Technology

Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. Existing law requires specified state entities to implement the policies and procedures issued by the office. Existing law additionally authorizes the office to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. Existing law requires every state agency, as specified, to certify, by February 1 annually, to the office that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified. This bill would require every state agency, as specified, and subject to specified exceptions, to implement Zero Trust architecture for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments, to achieve prescribed levels of maturity based on the Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model, as defined, by specified dates. In implementing Zero Trust architecture, the bill would require state agencies to prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks and, at a minimum, prioritize multifactor authentication for access to all systems and data, enterprise endpoint detection and response solutions, and robust logging practices, as specified. The bill would require the office's chief to develop or revise uniform technology policies, standards, and procedures for use by all state agencies in Zero Trust architecture to achieve specified maturity levels on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill would require the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also state the Legislature's intent that the bill's provisions be implemented in a manner consistent with the state's timely compliance with requirements that are conditions to receipt of federal funds. The bill would also make related legislative findings and declarations.

Existing law creates the California Computer Science Coordinator as a position within the State Department of Education to provide statewide coordination in, among other things, implementing the computer science content standards and leading the implementation of the Computer Science Strategic Implementation Plan, as provided. This bill would establish the California Computer Science Demonstration Grant Program for specified purposes, including increasing the number of public high schools offering a computer science course to increase pupil access to computer science education and increasing the computer science course access of pupils eligible for free or reduced-priced meals and pupils that are underrepresented in the field of computer science. The bill would also establish the California Computer Science Demonstration Grant Program Working Group that includes the coordinator and nonprofit organizations and private industry stakeholders with relevant expertise and experience in computer science education. The bill would authorize only public high schools that do not offer computer science courses to be eligible to voluntarily participate in the grant program. The bill would require the funding entity or funding entities, as defined, to administer the grant program. If there are multiple funding entities, the bill, among other things, would require each funding entity to determine how the funds that it contributes to the grant program will be spent, provided that expenditure aligns with the grant program's purposes, and require the funding entities to coordinate implementation of the grant program. The bill would require the funding entities, in coordination with the working group, to select the public high schools to participate in the grant program, as provided. The bill would require the grant program to be funded through contributions, gifts, grants, in-kind donations, and donations from the funding entity or funding entities, and would specify the allowable uses of those funds. The bill would require the funding entity or funding entities, in coordination with the working group, to evaluate the effectiveness of the grant program and submit an interim report to certain legislative committees on or before August 1, 2027, and a final report on or before July 1, 2028, as specified. The bill would repeal the grant program's provisions as of January 1, 2029. The bill would separately require the department, on or before June 30, 2028, and annually thereafter, to publicly post specified computer science course-related data on its internet website, as specified.

Existing law, the Electronic Communications Privacy Act, prohibits a government entity from compelling the production of, or access to, electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, or subpoena issued pursuant to specified conditions. Existing law authorizes a government entity to access electronic device information by means of physical interaction or electronic communication with the device in certain circumstances, including, pursuant to the specific consent of the authorized possessor of the device or if the government entity, in good faith, believes that an emergency involving danger of death or serious physical injury to a person requires access to the information. Existing law requires a government entity that obtains electronic information pursuant to an emergency involving danger of death or serious physical injury to a person, within 3 court days after obtaining the electronic information, to file with the appropriate court an application for a warrant or order setting forth the facts giving rise to the emergency. Existing law requires the court to promptly rule on the application and to destroy all information obtained upon a finding that the facts did not give rise to an emergency or upon rejecting the application on any other ground. This bill would additionally authorize a government entity to access electronic device information with the specific consent of an individual who locates a tracking or surveillance device, as defined, and the device is reasonably believed to have been used to track or record the individual without their permission. The bill would require a government entity that obtains information through this method, within 3 court days after obtaining the electronic information, to follow the above process for applying for a warrant or order from a court by setting forth the facts that describe the circumstances and would require the court to promptly rule on the application and order the immediate destruction of all information obtained upon a finding that the facts were not as described. Existing law authorizes an individual whose information is targeted by a warrant, order, or other legal process, or other specified recipients of a warrant, that is inconsistent with the act or the California or United States Constitution, to petition the issuing court to void or modify the warrant, order, or process, or to order the destruction of any information obtained in violation of the act or the California or United States Constitution. This bill would recast the provisions described above to authorize an individual whose information is sought or obtained by a government entity in a manner that is inconsistent with the act or the California or United States Constitution, or other specified recipients of a warrant, order, legal process, request, or demand seeking the individual's information, to petition a court to void or modify the warrant, order, other legal process, request, or demand to order the destruction of the information.