Bill Text: IL HB5398 | 2019-2020 | 101st General Assembly | Introduced

---

Bill Title: Creates the Illinois Cyber Reserve Act. Establishes the Illinois Cyber Reserve, to be administered by the Illinois Emergency Management Agency, in order to deploy volunteers upon the occurrence of a cybersecurity incident. Contains provisions regarding volunteer requirements, criminal history checks, and civil liability. Requires volunteers to provide assistance for 6 years from the time of deployment or for the time required under the Agency's record retention policies, whichever is longer, and assistance to be for 7 days unless a different period is specified in writing. Creates the Illinois Cyber Reserve Advisory Board as an advisory body within the Agency and tasks it with reviewing and making recommendations regarding the policies and procedures used in implementing the Act. Requires the Agency to publish guidelines for the operation of the Illinois Cyber Reserve program and provides minimum requirements for the guidelines. Allows the Agency to enter into contracts with clients, provide training to individuals, and establish a fee schedule for clients. Provides that specified information given to the Illinois Cyber Reserve or obtained under the Act is exempt from disclosure under the Freedom of Information Act. Provides that the Agency shall adopt any rules necessary for the implementation and administration of the Act.

Spectrum: Partisan Bill (Republican 4-0)

Status: (Introduced - Dead) 2020-02-18 - Referred to Rules Committee [HB5398 Detail]

Download: Illinois-2019-HB5398-Introduced.html

---

101ST GENERAL ASSEMBLY State of Illinois 2019 and 2020 HB5398 Introduced , by Rep. Grant Wehrli - Avery Bourne - Amy Grant - Dan Ugaste SYNOPSIS AS INTRODUCED:
New Act
Creates the Illinois Cyber Reserve Act. Establishes the Illinois Cyber Reserve, to be administered by the Illinois Emergency Management Agency, in order to deploy volunteers upon the occurrence of a cybersecurity incident. Contains provisions regarding volunteer requirements, criminal history checks, and civil liability. Requires volunteers to provide assistance for 6 years from the time of deployment or for the time required under the Agency's record retention policies, whichever is longer, and assistance to be for 7 days unless a different period is specified in writing. Creates the Illinois Cyber Reserve Advisory Board as an advisory body within the Agency and tasks it with reviewing and making recommendations regarding the policies and procedures used in implementing the Act. Requires the Agency to publish guidelines for the operation of the Illinois Cyber Reserve program and provides minimum requirements for the guidelines. Allows the Agency to enter into contracts with clients, provide training to individuals, and establish a fee schedule for clients. Provides that specified information given to the Illinois Cyber Reserve or obtained under the Act is exempt from disclosure under the Freedom of Information Act. Provides that the Agency shall adopt any rules necessary for the implementation and administration of the Act.
LRB101 16599 CPF 65983 b
A BILL FOR
HB5398 LRB101 16599 CPF 65983 b
AN ACT concerning safety.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 1. Short title. This Act may be cited as the
Illinois Cyber Reserve Act.
Section 5. Definitions. In this Act:
"Advisory Board" means the Illinois Cyber Reserve Advisory
Board created under Section 40.
"Agency" means the Illinois Emergency Management Agency.
"Chief information officer" means the individual within
the Agency designated by the Governor as the chief information
officer for this State.
"Client" means a municipal, educational, nonprofit, or
business organization that has requested and is using the rapid
response assistance of the Illinois Cyber Reserve under the
direction of the Agency.
"Cybersecurity incident" means an event occurring on or
conducted through a computer network that actually or
imminently jeopardizes the integrity, confidentiality, or
availability of computers, information or communications
systems or networks, physical or virtual infrastructure
controlled by computers or information systems, or information
resident on any of these. "Cybersecurity incident" includes,

HB5398 - 2 - LRB101 16599 CPF 65983 b
but is not limited to, the existence of a vulnerability in an
information system, system security procedures, internal
controls, or implementation that is subject to exploitation.
"Illinois Cyber Reserve" means the program established
under this Act under which civilian volunteers who have
expertise in addressing cybersecurity incidents may volunteer
at the invitation of the Agency to provide rapid response
assistance to a municipal, educational, nonprofit, or business
organization in need of expert assistance during a
cybersecurity incident.
"Illinois Cyber Reserve volunteer" means an individual who
has entered into a volunteer agreement with the Agency to serve
as a volunteer in the Illinois Cyber Reserve.
"Volunteer agreement" means the contract entered into
between the Agency and an Illinois Cyber Reserve volunteer
under Section 15.
Section 10. Appointment of volunteers. The Agency may
appoint individuals to serve as Illinois Cyber Reserve
volunteers for the purposes of facilitating the
responsibilities of the Agency as provided under this Act.
Section 15. Volunteer agreement.The Agency shall enter
into a contract with any individual who wishes to accept an
invitation by the Agency to serve as an Illinois Cyber Reserve
volunteer. The contract must include, at a minimum, all of the

