MINUTES OF THE meeting
of the
Assembly Committee on Ways and Means
AND THE
Senate Committee on Finance
JOINT Subcommittee on General Government
Seventy-Second Session
April 3, 2003
The Assembly Committee on Ways and Means and the Senate Committee on Finance, Joint Subcommittee on General Government, was called to order at 8:22 a.m., on Thursday, April 3, 2003. Chairwoman Sandra Tiffany presided in Room 2134 of the Legislative Building, Carson City, Nevada. Exhibit A is the Agenda. Exhibit B is the Guest List. All exhibits are available and on file at the Research Library of the Legislative Counsel Bureau.
Senate COMMITTEE MEMBERS PRESENT:
Senator Sandra Tiffany, Chairwoman
Senator Bob Coffin
Senator Dean A. Rhoads
Assembly COMMITTEE MEMBERS PRESENT:
Mrs. Vonne Chowning, Chairwoman
Mr. Bob Beers
Mr. Josh Griffin
Ms. Kathy McClain
Mr. David Parks
STAFF MEMBERS PRESENT:
Mark Stevens, Assembly Fiscal Analyst
Bob Guernsey, Principal Deputy Fiscal Analyst
Jim Rodriguez, Program Analyst
Susan Cherpeski, Committee Secretary
Carol Thomsen, Committee Secretary
Senator Tiffany convened the work session on the Department of Information Technology (DoIT) and commented that there were important decisions to be made.
The first issue to be addressed was the business process study proposed in The Executive Budget. The study would cost $125,000 and evaluate which services DoIT should offer. Senator Tiffany asked Terry Savage, Director, Department of Information Technology, to elaborate on the purposes of the study.
Mr. Savage clarified that the study was included in the budget of the Department of Administration, not in the budget of the Department of Information Technology Budget Account 1325. He indicated that the money was for a study of DoIT and would examine the entire provision of information technology services statewide. The study would examine each service individually and determine whether or not that function should be decentralized or outsourced to a private company. The study would be fairly complex as it would be examining the entire enterprise-wide effect of those changes. The study would also examine the impact of those decisions on federal funding. Mr. Savage said there had been a preliminary analysis on the federal fund impact completed in September. The results of that preliminary study indicated that the decentralization of the Nevada Operations Multi-Automated Data Systems (NOMADS) would have cost the state approximately $500,000 per year in federal funding for the same work.
Senator Tiffany asked if Mr. Savage was aware that the study was not as comprehensive as originally planned. Mr. Savage indicated that he was aware that possibility had been discussed. Senator Tiffany said that the study would evaluate internal functions, such as programming and applications development, technical support, NT server support, e-mail, database administration, project management, and other similar services. Senator Tiffany pointed out that a comprehensive study could not be completed for $125,000, and Mr. Savage agreed with that assessment.
Senator Tiffany asked Mr. Savage what he hoped to accomplish with the study. Mr. Savage stated that his goal was to identify which centralized services should be outsourced and which decentralized services should be centralized, and in so doing organize the delivery of services to minimize the cost to the taxpayers for a given level of service. Senator Tiffany questioned whether that goal could be accomplished with the amount of time allotted and the amount of money allocated for the study. Mr. Savage said that could be accomplished if the scope of the study was appropriate to the funds that were available for those areas. He commented that he and his staff would be working on the FY2006 and FY2007 budget upon completion of the study in February 2004.
Senator Tiffany inquired whether Mr. Savage expected the study to recommend organizational changes in addition to the centralizing and decentralizing aspects. Mr. Savage replied that there was a possibility that organizational changes would be recommended due to the results of the study. Senator Tiffany asked which functions and services would be examined in the study, and Mr. Savage explained that the original plan had been for a higher-level and less in-depth study. He would have to reexamine that situation as the study would be smaller and more in-depth.
Senator Tiffany commented that the study seemed like an internal audit, and she asked which services and functions would be examined. Mr. Savage opined that a study that was strictly internal, like an internal audit, would not be the optimum use of funds. One of the most important issues to examine would be the overall enterprise-wide effect. He used the example of the PC technicians and said that an argument could be made that a large central staff was unnecessary, and it might be more efficient to have the technicians decentralized because they would have an increased workload. Conversely, there might be reasons for them to remain centralized, but the study would aid in that determination. Mr. Savage indicated that he hoped the study would also examine the data centers, networks, and help desk technicians who worked on specific applications, such as NOMADS or the Integrated Financial System (IFS).
Senator Tiffany clarified that Mr. Savage was proposing an evaluation of the external information technology (IT) systems to determine whether those systems would make sense with the internal IT systems. Mr. Savage disagreed and explained that the intent was to examine the systems statewide, which included internal and external systems. He opined that the distinction between the internal and external systems could be overstated and the separation too severe, which could increase costs.
