Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Email Policy topic
No spam. Unsubscribe anytime.
Wyoming Management Council debates bill to list emails diverted from legislators’ inboxes as IT warns of security risk
Summary
Management Council spent much of its Nov. 19 meeting on a contested bill draft requiring the Legislative Service Office to publish addresses or domains whose messages are diverted from legislators’ inboxes. LSO IT staff warned Microsoft’s cloud filters and security concerns limit what the state can safely disclose; public testimony from Honor Wyoming urged a process to ensure constituent messages reach lawmakers.
Members of the Management Council on Nov. 19 debated a bill draft from Representative Bo Bair that would require the Legislative Service Office (LSO) to publish and periodically update a list of email addresses and domain names whose messages are diverted from legislators’ inboxes to junk or quarantine folders.
Representative Bair said the measure responds to constituents who use advocacy tools to send messages but who sometimes find their correspondence is not delivered to legislators’ main inboxes. "This bill says that if we have something go in the junk folder, we're going to obscure the name of that address or that domain name and we're going to put it on a list that our constituents can look up and see," Bair said during his presentation.
LSO technical staff described how Office 365’s cloud services classify incoming messages. Jamie Schaub, senior IT strategist at LSO, explained the system assigns a spam‑confidence and bulk score to every message and that the cloud Exchange service sets many thresholds. "With Exchange in the cloud, we do not have control of that setting," Schaub said, adding that Microsoft’s proprietary algorithms make some mid‑score messages move to a junk folder rather than the inbox.
The technical presentation emphasized two points repeatedly: (1) messages delivered to any legislator are not being deleted or silently dropped by LSO; they are routed to one of three destinations — inbox, junk, or quarantine — and (2) Microsoft advised against publishing quarantine domain lists because of security risks. Anthony Serra of LSO summarized LSO’s approach to balancing delivery and protection: the office has adjusted bulk‑mail thresholds where it can, implemented a proof‑of‑concept that surfaces flagged messages in legislators’ inboxes with a label, and posted guidance to help legislators check quarantined and junk folders.
LSO staff also told the Council that the Legislature’s cloud mail environment has been the target of widespread automated sign‑in attempts: over a 30‑day summer period LSO recorded about 10,000 failed login attempts against senators’ accounts and roughly 15,000 against representatives’ accounts, which staff used to underscore the need for layered protections.
Drake Hill, counsel for advocacy group Honor Wyoming, testified in public comment that his organization uses nationally recognized public‑engagement services to enable constituents to email legislators and urged the Council to create a process to ensure those voices are heard. Hill suggested a private list or an LSO‑administered process that would allow constituents or service providers to confirm delivery. "We want the practical solution arrived at," he said, adding that national providers have operated successfully in other states.
Opponents and skeptics raised three recurring concerns: (1) publishing domain names or details could provide a road map to bad actors and worsen security risk, (2) the bill’s draft language used the term 'quarantined' in ways that technical staff said are misleading, and (3) some members argued improved member training and simple LSO‑assisted checks could address most constituent complaints without creating a new public dataset.
LSO told the Council Microsoft recommended against publishing quarantine lists and that LSO could maintain and use a private operational list to respond rapidly to constituent inquiries. Representative Bair said he would consider amending the draft to use "diverted" or similar language and to require LSO to keep the operational list while preserving a timely process for constituents to get confirmation that a message did or did not reach a legislator’s inbox.
The Council did not vote on the bill draft on Nov. 19; members agreed to take public comments, break for lunch and continue work on the measure after the break. The Council asked LSO to continue technical research and to meet with national service providers and affected stakeholders before further action.
What’s next: the Council will reconvene after lunch to continue debate and consider amendments; members signaled interest in (a) a private operational list and specified response timelines, (b) clearer statutory language that distinguishes junk vs. quarantine vs. inbox routing, and (c) legislator training so members routinely check flagged folders.
