DEFENDING AGAINST SECURITY BREACHES PAGE 5 March 2015 Citizen Initiatives Teacher Training Gas Taxes AmericA’s innovAtors believe in nuclear energy’s future. DR. LESLIE DEWAN technology innovAtor Forbes 30 under 30 I’m developing innovative technology that takes used nuclear fuel and generates electricity to power our future and protect the environment. America’s innovators are discovering advanced nuclear energy supplies nearly one-fifth nuclear energy technologies to smartly and of our electricity. in a recent poll, 85% of safely meet our growing electricity needs Americans believe nuclear energy should play while preventing greenhouse gases. the same or greater future role. bill gates and Jose reyes are also advancing nuclear energy options that are scalable and incorporate new safety approaches. these designs will power future generations and solve global challenges, such as water desalination. Get the facts at nei.org/future #futureofenergy CLIENT: NEI (Nuclear Energy Institute) PUB: State Legislatures Magazine RUN DATE: February SIZE: 7.5” x 9.875” Full Page VER.: Future/Leslie - Full Page Ad 4CP: Executive Director MARCH 2015 VOL. 41 NO. 3 | CONTENTS William T. Pound Director of Communications Karen Hansen Editor Julie Lays STATE LEGISLATURES Contributing Editors Jane Carroll Andrade Mary Winter NCSL’s national magazine of policy and politics Web Editors Edward P. Smith Mark Wolf Copy Editor Leann Stelzer Advertising Sales FEATURES DEPARTMENTS Manager LeAnn Hoff (303) 364-7700 Contributors 14 A LACK OF INITIATIVE 4 SHORT TAKES ON NCSL NEWS Julie Bell Michelle Exstrom By Jennie Drage Bowser Expertise, social media, meetings Pam Greenberg Karmen Hanson Fewer citizen initiatives could make life easier at the Capitol, and more Stacy Householder Martha King but at what cost? Donna Lyons Ann Morse 5 STATESTATS Rich Williams 20 THE GREEN (AND WINDING) ROAD Defending against breaches Art Director Bruce Holdeman By Suzanne Weiss NCSL Officers It’s been a year since Colorado and Washington legalized 6 NEWSMAKERS President recreational marijuana, and not all that was predicted has Insight into what’s happening under the domes Senator Debbie Smith Nevada come to pass—with some surprises along the way. President-Elect 8 TRENDS Senator Curt Bramble Utah Gas taxes, energy efficiency, Gulf War vets Staff Chair and hungry elderly Margaret Piety Sr. Staff Attorney Indiana Denver Office 7700 East First Place Denver, Colorado 80230 (303) 364-7700 Washington, D.C. Office 444 North Capitol Street, N.W. Suite 515 Washington, D.C. 20001 (202) 624-5400 Website www.ncsl.org/magazine 12 STATELINE State Legislatures News from around the nation—from fois gras (ISSN 0147-0641), the national magazine of policy to cupcakes and politics, is published monthly by the National Conference of State Legislatures except 32 ON RECORD July/August and October/ November, which are combined. Postmaster: Send address changes to: State 23 EDIBLES: FOR EXPERTS ONLY? Legislatures, 7700 East First Place, Denver, CO 80230. Products infused with marijuana account for about 40 © 2015, All Rights Reserved. percent of all sales, but are they safe? Opinions expressed in this magazine do not necessarily reflect NCSL policy. 25 Q & A WITH GROWER TIM CULLEN Go to www.ncsl.org/ He began growing marijuana in his bookstore/ to subscribe. Annual rates: U.S.— basement, and now his stores make $49; foreign—$55; teachers—$25 (promo code 200 to 300 sales a day. SLMTEA). Single copy: $6.50. Letters to the editor and requests for permission to reprint may be mailed 26 ROOM FOR IMPROVEMENT to Julie Lays in the Denver office or e-mailed to her at: By Suzanne Weiss Q & A With Sir Ken Robinson, international education leader [email protected]. Send subscriptions and changes How can we expect A+ teachers “Creativity is the great driver of human achievement.” of address to the Marketing Department in Denver. from C- training programs? Periodically, NCSL rents 35 FINAL WORD mailing labels to other organizations. If you prefer 31 THE FINNISH FORMULA Phil Berger, North Carolina Senate president pro tem, on his your name not be included please send a written Finland—with a robust economy and No. 1 ranking on goals, leadership style and grandchildren request. international student tests—has caught the world’s attention. State Legislatures is indexed in the PAIS Bulletin and Expanded Academic Index. It is also available in microform and electronically through University Microfilms Inc. (UMI) at (800) 521-0600. 