200 S. Anaheim Blvd.
Suite #620
Anaheim, CA 92805
Tel: (714) 765-5110
Fax: (714) 765-5288
www.anaheim.net
CITY COUNCIL AGENDA REPORT
City of Anaheim
CITY MANAGER’S OFFICE
DATE: SEPTEMBER 26, 2023
FROM: OFFICE OF THE CITY MANAGER
SUBJECT: INFORMATION TECHNOLOGY (IT) ELECTRONICS POLICY,
ELECTRONIC DOCUMENT RETENTION AND POTENTIAL
MODIFICATIONS; POTENTIAL USE OF INTERNAL OR 3RD
PARTY SUPPORT SERVICES FOR PUBLIC RECORDS ACT
REQUESTS (PRAs)
ATTACHMENT (Y/N): YES ITEM # 25
GOVERNMENT CODE § 84308 APPLIES: NO
REQUESTED ACTION:
Discuss and provide direction to staff on potential modifications to the Information Technology (IT) electronics policy; electronic document retention policies, and the potential use of internal or 3rd party support services to independently respond to Public Records Act Requests (PRAs), and amend the City’s fiscal year 2023/24 budget accordingly.
DISCUSSION:
At the August 29, 2023 Council meeting, City Council approved a priority list of reforms stemming from the recommendations in the JL Group investigative report, and a calendar of when these items were to be brought forward for City Council discussion and action. The IT Electronics Policy was calendared for September 26, 2023, to include discussion on (but not limited to) the following: require use of government phones for defined employees; requirement to forward documents from personal devices to government address, or turn over access to personal device; document retention policy, and internal or 3rd party support service to independently respond to Public Records Act Requests (PRAs).
Use of Government Phones
Current Practice
Mobile phones are procured and provided to select employees, as determined by each Department.
Administrative Regulation 410 – Use of Office Communication (AR 410) requires employees to restrict the use of City owned phones exclusively for City business only, but also allows for Personal Use limited to occasions where reasonably necessary and Information Technology (IT) Electronics Policy
September 26, 2023
such use does not interfere with the duties of employee or the operations of the department.
For select departments and users, IT has enabled Mobile Device Management (MDM) for the core functions of configuring and protecting data from the phone when it has been lost or stolen. MDM is used in a limited capacity to configure, track, lock/unlock and/or wipe the device.
Recommended Modifications
Modifications to AR 410 would include a specific provision to require any member of the City Council, support staff or consultant/contractor of the Mayor or City Council, the Executive Team of the City, Chief Communications Officer, and any other as designated by the City Manager or Executive Team, to use City-issued phones only, for the purposes of conducting City business.
Furthermore, devices used by this group would include additional governance and controls as follows:
- Device procurement and management, including provision of services and monthly billing would be through Information Services only. - Equipment would have MDM with expanded features that restrict certain actions, such as deletion/modification of accounts. MDM would also allow for the creation and access of data backups for the purpose of data recovery. - Only city-approved software may be installed.
The expansion of MDM capabilities will require a one-time upgrade cost of $50,000 to activate the enhanced features.
The modifications to AR 410 can be completed and become effective within one to two months, while the MDM expansion would require additional time for implementation, with an anticipated earliest completion date of January 2024.
Requirement to Forward Documents from Personal Devices
Current Practice
No existing policy defines any authority for the City to demand access to personal devices, nor require employees to forward documents from their personal devices to their City account/email (unless defined as a record, which is required to be forwarded and captured through the formal records retention system and public records request process).
Recommended Modifications
Modifications to AR 410 would formally discourage the use of personal devices to conduct city business. The provisions of Anaheim Municipal Code Section (AMC)
1.10.070 related to public records will remain applicable and enforceable.
The modifications to AR 410 can be completed and become effective within one to two months.
Information Technology (IT) Electronics Policy
September 26, 2023
Document Retention Policy (Electronic Data)
Current Practice
Employees subject to the Sunshine Ordinance (any member of the City Council, staff of the Mayor or City Council, or the Executive Team of the City) has a default 90-day retention – copies of email in their Inbox/Sent/Deleted folders remain accessible through their Outlook account for 90 days. Once the item ages beyond 90 days, it will be automatically deleted from the Outlook folders.
Per AMC 1.11.050, these employees may also classify an email as “Public Record”, after which it will be flagged for retention of 24 months instead of the default 90 days.
The burden to qualify an email as public record lies on the recipient.
Post-departure, all emails will eventually reach the max retention period and are purged from the system.
For all items above, a “Litigation Hold”, can be activated at any time, usually by the City Attorney’s Office or the HR Department. When such a hold is placed on the account, the files, which include emails and calendar entries, are preserved indefinitely through the Microsoft personal storage table (PST) file type.
Administrative Regulation 155 - Information Services Technology User Policy (AR 155) defines the provisions related to electronic data, including the maintenance and retention of these records. The default retention period for all other employees outside of the Sunshine Ordinance is 30 days.
Recommended Modifications
AR 155 would be modified to expand the default retention period for employees subject to the Sunshine Ordinance from 90 days to 24 months. With this change, retention for all emails would be consistent across all records and would no longer require the active selection to classify emails as a “Public Record”.
In addition, to strengthen controls and capabilities for data retention and future searchability of email records, user accounts for this group would be enhanced with eDiscovery features through Microsoft Purview. The enhancement would allow Information Services to provide expanded amounts of information and data for electronic records preserved within the Microsoft ecosystem (Outlook, OneNote, OneDrive) while also enabling feature sets that would make searching through the records in a more efficient and effective manner.
The estimated cost to upgrade the accounts to include the eDiscovery features will be approximately $2,500 per 50 users, per year, along with a one-time implementation cost of approximately $50,000.
Modifications to the AMC and AR 155 can be completed within one to two months, while the MDM expansion will require additional time for implementation, with a projected earliest completion of January 2024.
Information Technology (IT) Electronics Policy
September 26, 2023
Internal or 3rd Party Support Service to Independently Respond to Public Records Act Requests (PRAs)
Current Practice
Administrative Regulation 148 – Public Records Requests Responses (AR 148) establishes procedure for responding to requests for public records which conforms to requirements of the California Public Records Act. Requests for public records which involve records from more than one departments are coordinated and administered by the Office of the City Clerk. Public Records Requests are forwarded to the respective departments to independently search their departmental records and provide the responsive records. Responsive records are reviewed by staff from the offices of the City Clerk and City Attorney.
Potential Modifications
Modifications to AR 148 would include procedures to utilize the eDiscovery enhancements for email accounts to facilitate an efficient way to perform these searches using software which would allow for specific search criteria, returning results of records within the eDiscovery purview that match the criteria, which would include the establishment of an internal support service, a new work unit, of staff who would perform searches for responsive electronic records.
Staff recommendation would be to create a work unit to include up to four positions.
The estimated cost for the staff of four would be approximately $750,000 per year. The establishment of the unit would take some time to complete, requiring the recruitment, training, and establishment of incumbents, along with new processes and procedures.
The projected earliest completion of establishing the new work unit is by February 2024.
IMPACT ON BUDGET:
Costs for implementation of each item will range from a nominal amount to $750,000, depending on City Council direction.
Respectfully submitted, Concurred by,
Jim Vanderpool Deborah A. Moreno
City Manager Finance Director/City Treasurer
Theresa Bass
City Clerk
Ed Jin
Information Services Manager
Information Technology (IT) Electronics Policy
September 26, 2023
Attachments:
1. AR 410
2. AMC 1.10.070
3. AMC 1.11.050
4. AR 155
5. AR 148