Loading...
HomeMy WebLinkAboutStaff Report 4729 CITY OF PALO ALTO OFFICE OF THE CITY CLERK May 12, 2014 The Honorable City Council Attention: Policy & Services Committee Palo Alto, California Policy & Services Committee Recommends Adoption of an Ordinance for the Use of Online or Electronic Filing of Campaign Statements RECOMMENDED MOTION Approve the first reading of an Ordinance Approving the Use of Online or Electronic Filing of Campaign Statements. BACKGROUND On January 1, 2013, Assembly Bill 2452 went into effect adding Government Code 84615 which allows a local government agency to mandate online or electronic filing for an elected officer, candidate, committee, or other person who is required to file statements, reports, or other documents under the Political Reform Act, so long as the filer receives contributions or makes expenditures totaling one thousand dollars ($1,000) or more in a calendar year. The law prescribes criteria that must be satisfied by a local government agency to require online or electronic filing of statements, reports, or other documents. The system must be available free of charge to filers and the public for viewing filings, and must include a procedure for filers to comply with the requirement that they sign statements and reports under penalty of perjury. On April 22, 2014, the Policy and Services Committee voted (4-0) in favor of sending an Ordinance Approving the Use of Online or Electronic Filings of Campaign Statements to City Council. During the meeting Council Members raised questions relating to the security of electronic filing of campaign statements. The City Clerk’s Department is currently under contract with a company, NetFile, who also administers the online filing of the Statement of Economic Interest forms (FPPC Form 700) for the City of Palo Alto. NetFile provided Attachment D: Campaign Data and Protection details the various roles a campaign may assign to individual campaign staff as well as the level of access granted to each role. NetFile also provided Attachment E: NetFile FPPC Certification Submission which explains security and redundancy measures used by NetFile to ensure minimal service disruption and secure data storage for Statement of Economic Interest Forms. NetFile uses the same hardware and software infrastructure for electronic filing of campaign statements. RESOURCE IMPACT The existing contract with NetFile for the e-filing and administration system for the campaign system is $1,750 per quarter or $7,000 per year. Page 2 ATTACHMENTS:  Attachment A: Electronic Filing of Campaign Statements Draft Ordinance (PDF)  Attachment B: CAO Report 3-22-14 (PDF)  Attachment C: P&S 04-22-2014 Item 2 Minutes (PDF)  Attachment D: Campaign Data and Protection (PDF)  Attachment E: NetFile FPPC Certification Submission (PDF) Department Head: Donna Grider, City Clerk Page 3 NOT YET APPROVED 140403 dm 0160076 1 Ordinance No. ____ Ordinance of the Council of the City of Palo Alto Approving the Use of Online or Electronic Filing of Campaign Statements The Council of the City of Palo Alto does ORDAIN as follows: SECTION 1. Findings and Declarations. The City Council finds and declares as follows: A. California Government Code Section 84615 provides that a local agency may require an elected officer, candidate, committee, or other person required to file statements, reports, or other documents, except an elected officer, candidate, committee, or other person who receives contributions totaling less than one thousand dollars ($1,000), and makes expenditures totaling less than one thousand dollars ($1,000), in a calendar year, to file those statements, reports, or other documents online or electronically with the local filing officer. B. The City has entered into an agreement with Westcoast Online Information Systems, Inc. dba NetFile, a vendor approved by the California Secretary of State, to provide an online electronic filing system (“System”) for campaign disclosure statements and statements of economic interest forms. C. The System will operate securely and effectively and will not unduly burden filers. Specifically: (1) the System will ensure the integrity of the data and includes safeguards against efforts to temper with, manipulate, alter, or subvert the data; (2) the System will only accept a filing in the standardized record format developed by the Secretary of State and compatible with the Secretary of State’s system for receiving an online or electronic filing; and (3) the System will be available free of charge to filers and to the public for viewing filings. SECTION 2. Section 2.40.065 (Electronic Filing of Campaign Statements) of Chapter 2.40 (Municipal Elections) or Title 2 (Administrative Code) of the Palo Alto Municipal Code is hereby added to read as follows: “Section 2.40.065 Electronic Filing of Campaign Statements (a) Any elected officer, candidate, committee, or other person required to file statements, reports or other documents described by Chapter 4 (Campaign Disclosure) of Title 9 (Political Reform) of the California Government Code, and that