Senator Tiffany asked Mr. Savage which services he anticipated would be centralized. Mr. Savage indicated that e-mail and networks probably should be centralized. He said that if the service was primarily hardware with support technicians it should be centralized. If it was a service provided by a help desk technician on a specific system, it should most likely be outsourced. Regardless, he agreed to go by the results of the study.
Senator Tiffany stated that the main objective of the study appeared to be determining which services, on an enterprise-wide scale, should be outsourced or centralized. Mr. Savage agreed with that assessment. Senator Tiffany asked if Mr. Savage would assist in determining the scope of the study, and Mr. Savage said he assumed he would work with the Department of Administration, which would manage the study, to determine the scope and the specific areas of focus.
Senator Tiffany asked again if the study would examine organizational and personnel issues. Mr. Savage indicated that a study of the services would provide information regarding the most efficient use of resources including personnel.
Senator Tiffany commented that Mr. Savage appeared to be focusing on external services, but she questioned the internal process of direct billing of state agencies for services provided by DoIT database administrators and project managers. She noted that there had been complaints from state agencies regarding the amounts being assessed. Some felt the assessments were too high and others were concerned that the billable hours were not needed. Senator Tiffany inquired whether those concerns would be studied, and Mr. Savage replied that the original plan had been to study those issues. However, the study had been narrowed and should focus on those services with the potential to save money. He would work with the Department of Administration to determine which services would be studied, as it would not be possible to study all of them.
Senator Tiffany asked if the study would examine the administration of DoIT and the financial components. Mr. Savage said that would be implicit in the study to the extent that administration could impact the cost of providing a given level of service, which would be studied. He asked Senator Tiffany to clarify the question. Senator Tiffany said she was trying to determine how much of the study would be internal and how much would be external. She was particularly interested in the agency assessments and the direct billing. Mr. Savage reiterated his earlier point that the distinction between external and internal services was not as defined as had been assumed. He remarked that drawing that distinction was not the most cost-effective way to look at the question. Senator Tiffany asked if the Subcommittee had additional questions regarding the business process study.
Assemblywoman Chowning expressed confusion regarding the time frame of the study. Mr. Savage clarified that the study would start in July 2003 and would conclude in January 2004, which would allow the results to be used in structuring the budgets for FY2006 and FY2007. Mrs. Chowning noted that the study would take approximately six months, and Mr. Savage agreed. Mrs. Chowning expressed doubt that six months would be a sufficient amount of time to accomplish the objectives of the study. Mr. Savage said that would depend on the amount of money allocated for the study as the funding would determine the scope.
Mrs. Chowning inquired as to the most important reason for the study, and Mr. Savage replied that the reason was to provide the best service at the lowest cost, making the services as efficient for the taxpayers as possible.
Senator Tiffany summarized the previous discussion and said the cost of the study would be $125,000 and it would examine centralizing and decentralizing services, particularly the data centers, the networks, the PC technicians, the help desk technicians, e-mail systems, hardware support, and other similar services. Senator Tiffany indicated she would like the study to examine the internal administrative and financial processes.
Mr. Savage said that had not been in the original plan for the study, but he would be willing to alter the study to include an examination of the administrative and financial processes. Senator Tiffany indicated she would like the study to include the different services that were offered to the state agencies, such as database administrators.
Senator Tiffany broached the subject of cost assessments and questioned the chief information officer (CIO) assessment in the Director’s Office Budget Account 1373. She commented that she understood the bill regarding the CIO position had been withdrawn, which meant there was no statutory definition or requirement for a state CIO. Mr. Savage explained that the assessment and the bill were designed to function independently of each other if one portion was passed without the other. There had been no funding attached to the bill, and the assessment had been designed to address functions and proper cost allocation, regardless of whether there was a CIO.
Senator Tiffany repeated that there was no statutory requirement for a CIO, but the CIO position had been created by order of the Governor. Thus, Mr. Savage was the state CIO, but he still performed the functional requirements of the director of DoIT. Mr. Savage indicated that was correct.
Senator Tiffany commented that the CIO assessment appeared to allow Mr. Savage to sit on multiple boards and attend multiple committee meetings and hearings, which had changed Mr. Savage’s duties from the day-to-day operational part of data processing to a higher level for planning and evaluating enterprise-wide functions. Mr. Savage indicated that was fairly accurate. The meetings were a small component, and the main focus was the enterprise-wide coordination, particularly on issues such as radio interoperability. He said the intent of the CIO assessment was to properly allocate, from a federal accounting standpoint, the cost of those functions that were enterprise-wide to the benefiting agencies.
Senator Tiffany indicated the Subcommittee had received information from staff regarding the CIO support assessment, which indicated the assessment was $38.87 per hour with the assessments applied to all state agencies within the Executive Branch of state government and to those state agencies, boards, and commissions that had elected to utilize DoIT services. The total assessment would be $627,090 each year of the biennium. Senator Tiffany said the Subcommittee needed to decide whether they wished to support the recommendation for the CIO assessment and expressed her opinion that with the current financial situation and the upcoming study, it did not make sense to create a CIO assessment at the present time.
