 I guess I'm just starting the meeting to tell you what the enacting language says. And part of that language says that you all need to elect a chair and a vice chair. So I think that would be the next step after this. So this language, the Joint Information Technology Oversight Committee, was part of Act 187, which actually had a health care focus, but this language was added in. So that was the enact relating to health information technology and health information exchange. And just for some context, this committee actually existed in the past. And it was first enacted in a somewhat different form in 1994. And then that was sunset in 1996. And my understanding of this language in creating this committee now was that some of you seen responsibilities from what the committee did back then is passed over into this new language, although there are some differences. So the purpose of the committee, you'll see in, it's very broad language. So in subsection A, the committee is created to oversee investments in and use of IT in Vermont. And the membership is three members of the House and three members of the Senate. And in subsection C, under the powers and duties, again, these are all very broad powers and duties there. The committee is overseeing, evaluating, and making recommendations on primarily four broad areas. The first is the state's current use management and oversight of IT in government activities. And that very broadly includes data processing systems, which could be hardware and software. So pretty much anything that processes data. Telecommunications networks and related technologies. And then there is language on line 22 that says particularly with regard to issues of compatibility among existing and proposed technologies. And I think that is referring to how new systems, adding new systems onto our existing systems and how they work together. The other three duties are issues relating to storage, maintenance, and access to privacy of and restrictions on the use of computerized records. So that is really focusing on access control and the retention of data. The third is issues of public policy relating to development and promotion of both private, commercial, and non-profit information infrastructure in the state and its relation to the state's information technology infrastructure, as well as integrating this with national and international information networks. So that also is incredibly broad. And then finally, cybersecurity, which is how the state builds security with respect to its IT networks and infrastructure. And I would mention here that this language under these duties is referring to state government. It doesn't specifically say the executive branch, but I wanted to note that there is a legislative information technology committee that does have some oversight over the legislative branch. So it's not entirely clear how the two committees interact, but I just wanted to mention that other committee in case you are not all aware of that. Okay. I would like clarification on that, and I guess I'm going to keep giving it. I did see on the legislative website that there had been a joint information technology committee that met all through last winter. Actually, Chris, you were on it. And so is that a difference? Or was that supposed to be just related to the legislature? Yeah. Yeah, this is just related to the legislature. It's called the legislative IT committee, I think. It's about this stuff among us. Basically, I was on it for four years, and it typically just looked at things that related to the legislature's use of information technology, and it got into our use of iPads and programs to use it. The websites, stuff like that. But it's very limited, and it really is not, I don't think you'd consider an oversight committee as this was envisioned. Representative Feltas, maybe one way to think of it is it's not too different from the way we have a legislative council committee that oversees the legislative committee. In a sense, we're, and it's a little murkier, but we oversee the IT staff that serve versus the head. I see. Okay. Okay. We're looking. I have another theory. It shouldn't lay with the storage of maintenance out of access to your privacy. It doesn't specifically say within that of state records. No, it doesn't. But what is the intent of the legislation at that point to restrict it to state records? Otherwise, it's a pretty broad net. I don't, I don't actually apologize for being any testimony on this. I can say that this is one of the pieces of language that was in the original language for the committee back in 1994. I don't know how helpful that is. I can look into whether the intent back then, but the testimony was limited with respect to that. So if you look at vital, those are private records, and we have that vital is really as generated from the legislature. And then the record storage and information is something that we've had oversight on. So I would say the broadness of this statement is probably a good thing because it does allow for us to move into an analysis of vital, among others. So just to finish here. So moving on to subsection D of line eight, the assistance of the committee, the JFO and the council provide administrative technical and legal assistance. And then with respect to meetings, the committee has to elect a chair and a vice chair and adopt rules of procedure. And the chair will rotate bi-annually between the house and senate members. A majority of the membership constitutes a quorum. And then finally, the committee can meet when the general assembly is not in session. And then the last piece is reimbursement. So when you're not meeting in session, members can be reimbursed for being here. So I understand the timeline. So the bi-annually reorganizing. Does that mean that basically we exist for the next three months and then it starts again? Yes. I think because it was created. That's my assumption. In June, then that would make sense, yeah. Who will be organized? It's going to be a very short appointment. Exactly. Will there be a, well, there may have to be a reorganization of members in January as well. That's right. Depending on the problems. Yep. So our next four businesses will elect a chair and a vice chair. So I would like to nominate Randy Brock as chair. For the next three months. For the short term. Can we have a house member's chair? We'll look at many votes on that. Could you be our, no, I'm just kidding. I don't know how to. We just say, you know, are there any other nominations? And then all those in favor, say hi. So should we do it that way? Sure. Okay. Are there any other nominations? All those in favor, say hi. All those opposed? All right. And then it's up to you to run for the vice chair. And I think the next order of business is to elect a vice chair. Any nomination for a vice chair? Typically be a house member. So I'll nominate Laura Sebelia. Any other nominations? I'll second her nomination. Are there any other nominations? Then we should have a vote. All those in favor, Laura Sebelia. Okay. All right. Okay. Vice chair. All those in favor, come sit here. Pretty much. I don't think that far I did. You're more of a side, okay? Good. So to chair your first witness, the first point is ready to go. The update on the state-wide internet outage. You've all been waiting anxiously to hear about, did you bring the squirrel with you? Squirrel is decomposing. Would anyone like a paper copy? Yes, please. We're hearing from John Quinn, the secretary of the agency of digital services, perhaps with Darwin Thompson also. Or not. Or not. For the record, I'm John Quinn. I'm the secretary of digital services in the state CIO. And chair of services director Thompson appears to be running a little late, so I should be able to cover any questions that you have, but anything too technical, I can always get back to you with an answer. If I don't know. So as most of you read, actually first I'd like to take a minute and thank the legislature for standing up this IT oversight committee. I think that EDS certainly welcomes it. And we look forward to a collaborative partnership and guidance and oversight by the committee. I think it's needed. And I think it'll make my job a little easier in the long run. So I certainly appreciate all of you that helped stand this up and your time on this board. So on Wednesday, August 8th, we had a squirrel chew through a fiber optic line in SX Junction. The fiber optic line was owned by First Light, which is our main internet service provider. Our second internet service provider we had redundant lines was Sovereign, who was earlier bought out by First Light. So both lines were owned by the same company, but we were guaranteed diverse routes, which meant that they went out from different locations. So if one line went down, the other line would stay up. As you can see from the timeline, a number of steps took place as a matter of, you know, coincidence or bad timing, our senior network engineers were both on the road and weren't in the office how this happened. So internet outage happened. Both lines went down. The people in the office assumed it was because of the squirrel, which is partially true. But our redundant line also went down. And it was a few hours before First Light technicians and state of Vermont technicians were able to identify why traffic wasn't passing out of that second route. Because up to that point, we've done testing between our data centers. We've shut data centers down, failed over back and forth, and data's always passed out both paths. We have never shut down the First Light circuit and left the other circuit open, meaning we have never actually tested only one internet path at a time. We felt that we had done that through the data center failovers and shutdowns. So here's where it gets a little technical. I'll try to stay as high as I can, but each path to the internet has a default route, which tells it, and a routing table, which tells it where to go out. We had a default route that was set by the internet service provider on the First Light circuit. On our SolverNet circuit, when it was put in place, it was ordered about two years ago, no default route was ever set. Our network engineering team did not have the skill sets by their own words to understand how to figure out whether or not there was a default route or whether or not it was needed, unfortunately. So after working together with First Light, troubleshooting between the network engineering teams, they discovered that the default route on the First Light side was broken because of the squirrel outage and the SolverNet side didn't have a default route. It was previously getting its default route from the First Light side. So it gets a little complicated on where it lives and how that default route is pushed, but it's pushed closer to our equipment, thinking of it like a projector. It's