has received contributions and made expenditures of $1,000 or more, shall electronically file such statements using procedures established by the City Clerk. (b) Once an elected officer, candidate, committee, or other person files a statement, report, or other document electronically pursuant to subsection (a), all future statements, reports, or other documents on behalf of that filer shall be filed electronically. (c) In any instance in which an original statement, report, or other document must be filed with the California Secretary of State and a copy of that statement, report, or other document is required to be filed with the City Clerk, the filer may, but is not required to file the copy electronically. NOT YET APPROVED 140403 dm 0160076 2 (d) If the City Clerk’s electronic system is not capable of accepting a particular type of statement, report, or other document, an elected officer, candidate, committee, or other person shall file that document with the City Clerk in an alternative format.” SECTION 3. If any section, subsection, clause or phrase of this Ordinance is for any reason declared invalid, such declaration shall not affect the validity of the remaining portion or sections of the Ordinance. The Council hereby declares that it should have adopted the Ordinance and each section, subsection, sentence, clause or phrase thereof irrespective of the fact that any one or more sections, subsections, sentences, clauses or phrases be declared invalid. SECTION 4. This ordinance shall be effective on the thirty-first day after the date of its adoption. SECTION 5. The Council of the City of Palo Alto hereby finds that this is not a project under the California Environmental Quality Act and, therefore, no environmental impact assessment is necessary. INTRODUCED: PASSED: AYES: NOES: ABSENT: ABSTENTIONS: ATTEST: ___________________________ ____________________________ City Clerk Mayor APPROVED AS TO FORM: APPROVED: ____________________________ ____________________________ City Attorney City Manager ____________________________ Director of Administrative Services CITY OF PALO ALTO OFFICE OF THE CITY CLERK April 22, 2014 The Honorable City Council Palo Alto, California Ordinance Approving the Use of Online or Electronic Filing of Campaign Statements RECOMMENDED MOTION Recommendation to the City Council to Approve the first reading of an Ordinance Approving the Use of Online or Electronic Filing of Campaign Statements BACKGROUND On January 1, 2013, Assembly Bill 2452 went into effect adding Government Code 84615 which allows a local government agency to mandate online or electronic filing for an elected officer, candidate, committee, or other person who is required to file statements, reports, or other documents under the Political Reform Act, so long as the filer receives contributions or makes expenditures totaling one thousand dollars ($1,000) or more in a calendar year. The law prescribes criteria that must be satisfied by a local government agency to require online or electronic filing of statements, reports, or other documents. The system must be available free of charge to filers and the public for viewing filings, and must include a procedure for filers to comply with the requirement that they sign statements and reports under penalty of perjury. The online or electronic filing system shall only accept a filing in the standardized record format that is developed by the Secretary of State and is compatible with the Secretary of State’s system for receiving an online or electronic filing. There is currently only one company that is certified by the Secretary of State to provide this service. The City Clerk’s Department is currently under contract with this company, NetFile, who also administers the online filing of the Statement of Economic Interest forms. Electronic filings reduces the staff time required to process the campaign forms, and also allows visibility in the public’s eyes to view the filings at any time without waiting to come to the City Clerk’s office. Page 2 Since January of 2013, the following government agencies have converted to online campaign financing: CITIES COUNTIES / REGISTRAR OF VOTERS Anaheim Alameda Berkeley Butte Irvine Monterey Manteca Orange Oakland Riverside Pleasanton San Bernardino Sacramento San Joaquin San Francisco (Ethics Commission) San Luis Obispo San Jose Santa Clara Santa Clara Ventura Sunnyvale DISCUSSION: The default rule under AB 2452 is that all filers that receive contributions or make expenditures totaling $1,000 or more are required to file all campaign statements electronically. However, a local legislative body retains the discretion to limit the electronic filing mandate to certain types of filings or filers that meet higher monetary thresholds. Nothing in the law prevents the City from accepting electronic filings from those who opt-in to the electronic filing system. The draft ordinance before Council maintains the default rules under AB 2452. According to NetFile, most of their agency clients who have adopted paperless electronic filing have adopted the