislature.

Section 3.

Subsections (6) and (11) of section 282.318, Florida Statutes, are renumbered as subsections (5) and (10), respectively, and present subsections (5), (7), (8), (9), and (10) of that section are amended to read:

282.318 Cybersecurity.— Page 5 of 10 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2022 CS for CS for SB 1694 576-03524-22 20221694c2 (5) Portions of records held by a state agency which contain network schematics, hardware and software configurations, or encryption, or which identify detection, investigation, or response practices for suspected or confirmed cybersecurity incidents, including suspected or confirmed breaches, are confidential and exempt from s.

119.07(1) and s.

24(a), Art.

I of the State Constitution, if the disclosure of such records would facilitate unauthorized access to or the unauthorized modification, disclosure, or destruction of:

(a) Data or information, whether physical or virtual;

or (b) Information technology resources, which includes:

1.

Information relating to the security of the agency’s technologies, processes, and practices designed to protect networks, computers, data processing software, and data from attack, damage, or unauthorized access;

or 2.

Security information, whether physical or virtual, which relates to the agency’s existing or proposed information technology systems.

(6)(7) Those portions of a public meeting as specified in s.

286.011 which would reveal records which are confidential and exempt under subsection (5) or subsection (6) are exempt from s.

286.011 and s.

24(b), Art.

I of the State Constitution.

No exempt portion of an exempt meeting may be off the record.

All exempt portions of such meeting shall be recorded and transcribed.

Such recordings and transcripts are confidential and exempt from disclosure under s.

119.07(1) and s.

24(a), Art.

I of the State Constitution unless a court of competent jurisdiction, after an in camera review, determines that the meeting was not restricted to the discussion of data and Page 6 of 10 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2022 CS for CS for SB 1694 576-03524-22 20221694c2 information made confidential and exempt by this section.

In the event of such a judicial determination, only that portion of the recording and transcript which reveals nonexempt data and information may be disclosed to a third party.

(7)(8) The portions of records made confidential and exempt in subsections (5) and, (6), and (7) shall be available to the Auditor General, the Cybercrime Office of the Department of Law Enforcement, the Florida Digital Service within the department, and, for agencies under the jurisdiction of the Governor, the Chief Inspector General.

Such portions of records may be made available to a local government, another state agency, or a federal agency for cybersecurity purposes or in furtherance of the state agency’s official duties.

(8)(9) The exemptions contained in subsections (5) and, (6), and (7) apply to records held by a state agency before, on, or after the effective date of this exemption.

(9)(10) Subsections (5) and, (6), and (7) are subject to the Open Government Sunset Review Act in accordance with s.

119.15 and shall stand repealed on October 2, 2025, unless reviewed and saved from repeal through reenactment by the Legislature.

Section 4.

(1) The Legislature finds that it is a public necessity that the following information held by an agency be made confidential and exempt from s.

24(a), Article I of the State Constitution:Constitution to the extent that disclosure of such information would facilitate unauthorized access to or the unauthorized modification, disclosure, or destruction of data or information, whether physical or virtual, or information technology resources.

(a)Such Coverageinformation limitsincludes andproprietary deductibleinformation orabout self-insurancethe amountssecurity of insurancea orgovernment othersystem, riskand mitigationdisclosure coveragesof acquiredthat forinformation thecould protectionresult ofin informationthe technologyidentification systems,of operationalvulnerabilities technologyand systems,further orbreaches data of anthe agency.government system.

PageIn 7addition, the disclosure of 10such CODING:information could compromise the integrity of a government’s data, information, or information technology resources, which would significantly impair the administration of vital programs.

Therefore, this information should be made confidential and exempt in order to protect the government’s data, information, and information technology resources.

The Legislature also finds that it is a public necessity that any portion of a meeting in which the confidential and exempt information is discussed be made exempt from s.

286.011, Florida Statutes, and s.