Senator Coffin added that there were many issues in the DoIT budget he supported, but the CIO assessment was not one of them. The CIO position had been created without additional funding, and the assessment would hurt the other agencies. For those reasons, he agreed with Senator Tiffany.
Senator Tiffany reminded the Subcommittee that the rejection of the CIO assessment would not eliminate the director’s functions, it would eliminate those functions associated with the CIO, such as meeting attendance. Senator Coffin commented that an individual would not want to take on additional duties without receiving additional pay, and Mr. Savage interjected that was what he had done. Senator Tiffany remarked that Mr. Savage was performing extra duties, but he might want to change that as she felt the meeting attendance and duties of the CIO should not be assessed with the current financial situation in the state. Senator Coffin commented that Mr. Savage, as director, had used the CIO function to move into areas that had been beneficial to DoIT, and he wondered if that should be maintained in the next biennium. Senator Tiffany agreed and said those assessments could be added in if the study showed them to be necessary.
Assemblywoman McClain indicated that she needed clarification regarding the information provided by staff. She questioned the difference between the proposed assessments and the current assessments. Jim Rodriguez, Program Analyst, Fiscal Analysis Division, explained that the chart provided to the Subcommittee outlined the budget proposal for the assessments. There were three proposed assessments: the CIO assessment, an enterprise access assessment, and a security assessment. Those three assessments would either create a new charge or reallocate a current charge, as in the case of the enterprise access assessment, which was a reallocation of current DoIT costs spread over a wider base.
Ms. McClain asked if that meant DoIT was already receiving those funds, and Mr. Rodriguez indicated that the costs were being absorbed in other budget accounts within the Department. The security assessment was a new basis of cost for the department and would support four positions and a transfer of a position into the director’s office to run the security unit. The CIO assessment was a combination of reallocated costs and additional support costs for the oversight committees. The planning in the contract assessments represented an ongoing cost for the Department. Ms. McClain asked what the difference would be between the proposed amount and the current amount of assessments. Mr. Rodriguez said the difference would be a combination of costs and the CIO assessments—those that could be identified as new costs for the support of the committees—and the security assessment. Mr. Rodriguez indicated the exact portion was unknown.
Mr. Savage interjected that the majority of the costs included in those assessments were existing costs, not new costs that had been added. The Department was increasing the scope of work that the employees were currently doing to include those statewide functions and then allocating those costs appropriately, based on that increased scope of work. As a result of that increase in scope, the federal funding contribution to the state would increase as the agencies that received federal funds were assessed for the additional services. For example, the Department of Transportation was federally funded and was included in the assessment so the federal funding contribution to the Department was increased. Thus, the cost to the Nevada taxpayers was reduced by the reallocation, and it was appropriate based on the federal costing requirements. Mr. Savage concluded that it was the “right thing to do” from an accounting standpoint, as well as in regard to the proper scope of operation of the people involved.
Senator Tiffany informed the Subcommittee that the CIO assessment was not a redefinition of the scope, it was a reallocation of the assessments across all agencies. She said the Subcommittee would need to make that decision. Mrs. Chowning agreed that the decision would need to be made, but she felt the provided information was not complete. She would prefer a breakdown of the information that differentiated between the old and new assessments. Senator Tiffany agreed and indicated that if a decision was made to forego the CIO assessment, staff could reevaluate the assessment in terms of allocation for the position of director rather than for the combined position of director and chief information officer.
Senator Tiffany directed the Subcommittee’s attention to the next issue—a common enterprise access assessment. That assessment was a reallocation of current DoIT costs for three Web designer positions. The cost of the three Web designers was originally billed directly to agencies that utilized DoIT’s Web services. The common enterprise access assessment would reallocate those costs to all state agencies. Senator Tiffany disagreed with the reallocation and said that one Web developer could be allocated across all state agencies, but she would need verification that all state agencies were using all three Web designers all the time in order to feel comfortable with the assessment.
Mark Blomstrom, Deputy Director, Communication and Computing Division for the Department of Information Technology, responded to Senator Tiffany’s concerns. He said the primary functions of the three Web developers could be broken into three areas. The first function for the unit was establishing policies and guidelines for the state Web sites and the entire state presence as a whole. The second function was training state Webmasters and coordinating the efforts of state Webmasters. The three Web developers maintained the state Web portal, which meant they maintained the state Web page and the links contained on that Web page. The final function was maintaining Web sites for the smaller agencies, boards, and commissions that did not employ their own Webmasters.