requirement thresholds from AB2452 (i.e. mandatory electronic filing for committees that have spent or received more than $1,000/year). The California legislature adopted the $1,000/year default because this is the level at which a filer must open a committee. While increasing the threshold for mandatory electronic filing offers greater flexibility to filers who may want to continue filing exclusively in paper format, it adds an additional level of complexity in tracking campaign expenditures for the filer, the City Clerk’s office, and the general public. In addition, the draft ordinance imposes an opt-in rule, under which filers that utilize the electronic filing system once are required to use the system for all future filings, regardless of whether they meet the monetary thresholds in the future. Several cities have adopted this rule to ensure continuity of records in the electronic system. The decisions before Council are: First, whether to authorize the electronic filing system and mandate electronic filings for certain elected officers, candidates, committees or other persons required to file statements, reports, or other documents under AB 2452. Second, whether to modify the default rules setting the monetary threshold and types of documents subject to Page 3 mandatory electronic filing. Third, whether to adopt the “opt in” rule, under which a filer that uses the electronic filing system one time is required to electronically file all documents in the future. RESOURCE IMPACT The existing contract with NetFile for the e-filing and administration system for the campaign system is $1,750 per quarter or $7,000 per year. ENVIRONMENTAL REVIEW The adoption of this ordinance is not a project subject to environmental review under the California Environmental Quality Act. ATTACHMENTS:  Electronic Filing of Campaign Statements Draft Ordinance (PDF) Department Head: Donna Grider, City Clerk Policy and Services Committee MINUTES Special Meeting April 22, 2014 Chairperson Price called the meeting to order at 6:07 P.M. in the Council Chambers, 250 Hamilton Avenue, Palo Alto, California. Present: Klein, Price (Chair), Schmid, Scharff Absent: ORAL COMMUNICATIONS None AGENDA ITEMS 2. Ordinance Approving the Use of Online or Electronic Filing of Campaign Statements Donna Grider, City Clerk, stated in January of 2013 the State of California approved the electronic filing of the Campaign Statements. She explained the City Clerk’s Department was in contract with a firm, NetFile, for the electronic filing of the Statement of Conflict of Interest and now was the only State certified company approved to electronically file the Campaign Statements. She asked the Policy & Services Committee to forward the proposed Ordinance to the City Council on the Consent Calendar to authorize the electronic filing of the Campaign Statements and mandate to follow the State’s protocol for filing the Statement of Committee at the $1,000 level. She requested there be an Opt-in rule that once an electronic filing has occurred the Committee remained filing electronic. She felt this was a positive move for City Staff and the candidates since they or their Treasurer can complete the form without office hour constraints. The public and newspapers have access to the information without needing to make an office visit. She thanked Albert Yang, the Senior Deputy City Attorney for his work drafting the Ordinance. Council Member Scharff asked if the Committee had a Campaign Manager or a Treasurer, could they file on behalf of the candidate. 1 Ms. Grider said the candidate provided access to their filings as they saw fit. The objective of the electronic filing was moving away from the printed version and the requirement of the blue ink signature. Albert Yang, Senior Deputy City Attorney, noted as long as the filing was submitted by an authorized user for the candidate it would be a legitimate filing. Council Member Scharff asked how the system knew whether or not the filer was authorized. Ms. Grider said the Statement of Organization, the FPPC Form 410, which was mandated to be filed with the Secretary of State provided the authorized personnel. Council Member Schmid asked about the confidentiality and security of the information. Ms. Grider noted the documents were public information whether they were filed in paper or electronic. Council Member Schmid asked how to secure the electronic versions from being modified by an unauthorized user. Ms. Grider stated there were a number of other cities utilizing the NetFile electronic filing system and in Staffs’ research there had not been mention of security breach issues. Council Member Schmid asked if the electronic filing system was more susceptible to a security breach. Mr. Yang did not feel Staff had the technical knowledge to answer the question. Council Member Schmid asked about the security of signatures. Ms. Grider noted the purpose of the electronic filing system was the void of signatures. Council Member Schmid asked how the system knew the statements coming in were from the candidate or an authorized source. Mr. Yang stated although there was not a wet signature required the candidate was required to submit and affirm the information to be truthful and the submitter was authorized. 