mirroring an image onto our equipment that allows our equipment to know where to go to get out to the internet. When that light was broken, or that image was broken, this ISP no longer knew how to get to the internet. So once we put in a default route, we were able to come back up with one of our internet circuits and a couple of hours later, First Light was able to repair the other fiber break from the squirrel. I know that there's been a number of crazy stories that have gone around about what really happened and how it happened. So I included the timeline from First Light as well as picture of the squirrel break. So there's no misinterpretation of what actually happened. That was the course of events. Since then, we've we've done the lessons learned internally. We've spoken with First Light a few different times and we've added an additional internet service provider to our equipment. We bought additional equipment. So now we have a First Light circuit, a Sovereign circuit, and a First Light circuit. So we have three different paths. And those paths go out through Albany, Montreal, Boston and New York City. So I could say that we've learned a lot from this incident. It was a lot longer than I had hoped for. But I think we're better positioned now than we have been in previous years. The configuration issue or configuration error that affected the backup through Sovereign and that was the reason that you were not able to switch over to an alternate service provider once the break happened. That's correct. Now that you have determined that that was a problem, you mentioned that that was a problem because there was a lack of expertise set up within the agency. Has the expertise in the agency changed since then? To give you assurance that you don't have other issues like this where things have were configured improperly thereby exposing us to another failure of a different kind. I asked that question again this morning and the lessons learned yes we have figured out how to run those commands and how to properly test the different channels and the different failure points. But overall we are still lacking the most senior engineering skills in our position and what I mean by that is we don't necessarily have network architects that can really put together the whole puzzle and make sure that we're 100% positioned correctly. We're working with our internet service providers to do back and forth with them consulting to make sure that from their standpoint we're configured but this isn't a new problem this is certainly something that we've uncovered as a new agency and we're looking to fix but this is years and years of bad practice. So two questions I just want to clarify you added you said that we have connections Albany Montreal and New York City Albany, Montreal, Boston and New York City Oh Boston and New York City Which one was the new Did you say you added a new connection of those four? No And then regarding the lacking network that skill that you were just talking about something that we will be seeing coming forward, recommendations to add that skill or is that something we're looking to contract How will we be dealing with that? We're going to do more training with our internet service providers and our partners to make sure that not only we have a good architecture design and that we understand all the different pieces and how they work but we'll offer to send them to training to make sure that they understand the newest technologies as these technologies change we're going to need to keep these skill sets up because as we saw you know this is a these are critical positions to our to the state of Vermont So I just want to make sure I'm clear are we looking to build that capacity within Vermont State Government or within our partners? Within Vermont State Government Thank you So as as the whole industry matures then the knowledge that we need to do this work will also mature I know it's easy to say well we didn't do it 10 years ago or 20 years ago but things have really moved quite fast Do we have a system in place to test redundancies for all of these different locations and cables that we now have Are we testing the redundancy of the system on a regular basis or is that something we don't do when we wait for an emergency? A lot of our system doesn't have redundancy built into it And so in this particular area now you're saying that with VTEL that is redundant is that a new redundancy I'm trying to clarify what it is that we now have an additional internet service provider to provide additional redundancy onto the two lines that we already had we added a third line in case at some point down the line without any knowledge of this I'll just use the companies that we're talking about at first light and sovereign it end up using the same piece of fiber somewhere down near New York City and we go through each other and that fibers chewed into you know, that's still a problem and we've been working with the internet service providers to try to figure out okay, so it leaves here, it goes here and then it goes to New York City where does it go from there to see if we can figure out exactly what the paths are when it's on the internet service provider side that it's not always clear how we're getting to our final destination and our providers are talking with one another about this or is that the job is that your job? that's our job Representative Seltos well, related to that then our internet's our job, you're talking about the senior architecture expert who would understand where all these connections go Howard Network Engineering Team okay, and your network engineering team mentioned you wanted to get them additional training so they would be able to solve this kind of problem in the future so the answer I guess to the question of how we might avoid this in the future from our own personnel perspective is that our current personnel will have better training understand it better and we're not necessarily going to add new personnel is that the case? we're not necessarily going to add new personnel, we've had a number of positions change over over the past few years the original configuror and buyer of that second circuit no longer works for us so we continually have change over throughout our agency and it's common in very large organizations but we'll continue to provide training to the teams that were best equipped to handle issues like this to do that from time to time the field is a little limited but as a new agency I think a lot of the outside candidates are seeing ADS as an attractive place to work we've hired some very good people and we have some very good people in our networking group that are very experienced but we're either on the road or just said that's something that we've never dealt with we've never had to deal with the default route we can't find the record on whether or not we told the service provider to add the default route or not so there's some steps like documentation that we can absolutely do that will help us identify was this a sovereign issue did they not add the default route even though we didn't ask for it the default route is needed in order to get to the internet why wasn't it there so I'm not sure if things we can do internally internally you do have qualified candidates who certainly can take on new training and understand this problem and be able to resolve it I have a few questions one around just the overall structure of your department and the second about the impact of the incident so if we're talking about the structure of the department I think earlier in the spring we talked about I think 380 people so it's one of the fastest growing agencies I guess one of the questions that I have is instead of hiring and training because you're going to have to keep up with technology on a rapid basis because the representative is saying how much would you rely on your third party vendors to provide that expertise and have the ability in-house to actually evaluate whether or not they know their stuff so I would just caution you before you hire somebody to train them to see what you can do there and I imagine you still have a number of open positions within your agency as well I'm glad you brought that up so one of the great things about our new agency in bringing in approximately 300 people in merging them with what was the department of information and innovation we have about 380 still that number has not increased we have reclassified positions as they've come open to reprioritize the work to make sure that the priority areas are being addressed and that we have adequate staffing I think the last brief I got was about 6 weeks ago and we reclassified 29 openings which we believe was a vacancy savings of about a quarter million dollars reclassifying into proper positions lower positions so we can build that skill set in-house where we don't necessarily or we can't necessarily find candidates on the outside so we've done a number of things to address the inside structure and that we never immediately go out to hire without reviewing the position now all the positions that come open go through my office so we can review each one to make sure that aligns with our priorities and strategy going forward just to follow up on that because I have two more questions have you entered into an agreement with Norwich University for cybersecurity we are working on a contract right now okay will that replace people you have on staff or is that a contract in addition to what you're currently doing internally it's in an addition so it's a security operation center it'll be staff 24 7 right now we have a model of 8 to 5 which means our guys are there from 8 to 5 2 thirds of the world is getting up and awake when we're going home right the squirrels are up a lot about the squirrel just the impact what was the impact on the state government what was have you done a calculation has anybody done a calculation of loss of productivity in terms of total cost impacts did people not get their benefits were employees idle for a day what was the impact so I'm going to address it in two ways the impact to the citizens of the state where they could not get to state service websites so if they wanted to make a payment or renew registration of their car or something like that they were not able to do that for the 5 and a half or 6 hours that we were down so direct effect to the citizens was the websites did we do an inside assessment of what the total dollar projected loss was no but we did talk extensively with different agencies about continuity of operation planning and how we do this going forward or how we continue our work if there are issues in the future I've met with public safety they have a number of radio towers internal fiber and we've discussed at least at a high level right now potential contingency plans for public safety if something