Substitute For
HOUSE BILL NO. 5426
A bill to amend 2017 PA 132, entitled
"Cyber civilian corps act,"
by amending sections 2, 3, 4, 5, 6, and 7 (MCL 18.222, 18.223, 18.224, 18.225, 18.226, and 18.227).
the people of the state of michigan enact:
(a) "Advisory board" means the Michigan cyber
civilian corps advisory board created under section 9.
(b) "Chief information officer" means the
individual within the department designated by the governor as the chief
information officer for this state.
(c) "Client" means a municipal, educational,
nonprofit, or business critical
infrastructure organization that has requested and is using the
rapid response assistance of the Michigan cyber civilian corps under the direction
of the department.
(d)
"Critical infrastructure" means systems and assets, whether physical
or virtual, so vital to the United States or this state that the incapacity or
destruction of that system or asset would have a debilitating impact on security,
economic security, public health or safety, or any combination of these as
determined by the department.
(e)
(d) "Cybersecurity
incident" means an event occurring on or conducted through a computer
network that actually or imminently jeopardizes the integrity, confidentiality,
or availability of computers, information or communications systems or
networks, physical or virtual infrastructure controlled by computers or
information systems, or information resident on any of these. Cybersecurity
incident includes, but is not limited to, the existence of a vulnerability in
an information system, system security procedures, internal controls, or
implementation that is subject to exploitation.
(f)
(e) "Department"
means the department of technology, management, and budget.
(g)
"Michigan cyber civilian corps advisor" or "advisor" means
an individual who has entered into a volunteer agreement with the department to
serve as a nondeployable advisor in the Michigan cyber civilian corps.
(h)
(f) "Michigan
cyber civilian corps" means the program established by this act under
which civilian volunteers who have expertise in addressing cybersecurity
incidents may volunteer at the invitation of the department to provide rapid
response assistance to a municipal, educational, nonprofit, or business critical
infrastructure organization in need of expert assistance during a
cybersecurity incident.
(i)
(g) "Michigan
cyber civilian corps volunteer" means an individual who has entered into a
volunteer agreement with the department to serve as a deployable
volunteer in the Michigan cyber civilian corps.
(j)
(h) "Volunteer
agreement" means the contract entered into between the department and a
Michigan cyber civilian corps volunteer
or advisor under section 4.
Sec. 3. The
department may appoint individuals to serve as Michigan cyber civilian corps
volunteers and Michigan cyber civilian corps advisors for
the purposes of facilitating the responsibilities of the department as provided
in this act.
Sec. 4. The
department shall enter into a contract with any individual who wishes to accept
an invitation by the department to serve as a Michigan cyber civilian corps
volunteer or Michigan cyber civilian corps advisor and
meets the qualifying criteria for those positions as determined by the advisory
board. The contract must include, at a minimum, all of the
following:
(a) A provision acknowledging the confidentiality of
information relating to this state, state residents, and clients.
(b) A provision protecting from disclosure any confidential
information of this state, state residents, or clients acquired by the Michigan
cyber civilian corps volunteer or advisor through
participation in the Michigan cyber civilian corps.
(c) A provision requiring the Michigan cyber civilian corps
volunteer to avoid conflicts of interest that might arise from a particular
deployment.
(d) A provision requiring the Michigan cyber civilian corps
volunteer or advisor to comply with all
existing department security policies and procedures regarding information
technology resources.
(e) A provision requiring the Michigan cyber civilian corps
volunteer or advisor to consent to
background screening considered appropriate by the department under this act,
and a section in which the individual gives that consent as described in
section 5.
(f) A provision requiring the Michigan cyber civilian corps
volunteer or advisor to attest that he or
she meets any standards of expertise that may be established by the department.
Sec. 5. (1) When
an individual accepts an invitation to serve as a Michigan cyber civilian corps
volunteer or advisor as described in
section 4, the department shall request the department of state police to do
both of the following:
(a) Conduct a criminal history check on the individual.
(b) Conduct a criminal records check through the Federal
Bureau of Investigation on the individual.
(2) An individual who accepts an invitation to the Michigan
cyber civilian corps shall give written consent in the volunteer agreement for
the department of state police to conduct the criminal history check and
criminal records check required under this section. The department shall
require the individual to submit his or her fingerprints to the department of
state police and the Federal Bureau of Investigation for the criminal records
check.
(3) The department shall request a criminal history check and
criminal records check under this section on all individuals who wish to
participate as Michigan cyber civilian corps volunteers
or advisors. The department shall make the request on a form and
in the manner prescribed by the department of state police.
(4) Within a reasonable time after receiving a complete
request by the department for a criminal history check and criminal records
check on an individual under this section, the department of state police shall
conduct the criminal history check and provide a report of the results to the
department. The report must indicate that the individual is cleared or not
cleared to become a Michigan cyber civilian corps volunteer or advisor.
