MIRS provides comprehensive news and analysis of state government delivered in written reports detailing the activities of the House, Senate, Judicial and Executive branches of Michigan state government.
Michigan News And Capitol Report, Week Ending Fri., March 15, 2019
New Data Breach Bill Moves Amid Latest Ransomware Attack
Meanwhile, letters continue to go out from one recent example of a data breach, a ransomware incident that locked up servers and workstations back on Sept. 23 at Wolverine Solutions Group (WSG). A letter an impacted consumer received that notified him of the incident arrived on March 1, 159 days after the incident.
Bill sponsor Rep. Diana Farrington (R-Utica) said she is not happy with the speed of notification in that incident.
"Six months is a little excessive," she said.
According to a press release issued by Attorney General Dana Nessel's office Monday, it is unclear if any personal information was actually acquired in the breach, but up to 600,000 Michigander's records might have been exposed.
Information that might have been exposed includes names, addresses, dates of birth, Social Security numbers, insurance contract information, phone numbers and medical information for customers of Blue Cross Blue Shield of Michigan, Health Alliance Plan, McLaren Health Care, Three Rivers Health, North Ottawa Community Health System, and the Sparrow Health System.
According to the March 1 letter, WSG notified Sparrow of the incident Dec. 10. And on Feb. 7, the letter states, WSG identified the consumers' information in the computer system, so the notification was sent.
An article in the Detroit Free Press quotes WSG President Darryl English as saying the company sent letters to Blue Cross customers in late December and that the full impact of the breach will not be known until April. English did not return a call from MIRS Wednesday.
Business groups -- including the Michigan Chamber of Commerce, the Michigan Retailers Association and the National Federation of Independent Businesses -- oppose the bills, saying they'd prefer additional time, as they did last year when similar legislation was pending.
"This is a consumer protection. It is your data and my data," Farrington said. "If it is your information out there, I think you have a right to know, sooner than 90 days. You are talking about three months for somebody's information to be out there without their knowledge.
HB 4186 and HB 4187 are reintroductions of bills that passed the House in 103-6 votes last session, but the package stalled in the Senate.
Farrington explained the Senate made several changes that companies were asking for, and she "decided to not run the bill any further."
Among the changes made by the Senate was to extend the time period for non-credit card information. Businesses and agencies that use "a credit card payment processor or a credit card payment gateway" would have had to notify in 45 days, but those without credit card processors or gateways would have been given 75 days.
Farrington said she prefers the 45-day period because that is the standard set by 13 other states that have passed legislation for notification.
Farrington's bills would cover Social Security numbers, driver license numbers, state personal identification card numbers, passport numbers, and other sensitive information. The law would require businesses and government agencies which have such information in their computers to take reasonable security measures to protect such information.
The 45-day time period would begin running once a security breach is detected, Farrington explained. The law would require notification which would give the date or dates of the breach, a description of what information might have been acquired, what the business or agency is doing to restore security, and a description of steps consumers can take to protect against identity theft.
The Michigan Bankers Association (MBA) is on board with the proposal. Bankers often learn a breach has occurred before official notification goes out.
"Yes, we can send them a new card. Yes, we can close existing accounts and open new accounts, but until we have been notified, we cannot fully explain why we are taking these actions. Our hands are tied," MBA Policy Director David Worthams said in written testimony submitted to the committee. "When merchants notify financial institutions in a timely manner, we are more quickly able to react to potentially fraudulent activity as a result of a data breach. Our experience has shown, however, that merchants are reluctant to share this information."
Nessel spokesperson Kelly Rossman-McKinney said the Attorney General's office itself wasn't notified by the WSG data breach and learned of the incident through the Free Press article on March 7. She said that points out the need for the Attorney General's office to also be notified when such data breaches occur.
Judge Upholds Line 5 Authority But Strikes Down Board's Term
However, Judge Stephen Borrello struck down a "constitutional defect" that called for MSCAB members to serve six-year terms.
"However, the court must nevertheless enforce the remainder of the statute, to the extent possible," Borrello said of 2018 Public Act 359, which amended the 1952 act authorizing the Mackinac Bridge Authority to acquire a bridge connecting the upper and lower peninsulas.
"And here, there have been no challenges to any other provisions of the statute. Furthermore, it is apparent from the plain language of (the statute) that the Legislature intended for MSCAB members to serve at least four-year terms," the judge added.
PA 359 was approved in December by the Republican-led Legislature and then-Gov. Rick Snyder signed it into law during his final weeks as in office.
Gov. Gretchen Whitmer has since asked Attorney General Dana Nessel to opine on the constitutionality of the law, which helped pave the way for a deal between the state and Enbridge to construct an underground tunnel intended to house a Line 5 replacement.
Nessel's opinion is expected this month.
Robert Davis, a former Highland Park school board member who was convicted of embezzlement in 2014, and his nonprofit "A Felon's Crusade for Equality, Honesty and Truth," challenged the six-year terms, arguing it violated the state constitution, which bars any board or commission created after the constitution from exceeding four-year terms.
These news reports are brought to you by MIRS
Learn more at mirsnews.com
Shirkey Prioritizing Auto Insurance Over Budget
But this year, Senate Majority Leader Mike Shirkey (R-Clarklake) is prioritizing auto no-fault insurance reform over the budget. In short, the Senate leader wants to tell ratepayers that real relief is on the way before even asking residents to reach into their pockets for any more state investment, said Press Secretary Amber McCann.
With Michigan having the nation's high car insurance rates, Shirkey wants to show residents the state is serious about making life easier for them. What that looks like, is still not crystal clear.