Senator Tiffany said that establishing policies and procedures was a one-time event. The policies and procedures might be periodically reviewed and changed, but establishing them should not be an ongoing event. She pointed out that training sessions could also be held periodically, and she opined that the Web portal could be maintained by one Web developer. Because of that, she did not see the need for the cost of three Web developers to be allocated across all state agencies. Senator Tiffany advised Mr. Blomstrom to resume direct billing if he wished to keep those three positions and asked if that would be feasible.
Mr. Blomstrom indicated that those services could be billed on an hourly basis, much in the same fashion as billing for programmers. He agreed with Senator Tiffany regarding the establishment of policies, but the development and quality assurance of the guidelines was a continual process as the guidelines were constantly in a state of flux. The guidelines themselves required the Web developers to review all the Web sites regularly. The Web sites had to be reviewed for consistency in the application of guidelines whenever changes were made.
Senator Tiffany commented that she did not see the need for a “Web cop” and three “Web cops” was excessive and unnecessary. Mr. Blomstrom said the positions maintained quality assurance. Senator Tiffany commented that she changed her own Web site fairly often, and while she changed the content, she rarely changed the structure. She stated that the content of the Web site was not anyone else’s concern. Mr. Blomstrom agreed that the content of the Web site was the purview of the owner of the Web site. Senator Tiffany reiterated that a Web site’s structure did not change as often as the content did, and Mr. Blomstrom agreed.
Mr. Beers said that he had spoken to someone at the Department of Information Technology (DoIT) and that individual had indicated that when agencies changed a part of their uniform resource locator (URL), or Internet address, the Web developers had to change the reciprocal link on the state Web site, which was a constant source of work. Mr. Beers said he used a program called Dreamweaver, which updated links automatically. He suggested that the purchase of that software for approximately $400 might eliminate the need for at least one of the Web developer positions. He agreed with Senator Tiffany that a “Web cop” was unnecessary once the standards were implemented. It might take three weeks to discover a problem rather than two days, but that appeared to be a reasonable savings.
Senator Tiffany agreed and requested that the DoIT examine the possibility of direct billing for the Web developers as well as the possibility of eliminating one or two of those positions depending on the requirements of the agencies that used the services.
Senator Tiffany addressed the issue of the Information Technology (IT) security assessment. The issue had two components: a security risk assessment study for $200,000, and the creation of a five-person IT security unit. Senator Tiffany said it did not make sense to hire four new people and transfer one existing position and then do a study to determine that the five people were needed. In her opinion, it would be better to do the study and then use the results to determine what was needed. She remarked that she had not heard concerns from the agencies regarding their backup procedures and security policies. She conceded that there were issues with possible terrorist attacks and homeland security, but that seemed to be a small part of the overall issue. Firewalls and virus detection software appeared to be adequate as far as backup procedures were concerned.
Senator Tiffany noted that there were two separate studies being requested: the business plan study for $125,000 and the IT security risk assessment study for $200,000. She wondered if it would be possible to merge the objectives of the studies, so the first study would include an evaluation of the IT security assessment and whether those five positions were needed and whether additional security measures were needed at the agencies. She opined that the allocation for the business process study should be raised to $200,000 and an examination of the security needs of the agencies should be included in the study.
Assemblywoman Chowning interjected that the total amount recommended for both studies was $325,000. She asked Mr. Savage if it would be possible to combine the studies and conduct them for $200,000. Mr. Savage said there were several issues with that particular scenario. He emphasized that the studies were for very different purposes, and he felt that cutting the security risk assessment study could be a big mistake. A service-optimization study and a security-vulnerability study were two different issues and should not be combined. As far as the study determining the need for the five requested employees, Mr. Savage said security issues had already been identified sufficient to justify the requested positions. He indicated that he had given a report to staff detailing the tasks and the amount of time it would take to complete those tasks. With those calculations, the five-person unit would be capable of addressing approximately 10 to 20 percent of the known security issues. The proposed security assessment study would examine the known security risks as well as identify the risks that were currently unknown. Mr. Savage reiterated that, in his opinion, eliminating the study would be a mistake. He said it would be irresponsible to reduce the amount of security funding as it could affect his department’s ability to protect the state’s infrastructure, the state’s data, and the privacy of the individuals whose data was stored on the systems. He emphasized that security was an important function, which was why the study was the single largest request made by the DoIT. He felt that information technology security had never been addressed adequately, and the only reason the state had never been attacked was because it was a “small target” compared to other states, and that would not protect Nevada as the attack technology became more automated.
Senator Tiffany asked how the current security issues were being addressed, and Mr. Savage replied that the Department was “plugging the biggest holes” as quickly as possible with the available resources. Senator Tiffany asked him to be more specific and asked what duties the individual in the existing security position performed as far as the needs of the agencies. Mr. Savage commented that it was an artificial distinction between the agency and the overall enterprise. Security could not be done on a “piecemeal” basis.