like this was to happen we are not aware of any public safety issues when I say issues no death resulting or anything like that through this outage internally it was hard to come up with a dollar amount we talked about it and because there's still quite a bit of work that's form-based, paper-based truck drivers, BGS those type of jobs that don't necessarily rely on the internet it was really hard to come up with a semi-accurate number I think I'm building up some of the questions but it seems obvious to me that internally we need to have a way to evaluate what the vendors are doing but it's a little puzzling to me that this wouldn't fall under the vendor responsibilities of clearly our secondary backup failed us so can you explain to us and then you added a third I'd like to understand why we added a third did we make sure the second was now functioning and what did we do with that vendor if I'm hearing you right their entire job was to be the secondary backup and that didn't work so when you get money back how does that negotiation work? so what I would say is that we have a contract with the company and there's an SLA in the contract so there was some service level agreement so there was a dollar amount that we received back due to the outage or that we're working on getting back due to the outage was it enough? probably not from who? from first line but the subnet you mentioned that the subnet also failed that it was a configuration issue but the configuration issue if I was really the state's fault not the vendor's fault well I've asked that question in ten different ways and I think we can definitively say it was their fault my feeling you don't order a internet line without a default route right so we ordered a one gigabyte internet line to the internet we received that we received a routing table with it without a default route it doesn't make sense because without a redundant system which sovereign at wouldn't have necessarily known there was no way for that to work without that default route so you know was contractually where they required to provide that? or was it an assumption that they would provide it but not contractually specified? it was an assumption and that's why we went back through our old records and work orders to see did we specifically say we needed a default route and we could not find record of that and therefore that's why I'm taking partial responsibility responsibility as a person accountable for the agency that you know there's probably a shared responsibility they're not being able to definitively say that they didn't do this and so now we have solved that and added a third redundancy yes my for the record my network team believes it's overkill to have that third third line but for right now after the incident I wanted it up I wanted to make sure we were stable I did not want another outage the secretary of state was doing some important election primary stuff and the last thing I wanted was for him to not be able to complete that work so I authorized the third line to make sure that we were and do these secondary and third systems did they do we pay them according to the idea that we almost never use them how does that work no if I'm understanding your question correctly we we are provided a rate for the line whether we use it or not so it's in our best interest to push traffic through those different lines and this is where it gets a little technical and I don't know that I'm a hundred percent accurate so I hate to say too much but two of our three lines the traffic goes out of right now the third line I believe is sitting there in case one of those two goes down that's my understanding but if I'm wrong my network guy in the back will tell me after and I will send you an email and correct myself that's who that is enough to get into the weeds too much but you've got two lines that are being used and then the other one by contract is being held in case so we have a contract that says it's held in case we're paying to that part-time so is that other line being used by other in other service contracts is that other line being used is the business selling that line is the bit no that's it's just totally dedicated there's no information traveling across it until and unless we require that that's correct it's dedicated to the state of Vermont is there a regular testing of that line to ensure that it is operating as intended our network group has been testing these lines on a regular basis to make sure that we're fully functional if something goes down in terms of this there wasn't really a single point of failure problem multiple point of failure problem and the question is has there been any independent review of resiliency of backup of the entire network by some independent party such as an IT auditor either from the state auditor's office or contracted to take a second look has that ever been done no but I would certainly welcome it one of the questions also you mentioned that you did not have the expertise at the time that this was set up to give you comfort that things were set up properly and you talked about training by vendors to provide that the real question you know in my mind is do you have sufficient expertise to begin with within the department because whenever you know we contract with anyone to provide services you look at the hourly rates being paid to the contractors and compare it to what's being paid to state government I'm wondering do we have the capability of hiring people at the level needed for the expertise that you require I can't answer that question definitively not being a network expert and that's why one of the reasons why I welcome the audit of the network I think it would be a productive thing to do and as a new agency I would certainly welcome that I feel after many years of knowing our network team and their skill sets internally that they continue to grow and are I consider very good technicians but is there a level above that and what is it I don't necessarily know what I don't know I guess the question is are you able to hire people with the expertise that you want at the salaries that we're paying in some areas not every IT job is considered equal IT technician that works on desktops and laptops and that type we're calling them adequately for an Oracle database administrator or a chief information security officer no my chief security officer position has been open for well over a year I originally received 42 applicants we called them and told them the salary range each one of them and 40 of them backed out the two that didn't one of them was an internal candidate and I hired him as the deputy because I didn't feel he was quite where we needed him to be and the other one snuck through the process and wasn't qualified at all so we've gone back out we've advertised and I think this time we received eight candidates five of which backed out immediately or weren't qualified and the three that we called two of them backed out and so I'll be interviewing the one that's left so this is a problem that we deal with it's a problem that all states deal with and our salary I feel is good but these security professionals paid a lot of money and we would be up in the range of chief medical examiner pay range in order to get someone to keep someone we've all decided it makes sense to have a chief medical examiner is there some hesitation to have a salary so that you can have it seems like a pretty vital role for state government to meet there certainly is a function within our human resources organizations to deal with pay issues for specialized jobs for which the state's pay scale is insufficient right I believe because the next question will be if this one doesn't work out what are you going to do then what's plan B up to this point myself and the deputy have been covering the role between policy and operations is there a discussion underway to shift the pay scale to make it attractive yes but there's also a budget consideration that we need to address this year as well so we have had conversations about that at the capital level and how do we fill this position long term well I think that you've indicated that you've got a significant vulnerability information technology is the backbone that makes state government work or fail to work as we saw for five hours earlier this month so I'm just very concerned that you are covering the position right now with yourself and you mentioned that you don't feel that you're technically qualified in some of these areas and you've got a deputy that you did not feel was qualified technically to perform the function of chief information officer and the two of you are functioning as the chief information officer right so I want to clarify network engineering is different than security policy I am very qualified to cover the security policy piece of it and my deputy is very qualified to cover the operations piece of it network engineering is very very complicated when you get into some of the challenges and the different protocols and ways to configure it that area I'm not an expert and I'm not going to pretend like I am and I don't know a CIO that is so I just wanted to clarify that the CIO isn't a technical position so from my standpoint you know we're doing all the right things to try to fill these positions we had a reclassification of all IT positions I'm going to say two years ago maybe it was three you know that HR did in conjunction with IT to address the pay scale issues so that position was an exact position and I think it was probably missed so it's time to look at it again so I just want to double back on the number of connections and I don't know if I've asked you this before in terms of other states is there a best practice number that other states are employing in terms of their connections is it two, is it three does it depend on how big they are does it depend on how populated they are I think it depends on how big they are and where their data centers are and where their people are so I don't know that there's necessarily a best practice on the number obviously multiple lines is best practice okay and then my other question is on the staffing issue are you seeing any international applicants is that something that the administration is considering are you able to try and access those types of labor pools same thing in the positions that I review I have not seen any international candidates I have met with the 50 state CIOs a few times about this issue and most recently I met with the New England CIOs in Maine, New Hampshire, Rhode Island we're all experiencing the same issues with hiring and so is there any thought to look at the international labor pool in this to try and fill these positions there hasn't been I haven't thought of that that's not necessarily a bad idea though I would certainly consider that are you able to hire or to fill the position