Honorable Robert Bunda

President of the Senate

Twenty-Third State Legislature

Regular Session of 2006

State of Hawaii

Sir:

Your Committees on Media, Arts, Science, and Technology and Commerce, Consumer Protection, and Housing, to which was referred H.B. No. 2836, H.D. 1, entitled:

beg leave to report as follows:

The purpose of this measure is to protect the privacy of individuals by requiring the Department of Accounting and General Services through a governmental security task force, to develop a statewide information security protection program and policies that prevent unauthorized access to individual information collected or maintained by executive departments.

Your Committees received testimony in support of this measure from the Department of Accounting and General Services.

Identity theft is one of the fastest growing crimes committed throughout the United States, including Hawaii. The privacy and financial security of individuals are increasingly at risk due to the widespread collection of personal information. Your Committees find that the Department of Accounting and General Services is currently in the process of establishing a cyber security office to address information security programs, policies, and procedures for the executive departments.

Your Committees have amended this measure by requiring the new cyber security office to establish a program that addresses information security needs for state agencies instead of creating a governmental information security task force. Additionally, your Committees require that the cyber security office submit a report on its efforts to monitor, analyze, prevent, and mitigate cyber security issues for executive departments to the Legislature prior to the convening of the 2007 legislative session.

The Department of Accounting and General Services expressed concerns regarding establishing a statewide information security protection program that includes the University of Hawaii, the Department of Education, and certain quasi-independent agencies. The Department indicated that these departments and agencies may want to establish their own information security programs to address their own special requirements and express a degree of autonomy. In light of this concern, your Committees have amended this measure by requiring the Department to consult with the University of Hawaii, the Department of Education, and other attached agencies that may want to establish their own information security programs. Furthermore, your Committees have made technical, nonsubstantive amendments for style and consistency.

As affirmed by the records of votes of the members of your Committees on Media, Arts, Science, and Technology and Commerce, Consumer Protection, and Housing that are attached to this report, your Committees are in accord with the intent and purpose of H.B. No. 2836, H.D. 1, as amended herein, and recommend that it pass Second Reading in the form attached hereto as H.B. No. 2836, H.D. 1, S.D. 1, and be referred to the Committee on Ways and Means.