Senator Tiffany pointed out that there was not an interlinking computer system for all the agencies. The Department of Motor Vehicles was not connected to the Department of Health and Human Services, and so on. Mr. Savage disagreed and said all state agencies were connected through the SilverNet network. Senator Tiffany conceded there was a SilverNet connection, but said Mr. Savage had been discussing more than the network as he tried to justify the need for the new positions and the study.
Senator Tiffany repeated her earlier question and asked what duties the individual in the security position performed. Mr. Savage said the security officer had been working on creating a list of known procedures and vulnerabilities. Senator Tiffany asked if those procedures and vulnerabilities related to the network, and Mr. Savage indicated they covered a wide range of issues, including network issues. Senator Tiffany asked Mr. Savage to list the other issues included in that wide range. Mr. Savage said those issues included, among other things, data security and access security.
Mr. Blomstrom interjected that network security was one of the issues, as was social engineering, which meant ensuring that the state and the various agencies were aware of how hackers accessed the systems through open pathways. There was also the question of physical security and its relation to the availability of personal computers.
Senator Tiffany noted that those functions appeared to be part of the policies and procedures, which had been discussed earlier, and she still did not think four new positions were justified. Mr. Savage offered to provide a specific list of the individual items, but Senator Tiffany indicated that would be unnecessary. She opined that the process seemed backward—four new positions would be created and then the study would be done to show that those four positions were needed.
Mrs. Chowning commented that the real issue was a matter of what was necessary. She opined that the current security position would be sufficient while the study was taking place, and then the results of the study would determine if a security unit was needed.
Mr. Savage replied that the DoIT was already aware of security issues that needed to be addressed immediately, and he felt those issues justified far more positions than the four requested. Mr. Savage indicated the purpose of the study would be to identify those security risks that were currently unknown.
Mrs. Chowning asked if Mr. Savage intended to return in the next legislative session and request more positions due to the results of the study. Mr. Savage answered that he probably would be asking for more positions in the future. However, the Department’s current goal was to identify the risks and the potential losses associated with those risks. He said the amount of cyberattacks would continue to increase as it was a technology that was inexpensive for criminals to exploit. Mrs. Chowning pointed out that the security unit would not be able to prevent hackers from getting into the system, and Mr. Savage conceded that the unit would not be able to stop all of them, but he insisted it would be able to stop some of them. He emphasized that security was not “all or nothing.” Rather, it was a matter of determining how much of the risk could be covered. There would always be vulnerabilities, but the creation of a security unit would lessen those. Mr. Savage said that in constructing the budget, his department had identified a need for 40 new positions, had requested 10, and had then reduced that request to 4 new positions. He believed that was the minimum number of positions that would be a responsible reaction to the security threats.
Senator Coffin remarked that funding dilemmas could occasionally be solved with a sequential funding method. He asked how much of the data provided to the Subcommittee had been self-reported by the agencies and how much had been the result of DoIT’s findings at the agency level. Mr. Savage explained the information had been gathered by the security committee in which the vast majority of the user agencies were active participants. The security committee developed the procedures and the requirements with input from all of the participating agencies.
Senator Coffin commented that the agencies had participated by identifying a problem, but when DoIT assessed the agencies for fixing the problem, the agencies did not want to pay. He said he was curious about the aspect of self-reporting because the agencies should know what was occurring in their own “bailiwick,” but would not always admit to problems.
Mr. Savage said that the agencies participating in the security committee had been extremely forthcoming with problems, and the security committee had examined a wide range of security issues and determined which should be addressed. Senator Coffin remarked that the agencies were aware of the importance of security issues and they were aware that remedying those would cost them. The dilemma faced by the Subcommittee was whether to fund all of the requests at the same time or pursue a sequential funding method. Senator Coffin said that it might not be feasible to fund the study and the new positions at the same time. The Subcommittee was aware of the need for the study and for the new positions, but that was a large expenditure. Senator Coffin suggested that the security risk assessment study could be funded, and then later in the biennium, once they proved the need for a new security unit, that unit could be created and funded at that time.
Mr. Savage said that Senator Coffin’s suggestion made sense conceptually but was not practically feasible. He said that the four requested positions would not actually be able to address all of the known security issues, and he did not want to choose between the positions and the study. Mr. Savage said he could ignore problems that he knew existed in favor of finding the problems of which he was unaware or he could focus on those known problems and ignore the possibility of being “bitten” by one of those unknown problems.
Senator Tiffany repeated her earlier question and asked what the duties of the security position were and how those identified problems were being addressed. Mr. Savage said the individual in that position was working on developing procedures and identifying what needed to be done. The primary focus was creating an inventory of the systems and examining backup and recovery status for computer systems statewide. He said that an additional employee working on those tasks would be helpful. Senator Tiffany commented that backup procedures did not seem to be a big security issue.