2 April 22, 2014 Council Member Schmid asked how the system would know if a false filing was submitted. Mr. Yang noted it was possible for a false submission to occur in a paper filing; although, he did not feel the risk was high. Molly Stump, City Attorney, stated if there was an unauthorized submission it would come to light relatively quickly and would be brought to the attention of the Police Department or District Attorney for investigation. Herb Borock noted a line on the Staff Report read “the system must be available free of charge to the filers and the public for viewing filings, and must include a procedure for filers to comply with the requirement that they sign statements and reports under penalty of perjury”. He stated there must be a way to satisfy the signature requirements in the Staff Report. Mr. Yang stated there was a Federal Law, the E-Sign Act, which authorized electronic affirmation signatures and did not require a picture type signature. In 2013 the City Council authorized the use of e-signatures for City documents. MOTION: Council Member Scharff moved, seconded by Council Member Klein that the Policy & Services Committee recommend the City Council approve the first reading of an Ordinance Approving the Use of Online or Electronic Filing of Campaign Statements. MOTION PASSED: 4-0 ADJOURNMENT The meeting adjourned at 7:58 P.M. 3 April 22, 2014 Data Protection With a disclosure package running on a stand-alone PC, your data is only as safe as your hard drive. Every hard drive manufacturer provides estimates on the AVERAGE number of hours of operation before your hard drive will fail. It WILL fail; it's only a matter of time. How often do you make backups of your hard drive? With NetFile Professional, your data is backed up every night. Once a week, the data is permanently archived to CD's and shipped to a remote data vault for long-term storage. Wouldn't you feel better knowing your data was safe? Privacy Almost every stand-alone disclosure product assumes the user sitting in front of the computer keyboard is the campaign treasurer. With NetFile, you can assign each user a separate "role" with the campaign. NetFile "roles" include: Owner - Can e-file on behalf of the committee. Can do anything in the account. Can delete anything. E-Filer - Can e-file on behalf of the committee. Can do anything in the account except delete archived documents. Treasurer - Full account access, but can't e-file on behalf of the committee and can't delete archived documents. Data Entry Level 3 - Can perform data entry for all receipts and disbursements. No access to reports or bank registers. Data Entry Level 2 - Can perform data entry for Schedule G. No access to reports or bank registers. Data Entry Level 1 - Can perform data entry for contributions only. No access to reports or bank registers. Consultant - Can generate any report in the system, and can review bank registers. Can't add, alter, or delete data. Attorney - Can review generated disclosure statements, and can generate other transaction listing type reports for review purposes. Can't add, alter, or delete data. Fundraiser Level 3 - Can review contribution data and advanced contributor-related reports. Can't view expenditure data. Can update contributor contact information. Can't add, alter, or delete other data. Fundraiser Level 2 - Can only review contribution data and contributor-related reports. Can't view expenditure data. Can update contributor contact information. Can't add, alter, or delete other data. Fundraiser Level 1 - Can only review contribution data and contributor-related reports. Can't view expenditure data. Can't add, alter, or delete other data. Data Caging Firm - Can upload data using NetFile DataLoader. Can't log into the account at all. The client's administrative user can change a user's role at any time. A user can have different roles for different NetFile accounts as well. State & Federal Compliance Data Protection & Privacy Why NetFile is #1 in California Pricing for NetFile Professional Custom Development Services First Time Here? Take the Tour Try out a sample NetFile Professional or NetLobbyist (California Lobbyist) account. S accounts are available for a variety of organizations. Navigate Home About Us Campaigns & Treasurers State Lobbyists Local Government Agencies Contact Us Products NetFile Professional NetLobbyist Campaign Finance Disclosure Suite Statement of Economic Interests Suite Local Lobbyist Filings Sites of Interest CA Secretary of State ■Political Reform Division ■View Filed Documents ■City & County Electronic Filings ■Filing Requirements Sites of Interest FEC ■E-Filing Information ■View Filed Documents ■Legal Resources S.F. Ethics Commission L.A. Ethics Commission Data Protection & Privacy Copyright © 1998-2014 NetFile. All rights reserved. (209) 742-4100 sales@netfile.com NetFile Professional Log In NetLobbyist Log In NetFile Self-Admini Home About Us Campaigns & Treasurers State Lobbyists Local Government Agencies Cont Page 1 of 1NetFile | NetFile Professional Data Protection & Privacy 4/29/2014https://netfile.com/Content/CampaignDataProtection     FPPC Form 700 System  Certification Submission for Local Agencies    Last Revised  10 January 2013      OVERVIEW  Since its ground‐breaking launch in 2006, NetFile’s FPPC Form 700 e‐filing system has received and  processed more than 67,000 Form 700 filings to date.  