contractually if you aren't able to hire your own employee to do it there are a few different models which we've explored Maine's exploring Illinois's exploring a CISO as a service which is a chief information security officer as a service which we would hire them or a set number of tasks or a dollar amount and so that's definitely not out of the possibilities we're trying to find someone that or trying to figure out what that service looks like and what piece we need to cover them what piece they need to cover we did try a telecommute a couple years ago and it didn't work out there was too many things here on the ground that needed to be dealt with we did shift just for another question relating to this security operations center that will be at Norwich will that be manned by students? students with direct oversight from skilled security operation personnel made up of Norwich hires different positions that they've hired for this ADS oversight will that be oversight and experience people on duty 24 hours a day or are we looking for limited periods of portions of the day since this is a 24 hour operation? so on the ADS side it will have a playbook that outlines when this happens this is the here's the play for you to follow which will include a on-call security person at ADS we will not be going to three shifts at this point but we will have someone on call if they see an incident that rises to the need of needing to be shut down or needs further clarification on it in the off hours will that be a Norwich person there or will you have a situation in which you have essentially a student manning an operation center in part of the day unsupervised or not directly supervised we're still working out all the details in the the SLA that we're putting together as part of the contract so the contract though has been done? the contract is not signed yet so I'm hesitant to go into too much but I will say it's our intention that the kids are supervised at all times there's not a certain level agreement once that's done would specify the degree of supervision and yeah any other questions for the committee at this point? just one quick question on the contract that we're talking about are there conditions of liability built into the contract or will there be should there be a failure suppose it is a student and there is a failure it's students responsibility are there conditions of liability built into the contract so that Norwich accepts that liability those things are still being negotiated in the contract they're really in a monetary position so the way it works is we'll be putting sensors that will collect data across the state we have enough budget for a certain amount and so they'll be watching those, collecting the logs there's way more data than any human I can look at so we'll be using tools to analyze that data as well so with any tool there's possibilities of things to be missed this is just another way to mitigate the overall risk but it's not a certainty there's never a certainty that we're going to catch everything but this will certainly put us in a much better position is there anything that you think is particularly concerned from whether the security or a reliability or resiliency or a contingency planning issue that you feel is important enough to bring to our attention and if it's something that is non-public in other words that is confidential because the nature of the security it might be something that you would bring to us in executive session is there anything like that that you want to bring to our attention or should bring to our attention on both sides there's some security things that you should be aware of and understand why I'm doing what I'm doing and why cybersecurity is our top priority the second which is also related is visibility into our network and what we can see now it's been 18 months since we were organized before that we did not have an accurate asset inventory accurate software revisions we did not know how many applications we had as state government we did not know a lot about what we have going on after 18 months we have a much better picture it's not 100% but we know a number of areas where we don't have redundancy and where we are prone to hardware failure because of the age of our technology and we are putting a plan together that we are going to present to the legislature this year in our funding model and this will cover both of these areas yes well the security incidents will not be publicly disclosed do you think those are something though that you should bring to us to our attention in executive session if not necessarily today at our next meeting yeah I think it would be good for your awareness to understand what we are dealing with on a day to day basis and the kind of things that we see it's not a matter of if it's a matter of when right you answered my question okay I have one more in terms of follow-up items we talked about the security the audit of the IT network said that that's something you would welcome is that something that you would be prepared to talk to us at a subsequent meeting about what that should entail or is that something that you would include in the budget how should we handle that just talking out loud it seems like with any audit I wouldn't want to necessarily lead them down one path or another and chairman please correct me if I'm wrong I would think experienced IT auditor would know what to be looking for if we requested a network audit well just a suggestion would be to have a conversation with the state auditor indicating what your concerns are and perhaps indicating that you are looking for some assistance at a high level information security review of both the network itself and then also overall redundancy resiliency backup and security and then suggest that perhaps in a conversation with the auditor determine A if they're able to help you and B what their approach might be and C whether or not it's something that could be done internally and D whether or not and there are lots of outside contractors usually at extremely large amounts of money who do this kind of work right okay and then perhaps then at our next meeting perhaps come back to us with what you found and what if anything you're able to do going forward okay anything else from the committee well thank you secretary Quinn appreciate your testimony and thank you for being here today and the right on time you're right on time we're right on time the next item on the agenda is an update on Coverage Co and telecommunications planning and Commissioner Tierney and Clay Purvis director of telecommunications for the Department of Public Service are here thank you thank you for being here today I appreciate it and we hope that perhaps you will just begin and tell us what you think we need to know well thank you very much Chair Brock Chairman Tierney, Department of Public Service Commissioner with me Clay Purvis the director for telecommunications it's a pleasure to be here this morning what you need to know is everything that homeowners ought to know in order to understand the state of telecommunications particularly the two subjects about Coverage Co and the telecom plan in a nutshell since we last saw you I think last spring we have terminated the contract with Coverage Co and we have issued an RFP seeking a new vendor to come in and to complete the build out of that system and to manage the system as well right now it is not operating and we would expect a new operator to bring it back online we had originally established a September 29 response date for the RFP at the request of at least one bidder Delacombe was more than one bidder we have extended the window for responding to the RFP to October 29 we are hopeful that we will find a contractor at last count as far as I recall we had three responses to the RFP so stay tuned on the telecom plan we've made excellent progress in pulling that together I would like to acknowledge very candidly to the committee that last legislative session we represented to you that that plan would be done that it would be done before the end of the legislative session we did not meet that goal in retrospect I see that I should have been in touch with you over the summer to let you know that I apologize for not having done that it literally was just you stay on top of many other things as well but no discurriccy was intended to have the legislators on that point I'm pleased with the progress we've made in putting the plan together and I do think we are going to have it done in short order but I don't want to promise to you that it's going to be October 1 or October 31 because I don't want to be in this position again Clay perhaps you can speak to when you think the plan will be fully completed so we're working through our most current draft we're pulling it together it is my top priority to get the plan done and primarily responsible for its content and its production so for June has to take the blame for it but it is it is my work and it is my goal to have that done by the end of October with so much going on Coverage Co the other projects that we have going on it's something that we need to complete and get out to Vermonters as soon as possible I think as much as I appreciate Clay's comments the responsibility is entirely mine not his and I do take that responsibility for the delay I would point out too that we've been down to staff positions in the last month alone we've had one of our telecom staff mobilize to go to Hawaii in the wake of the severe weather they had there this person is a member of the type of team that Vermont Emergency Management mobilizes and then we have a staff member who is actually our broadband coordinator who has taken a position with Vermont Emergency Management so the good news is we have excellent staff at the department and it gets unfortunately the bad news it gets how do we put it poached so anyway I would also add too that part of the issue with the telecom plan is that it would be foolish to simply put the plan out without recognition of the debate that was had in the legislature last year and so some of the content will reflect the conversations that we're having I have memories of being asked what is the plan what is the plan those questions did not fall on deaf ears so again my apologies for the pace of the production I think the weight is worth the while I would also point out too when I came to the position as the commissioner it was following several years of having been at the public utilities commission as their general counsel where you live in a rather rarefied circle that is not fully connected to what is happening on the ground there are many issues that a commissioner deals with and it took a while to get to this issue the connectivity issue for many reasons but I feel I have done a good job of getting my arms around the current state of affairs