Assemblyman Beers opined that the positions were fully justified, but he suggested that rather than contracting out services, the expertise to perform those services should be developed internally. He reiterated that the positions were warranted, although the risk assessment study might not be.
Senator Tiffany disagreed and said setting up policies and procedures and databases was not a security issue. Mr. Beers interjected that it was not a security issue until the security had been compromised.
Senator Tiffany indicated that the larger agencies already had internal processes for security, and it appeared that the state would be subsidizing the smaller agencies. Mr. Beers remarked that there should be some oversight of the larger agencies as well. Security appeared to be unimportant until it was breached, and the more processes and systems were examined, the more secure they would become.
Senator Tiffany questioned the security of the SilverNet network. Mr. Blomstrom replied that there was a person assigned to the technical security of the SilverNet network. That person was a technical software engineer, and he created secure links on the network. Senator Tiffany asked if Mr. Blomstrom felt comfortable that the network was secure. Mr. Blomstrom said it was not as secure as it could be, and Senator Tiffany commented that it could always be more secure. She asked how the network was protected against hackers. Mr. Blomstrom explained that the SilverNet network connected to many different places and agencies, many of which had a local area network. That was where security issues arose. The SilverNet network itself was fairly secure but it was a constant process of adapting and changing to defend against attacks.
Senator Tiffany asked if the larger agencies employed staff to examine security. Mr. Blomstrom said he could not answer that question with specific details, but he did know that the agencies were aware of security issues and had most likely assigned that task to certain individuals within the agency; however, that was most often in addition to their regular duties and was not the primary focus of the employees. He emphasized that the large agencies were aware of the need for better security.
Senator Tiffany asked how the $200,000 for the security risk assessment had been derived. Mr. Savage said he had sent a request for information (RFI) to various security vendors and had chosen a bid which had been in the low-middle end of the bids received. Senator Tiffany asked if the request had been detailed regarding the functional requirements, and Mr. Savage replied that the request had not been detailed. It had been broad in scope, but if the study were approved, the Department would provide a detailed requirements specification before the Request for Proposal (RFP) was sent to vendors.
Senator Tiffany asked if the full $200,000 was necessary for the study or if a portion of that could be used in the business process study. Mr. Savage said the two studies were essentially unrelated and should not be combined. He explained that the $200,000 bid was in the low-middle end of the range of bids received. There had been a wide range of bids including several that were in excess of $1 million for a full enterprise-wide security assessment. Based on the responses to the request for information, the $200,000 bid appeared to be the lowest credible amount for an enterprise-wide assessment.
Senator Tiffany repeated her question regarding the amount of $200,000, and Mr. Savage said the intent of the RFI had been to determine if a company was credible, experienced, and capable of addressing the right issues. In order to find a company that met all those requirements, the minimum cost had been $200,000.
Mrs. Chowning questioned the time frame of the security risk assessment study, and she inquired if Mr. Savage had examined what other states were doing in terms of security. Mr. Savage said he did not have specific details regarding other states, but he did know that there were other states that had security units and were conducting ongoing assessments. Mr. Savage explained that the requirements for the study would be finalized in July, the RFP would be sent out in August, and then the study would begin in October or November 2003. It would take approximately one year to complete and should be done in November 2004.
Mr. Beers reemphasized his earlier point that security was important and that security was not a state that was achieved, it was a state that was maintained, and people were needed in order to maintain that secure status. Senator Tiffany said the request for four new positions and an expensive study seemed rather excessive and rather sudden as it had not been a concern in the previous biennium. Mr. Beers explained that the requests had originated with an interim committee of which he had been a member, and the committee had developed the first information technology security policies for the state. Senator Tiffany was correct; prior to that, the security issues had not been addressed.
Senator Coffin related an earlier experience with a computer virus contained in an e-mail. He asked what DoIT did in those situations. Mr. Savage explained that in the particular instance Senator Coffin was referring to, the virus was broad-spectrum, which raised several issues. Mr. Savage said that one of the emerging trends in security was to change the current virus definition in terms of the behavior of the virus and what the virus actually did.
Senator Coffin asked if the Department of Information Technology (DoIT) had been able to determine the source of the virus. Mr. Blomstrom said that the source often could not be determined because infection was almost instantaneous and the more systems that were infected, the more difficult it was to backtrack and identify the initial case. Senator Coffin asked if any attempt had been made by DoIT to ascertain the initial case. Mr. Blomstrom said the Department had examined the paths within the network, but had focused primarily on reactive measures, such as sending out an e-mail informing those on the network of the virus threat. Senator Coffin commented that seemed to make the Department’s case that a risk assessment study was needed.
Senator Tiffany disagreed and said it appeared that an additional four employees would not have changed the outcome. Senator Coffin interjected that it proved there were holes in the security. Senator Tiffany opined that adding four new positions and conducting a study did not mean the security issues would suddenly be resolved. Mr. Savage commented that more security issues would be resolved with eight new positions, and Senator Tiffany said she would prefer to maintain the status quo with the current position and reexamine the cost of the study.
