Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity Policy topic
No spam. Unsubscribe anytime.
Winnebago committee flags broad unfunded software ban in AB415/SB400
Summary
Winnebago County IT director warned the committee that AB415/SB400, which would bar certain foreign-controlled software from government devices, is written so broadly it could affect common platforms and firmware, and currently lacks funding or clear waivers for local governments to comply.
Jennifer, Winnebago County’s IT director, told the county legislative and administrative committee that recently amended legislation (referred to in committee materials as AB415/SB400) would prohibit government devices from using software controlled by entities in a Department of Commerce “foreign adversary” list and that the current amendment’s compliance timetable and scope could be impractical and costly for local governments.
“The bill could cause significant challenges for the state and local government,” Jennifer said, urging caution about the lack of a fiscal note and the tight implementation timeline in the amendment. She told members the amendment removes waiver language and does not clearly define “owned,” “operated” or “located,” which could sweep in firmware and common system drivers as well as user-installed applications.
County members said the bill’s broad language risks affecting widely used vendors and services. One member asked whether multinational providers such as Microsoft, Google or Amazon Web Services would be disallowed because those companies operate servers in many countries; Jennifer said that is one of the key ambiguities the county must understand before compliance would be possible.
The committee also questioned the amendment’s January implementation date. Jennifer said local procurement rules, RFP cycles and contracting timelines would make a rapid vendor replacement or procurement process infeasible without funding or an extended schedule: “We have 31 days to completely comply, which is feasible from a resource perspective only if we already own or control the replacements; but we won’t even complete an RFP process in 31 days,” she said.
Members discussed options, including asking the state senate to delay implementation until after the next budget, requesting funding in the budget, and drafting a local resolution asking for clarification and an implementation waiver. The committee did not take a formal vote on the matter; members agreed to monitor the bill’s progress in the Senate and to contact their state legislative delegations about funding and timeline concerns.
Why it matters: local IT systems frequently rely on software components, firmware and third-party services that are not hosted entirely in the U.S.; an unfunded, broad prohibition could require immediate procurement, retraining, and reconfiguration costs for counties that are not budgeted or practically achievable within a single budget year.
The committee’s next procedural step is outreach: members agreed to contact senators on the committee’s concerns and to consider drafting a board-level resolution if the bill is scheduled in the Senate.