HB5398 - 3 - LRB101 16599 CPF 65983 b
following:
(1) A provision acknowledging the confidentiality of
information relating to this State, State residents, and
clients.
(2) A provision protecting from disclosure any
confidential information of this State, State residents,
or clients acquired by the Illinois Cyber Reserve volunteer
through participation in the Illinois Cyber Reserve.
(3) A provision requiring the Illinois Cyber Reserve
volunteer to avoid conflicts of interest that might arise
from a particular deployment.
(4) A provision requiring the Illinois Cyber Reserve
volunteer to comply with all existing Agency security
policies and procedures regarding information technology
resources.
(5) A provision requiring the Illinois Cyber Reserve
volunteer to consent to background screening considered
appropriate by the Agency under this Act, and a provision
in which the individual gives that consent as described in
Section 20.
(6) A provision requiring the Illinois Cyber Reserve
volunteer to attest that he or she meets any standards of
expertise that may be established by the Agency.
Section 20. Clearance to become a volunteer; requirements.
(a) When an individual accepts an invitation to serve as an

HB5398 - 4 - LRB101 16599 CPF 65983 b
Illinois Cyber Reserve volunteer as described in Section 15 the
Agency shall request the Illinois State Police to do both of
the following:
(1) Conduct a criminal history check on the individual.
(2) Conduct a criminal records check through the
Federal Bureau of Investigation on the individual.
(b) An individual who accepts an invitation to the Illinois
Cyber Reserve shall give written consent in the volunteer
agreement for the Illinois State Police to conduct the criminal
history check and criminal records check required under
subsection (a). The Agency shall require the individual to
submit his or her fingerprints to the Illinois State Police and
the Federal Bureau of Investigation for the criminal records
check.
(c) The Agency shall request a criminal history check and
criminal records check under this Section on all individuals
who wish to participate as Illinois Cyber Reserve volunteers.
The Agency shall make the request on a form and in the manner
prescribed by the Illinois State Police.
(d) Within a reasonable time after receiving a complete
request by the Agency for a criminal history check and criminal
records check on an individual under this Section, the Illinois
State Police shall conduct the criminal history check and
provide a report of the results to the Agency. The report must
indicate that the individual is cleared or not cleared to
become an Illinois Cyber Reserve volunteer.

HB5398 - 5 - LRB101 16599 CPF 65983 b
(e) Within a reasonable time after receiving a proper
request by the Agency for a criminal records check on an
individual under this Section, the Illinois State Police shall
initiate the criminal records check with the Federal Bureau of
Investigation. After receiving the results of the criminal
records check from the Federal Bureau of Investigation, the
Illinois State Police shall provide a report to the Agency that
indicates that the individual is cleared or not cleared to
become an Illinois Cyber Reserve volunteer.
(f) If a criminal arrest fingerprint is subsequently
submitted to the Illinois State Police and matches against a
fingerprint that was submitted under this Act and stored in its
automated fingerprint identification system database, the
Illinois State Police shall notify the Agency that the
individual is still cleared or is no longer cleared to continue
as an Illinois Cyber Reserve volunteer. When the Illinois State
Police is able to participate with the Federal Bureau of
Investigation automatic notification system, then any
subsequent arrest fingerprint submitted to the Federal Bureau
of Investigation must also be reviewed by the Illinois State
Police. The Illinois State Police shall provide a report to the
Agency that indicates that the individual is still cleared or
is no longer cleared to continue as an Illinois Cyber Reserve
volunteer.
Section 25. Nature of the conduct of volunteers.