of telecommunications in the state and I know it's a matter of great urgency to several members of the committee what I have drawn the way of conclusion is that in our discussions we lose sight of the significant impediments that we experience here in the state due to decisions that are made at the federal level about funding that ought to be available as a straightforward matter to the states in order to do something about rural connectivity this is an item on the agenda item two mobility fund phase we have a staff member who is extraordinarily talented who has devised a very sound means of challenging basic mapping data that the FCC saw fit to accept from larger carriers earlier this year on the strength of affidavits that they file saying that this was the state of broadband connectivity and their respective jurisdictions when we looked at the maps that was at 1810 we probably should not say fair enough could you say that in executive session I would have to review the non-disclosure agreement that we signed with the FCC I'm going to ask that question later so we'll hold on I think the way we could talk about it probably is to not mention names but if you'll forgive me I'll just go to concept here for a moment we saw maps and we did not recognize the state of connectivity of Vermont in those maps and there's a process by which you can challenge those maps and we are vigorously engaged in that challenge and to return to my narrative we have a very talented staff member who has come up with a means of challenging and who is literally driving the roads of the state as we speak with a box with a variety of devices in it in order to mount a successful challenge my point in bringing it up is to say that it shouldn't be this way but it is the state that we are dealing with so while we want to have conversations about what we can do to get this that and the other out it's important to understand that there's a preliminary objective that has to be achieved which is making sure that our federal partners have the requisite knowledge to give us resources or better said to make them available to us to successfully advocate for and when I came to the department I will candidly tell you that we do not understand that there's that kind of battle that has to be fought first my mind is incongruous but it is true we in some respects are in the position of fighting our own government but we are taking that fight on and I might add my memory is that we had outreach from the state of West Virginia the state of West Virginia and the state of Mississippi so this is how well our efforts are being received that sister states are recognizing that they need to do similar things but that is my way of telling you that this is where a lot of our attention is going to be and when resources are devoted in this manner which is a worthy thing to do it does unfortunately put a crimp on other things that we have to do to return to the agenda here we've also very recently launched an investigation into consolidated communications in the state of their quality of service we tried very hard to take a measured approach in exercising our regulatory jurisdiction over the company because my experience has been that you often get more results more immediately from a regulated entity if you try to work with them instead of simply dropping the hammer on them but there came a point where progress had stalled out we saw a significant spike of service quality complaints to the point where it clearly was a matter that needed to be put in a public form for the PUC to be able to super-intensive the company understands about doing the right thing just because they choose a pace or resources but rather it's because there is a quasi-judicial entity that is bearing down on them and an advocate in that poor who is saying we've got as far as we can with our supervisor jurisdiction it's time to take this to the next level so that is what we did a couple weeks ago I'm hopeful that there will be a productive outcome in that investigation and that we will come get to the bottom of why Consolidated has not so far been able to deliver on its promised level of quality of service that was a big selling point for us at least in our support of their acquisition of Fairpoint and it has been deeply disappointing to experience what we have so far because as I think I've said to some of you before when I see you here at these tables I see you I see the people behind you and those people have been experiencing unacceptable issues with their connectivity in the course of the summer I wonder Clay if you might speak to the details of the USDA connectivity pilot programs they're escaping at the moment so the USDA received $600 million this past year to devote to rural broadband funding rural broadband projects all across the country $600 million is a significant investment in rural broadband but the USDA has funded projects in the past specifically in Vermont and it is prohibited from funding projects in census blocks that it has already funded a project in which those loans are in a repayment phase so we have a significant number of census blocks in the states that are covered by an existing project we file comments with the USDA expressing our concern over that issue and ask them to reconsider that policy can you define census block and how much population that covers is it a geographic area or is it a population base sure the U.S. Census Bureau has broken down the country into a series of census blocks in Vermont we have about 15,000 I believe there are small population depends on who lives in the census block in my particular census block there are 3 houses in Burlington there could be 1,000 or 10,000 houses so it all depends on the area these census blocks that we are talking about are rural in nature so they are more like 3-5 houses geographic area it depends again on how the U.S. Census Bureau breaks it down some are large some are small the ones in urban areas are smaller of course than the one census blocks in rural areas and I apologize I do not remember exactly how many census blocks are affected we did do an analysis of this which I'm happy to provide to the committee at a later point do you have a sense percentage wise geographic area maybe please do not quote me on this maybe I have the state landmass we are talking rural areas though places that need broadband and again I can provide an analysis later I apologize I did not bring that with me but to avail ourselves of that federal funding it would be necessary to have the USDA reconsider this policy in light of the great need that we still have in this area can you just clarify why we are disqualified is there a project with multiple projects that have disqualified the VTEL WAL project and how much money is outstanding as a result of those grants I believe those grants have been closed out but how much money did all of that involve the VTEL WAL project specifically I believe was 33 million then there was a Fiber to the premises project in Vermont telephones traditional exchange territories was 80 million and that was a mixture of grants and low interest loans the Fiber to the premises project my understanding is that that was successful on all the homes that in those exchanges should be served with Fiber to the premises but if I understood you correctly it's that when there has been a project that has been started in which there are funds that are still outstanding that you can't get additional money for the census blocks that are affected is that right? until those loans are paid back and I'm assuming that those census blocks are scattered throughout the state yes they are and so if you are now looking for additional funds from the USDA absent some dispensation from the USDA you will be limited to applying any new money that you might get to census blocks that have not been previously served and is that practical? no because of the area that made up the the FETEL WOW project there aren't enough census blocks in a large geographic area to make a project make sense so you have to then get some sort of an exception or waiver from the USDA and is there a process to do that and has anything been done to move you along those lines? the USDA is writing rules for the e-connectivity pilot project and they had a comment period and we submitted comments to that effect and what's the timeline that will be involved both in the review of comments, the acceptance of comments and the publication of a final rule or procedure or process or whatever it is that they do. I believe it's a few months I'd have to review the Federal APA and follow the Administrative Procedures Act the comment period is closed I believe it closed September 10th the goal is to have the comments allow the USDA to make some sort of an exception that would allow us to be eligible for this program on two fronts just to give you comfort Senator we have a process and filed our comments but my own reflex what I heard about this was to say there has got to be a better way and this involves engaging our federal delegation and to simply pursue as a matter of a cry from the heart there must be a way to waive this and so you can be sure that it's going to be brought to the agency's attention whether they're listening it would seem as though this would be a problem that almost any state that's ever applied for a grant would have I wouldn't speak to that intuitively I think you're right but then I consider our geography and given the smallest of our state and how the connectivity issues are sprinkled and the impact of the retail project it wouldn't surprise me if we are differently situated from other states that have different circumstances so I wouldn't want to speculate beyond that is my understanding so first of all the well project was supposed to cover virtually every last unserved address in the state of Vermont throughout all of our rural hills and valleys and now the last time we were at about 10% so that was around 30-35 addresses that were to have been covered and now we're at about 10% almost 10 years out that was my last understanding I guess if there's confirmation, if not is it more than that at this point do we have any sense? I don't have any confirmation of the reach of the retail well project I would like to encourage continuation of this because for our rural communities that have no alternatives and that don't have the financing the USDA financing is potentially a very key tool for them and I'm not aware, are you aware of other rural infrastructure funds for last mile build that are of that size and significance? none of that size other than the Connect America fund okay and the other question I have is, I know we haven't you've mentioned you want to encourage continuation of this and by that you mean the advocacy yes, yes and I think to the extent that this committee can be helpful I'd like to ask, have