Senator Tiffany indicated the Subcommittee would discuss decision unit E‑275, the cost of the contractor for DoIT’s rate model. She explained that there was a contractor who helped DoIT set and review the rate model, and the contractor was paid $15,000 per year. Senator Tiffany noted that earlier discussion had indicated that DoIT would eventually perform those duties internally and no longer have need of a contractor. Senator Tiffany opined that the contractor should be used in the first year of the biennium to review the rates, and then DoIT should assume those duties and the contractor should not be used in the second year of the biennium.
Mr. Savage said that the level of competence on the rate model had greatly improved in the previous two years, and DoIT would be able to perform some of those duties, in terms of maintaining and updating the rates. The contractor, however, was an expert in federal funding and federal compliance, and the Department did not have that same level of expertise. Thus, when the budget was being prepared and changes to the rate model were being contemplated, which was an ongoing process, that consultant provided the necessary expertise. Mr. Savage said that it was not necessary to have someone on staff at the Department with that level of expertise because DoIT could not justify paying for that individual as a full-time employee when the contractor was only needed for 90 hours per year. Mr. Savage said the Department had the software and the personnel necessary for the maintenance of the rate model, but the contractor provided high-level oversight and federal quality control on an ongoing basis.
Chairwoman Chowning said that DoIT had told the Legislature several times that the goal was to eliminate the outside contractor and assume those duties internally. She asked why the Department had not made progress in that direction and had apparently abandoned that course.
Mr. Savage said that goal had changed since the previous biennium as he had become aware of the magnitude and complexity of the issues. He assured her that he had intended to reach that goal, but he had underestimated the scope of the problem. Mr. Savage said DoIT could perform those duties in a mechanical day-to-day process. DoIT could develop the rate model, but there was a risk that without the contractor’s expertise, the rate model would not be compliant with the federal cost compensation rules.
Chairwoman Chowning asked if the request of $15,000 per year for the contractor would be an ongoing request. Shelly Person, Chief of Administration, Department of Information Technology, responded to Chairwoman Chowning’s question and said that the complexity of the federal compliance rules had not been understood. The Department now understood the difficulties so DoIT had again requested the funding to support the consultant’s time. Ms. Person said that DoIT had taken on the development of the rate model and was able to maintain the rates and work with the agencies, but the information technology industry was constantly changing and the 43 services offered for the next biennium would most likely change the following biennium. The oversight was needed to ensure federal compliance as well as to assist with determining new services and rates.
Chairwoman Chowning requested that Ms. Person provide information regarding how much it would cost for the consultant to perform a periodic review, meaning the Department would assume all other duties. Ms. Person said the $15,000 per year was essentially 45 hours every six months for the consultant and what Chairwoman Chowning suggested was already being done.
Assemblywoman McClain voiced her opinion that it was a good idea to hire a consultant rather than hiring a full-time employee who would need to be trained in the federal compliance laws. Oversight was necessary and it was a relatively small cost for maintaining federal compliance.
Senator Tiffany agreed but pointed out that DoIT had promised to assume those duties internally, and she wanted to know if DoIT intended to do that. Ms. McClain said she did not think DoIT would ever be able to assume all of those duties because the oversight and the expertise of the consultant would still be needed, and it would cost more than $15,000 per year to train an expert internally. Senator Tiffany commented that the Department should already have that expertise in-house. Ms. McClain said she did not think every department and agency needed an expert in federal guidelines and compliance issues.
Mr. Savage agreed with Ms. McClain and said that the cost of maintaining that detailed expertise in-house would be more than the cost of a consultant. Senator Tiffany asked who performed those duties now, and Mr. Savage replied that the consultant was supplying the high-level oversight. The Department determined the costs, the cost pools, and the assessments, and then worked with a consultant to ensure that the principles and the allocation process used were consistent with federal and general accounting principles.
Senator Tiffany commented that once the framework was established DoIT should no longer need a consultant. Mr. Savage said that would be the case if the framework never changed and the federal requirements never changed. However, given that the federal requirements, accounting practices, and the IT industry itself changed constantly, the biggest mistake would be to assume that it was a one-time process. Senator Tiffany acknowledged it was an ongoing process, but said she assumed that the Department would perform those tasks internally. Mr. Savage said DoIT could spend more than the $15,000 proposed and maintain that expertise internally, but he believed it was better to spend less money and hire an expert in those areas.
Mr. Beers commented that there were other agencies that had to comply with federal regulations regarding assessments, and he wondered how those agencies ensured compliance. Mr. Savage said that those agencies frequently used the same consultant as DoIT. Senator Tiffany remarked that she had not seen a request for a consultant in the other budgets. Mr. Beers interjected that he had not seen a request either, but he thought that cost might be included in the base budget.