(5) Within a reasonable time after receiving a proper request
by the department for a criminal records check on an individual under this
section, the department of state police shall initiate the criminal records
check with the Federal Bureau of Investigation. After receiving the results of
the criminal records check from the Federal Bureau of Investigation, the
department of state police shall provide a report to the department that
indicates that the individual is cleared or not cleared to become a Michigan
cyber civilian corps volunteer or advisor.
(6) If a criminal arrest fingerprint is subsequently
submitted to the department of state police and matches against a fingerprint
that was submitted pursuant to this act and stored in its automated fingerprint
identification system (AFIS) database, the department of state police shall
notify the department that the individual is still cleared or is no longer
cleared to continue as a Michigan cyber civilian corps volunteer. When the
department of state police is able to participate with the Federal Bureau of
Investigation automatic notification system, then any subsequent arrest
fingerprint submitted to the Federal Bureau of Investigation must also be
reviewed by the department of state police. The department of state police
shall provide a report to the department that indicates that the individual is
still cleared or is no longer cleared to continue as a Michigan cyber civilian
corps volunteer or advisor.
(7)
If a background check results in previous criminal history, the individual may
appeal to the director or his or her designee for nondeployable Michigan cyber
civilian corps advisor status.
(8)
Michigan cyber civilian corps volunteers or advisors may not engage in training
until either the background check or appeal regarding the background check
process has been completed.
Sec. 6. (1) A
Michigan cyber civilian corps volunteer or
advisor is not an agent, employee, or independent contractor of
this state for any purpose and has no authority to bind this state with regard
to third parties.
(2) This state is not liable to a Michigan cyber civilian
corps volunteer or advisor for personal injury or
property damage suffered by the Michigan cyber civilian corps volunteer through
participation in the Michigan cyber civilian corps.
Sec. 7. (1)
Except as otherwise provided in this section, the department and this state are
immune from tort liability for acts or omissions by a Michigan cyber civilian
corps volunteer or advisor under this act.
(2) Except as otherwise provided in this section, and without
regard to discretionary or ministerial nature of the conduct of a Michigan
cyber civilian corps volunteer or advisor,
each Michigan cyber civilian corps volunteer or
advisor is immune from tort liability for an injury to a person
or damage to property that occurred while deployed and acting on behalf of the
department if all of the following are met:
(a) The Michigan cyber civilian corps volunteer or advisor is acting or reasonably believes that he
or she is acting within the scope of his or her authority.
(b) The Michigan cyber civilian corps volunteer's or advisor's conduct does not amount to gross
negligence that is the proximate cause of the injury or damage.
(c) The Michigan cyber civilian corps volunteer's or advisor's conduct is not a material breach of the
volunteer agreement during that deployment.
(3) If a claim is made or a civil action is commenced against
a Michigan cyber civilian corps volunteer or advisor for injuries to persons or property
caused by negligence of a Michigan cyber civilian corps volunteer or advisor that occurred while in the course of his
or her deployment on behalf of the department and while acting within the scope
of his or her authority, the department may pay for, engage, or furnish the
services of an attorney to advise the Michigan cyber civilian corps volunteer or advisor as to the claim and to appear for and
represent the Michigan cyber civilian corps volunteer or
advisor in the action. The department may compromise, settle, and
pay the claim before or after the commencement of a civil action. Whenever a
judgment for damages is awarded against a Michigan cyber civilian corps
volunteer or advisor as a result of a
civil action for personal injuries or property damage caused by the Michigan
cyber civilian corps volunteer or advisor while
in the course of his or her deployment and while acting within the scope of his
or her authority, the department may indemnify the Michigan cyber civilian
corps volunteer or advisor or pay, settle, or
compromise the judgment.
(4) If a criminal action is commenced against a Michigan
cyber civilian corps volunteer or advisor based
upon the conduct of the Michigan cyber civilian corps volunteer or advisor in the course of his or her deployment,
if the Michigan cyber civilian corps volunteer or
advisor had a reasonable basis for believing that he or she was
acting within the scope of his or her authority at the time of the alleged
conduct, the department may pay for, engage, or furnish the services of an
attorney to advise the Michigan cyber civilian corps volunteer or advisor as to the action, and to appear for and
represent the Michigan cyber civilian corps volunteer or
advisor in the action. A Michigan cyber civilian corps volunteer or advisor who has incurred legal expenses for
conduct prescribed in this subsection may obtain reimbursement for those
expenses under this subsection.
(5) This section does not impose liability on this state or
the department.
(6) As used in this section, "gross negligence"
means conduct so reckless as to demonstrate a substantial lack of concern for
whether an injury results.
Enacting section
1. This amendatory act does not take effect unless House Bill No. 5427 of the
100th Legislature is enacted into law.