24(b), Article I of the State Constitution, and that any recordings and transcripts of those portions of a meeting in which the confidential and exempt information is discussed be made confidential and exempt Page 3 of 4 CODING:

Florida Senate - 2022 CS for CS for SB 1694 576-03524-22583-02824-22 20221694c220221694c1 (b)from Informations. relating to critical infrastructure.

(c) Network schematics, hardware and software configurations, or encryption information or information that identifies detection, investigation, or response practices for suspected or confirmed cybersecurity incidents, including suspected or confirmed breaches, if the disclosure of such information would facilitate unauthorized access to or unauthorized modification, disclosure, or destruction of:

1.

Data or information, whether physical or virtual;

or 2.

Information technology resources, which include an agency’s existing or proposed information technology systems.

Release of such information could place an agency at greater risk of breaches, cybersecurity incidents, and ransomware attacks.

Such information could be used by criminals to identify any vulnerabilities that may exist in an agency’s security system, thereby compromising the integrity of the agency’s information technology, operational technology, and data.

If information related to the coverage limits and deductible or self-insurance amounts of cybersecurity insurance were disclosed, it could give cybercriminals an understanding of the monetary sum an agency can afford or may be willing to pay as a result of a ransomware attack at the expense of the taxpayer.

In addition, critical infrastructure information is a vital component of public safety and, if made publicly available, could aid in the planning of, training for, and execution of cyberattacks, thereby increasing the ability of persons to harm individuals in this state.

The recent cybersecurity hacking and shutdown of the Colonial Pipeline by the criminal enterprise Page 8 of 10 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2022 CS for CS for SB 1694 576-03524-22 20221694c2 DarkSide in 2021 and the infiltration of the Bowman Avenue Dam in Rye Brook, New York, by Iranian hackers in 2013 provide evidence that such criminal capabilities exist.

These events also show the crippling effect that cyberattacks on critical infrastructure may have.

Further, the release of network schematics, hardware and software configurations, or encryption information or information that identifies detection, investigation, or response practices for suspected or confirmed cybersecurity incidents, including suspected or confirmed breaches, would facilitate unauthorized access to or the unauthorized modification, disclosure, or destruction of data or information, whether physical or virtual, or information technology resources.

Such information also includes proprietary information about the security of an agency’s system.

The disclosure of such information could compromise the integrity of an agency’s data, information, or information technology resources, which would significantly impair the administration of vital governmental programs.

Therefore, this information should be made confidential and exempt in order to protect the agency’s data, information, and information technology resources.

(2) The Legislature also finds that it is a public necessity that any portion of a meeting that would reveal the confidential and exempt information be made exempt from s.

286.011, Florida Statutes, and s.

24(b), Article I of the State Constitution, and that any recordings and transcripts of the closed portion of a meeting be made confidential and exempt from s.

The failure to close that portion of a Pagemeeting 9at which confidential and exempt information is discussed, and prevent the disclosure of 10the CODING:recordings and transcripts of those portions of a meeting, would defeat the purpose of the underlying public records exemption and could result in the release of highly sensitive information related to the cybersecurity of a government system.

WordsFor strickenthese reasons, the Legislature finds that these public records and public meetings exemptions are deletions;of the utmost importance and are a public necessity.

wordsSection underlined3. are additions.

FloridaThis Senateact -shall 2022take CSeffect foron CS for SB 1694 576-03524-22 20221694c2 meeting at which confidential and exempt information would be revealed, and prevent the disclosuresame ofdate thethat recordingsSB and1670 transcriptsor ofsimilar thoselegislation portionstakes ofeffect, aif meeting,such wouldlegislation defeatis theadopted purpose of the underlying public records exemption and could result in the releasesame oflegislative highlysession sensitiveor informationan relatedextension tothereof theand cybersecuritybecomes ofa anlaw. agency system.

(3)Page For4 these reasons, the Legislature finds that these public records and public meetings exemptions are of the4 utmostCODING: importance and are a public necessity.

Section 5.

This act shall take effect on the same date that SB 1670 or similar legislation takes effect, if such legislation is adopted in the same legislative session or an extension thereof and becomes law.

Page 10 of 10 CODING: