Digital

In just two months, California’s Technology Modernization Fund (TMF) has launched and officially selected four projects from its inaugural application period.

On January 12, 2022, the California Department of Technology (CDT) — which approved the TMF in summer 2021 to fund small efforts that can quickly provide high-value services and fund urgent needs identified by the state’s Stabilization Service — announced that projects from the California Environmental Protection Agency (EPA), and the California departments of Corrections and Rehabilitation (CDCR), Food and Agriculture (CDFA), and Consumer Affairs (DCA) will move forward.

With an estimated budget of $1.5 million, the California EPA will develop a geospatial dataset that will help the state “more quickly respond to emergencies by identifying locations and jurisdictions of hazardous materials incidents.” Platform development is expected in roughly 6 months; full data population should occur within one year.

In an effort to both expand awareness of open CDCR positions and smooth out the application and hiring process for applicants and state staff, the department will develop a method to “integrate state HR systems with commercial job boards and industry standard recruitment platforms.” The project’s estimated budget is $3.5 million over two years, and it’s expected that the solution will serve as a proof of concept that can extend to other state departments.

The project with perhaps the quickest production time is from the CDFA, which will update the system that tracks companies who can test and repair weight and measurement equipment — such as grocery scales, electric meters and gas pumps (there are nearly 1.85 million such devices registered in California) — and move it online. The project, which has an estimated budget of less than $1 million and is expected in production in a few months, will help companies find a certified agent who can quickly get faulty equipment back online, saving time and lost revenue for the business.

With a projected budget of roughly $400,000, the speech and hearing board within the DCA will move a currently paper-based process — for application, processing and payment for 13 license types — online. Implementation of the first license type is expected within six months, and the remaining 12 will follow over an additional year or so.

These four projects were chosen from a pool of 21 state-submitted project applications, five of which were selected to pitch their projects to a committee of executives from other state agencies and departments. Following the pitch day, these four projects were deemed most suitable for TMF funding.

As Carolyn Nordstrom, deputy director of the CDT’s Project Management Office (PMO), said in December, this is a recurring process.

“We’ll continue while we have money available to invest with the goal of demonstrating to the Department of Finance and the Legislature and others that this is a really successful and viable alternative way to fund certain kinds of technology investments and modernization,” she said during the CDT Vendor Forum on Dec. 8.

The next TMF program application period will open by Spring 2022.

 

Cal-Secure Aims to Cut Costs, Upskill Staff, and Improve Statewide Security.

California’s cybersecurity journey is full of setbacks and successes, hard tumbles and tenacious wins. In every sense, it’s a coming-of-age story, where growth is driven as much by loss as achievement. In this evolution, the Golden State is about to take its next big leap.

Earlier this month Gavin Newsom took to the podium to announce Cal-Secure, the state’s first long-term road map to direct and decide cybersecurity strategies across agencies. The plan represents a Herculean effort. It’s the result of extensive collaboration between agencies, beginning in 2019 as an aspiration to establish statewide cybersecurity standards, defense protocols, and consolidate a patchwork of cybersecurity technologies.

Despite its broad aim, Newsom stressed Cal-Secure has teeth, describing it as something more than soft recommendations, but a new standard that would compel agencies to act through implementation deadlines, mandatory reporting, and dedicated resources. He said funding for Cal-Secure will be drawn from the state’s annual budget that allots $40 million per year for IT security.

“Cal-Secure will define a path for state entities to strengthen their cybersecurity measures, so that they may continue to provide critical services without interruption,” Newsom said. “The strategy isn’t going to gather dust on a shelf, we’re going to issue a directive to all state agencies to implement requirements within specific timeframes and to require agencies to report that progress and completion on the implementation.”

Yet this cybersecurity road map has yet to be officially released to the public, and even when it is released later this month, the plan prompts questions. These unknowns include how the plan will roll out, its specific deadlines, impacts on IT staffing, operations, and for the private sector, which cybersecurity vendors will come out winners or losers as California consolidates services.

A culminating effort

While Newsom said Cal-Secure would be released in early October, a spokesman from the California Department of Technology (CDT) confirmed it had been delayed, saying the department expected the road map “to be available soon.”

Still, the state has released some details, with the most recent packaged within Newsom’s 2020-2021 Governor’s Budget proposal. The document contains a brief description that summarizes Cal-Secure by its top three priorities. These include bolstering California’s cybersecurity staff via training and recruitment, unifying security oversight and enforcement, and creating minimum cybersecurity requirements for agencies when contracting or providing services.

Additional details can be found when looking back at Cal-Secure’s development. Officials have been talking about Cal-Secure since its inception in 2019 when Peter Liebert, the state’s former chief information security officer, began collecting input from 40 state departments for the five-year cybersecurity strategy. At the time, Liebert promoted Cal-Secure as California’s first statewide cybersecurity plan.

Vitaliy Panych, California’s current CISO and Liebert’s successor, continued Cal-Secure’s development. In 2020, Panych revealed at an industry event that the plan would be broken down into three essential components. Security governance, security operations, and technology capability.

Panych said security governance would focus heavily on safeguarding the state’s use of cloud services, while security operations guidelines would aim to improve cybersecurity information sharing between departments, and the last component, technology capability would be geared to improve contract requirements for cybersecurity vendors.

In February, Mike Marshall, the agency information security officer for the California Environmental Protection Agency (CalEPA) offered more insights into why the technology contracting component would be so important, at least speaking for his organization. As a collaborator in Cal-Secure’s development, he said for CalEPA it amounted to lower vendor costs through IT consolidation and better equipped IT staff through cross-training.

“The economies of scale work in our favor if we can get all the [CalEPA’s] boards, departments, and offices to come together and buy one [cybersecurity] product and utilize it, and cross-train people and have those backup types of scenarios with staff that understand the products across the agency,” Marshall said.

“…it’s my job to utilize all the available funds that we have and the staff that we have and the technology to stay on top of any-and-all potential vulnerabilities.”

Statewide cybersecurity consolidation

If Cal-Secure acts as a catalyst for statewide cybersecurity consolidation or shared services, there are likely big benefits for agencies. For instance, the National Association of State Chief Information Officers (NASCIO) has been a long-time proponent for IT consolidation in general. A NASCIO report noted the key advantages include improved operational efficiency, optimized service delivery, and lower costs.

It also should be noted that most state CIOs are in favor of IT consolidation where it makes sense. A NASCIO poll showed IT consolidation was one of the top 10 priorities for state CIOs in 2021, ranked seventh, while cybersecurity was ranked number one.

Outside of research, there are prominent use cases that support statewide cybersecurity. For example, in Louisiana the state saved $75 million in its first year after it consolidated its services in 2015. The consolidation helped departments eliminate redundant security IT services while also expanding protections to department and offices that had cybersecurity gaps.

After the consolidation, Dustin Glover, Louisiana’s former chief information security officer told  The Advocate that change had improved the state’s defenses considerably.

“Right now, I think the state is in its best posture ever, and we’re continuing to improve upon that,” said Dustin Glover, Louisiana’s former chief information security officer to The Advocate.

Other instances of state cybersecurity consolidation have happened in Virginia, where in 2012, its former CIO Sam Nixon said the move had led to more efficient threat detection and defense technologies. He compared the consolidation to Virginia departments receiving services through the same “pipes.”

“In Virginia, at least we’re fortunate to have a unified, consistent, reliable, and secure infrastructure that everyone is connected to,” Nixon said. “We have a single set of pipes that are shared by all agencies, but through that we’re able to place more sophisticated shared services and 24-7 security monitoring. So, we’re seeing the threats…and we can take pretty immediate action.”

Yet Nixon said the work to consolidate services didn’t come without challenges. Teaching agency administrators to use new technologies and convincing departments to see the value in new cybersecurity tasks had been an ongoing obstacle.

“We’re not always sure the agency leadership is aware of the threat, and it embraces some of the things that we have to do — or ask them to do — which are inconvenient to them, require more resources, and require them to reorder priorities,” Nixon said.

A moving target (California momentum)

Once Cal-Secure’s road map is published and agencies begin to apply its strategies it will represent another cybersecurity milestone for California. Likewise, its adoption may serve as a guidepost to prevent severe data breaches and attacks on systems.

Recently, state agencies have been the victims to number of cyberattacks. These include a ransomware attack on California’s Department of Motor last February where millions of records were compromised in a data breach. During the height of the pandemic in 2020, the California Employment Development Department also suffered from more than 30,000 false unemployment claims. This agency’s vulnerabilities were brought to light when district attorneys showed that claims had been filed by incarcerated state residents.

Newsom said that in recent years California has spent more than $260 million in its battle against cyberattacks, and that Cal-Secure will complement an array of cybersecurity initiatives that are already underway. In 2017 California launched the state’s first Security Operations Center (SOC), that continuously monitors and responds to cyber threats on the California Government Enterprise Network (CGEN), California primary enterprise network. And within the governor’s budget, funding has been allocated for a range of ongoing cybersecurity initiatives that include everything from IT security performance metrics to resources for state organizations to increase or improve their cybersecurity programs.

In a statement, the California Department of Technology (CDT) said that one of the biggest differentiators in Newsom’s 2021-2022 budget is direct funding for the CDT to provide cybersecurity service to all state agencies—as opposed to charging agencies individually for cybersecurity services. It’s unconfirmed if this move is tied to Cal-Secure or a statewide cybersecurity consolidation plan, but CDT said it will expand its reach.

“The new centralized funding model ensures SOC and Statewide Information Security Oversight benefits for all state entities and supports maturing the statewide information security infrastructure as a default and a built-in function across state government,” the CDT stated.

In his announcement of Cal-Secure, part of the state’s celebration of Cybersecurity Awareness Month, Newsom stressed his administration’s commitment to protect the state through cybersecurity and pledged continued support.

“Hackers steal our time, money, and they also steal our peace of mind. So protecting our data, and more importantly, other people’s data, is among the most important things we can do to prevent disruption in our daily lives,” Newsom said.

 

Image: YouTube: Gov. Gavin Newsom kicks off Cybersecurity Education Summit on October 6, 2021.

More than 96 percent of Californians receive broadband internet service from a Digital Infrastructure and Video Completion Act (DIVCA) franchisee. Since DIVCA’s enactment, the rise of web-based video streaming and personal wireless communication devices has changed the video service market.

Senate Bill (SB) 28, by state Senator Anna Caballero (SD 12), was signed into law earlier this month—and revises the DIVCA of 2006—including changes to the type of information collected by the California Public Utilities Commission (CPUC) from state franchise holders. The CPUC can use the collected data to enforce customer service requirements on cable and internet service providers (ISPs). If the service providers fail to meet their franchise license obligations, they will be shut down.

The push for the legislation was another step toward closing the current digital divide that plagues underserved and disadvantaged communities.

“The COVID-19 pandemic placed a spotlight on the inequality caused by California’s persistent digital divide. Students, residents, and business owners are placed at a huge disadvantage and are struggling to participate in the 21st Century way of life,” said Caballero in a press release. “Now more than ever, we must ensure equal broadband network development across all of California and eliminate the digital divide.”

Broadband network developers will also be able to utilize state assets in network development planning and deployment plans.

SB-28 garnered myriad supporters who argued that the CPUC will have more information to ensure state franchise license holders meet legal obligations including non-discrimination terms, and granular data collection will prevent “digital redlining”—where lower the digital divide is more pronounced in low-income neighborhoods.

“Many of our residents all over the state were unable to work from home, and their children and teens were unable to connect to the internet to comply with school obligations. There simply was a lack of infrastructure capacity to support their internet service needs,” reads the supporting senate floor analysis.

On the other hand, those in opposition to the legislation were concerned about granular data collection by the CPUC, stating that there would not be no guarantee that the information collected would be confidential. Furthermore, the bill “significantly expands the CPUC’s cable franchising authority in a way that is federally pre-empted.”

Caballero says that more than two million Californians are struggling to participate in the more modern way of life due to “inferior or non-existent broadband,” especially low-income residents and underserved communities. This legislation is another step toward digital equity.

For the first time in more than 10 years, California has updated its telework policy for state employees.  The Government Operations Agency posted the new policy on its website last week.

Advocates say the new policy reflects the realization that enabling remote work allows for better response to disasters like the COVID-19 pandemic, enhances workforce diversity and improves work-life balance for employees, among other benefits, ranging from the health of the environment to reduced operational costs.