you had an opportunity I know there's a new state director for USDA, are we engaging that? yes and would it be helpful for us to engage them? I think all hands on deck so that may be something we want to think about Mr. Chair at the next meeting do you need any more voices for the additional capacities that are heard the better, absolutely because it's very reminiscent to me of Tropical Storm Irene and the progress that Vermont was able to make because it was willing to articulate in every venue possible the unique circumstances facing Vermont which were very different from how FEMA administered relief in states more typically affected by extreme weather we've had good success in that direction before and so I think it's very helpful for your engagement as well I have one other question I want to comment Mr. Chair, just briefly first I want to thank Commissioner and also Secretary Quinn given the level of issues that we have had in my neck of the woods I know that it's not the only I know we've seen it throughout I want to thank you for coming and hearing from the Vermonters in my neck of the woods that situation as you know is pretty urgent and ongoing my sense is that you all could use maybe some more manpower, is that something that that woman though thank you, thank you Senator I apologize is that something that we could anticipate, is that something on the horizon thank you for asking that question if you talk to your colleagues on the Joint Fiscal Office or Joint Fiscal Committee you will see that we testified in front of them yesterday about budget woes that the Department and the Public Utility Commission are experiencing so in a perfect world I would take 100, 200, 300 employees this is not a perfect world and so I'm loathe to tell you that more staff is necessarily the key to greater progress but at this point it is not help that we've had a vacancy it is not help that we've had an emergency mobilization but these are things that you simply have to do as a matter of connectivity you have to be able to your responsibilities as an issues model I do not have to simply do anything but be mobilized but I don't know that I can responsibly say to you yes, please send us more people to be sure that you're sending us the money that goes with it that's the one thing that we've noticed in the way the ones that we've used in the state and there's just the number of unfunded mandates that we have observed well one thing that I think this committee would like to hear is that if you have things that you are required to do by law such as produce a telecommunications plan on time if you're not able to do that to let us know and to perhaps give us a sense for what your prioritization is if there's something that isn't going to get done so that we have a sense of what it is well I thought that the plan was due in 2017 to be begun so I'm going to shift gears is that okay with you so I'm glad that Secretary Quinn is here so right now we have fiber optic cable that is reaching different parts of the state but not to the last one so who owns the fiber optic cable I'm looking at both of you who owns that cable depends I mean but basically a variety of private and telecom providers the state of Vermont has fiber electric utilities have fiber Velco has fiber so Velco has fiber do any other electric utilities have fiber so when an electric utility has fiber connected to its poles that ownership then is under the under the your oversight and is approved or disapproved or whatever through the PUC maybe it's important for us to not give you bad information so I think in terms of the technical aspects everything I'm about to say would probably be best verified by having the PUC so much more engineering to testify on perhaps the departments although our department engineers not passed a layer of corny what I'm about to say is that to the extent the electric utilities have fiber it's specifically for your AMI building so this is something I was thinking of this summer too it was not built out to the to the power necessarily to become essentially a replacement for commercial so a couple of things then about that so Velco has and they have more capacity than they should stick at so we have been in discussions with them how about the membership that's what I wanted to know so that's been followed up on that to me is really important whether it's something that department initiated well it's something I had in a bill two or three years ago so it's nothing important and we all agree it's important and we need to follow up on it well thank you for bringing that up Senator because I was not aware of what you had done so I don't think it's no I think it's wonderful that you did because it goes out it means more than one percent to keep the same conclusion yours being more important so I mean the point is that it's accessible if it's owned by utility and it's something that we can regulate it's owned by utility I need that question the answer to that I think I can help you with that because this is some of what I was looking at Velco's system as you recall is actually running out of work now they do have a CPG and a lot and they have let's put it simply in response to the case that's precisely why I'm open to conversations with them to see what used to be made of that one of the early hurdles is how do you go about and how do you reduce the burden of the system given that they are regulated but these are issues that we definitely examine so we're on that track but there is some legislation relating to their regulation and how they expand and where they move through the state so there is some of that already to and that includes the electric transmission so we also I don't know does FERC regulate telecom I think it's a bigger question I'm asking just to get that information at some point I think you're asking all the right questions they are questions that we're asking too and the way I believe it's this is you can be sure that to the extent the state has the power to do something in that area but the state is on it like okay so maybe we can get an update on that at some point it's not an emergency but then the other piece that I think is of interest to all of us is something I mentioned earlier and that is how can we look at and make perhaps an executive session a contract that exists for our first net can we see that there's a lot of there's a lot of there are a lot of assumptions that people are making about that contract and what it means and what it doesn't mean I think it would be very helpful to us and especially in light of the emergency situation with the squirrel you know so is there a way that we could have that conversation in executive session and look at the conditions of the contract because it does have a significant meaning for emergency situations in the state so I'm going to take that as an approach from you I think the answer is not from the department but I think we can find that would be very helpful so thank you Representative Felter yes I'd like to go back to the USDA program that we were talking about and I guess I just need to clarify what you mentioned is we cannot apply these funds to areas which have already received some funding in the past surely there are areas that have received funding in the past but why cannot these funds be applied to those areas they absolutely can so I think what we found though is that a census block here and a census block here and a census block up here and there isn't a large group of census blocks to make a new project make sense so an existing provider maybe like an independent telephone company or an EC5 or like carrier might be able to expand their networking and begin kind of statewide or regional project and we're talking about an extension of our existing network I think it's also important to point out that the original grant was made to VTEL and VTEL VTEL network is doing wonderful things where it is and where people can reach it but that award was made in 2011 under it had brought in a bandwidth of requirements that we now expect to surpass today so they were required to bring Internet of 768 kilobits per second to the households that it was intended to serve now the USDA is funding projects that has to be either 10-1 or 25-3 megabits per second so that's 10 times as fast or 25 times as fast as the VTEL project and so there if you look at these census blocks even if they're served they're served with internet that potentially isn't what the FCC considers to be necessary, we're on the state of Vermont today mindful of the time that your time is virtually up I know there are a couple additional items that are important to discuss but Senator Pearson will defer to his question so maybe we'll go maybe 5 minutes over but if we really should end I can try to be quick I want to go back to personnel you kind of tip note around it is your budget recommendation going to ask us to fund new positions more positions or are you staying staying? thank you for that question this is familiar to you so we're proposing a budget that's based on our special fund and the issue that we're facing is that that fund at this time is not adequate to pay for our ongoing staffing operations and this is the subject of the study at the Jackessville office commission so I'm not quite sure what that's going to look like yet I think that the discussions that the legislature is going to have about this I apologize that's okay and then going back to the telecom plan when you have a draft is that going to go public comment? and so this plan would be seen as the blueprint I'm assuming for decisions down the road like we do the comprehensive energy so that's the one I'm more familiar with it's still not vain but I wouldn't look at it as an executive plan it's a planning document that spells out a vision and it spells out the norms and the principles that are reflected in the legislation that this body has passed it accumulates our best information of matters that we have during the plan but I think it's important to recognize that it's a planning document that's not the same as a prescription right which is what our planning documents do and then is it meant to be updated for three years or something so help me understand how we're making decisions now maybe we could debate whether it's past due I would argue it is past due but our intention was to have it and we are awarding contracts we are making decisions but we don't have the process that the legislature asked around the plan so it kind of occurred for the horse here and I'd like to understand is it appropriate to stop making some of these decisions until we have the plan I just would like to better understand the interconnectivity there I don't think it's I don't think it's appropriate to stand still the members of this community and the public discourse the decisions from the PEC the actions to