4 SHORT TAKES ON NCSL’S NEWS FOCUSED SOCIAL MEDIA 10,400+ 3,900+ NCSL’s followers Likes on NCSL’s on Twitter Facebook page EXPERTISE“Congress hasn’t been very productive, but that’s just not the Louisiana Representative Julie Stokes (R) catches up case in the states.” with James Cox of the American Institute of CPAs at NCSL’s Executive Committee meeting in January. —NCSL’s Max Behlke in a CQ Roll Call article, States Six Times More Productive Than Congress. “Voter ID is a perennial question. Working with biometrics is a relatively new idea.” —NCSL’s Wendy Underhill on a New Mexico proposal to study using technology, such as retinal scans, to identify voters, in the Associated Press. “How do you write a policy that covers every situation? That is where states are struggling.” —Peggy Kerns, Director of PHOTO: GILBERTO MENDOZA the NCSL Center for Ethics in U.S. Senator Tom Udall (D) of New Mexico, left, Massachusetts Representative Jay Kaufman (D), left, Government, in the Columbus celebrates with Senator John Pinto (D) on his 90th popped in to visit his friend, Hawaii Senator Les Ihara, Dispatch, regarding “the very gray birthday during the NCSL Forum in Washington, D.C. Jr. (D), on the opening day of Hawaii’s legislative session area” of personal social-media Pinto is the longest serving state senator in New Jan. 21. They first met at an NCSL meeting on citizen pages. Mexico, and one of a few surviving Navajo code engagement, a shared interest. talkers. NCSL Staff Vice Chair Karl Aro of Maryland (left), along with NCSL Executive Director Bill Pound (right), listen to NCSL Vice President and Iowa Senate Majority Leader Mike Gronstal (R) during policy discussions at NCSL’s Executive Committee meeting in January. MARCH 2015 | STATE LEGISLATURES STATESTATS | 5 Defending Against Breaches t’s not if, but when. A “Data Security Breach” With the enormous amount of personal data Americans are sharing online and businesses are amassing, is the potential or actual experts agree that it’s just a matter of time before hackers and cyber thieves get their hands on all that unauthorized access to Itreasure. or acquisition of sensitive, Legislatures have worked to protect citizens by passing laws that require businesses with computerized protected or confidential personal information to notify customers if that information is leaked or accessed without authorization. The personal information, such laws also allow consumers to monitor their records or close their credit card accounts to protect themselves as names with Social Security against theft and fraud. Many credit these data breach laws with prompting better security practices among or driver’s license numbers, businesses—such as encryption, which makes documents unreadable except to the intended recipient. or credit card numbers with Still, data intrusions continue. The credit reporting agency Experian predicts thieves will be focusing more on access codes. usernames and passwords stored in the cloud this year, as well as patients’ confidential health information. This increased vulnerability has lawmakers searching for ways to improve upon the laws already on the books TOP 10 to make them more effective. California expanded its law requiring reasonable security practices to include INFORMATION MOST OFTEN businesses that maintain—not just own or license—personal information. Kansas, Louisiana, West Virginia and STOLEN Wyoming expanded notification requirements to educational institutions. Florida amended its law to include notification of medical and insurance information breaches and to require businesses to notify consumers within Real Names Birth Dates 30 days. (Most states simply require notification in the “most expeditious time possible and without unreasonable Social Security Numbers delay.”) And South Carolina now requires state agencies to report breaches to the Division of State Technology Home Addresses along with developing security plans. Medical Records Phone Numbers As awareness and security practices improve, so do the skills of those determined to break into systems and Financial Information steal confidential data. Businesses and governments will have to run fast to stay ahead of them. Email Addresses — Pam Greenberg, NCSL Usernames and Passwords Insurance Policy Numbers Source: Symantec A BUNCH OF BReach Laws States vary in who they require businesses to notify when breaches occur. HOW DO THEY DO IT? Businesses must notify: Customers when personal electronic information is breached At least 90 percent of all breaches can be attributed to one Patients when medical information is breached of these methods. Attorneys general or another state entity after a breach Customers after breaches of paper records, in addition to computerized records Point of Sale Intrusions Web Application Attacks Insider Misuse Physical Theft or Loss Miscellaneous Errors Crimeware Card Skimmers Denial of Service Attacks Cyber Espionage Other Note: Web applications are browser-based programs in which all or Note: Twenty-nine states also require government