March 26, 2026 · Technology Committee · 2,578 words · 8 speakers · 87 segments
Mr. Graver, will you please call the roll?
Senators and Representatives Baisley.
President Kelty. Here.
Haskell.
Here.
Rodriguez. Vice Chair Titone. Here.
Madam Chair. Here. We are here very briefly after hearing the OIT audit that we heard yesterday. there was a request that we vote on whether or not to go into bill drafting there are some things that came out of the audit that I think are what I would say low hanging fruit I've shared them with the department haven't heard back yet because like I was thinking about it at 5 in the morning and so they haven't had a chance yet but we will get with the department and what I am proposing are the five things that I sent today, but we don't have to even decide on those things. I did. It was really early. I apologize. Couldn't sleep and sent good. Sorry about that. So I can read them. Let me, I didn't bring my computer. Give me two seconds, friends. Okay. Yes. Okay. So the things that came... Oh, Senator Baisley.
Thank you, Madam Chair. While you're reading that, I just want to suggest that you... Would you spell out first time, so for the acronyms?
Yes.
For my sake, I'm one of them, but also anyone listening in, that they know what the acronyms mean. Thank you.
It's as if you're reading my mind, Senator Baisley. I have a list of acronyms. So, yeah, I'm with you, my friend. The five things that I thought we could do that don't expand our authority, change OIT, and don't really create any new programs because of fiscal are the CISO duty integrity. CISO, Chief Information Security Officer. This is Dr. Frazier, Jill Frazier. Is she a doctor? I'm not sure. but just codifying that part of what they have to do is that they have to do it and they can't give it out which happened in 24 the second thing is privileged access deactivation
rep pascal Yes, ma'am. When you say they have to do it, do you mean that has to be done in-house as opposed to contracting?
No. What happened was the former chief information security officer delegated this to departments but didn't train and didn't tell them how to do it, and that actually goes against statute. So what we're looking to do now is to codify.
Okay, and what was the it that they did? Is this the logging thing or is this which thing?
So remember there's a number of things that we talked about yesterday that are under executive.
Oh, sorry.
Yep. And so this, I believe, was in governance, which was part of the public. Okay. Okay.
Senator Baisley. Thank you, Madam Chair. Just for clarification, I thought I'd add that some 10 years ago or so, OIT, the Office of Information Technology, became the IT department for all of the agencies, all the departments. And so since what Madam Chair is saying is here, the chief information security officer of OIT for that centralized IT organization would have the responsibility for fulfilling these, the shortcomings, the vulnerabilities, rather than the departments, the agencies themselves that they serve. So all the agencies would not have their responsibility for fulfilling or mitigating the vulnerabilities, but rather the Office of Information and Technology, which makes it simpler for all of us, especially for holding someone accountable, not holding 18 or whatever it is departments accountable. So anyway, I just wanted to add clarification. Thank you.
Okay, thank you.
Rep Kelty. Thank you. Thank you for that. I just have a question. So if they the ones being held accountable the other agencies that they trying to give the delegations to like you can delegate authority but you can delegate responsibility So OIT is responsible They trying to give authority to the underlying departments
but what you're saying is that OIT is still holding on that responsibility of having all that done. And they can tell all the other people to do it?
No.
What we should do, and it's fine, we should have a broad conversation about all these things. I do want to clarify that what this does is it's really just about the cybersecurity. It's really just about the compliance and audit duties. They have to do it. By statute, they have to do it. But what happened is in 24, they decided to delegate this out, and it didn't get done. And so a lot of what we were hearing yesterday is because there was no accountability. And so this little component would add that accountability.
Rep Kelty. What made them feel they could delegate that if that's really their responsibility? Because they have no power over the other department, so why would they think that they could give it to someone else if it's their job to do? Right.
Oh, okay. Exactly. Exactly. So we'll codify it just to be really clear. And that's what all of these are. That's what all of these are. These are all under the responsibility of OIT the way I see it. And these are just we're going to codify. These things have to be done.
Rep to Tom. Thank you, Madam Chair. I think, though, we're missing a big part of what we're seeing happen is the blatant disregard of statute to actually furnish the information we're requesting. We have two statutes that say we can get information and we're not getting it. We're getting non-answers. The independent auditor is not getting the information and we cannot hold them directly accountable. And in the work that I've done looking at how other states have been holding executive branch accountable NCSL provided some information about a California law and this one actually has a way of, if we do subpoena and there is refusal to obey the subpoena, that there's actually some ways that the legislature can compel the executive branch to, well we can have someone dismissed or lose pay or a lifetime ban on employment in the state. This is what California does. I'm not saying that this is what we should do, but maybe pull some inspiration from what California is doing because if there's no willingness to actually answer our questions under law and we have no way of compelling it, then we're going to keep running around in circles. And I think that this is the time and this is an example of where we have to say enough is enough and we need the tools to be able to do it. And that's what I would like to see in this bill.
Okay, fair enough. I hear what you're saying. I would rather keep this more narrow and wait to get to the place where they're not going to provide the information. Because one of the five things I have on here is that they would annually go before the audit committee. And that's at the request of the audit committee. Because they need to be held accountable for the audit, just like we saw yesterday. So all that we're doing today is we are going to vote on whether we're going to open, I know, but whether we're going to open up for drafting a bill. The bill, and then the contents of the bill, we need to talk about. Okay.
Rep. Paschal.
I was just going to say, thank you, Madam Chair. I was just going to say that I agree with Rep. Tatone, that I think it needs a little teeth. So we should do a motion. Samantha, would you mind just kind of letting us know what we need to vote on?