HB5398 - 6 - LRB101 16599 CPF 65983 b
(a) An Illinois Cyber Reserve volunteer is not an agent,
employee, or independent contractor of this State for any
purpose and has no authority to bind this State with regard to
third parties.
(b) This State is not liable to an Illinois Cyber Reserve
volunteer for personal injury or property damage suffered by
the Illinois Cyber Reserve volunteer through participation in
the Illinois Cyber Reserve.
Section 30. Civil liability. Any Illinois Cyber Reserve
volunteer who in good faith provides professional services in
response to a cybersecurity incident shall not be liable for
civil damages as a result of his or her acts or omissions in
providing the professional services, except for willful and
wanton misconduct. This immunity applies to services that are
provided during or within the time of deployment for a
cybersecurity incident.
Section 35. Initiation of deployment.
(a) On the occurrence of a cybersecurity incident that
affects a client, the client may request the Agency to deploy
one or more Illinois Cyber Reserve volunteers to provide rapid
response assistance under the direction of the Agency.
(b) The Agency, in its discretion, may initiate deployment
of Illinois Cyber Reserve volunteers upon the occurrence of a
cybersecurity incident and the request of a client.

HB5398 - 7 - LRB101 16599 CPF 65983 b
(c) Acceptance of a deployment by an Illinois Cyber Reserve
volunteer for a particular cybersecurity incident must be made
in writing. An Illinois Cyber Reserve volunteer may decline to
accept deployment for any reason.
(d) To initiate the deployment of an Illinois Cyber Reserve
volunteer for a particular cybersecurity incident, the Agency
shall indicate in writing that the Illinois Cyber Reserve
volunteer is authorized to provide the assistance. A single
writing may initiate the deployment of more than one Illinois
Cyber Reserve volunteer.
(e) The Agency shall maintain a writing initiating the
deployment of an Illinois Cyber Reserve volunteer to provide
assistance to a client for 6 years from the time of deployment
or for the time required under the Agency's record retention
policies, whichever is longer.
(f) The deployment of an Illinois Cyber Reserve volunteer
to provide assistance to a client must be for 7 days unless the
writing initiating the deployment contains a different period.
(g) At the direction of the Agency, the deployment of an
Illinois Cyber Reserve volunteer may be extended in writing in
the same manner as the initial deployment.
Section 40. Illinois Cyber Reserve Advisory Board.
(a) The Illinois Cyber Reserve Advisory Board is created as
an advisory body within the Agency.
(b) The Advisory Board is composed of the adjutant general,

HB5398 - 8 - LRB101 16599 CPF 65983 b
the Director of the Agency, the Director of State Police, and
the Director of the Department of Commerce and Economic
Opportunity or their designees.
(c) The Advisory Board shall review and make
recommendations to the Agency regarding the policies and
procedures used by the Agency in implementing this Act.
Section 45. Powers and duties of the Agency.
(a) After consultation with the Advisory Board, the chief
information officer shall do both of the following:
(1) Approve the set of tools that the Illinois Cyber
Reserve may use in response to a cybersecurity incident.
(2) Determine the standards of expertise necessary for
an individual to become a member of the Illinois Cyber
Reserve.
(b) After consultation with the Advisory Board, the Agency
shall publish guidelines for the operation of the Illinois
Cyber Reserve program. At a minimum, the published guidelines
must include the following:
(1) An explanation of the standard the Agency will use
to determine whether an individual may serve as an Illinois
Cyber Reserve volunteer and an explanation of the process
by which an individual may become an Illinois Cyber Reserve
volunteer.
(2) An explanation of the requirements the Agency will
impose for a client to receive the assistance of the

HB5398 - 9 - LRB101 16599 CPF 65983 b
Illinois Cyber Reserve and an explanation of the process by
which a client may request and receive the assistance of
the Illinois Cyber Reserve.
(c) The Agency may enter into contracts with clients as a
condition to providing assistance through the Illinois Cyber
Reserve.
(d) The Agency may provide appropriate training to
individuals who wish to participate in the Illinois Cyber
Reserve and to existing Illinois Cyber Reserve volunteers.
(e) The Agency may provide compensation for actual and
necessary travel and subsistence expenses incurred by Illinois
Cyber Reserve volunteers on a deployment, at the discretion of
the Agency.
(f) The Agency may establish a fee schedule for clients who
wish to use the assistance of the Illinois Cyber Reserve. The
Agency may recoup expenses through the fees but may not
generate a profit.
(g) Information voluntarily given to the Illinois Cyber
Reserve or obtained under this Act that would identify or
provide a means of identifying a person that may, as a result
of disclosure of the information, become a victim of a
cybersecurity incident or that would disclose a person's
cybersecurity plans or cybersecurity-related practices,
procedures, methods, results, organizational information
system infrastructure, hardware, or software is exempt from
disclosure under the Freedom of Information Act.

HB5398 - 10 - LRB101 16599 CPF 65983 b
(h) The Agency shall adopt any rules necessary for the
implementation and administration of this Act.