get the federal level funding available federal level all pull in the direction of taking action and I think the agency using its residual expertise on these matters takes informed action it does so on the basis of a resisting telecom plan it's not like we don't have one and these things don't it's like life it's evolved, it's grown it's very rare dramatic departure from one particular plan to the next it should reflect the evolved circumstances does that plan mean also the 2014 plan public comment I was known at the agency at the time so I didn't know in an ideal world the plan is finished and it therefore is a resource for important partners in the private sector to look to in order to best figure out how they can proceed constructively on jurisdiction but the plan itself is not the same quantum mode of informed I don't know, excuse me state action and particularly action decision making by my agency but I certainly take a point that the legislature has an idea and time in mind for this planning process and the point in my exchange was said on the block earlier was not to be very difficult it was simply to as far as the law is concerned as presently written when we are compliant with it thank you you have two additional items one is the telecommunication plan which I think we've largely discussed the last legislative reports and the three reports that you mentioned in your document is there anything that you want to bring towards attention in particular about? Are you the three? I think just the awareness that they are there from they have been working on and they were mindful of them and that I hope we are able to be confident that we can take the time to look at our obligations very seriously we're really we're really doing what we can it's a considerable load it's one with their and above all you know I take more of your time except to say that it is our policy it is my core value as administrator to be listening to the legislature so please know that when you contact me I hear you always happy to answer your questions and maybe it's a really appreciate to be there how we can thank you very much for coming and for testifying nice to see all of you I hope you guys have the pleasure of doing this next item that we have on the agenda is an update on the vital of Dan Smith who is a JFO consultant I would suggest that perhaps if we can limit this to about 15 minutes maybe 30 minutes if that's possible well he's prepared to I think he's prepared to he will do whatever he wants he should report the one reason for the 15 minutes is I think the committee needs to spend a little bit of time discussing what our agenda will be for the next meeting and when that meeting will be held Mr. Smith good morning good morning this is Randy Randy Brock thank you so much for joining us this morning to talk a little bit about the vital we would like to perhaps limit your testimony to about 15 minutes if that's possible if we have another agenda item that we need to cover during the last portion of that meeting is that feasible for you that's fine if you just give me the direction as to which it's big too low we are the joint information technology oversight committee and if you take that title as a starting point I would be very interested in hearing whatever you think is important for you to tell a committee like this about vital okay well without going deeply into the history of vital which I think you're all familiar with the summary of the situation over the past year or so was the evaluation of November 2017 showed that life has really not been the best in meeting the expectations that the state had for that enterprise that report pointed out a number of weaknesses areas letting patient consent sharing data and overall effectiveness in being helpful to the health information technology community as a result of that report the legislature passed act 187 which set forth a number of activities that David vital would have to perform over the next year to basically prove that the state should continue with the status quo during the course of the summer both diva and vital have energetically addressed the requirements of that act they've met the requirements set out in the act with regards to creating a new plan reporting the status getting a contingency plan put together so that if things do not work out as hoped the state has possible directions to go so they met the requirements of the act as far as looking ahead so at this point I would say I'm fairly comfortable that both diva and vital are on track to get this brought in address and to meet the recommendations of the HIT to HIT report the significant things that we have to look at are really happening in the next three or four months that's when a lot of the planning that David vital has been engaged in should really start to show prove and or show results and the state should have much better idea of whether the current arrangement is really going to work in the long term the recommendation I had in my report was based on how those things go your committee and others may want to look at whether we're going to continue with vital as is or make some changes and the changes to both be in accepting the recommendations or options in the contingency plan the changes could also be the level of what kind of state manages vital on a routine basis if you look at the contingency plan one of the things they mentioned for all the options was there needs to be planned on the road for vital as opposed to what has been the kind of hand about feeding we've been doing over the past several years so for example if you look at vital right now the contracts are on a yearly basis the funding is on a yearly basis there has not been any real long term strategic plan for vital those are the kind of things that we keep vital as is or we go to one of the options the state needs to look at how we're going to really make sure that the HIT, HIE environment is better supported long term and I'd like to stop here for a moment to see if you have questions or wish me to redirect the testimony any members if any have questions there are no specific questions there's no point would you please continue with that point okay so basically I'll summarize and say I think dealing with vital has done a good job so far the next three to four months will really be the proof of the putting to see what the work they've done is really going to result in meaningful changes and improvements and then early next year so whether we're going to maintain our current relationship with vital the legislature or whoever they direct should look at that contingency plan and start thinking of the best option before it gets to the point where that option has to be executed the contingency plan is very comprehensive I thought it was a very well done plan with a lot of good information but it's not something that you can just look at and say okay based on this we're going to do that there's a lot of thought that has to be to the alternatives and it's the kind of thing that you would not want to wait to the 11th hour to do so even if there's a good improvement in vital if there's any question that that contingency plan is going to be executed or should we start early to determine what the best option is and in terms of that timing when do you see that occurring and who makes the decision that it is not likely that this is going to succeed or it is in doubt to the extent of having to think through that contingency plan in more detail what's the timeline for that and who's involved in getting to that decision point well I think your committee is going to have a big part of that a lot of it will depend on the progress vital is made over the next couple of months and I really think that early in the next calendar year there should be a solid presentation by deep and vital as to where they stand and whether they feel that they're on the path to success or not as far as who would make the decision on a contingency plan that has not been established I guess if it was up to me I would say if there is any doubt or any consideration that the state is going to change direction I would cast the first going through that contingency plan and coming up with a recommendation as to based on their knowledge of vital and what they can do and the various options they should come up with a recommendation as to which of the alternatives is most beneficial to the state and has the greatest chance of success as far as who would make the ultimate decision I would expect that that would be some portion of the legislation whether it's your committee or the Greenmont Care Board but given that Act 187 was an external factor from deep and vital the decision should probably also be an external mechanism anything else that you would like to also advise us on at this point? I guess I would just go back to the overall summary of projects and I think my feeling at this point is for the projects that the Joint Fiscal Office has worked at I think the most part we are in good shape there are definitely challenges out there and as I mentioned in the summary they tend to be mostly related to resources and schedule and to give you the background for that if you look at the kind of large projects that the state is doing whether it's Judiciary Next Generation Case Management System DRB Upgrade etc. Those kind of projects are the same project regardless of the size of the state that's doing Case Management System is in use by other states it's a common solution but the solution is the same regardless of state size and when you look at Vermont we have a much smaller state government we have a much smaller IT division we have to do the same project work with a much smaller group of people and that's true not just the projects but throughout the whole IT enterprise so a lot of times what happens is even when the people involved are doing the right thing the stress and the strain and the load on the IT group and the business side of the group it sometimes results in challenges that a larger state may not experience so for the most part the projects that we look at are in general good shape and the stress of getting them implemented causes an increased risk and sometimes things don't go as well as you would hope they would One of the observations I know that I've had over the years is it doesn't seem like large IT projects are within the core competency of state government we've had this long string of failures the most recent of which is Vermont Health Connect I think most would agree went very badly and so my question is overall what are we doing differently to prevent that the last judiciary failure the last motor vehicle software failure what's going to prevent us continuing along those lines in the future Right and it kind of goes back to what I stated before is a lot of times Vermont is not more than we can choose in other words