“COVID showed us that short-term is not the same as long-term disaster planning,” said John O’Duinn, a telework expert and strategist with Lafayette-based CivicActions and hired by the state to help update the policy. “When you close the office for 18 months, people expect government services to keep working even if a human can’t get into a government building. To do that you need a policy that says this is a standard way of working for the organization, not just a perk for some.”

The update also considers the fact that the workforce has changed, with millennials dominating the ranks, followed by Gen Zers, who are accustomed to using digital technologies and believe there is no such thing as a job for life. O’Duinn, author of “Distributed Teams, the Art and Practice of Working Together While Physically Apart”, said it also signals a move from outdated notions that only highly trusted, senior-level workers are allowed to work remotely or that remote work is associated with low productivity.

The policy assumes managers will shift their focus from counting “butts in seats” to measuring results that matter and that can be realized with telework arrangements and distributed teams of employees. O’Duinn cited the shutdown of DMV offices during the pandemic and the department’s shift to enable the public to do most DMV business online.

“People found a way to keep doing the work to keep the wheels of government turning,” he said.

State departments, agencies and other offices have one year to adapt the new telework framework for their own department operations and collective bargaining agreements. Each will determine which of their employees will be eligible for a telework arrangement based on the types of activities they do, whether their work requires them to have a public presence or if data required for their job could pose a security risk when accessed offsite.

A worker who prints new drivers’ licenses would not be eligible to telework, for example, and would be designated an “office-centered” worker. Other employees who enter data, answer telephones, write, edit, design or deliver services virtually would be more appropriate for telework arrangements, and be designated “remote-centered.” Departments will ensure teleworkers have the equipment they need to work at alternative sites, which may include ergonomic desks, chairs and computer and other office equipment.

Department managers are being asked to consider how telework arrangements will affect department efficiency and the effectiveness of project teams. Single parents, for example, are less likely to miss work and more productive if they can eliminate time-sucking commutes that make it hard to juggle parenting or other caregiving needs that occur during the workday.

O’Duinn said telework opportunities also attract a far more diverse set of job applicants, including people who do not live close to urban centers and people with physical disabilities. Military spouses, who face three times the unemployment rates as other workers because of frequent relocations, will also benefit from state jobs that can be done remotely.

In addition to potential cost savings on office space, O’Duinn said taking commuter cars off the road has significant environmental impacts. According to the state’s telework dashboard, of 15 state departments tracking their telework rates, 15,000 state employees (95%) are teleworking some or all of the time, which translates to 612 metric tons of CO2 emissions avoided per week.

Image: The Ziggurat Building, home to the Departments of General Services and Technology.  Source: iStockphoto.com

State explores new ways to boost IT talent.

Whether it’s a city IT department or a state technology office, it’s not easy for the government to hire capable talent. The California economy is competitive. It brims with nearly 1.9 million tech jobs, boasts the most tech companies out of any state, and on average, pays tech workers 78 percent more than all other occupations, according to the U.S. Bureau of Labor Statistics.

In this private-vs-public sector tug of war, California IT departments battle to capture top candidates. In a Deloitte panel discussion last month, Joy Bonaguro, California’s chief data officer, laid out a few strategic plays the state has set in motion to find the next generation of tech talent. The methods include an assortment of modernized contracting agreements, the launch of a workforce development program called the Cal Data Academy, and a zealous push to market rewarding, mission-driven jobs.

California’s desire to add and upskill technologists—and in Bonaguro’s case, data analysts, data architects, and data scientists—is motivated by more than efficiency. It’s about adaptation. To react and respond to disruptive technologies like artificial intelligence, demands, and emergencies, Bonaguro said departments require a reservoir of expertise, or what she described as “resiliency.”

“A big part of data resiliency is lifting and upskilling and creating common competencies across your staff so you can rotate those people [into different roles and projects],” Bonaguro said. “We can’t forget the human component when we’re talking about data resiliency.”

1. Jobs with p­urpose

This human-centric approach, she explained, means offering exceptional people equally exceptional pursuits.