Of those filings, nearly 25,000 have been filed  electronically.  The NetFile FPPC Form 700 application (“SEI”) is a shared, hosted, cloud‐based system comprised of  three major architectural components:  Admin: Provides features for local agency staff to create, track and correspond with filers  Filer: Allows individuals to create, review, print, and e‐file their Form 700 documents  Public: Displays filed documents to the public on the web    SUBMISSION REQUIREMENT #1 – Network Topology    SUBMISSION REQUIREMENT #2 ‐ COI Form 700 Application  Development  All development/maintenance for the SEI application is performed in Windows 7 using Visual Studio  2010.  All application code is written in ASP.NET and C# against the .NET 3.5 runtime.  Two third party libraries are used.  First, for PDF rendering, we use iTextSharp.  Second, for middleware  data access, we use DataObjects.NET.  The web application pages use code behind files that talk to data  access libraries to retrieve and store data.  Code integrity is maintained using the Perforce source  control system.  Production  The deployed web application suite runs on Windows Server 2003 hosts, with a SQL Server 2008 R2  backend.  The operating system for the primary database server is running Windows Server 2008 R2.    SUBMISSION REQUIREMENT #3 – Website  The website runs on Windows Server 2003, using IIS v6. Two web sites are configured, one for public  access and the other for internal services.  ASP.NET web applications are stored under virtual  directories. The applications run under IIS app pools designed to maximize simultaneous users.  The app  pools will also auto restart on any detected issues to maximize uptime.  Database caching is enabled up  to 1GB on reads.    ASP.NET web services are used internally to communicate between the admin and filer components of  the system.  These web services endpoints are not exposed to the public internet, and require ASP.NET  authentication.  Secure web browsing is available using SSL certification from COMODO.  The SSL  encryption uses RC4 128 bit keys.  System logging is performed through syslog and all messages are  routed to a central logging database.  Alerts are triggered on system errors or service outages and sent  to NetFile support staff via email and text messages.    SUBMISSION REQURIEMENT #4 – Secured Authentication  Filers are uniquely identified by their private e‐mail address, stored in the NetFile SEI database along  with an internal identifier which is also unique.  Filer account creation is controlled via the Admin  application, which is administered by department‐level Filing Liaisons or agency Administrators.  Passwords are randomly generated with a mix of lower and upper‐case letters and numbers with a  length of 8 characters.  Special characters are also included.  Filers may request a new randomly‐ generated password at any time through the Filer application.    SUBMISSION REQUIREMENT #5 – Security (network, system, application)  While NetFile does use Amazon Web Services for additional off‐site storage of backup files, all other IT  assets of the SEI system are owned and managed by NetFile.  The SEI system is located at the Oakland Co‐location facility of Digital Realty Trust, a tier one data  center.  This ensures the highest level of facility‐related support, such as power, cooling, and networking  infrastructure for NetFile’s servers.  The facility is secure, with 24‐hour security on site.  Primary network security for NetFile’s collocation is provided by a High‐Availablity pair of SonicWall NSA  2400 devices.  These units act as our network firewall and intrusion detection system.  All communication between the collocation faciltity and NetFile IT staff is done through VPN  connections.    SUBMISSION REQUIREMENT #6 – Security Operations (Industry Best Practices)  NetFile has been providing online e‐filing and disclosure systems since 1998, before most of the rest of  the world even though online disclosure was a real possibility.  All of our software is carefully reviewed  with security in mind – particularly regarding such popular attack vectors as SQL injection, buffer  overflows, and server misconfigurations.  NetFile utilizes online and internal vulnerability scanning services, such as HackerTarget.com and  Netsparker to scan its software on a per‐build basis.  All software in the collocation network is updated on a continuous basis, to ensure all the latest security  patches are deployed.    SUBMISSION REQUIREMENT #7 – Backup and Restore  SQL 2008 R2 Data  All transactional data and filing document data is stored in our primary SQL 2008 R2 database.  