we have good people in the state we have qualified people in the state but we don't have that minimum and when a project is a big project that requires a lot of good thinking and a lot of energy for people we just may not have a deep enough bench that we can adequately make that happen I think the solution going forward to one of the solutions is whenever possible to make the proven solutions things that other states have done before and made a success that we can then implement with less of a commitment of people and time and dollars of risk than if we were just going out on our own We should stop being first in the nation Don't be creative Don't be creative Right as I said we really have good people we don't have that many of them If you look at a state that has an IT division of a thousand people and it's going to take ten people to successfully implement a project Okay, you can crop them up with those ten people but if you look at Vermont and we've got an IT division of a hundred people and you still have these ten people now that has a much bigger impact on the rest of the organization we can't always pull it off So that in a way if our question though does a model than that model of mimicking what large states do in order to come up with and implement new projects There is one is to try to build up proven successes on other states the other is to approach your projects in a much more modular incremental fashion which is what integrated eligibility is doing right now if we were to try to do the whole IE project as one big build and purchase and we have kind of tried to do that in the past it would be almost impossible to pull it off even though states that have done that have really struggled but the strategy of looking at smaller pieces that we have the resources to do and doing it bit by bit is a lot less risky and has a lot better chance of success than IE has taken now it's still a huge project it still has a large amount of risk in it but by doing it smaller faster cheaper I think we can approach it more intelligently and that's the way we approach it Is there a single vendor though that's being used to that? No it's multiple vendors smaller pieces, smaller purchases they're not trying to put all their eggs in one basket Today Representative Kimball A lot of software implementations fail especially at the enterprise level because they're inadequately resourced for implementation talent and I think the judiciary is a good example of go slow and actually take your time and do it right and that's strong on this and to report that you've given us but the Department of Labor is weak and I thought that was an off the shelf product used by another state reallocating resources before you answer that the Secretary of State's office has been able to implement a number of different software implementations successfully it's not in your report because it's a different branch but just thinking about the Department of Labor have we stolen resources from that implementation project and allocated it to a different one? I don't believe so and I think you might be able to address the resource the thing with Department of Labor it's not an off the shelf product solution it's a solution that was built by another state and then Vermont went into partnership with another state of Idaho to build on that solution the issue there is the original solution was just for Idaho it has to be expanded to support Vermont's particular uses of unemployment insurance there's not there haven't been sufficient resources to make those changes and there's also some issues regarding governance between the various states involved as far as schedule who makes decisions who improves changes etc so it's a little different from an off the shelf project it's got strengths in that it is a proven solution we're not starting to scratch but there are several challenges to it on the plus side there's no funding for Vermont involved so that risk is low okay thank you if you can add it quickly because our time is about running out so Secretary Quinn if there's anything you do want to add please feel free to come up when you do so very briefly I would just say that PN Smith's assessment is accurate they probably are on the weaker side of things commissioner currently myself and a number of B-Doll employees went to Washington D.C. on the new state to meet with Idaho in the US Department of Labor to work on some of the issues that being in a consortium is difficult working with another state is difficult they had a product we call it version 1.0 version 2.0 is being built for the state of Vermont which then they will turn around and implement themselves so a lot of the details around that payment mechanisms work done how do they get paid around deliver calls a lot of that stuff was ramping we have a solid plan heading out of that meeting to address all those concerns and hopefully get us back in the right track but we are certainly on the project around right now this is for Dan actually the the question I have is you look at the extent to which technology is now affecting our various agencies and divisions and departments everything from labor to health care from your perspective are any states having difficulty in managing the leadership on for example health care issues or judicial issues between the sort of the human component and the technological component are you seeing any imbalances emerging as a result of the changes that are going on forgive me if I don't answer your question any technological change whether it's an upgrade to an existing system or a change to a new system there is going to be very difficult human challenges to work through you know people are used to doing their job the way they have done it and especially if you look at health care medicaid stuff like that where you may have years of rules of regulation and years of process and procedure that people have become familiar with when you change the technology even if it's changed for the better it can be extremely difficult for the people involved to make that change smoothly and that's why in most of the projects that are out there now the change management component is a very critical part is making sure that people understand the reasons for the change they understand how the changes are going to affect them how the changes in technology are going to make their jobs better hopefully and how they can be more effective with the new environment it's always going to be a challenge and hopefully if the project is planned correctly that challenge will be met and if I didn't answer your question please you did just one step further the who is managing the change in the states that you you know you're familiar with how is that change being carried on here we are in the legislature we pass the laws that manage our administration so is the legislature managing the change and what kind of coalitions are forming to ensure that the transitions are smooth so at the project level that's not really the legislature's responsibility or it shouldn't be if a project is planned correctly there should be an identified experience change management organization that's involved from the very beginning that is the case in most of our projects whether it's the ERP upgrade or integrated eligibility or judiciary they all have change management organizations that are actively involved in making sure that the project goes smooth what we want to avoid is having a technology success and an implementation failure and that's also part of the reviews that I do now if you go beyond the project level to the broader IT level whether you're talking artificial intelligence or big data and things like that that's where the judiciary you know may want to get more involved and it already has to some degree for example you've got an AI task force that just went in the shoe I think agency of digital services is taking a bigger role than looking at the big data question how state data is coordinated those are things that the legislature may want to keep a little more informed of because they're they're bigger issues than a single project thank you we've reached the limit of our time I would like to take one minute and 25 seconds we have left though we're going to hang up then Dan thank you very much appreciate it to perhaps just discuss briefly the time you have next meeting and whether or not there are any items or issues that we think are important and what I will do just given the the short time that we have is I will send out a document after this meeting polling you and asking you some of those questions are about next meeting frequency of meetings and also about issues that you'd like to hear about and then ask that you turn them around and perhaps with your provision representative civilian myself can perhaps formulate an agenda and then send it out as a draft for everyone to look at to agree on and then proceed from there is that agreeable? I would just like to comment on this last discussion we had there were 2 reports that were issued recently that came to me at least because there was some appropriations I guess one directly from Michael Costin and Michael Smith regarding vital and it has some very detailed information regarding vital and there was also the full contingency report that Dan Smith referred to what are the 6 options that they outlined 6 options of what to do with the draft in our legislative thank you very much anything else that we need to do today we're about 1 second over according to my watch the only thing I I always I feel like I get appointed to committees like this because I'm not 50 yet but I don't have a lot of background you know I just I haven't been super steeped in these necessarily and so I'd like to ask if there's any space and it makes sense for a little bit of a 101 maybe with Dan in our next meeting and the other question I just have is would it be appropriate to kind of set a goal for between now and the beginning of session particularly for me the goal would be a broadband or strategy or at least understanding what that exists of course we're going to see the plan but just to help orient we could probably meet every day to see now in January and not get all the work done so there's just such an enormous authority and need and so to me I hope we can spend some time talking about what kind of goals we have also just making sure that we have a sufficient overview of the scope of what it is that we've accepted responsibility for and so some additional briefings would likely be very helpful I think also that I'd like to invite the state auditor in with perhaps his director of information technology audits to talk about audit strategy and preemptive reviews and those kinds of things that are also relevant to some of the things that we're talking about and so do we have a motion to adjourn at this point for today? Second favour?