Bonaguro said that since the state can’t compete with Silicon Valley on benefits, she’s working to structure positions around purpose and impact. It’s an overlooked but important advantage the public sector has over the private sector she said. Health, education, housing, transportation, safety, these quintessential qualities of life elements are all in the public sector’s domain.

“While we can never compete on salary we can compete on mission, so there becomes a marketing play around the work that we’re doing,” she said.

In contrast, Bonaguro said she has seen how the private sector can at times struggle to craft meaningful IT roles. For instance, at Google, one common criticism levied by employees is a glut of overqualified workers. The company’s brand recognition and high pay often command the best applicants, but the work doesn’t always match abilities. Employees have criticized Google for relegating highly educated staff to tasks like tech support or social media monitoring.

“I’ve talked to data scientists who have worked in the private sector, and they’re kind of doing the same boring things over and over again,” Bonaguro said. “The sheer number-rich volume of questions to explore in the public sector is really cool and exciting and fun and so I think that’s quite a compelling value proposition for a lot of people.”

Yet the state’s goal to attract, hire and retain skilled tech workers isn’t just about pitching an appealing message. Bonaguro said the positions needed to be designed in a way to merit the marketing. Job titles and descriptions need to be modernized to mirror similar positions in the private sector.

For example, she said that where possible, data workers specializing in business intelligence should have roles connected to decision-making offices, something that hasn’t always been the case.

“I strongly would argue that data teams do not belong in technology [departments],” Bonaguro said. “They impact business change and business opportunity and so I think they should sit within and be closely tied to the [state’s] business and lay outside the operational pressures of your typical IT shop.”

She estimated that the update to job descriptions could take a year, to a year-and-a-half, based on California’s positions.

2. Cal Data Academy

Next, Bonaguro spoke of a workforce development initiative she called the “Cal Data Academy.” The state has yet to officially announce the program, but when launched, it will provide technical data analytics training and tools for California staff. The idea is to develop qualified, in-house data professionals for departments and offices. Bonaguro said the project is still in its infancy, but her aim is to spearhead the Cal Data Academy’s development so the state can leverage its current talent more effectively.

“I’m working to create development pathways for existing workforce, and so we’re working on scoping out the Cal Data Academy, which will be an internal training and professional development program,” Bonaguro said. “We’re just starting on that so I don’t want to get in front of myself, but we can say, there’s plenty of existing analytical talent that might just need the right access to tools or the right framing for how to talk with business [decision makers].”

Bonaguro said to create the Cal Data Academy she’ll be leaning on her time in San Francisco where she served as the city’s first chief data officer, from 2014 to 2018. Her work in San Francisco entailed a range of data and open data initiatives, efforts that were supported by a data coordinator program she instituted from the outset.

Under San Francisco’s Data Coordinator program, Bonaguro met with internal and external stakeholders to triage the city’s data needs, then recruited volunteers to be data coordinators—staff who could help inventory, interpret, publish, and manage data in their respective departments.

“When I was in San Francisco, we worked to sort of level and upskill armies of analysts on similar tools and approaches,” Bonaguro said. “In California, we’re just not at that stage yet. We’re still early in the data strategy.”

3. Smart Contracting

When in-house technical expertise isn’t available, the final option is to find outside contractors. In this effort, Bonaguro said the state is also trying to modernize its operations to be as smart and agile as possible. Bonaguro said this involves looking at the contracting process and ensuring it gives the state maximum flexibility.

Those familiar with government procurements know contractors—whether companies or individuals—are often challenged with complex regulation and red tape before they can secure a contract. The process alone can be deal-breaking and eliminate newer, innovative companies, startups, and professionals who don’t have the resources, time, legal expertise, or patience to deal with bureaucracy. Their solutions could be vastly cheaper, answer a need more effectively, and yet be altogether discarded due to a traditional procurement regulation.

Bonaguro said her team is planning to issue unique contracts that will allow California the flexibility to hire modern contractors as needed.

“The state issues what are called service contracts, global service contracts, where the state can essentially bring in and hire end contractors,” Bonaguro said. “And so we have updated and modernized [this contracting tool] and we’ll be re-issuing that so it becomes sort of a vehicle in which using modern job descriptions the state can access talent.”