Gov. Gretchen Whitmer's proposed 45-cent-a-gallon gas tax increase isn't going to move through the Legislature, but Shirkey and other Republicans are reluctantly signaling that some increase in revenue to pay for Michigan's roads is likely.
"The Senate Majority Leader is very focused on not linking any policy to the completion of the budget," McCann said. "Car insurance reform is a complex issue by itself and locking it to the budget, which is complex in itself, would make it all very difficult to resolve."
Senate Transportation Appropriations Subcommittee Chair Wayne Schmidt (R-Traverse City) is on board with the timing of saving drivers money on their auto insurance at about same time as asking for more money for the roads.
"That's ultimately the goal. To make sure we have some kind of reduction in the auto insurance rates and part of that reduction is going toward fixing the roads," he said. "In order to have safe roads we're going to need some more money."
Of course, if there is enough money for the roads, the Governor's gas tax would not be needed to which the Traverse City senator opines, "that would be nice."
It's unclear what dollar amounts are in this plan since all of the interest groups involved in the auto no-fault debate point to each other as the reason for the state's sky-high rates.
"I don't know the exact amounts that would be reasonable," said Schmidt, but he contends there is an extra bonus for motorists. If there are better roads, "that would help auto insurance claims costs," he added.
To this general idea, Sen. Curtis Hertel Jr. (D-East Lansing) said, "I am more than willing to have any conversation possible. Obviously, I have an enormous amount of respect for the majority leader and I'll look forward to what the actual puzzle looks like."
In the meantime, minus the "devil in the details," he said, "the concept is a fair thing to talk about and sounds like a balanced approach, but only if the details are there and I don't know what those look like."
Schmidt says it could be a couple of weeks before all this comes together, but with the whole package riding on special interests chipping in on no-fault, there may be some who doubt it can happen.
Local Road Agencies Owe MDOT $30M In Mistakenly Overpaid Road Funds
The Michigan Municipal League (MML), in a blog post on its website last week, reprinted a message MML said was sent by Michigan Department of Transportation (MDOT) to local road agencies, as well as to House and Senate leaders about the situation.
According to MDOT, during the book-closing for Fiscal Year (FY) 2018, it was discovered "incorrect amounts" of road funding had been distributed to county road commissions, cities, villages and MDOT's State Trunkline Fund (STF). Road funding distribution in Michigan is governed by the formula of Public Act (PA) 51 of 1951.
Because of the error, MDOT said it would have to correct the overpayments, and would do so by spreading out the recollections over the monthly distribution cycles this year.
According to the calculations released by MDOT, counties will need to collectively pay back $19.3 million, with county-by-county totals found here.
Cities and villages have to send back $10.7 million, with municipality-by-municipality details found here.
But because the payments are going to spread over 10 months, it's going to cost $1.9 million a month total across all the counties and $1.1 million a month total across the cities and villages.
MDOT attributed the issues leading to the overpayments to the state's new back-end central financial system, known as SIGMA, which has caused other hiccups across state government in the past.
The issue came up during today's meeting of the Senate Appropriations Subcommittee on Transportation, when Sen. Peter MacGregor (R-Rockford) questioned Michigan Department of Transportation (MDOT) Director Paul Ajegba about it.
MacGregor referenced the overpayment issue and the "scuttlebutt" he's heard that it may happen again, and asked about MDOT's request for $3 million in IT needs in its FY 2020 budget request, which was the subject of the hearing.
"Why should . . . this subcommittee appropriate more budget dollars towards IT if we can't even accomplish the simple duty of Act 51 dollars going to the locals?" MacGregor asked.
MDOT official Patrick McCarthy told MacGregor the IT investment request was separate from the overpayment issues.
The "scuttlebutt" MacGregor was referring to was likely a line in the MDOT message that read, "due to the variables involved, there can be no guarantees this will not happen again."
MacGregor said "it's a matter of trust," asking why the department couldn't go back to the old way while the new process is fixed, rather than tell people, "we're not sure how accurate your next payment is going to be," as MacGregor put it.
McCarthy said some might have been looking for a "guarantee" that it wouldn't happen again, but he couldn't give that guarantee in the letter.
He also said MDOT, in the course of correcting the issues, has "taken the brunt in the department for any of the adjustments . . . we've taken the hardest impact to . . . the department and tried to minimize the impact as best we could" to the local agencies.
The total overpayment adjustment amounted to $50 million, which McCarthy said in the context of $1 billion-plus in road funding distributed to locals, was a 2 to 3 percent adjustment.
According to MDOT's explanation as reprinted by the MML, during FY 2018, reports from Treasury and the Secretary of State (SOS) about road funding revenues were delayed on several occasions.
MDOT chose to distribute monthly funds based on the revenues reported the previous month, then reconcile the actual figures the next month, rather than delay monthly distributions to the locals.
However, at year's end, MDOT said, "the accounting accruals were not able to be reversed timely due to the complications of closing" in the new SIGMA system.
As a result, MDOT said the revenue collections reported to the agency were "overstated," causing payments to local road agencies and MDOT in December 2018 to be overstated. But MDOT said this was corrected in the February 2019 payments to locals and the STF.
Then, MDOT said, in 2018, a SOS revenue report "was changed, without MDOT's knowledge, which caused an overstatement of the monthly revenues to be distributed," which was discovered in the FY 2018 book-closing when it looked like the Michigan Transportation Fund (MTF) -- the state's major road fund -- would close with a negative fund balance.
MDOT said it met with Treasury and SOS officials to "clarify procedures and implement new procedures and controls to monitor the monthly MTF revenue collections."