Samantha, Falka, legislative council staff. So the committee would make a motion to draft a bill. It can be fairly broad similar to how interim committees are set up So perhaps the committee would like to vote to draft a bill regarding um i don know how the specific wording you want to use but oit reporting requirements and the oversight of the drone technology committee um just something that encapsulates the committee's intent and then the committee can work together with caroline the bill drafter and weed out the details of the draft before it's introduced.
LT. Thank you. Thank you for putting up with me because I'm trying to put this together. So for me, so there's OIT. They're not doing their job, apparently, with some of this. I'm picking up things. But who is the boss of OIT? Is that the governor? And if it is, why isn't he doing his job making sure that OIT is doing their job? Because like I said, so then really the responsibility lies on the governor, right? So if OIT is not doing their job, which he's delegated the authority to do, the responsibility still lies with the governor. So why isn't he's captain of the ship? The ship's sinking. So why isn't he doing his job to make sure his ship doesn't sink? So I understand what you're saying. And I would say, like I always remind his friends, there are three branches of government, and his is the executive and ours is the legislative. And so the way I see this, these are ways the legislative can put some pressure on the executive branch to do what we require if it's not clear. Really good question, though. And I don't have the definitive answer. I just offer that just for you to consider because it is a very good question.
Ms. Falco?
Motion. Motion.
Okay. Who wants to make a motion?
Rep to Tom. I move JTC start drafting for a committee bill for oversight authority of JTC on the Office of Information Technology. I think that's broad enough.
And then say again? We got a vote. Mr. Gravy.
Oh, Senator Baisley.
Thank you. Sorry, I'll make it quick, but I'm trying to understand how this bill would differ from the oversight role that we have now. Oh, I guess I don't have to raise my hand to be called on. Senator Baisley, please call on me.
Um, I, the way I envision this is just really spelling out some of the things that I saw, just me, uh, but we can change this. We can talk about it, but just some things that I saw that I feel like, well, this is in the law. This should already be specified. Let's just make it more specific. So again, I'm not interested in really expanding our oversight. I'm not really interested in reorganizing the department because I know they're already doing that. And I'm not really interested in doing anything that's going to drive a fiscal. And so these would be tweaks. These would be clarifications. One of the things is you'll go in front of the legislative audit. One is you're going to put in place a standard operating procedure for when people quit. How do we make sure that their access is gone? And a number of other things.
Yeah. Just a consideration, do we want to expand the motion a bit? Because if it's just JTC oversight, I don't know how much of that would fall directly under JTC statute.
Yes.
Just a consideration.
Yeah.
You're good. Rep to tone, do you mind withdrawing your motion so we can broaden it?
Oh, really?
Yeah.
I withdraw the motion.
Okay. Do we want to write something down, or what's the right way?
Maybe Caroline can phrase it better for me. The duties of the JTC.
Here we are.
I am so sorry, I don't remember.
Oh, you're Caroline Martin.
Yes, Ms. Martin.
Thank you, Madam Chair.
Caroline Martin, Office of Legislative Legal Services. I believe Reptitone just said regarding the Office of Information Technology. That pretty broad I think that would be suitable to cover everything that I heard you all discuss so far today I don remove my motion
Fair enough. I rescind my non-rescinding of motion.
My concern is that the motion just involves only JTC, or mentions specifically JTC oversight. So I'm saying to broaden. Martin, can you please give us words?
I got it. I got it.
Thank you, Madam Chair.
I think concerning the Office of Information Technology would be relatively broad.
Perfect. I move to draft a bill concerning the Office of Information Technology.
Very good. Thank you, Ms. Falco. Thank you, Ms. Martin. Thank you, Mr. Gravey. You're so good. Mr. Gravey, will you please pull what's left of our committee?
Yeah. Senators and Representatives Baisley.
Pass.
Kelty.
Pass.
Oh, no.
Pascal.
Yes.
Rodriguez.
Excused.
Vice Chair Tatone.
Yes.
Senator Baisley.
No.
Representative Kelty. I have to know more, so I'm going to say no for now, but I just have to know more.
Madam Chair. Aye. That passes on a vote of 3-2. Ms. Martin, do you need any other details from us?
Thank you, Madam Chair. The main details I need are who are the contact people, who am I working with, and me. I want it to start in the Senate. Okay.
So tell me more about this process.
Thank you, Madam Chair. Right now, the only information I need is that really broad topic that you all just came up with. And then also I need contact people that I'm working with on this bill. that's all I need for right now. Once the bill is drafted, it'll come back to the committee and you all will vote on where it starts and who's going to be the sponsors. Perfect. So you can work with any of us.
Yeah. Rep. Paschal. Thank you, Madam Chair. I am going to request that we work on this as a committee to at least get it started and that we draft it up in session. I don't know if we have to do executive because of the executive session on the audit or not, but yeah, I think we should work as a group in committee.
Senator Baisley. Thank you, Madam Chair. Now that it's been voted in, I'll be an enthusiastic partner in all this. Go ahead. But I just want to point out that what I believe we're doing is evolving the role of the Joint Technology Committee from being an advisory committee to the Joint Budget Committee, where was the original intent, as I've understood the history, to advise on budget items and oversight for budget items that are of a technical nature to becoming more of a have the authority of oversight more directly over the agencies. And so not a bad thing. I just wanted to point out, I think this is changing the rule by statute, changing our authority.
Senator Baisley, we have two roles, and one of them is what you said, and the other is oversight of the OIT. We are the Oversight Committee, but fair, fair. What you're saying is fair. We should look back, because again, my intention would be not to expand that.
Thank you.
So, anyone else?
Rep to tone. Thank you. And Senator Baisley, I would just refer you to 2-3-1704 to see all of the statutory duties that we have, which is direct oversight over OIT, and it has been that way for years. All the years you've been on the committee with me. All right.
And with that, Joint Technology Committee will adjourn. Thank you.