Log  shipping is utilized to maintain a hot standby database server at all times, also located in the Oakland  facility.  Log shipping is also performed to a hot standby database server located in our Mariposa office  over the VPN.  Additionally, log shipping is performed to a SQL 2008 instance hosted in Amazon Web  Services as a failsafe.  Full backups of the SQL data is performed nightly with two copies of the backup files maintained at the  Oakland facility.  Copies of the full backups are sent nightly to our Mariposa office and Amazon S3  storage.  Backups stored in S3 are encrypted.  A minimum of ten days of complete backups are maintained.  Machine Images and Configuration Data  Backup VM images and configuration data files (such as firewall and load balancer configurations) are  made after configuration changes to the affected VM/device.  These backups are stored in Oakland and  Amazon S3.  Source Code  All NetFile source code related to the SEI system is hosted in Perforce.  A full backup of the Perforce data  is made nightly and copied to multiple locations in the Oakland facility and Mariposa office.    SUBMISSION REQUIREMENT #8 – Business Continuity and Planning / Disaster Recovery  The NetFile SEI system is designed to provide a significant amount of fail‐over redundancy without  creating exorbitant costs for our clients.  Designing the system to provide a reasonable level of planned  fault‐tolerance includes:  • Dual HA SonicWall NSA 2400 firewall appliances  • Multiple network switches with every server having at least two NIC adapters  • Kemp Technologies Load‐balancing systems configured in an HA pair  • Multiple web servers, load balanced by the Kemp units  • Multiple application/processing servers, balanced by our software processes  The only ‘single point of failure’ in the entire SEI system is the primary SQL 2008 database server.  The  database server itself is as fault tolerant as any single Intel‐based server can be with multiple power  supplies and RAID 10 SSD disk arrays.  If any single device or server apart from the SQL database server failed, NetFile’s users should not even  be able to notice.  Should the SQL database server fail, NetFile IT staff can remotely reconfigure the system to use the hot  standby SQL server (with the log shipped data, so it is fully up to date even as the failure of the primary  server occurs) within ten minutes.  If there was a more extensive disaster, such as a major earthquake destroying the city of Oakland, the  SEI system could be running again within a maximum of six hours with provisioned Amazon EC2  instances.  We’re currently in the process of evaluating several different backup solutions to reduce our  maximum potential outage duration.    SUBMISSION REQUIREMENT #9 – System Access  NetFile staff will contact FPPC IT staff to provide appropriate user credentials.  REQUIRED SYSTEM FEATURE CHECKLIST    1. E‐mail notification of filing  YES.  All e‐filing submissions to NetFile’s SEI system receive an e‐mail indicating success or  failure of the submission.    2. Electronic confirmation number  YES.  All e‐filings accepted by NetFile’s SEI system are issued a unique filing ID.  This ID is listed  on the Public portal and rendered onto the PDF representation of the e‐filing.    3. Electronic signature (date/time stamp)  YES.  All e‐filings accepted by NetFile’s SEI system are time‐stamped, and can be related back to  an individual’s private e‐filing credentials.    4. Extractable COI data in a common file format  YES.  All e‐filings generated or accepted by NetFile’s SEI system are XML data documents, which  pass through a PDF rendering process for presentation and printing purposes.    5. Auto‐populate filer information  YES.  Previous year e‐filings auto‐populate the following year form.  Additionally, changes to a  filer’s departments or positions during the year are available for easy selection into the new  form, along with the previous year’s departments and positions.    6. Previous year filings  YES.  A filer is able to review, reprint or amend any previous filing they have created using the  SEI system.    7. Public website available 24x7x365  YES.  NetFile’s web portals into the SEI system are always available.    8. FPPC Pamphlet Online  YES.  FPPC‐provided manuals and instructions are readily available to all filers while using the  system.    9. System assistance hotline  YES.  Local cities and counties using the NetFile SEI system provide telephone help desk support  to their filers.    10. Online password management  YES.  Filers or agency administrators may reset their passwords at any time.    11. Account registration process  YES.  NetFile provides local agencies with helpful documentation and procedures along with on‐ site training seminars that have worked well for other jurisdictions to achieve a high percentage  of initial e‐failing adoption by their filers.  Additionally, NetFile imports personnel database  records to initially populate the Admin system.