Senator Tiffany addressed decision unit E-276, the software executive position, and said a decision needed to be made regarding the recommendation for continued funding of the software executive position. Previously, the position had been funded through the Department of Human Resources (DHR); however, due to lack of demand, the position was being redefined and moved into the Director’s Office and would manage the Applications Design and Development Division of the Department of Information Technology (DoIT). The position would be maintained in the Director’s Office budget and cost allocated back to the Applications Design and Development budget.
Mr. Savage added that the position was currently providing project management and oversight services to all major DHR software projects. Decision unit E-276 would make the software executive responsible for overseeing all project management activities for major software system design, development, and maintenance projects statewide. Thus, the role of the software executive position would be expanded and additional functions would be added without additional cost. He noted that a position, such as the software executive position, which managed a broad range of systems across agencies, was not typically charged back directly. That had been an ongoing issue in software development and it made sense for the cost of some positions, such as the senior manager of a large division, to be allocated into the overall rates.
Senator Tiffany said the position had been absorbed back into the DoIT budget and there was already a manager in the Applications Design and Development Division. She saw no need for two layers of management and was not sure if the position was even necessary. Senator Tiffany said it was confusing to have the position in the Director’s Office but managing the Applications Design and Development Division. She expressed concerns that the position had not been justified nor were the cost allocations appropriate.
Mr. Savage said the cost of the position was not in the Director’s Office budget; it was allocated to the Applications Design and Development Division, Budget Account 1365. Ms. Person interjected that the proposal was to place the position in the Director’s Office budget, but within the rate model, the position would be allocated back to Budget Account 1365.
Senator Tiffany confirmed that the position was in Budget Account 1373 but was allocated to Budget Account 1365, and she commented that she was not sure that allocation was appropriate. Mr. Savage said that it would not be a problem to move the cost code into Budget Account 1365.
Senator Tiffany asked if the position would be physically moved out of the Director’s Office and placed with the Applications Design and Development Division. Mr. Savage explained that the individual holding that position would be in many different places: the Director’s Office, customer sites, and different divisions within the Department. The nature of the position required moving around.
Senator Tiffany remarked that the duties of that position had included supporting the CIO position and attending committee meetings, but if the CIO position were eliminated, those duties were eliminated as well. Mr. Savage explained that the position had only attended those committees to the extent that they were appropriate to the functions of that position. The individual in that position had attended the IT Project Oversight Committee because that individual managed the IT projects and needed to be involved with that committee. Conversely, that individual was not on the security committee because that did not pertain to the responsibilities of the position. Mr. Savage reiterated that the senior manager position, which was currently handling project management and human resources software, was being expanded to include management of database administrators and overall programming. The cost was then being allocated over a broader base. There was no additional personnel included in the request, and Mr. Savage indicated that while the workload of the individual in that position would increase, the total number of staff in the constituent parts of the new unit had decreased, which was appropriate based on a decrease in workload.
Senator Tiffany said she did not feel Mr. Savage had justified the absorption of a position that the DHR no longer needed in order to split the position between the Director’s Office and the Applications Design and Development Division, which would essentially add another management layer to that division. Mr. Savage replied that an additional layer was not being created. The Division currently reported to the deputy director who was at the same level as the proposed position; the Division would report to that new manager. It was a reorganization of the existing units within the Department in order to increase efficiency and coordination between the units.
Senator Tiffany indicated the Subcommittee would discuss decision unit E-905, the transfer of the Chief of Planning and Research to the Director’s Office. The question that needed to be addressed was whether the transfer was necessary. Ms. Person explained that E-905 was an attempt to place all the executive staff positions into the Director’s Office budget account.
Senator Tiffany pointed out that would change the cost allocation, and Mr. Savage explained that the position was currently allocated and would be allocated to the Planning and Research Division under the new scenario as well. Senator Tiffany commented that transferring the position into the Director’s Office would change that cost allocation. The position would be allocated across all agencies rather than to the Planning and Research Division. Ms. Person explained that within the rate model, it was possible to make personnel allocation to the appropriate budget accounts based on percent. She indicated that personnel sheets with allocation breakdowns had been provided to staff and the reports showed that the rates absorbed the percent that was allocated, regardless of budget account.
Jim Rodriguez, Program Analyst, Fiscal Analysis Division, requested clarification regarding the cost allocation. He said he had examined the rate model information that had been provided and noted that the allocation for the Chief of Planning was allocated through the Director’s Office overhead back to planning. With the proposed transfer there appeared to be an inconsistency in cost allocation as the Chief of Planning would be supporting CIO functions as well as planning functions. The cost allocation did not account for that dual functionality.
Mr. Savage repeated that the transfer was an attempt to take statewide functions and allocate them statewide. Mr. Rodriguez said the problem was that the position was being allocated to planning, but the position also supported the CIO function and that was not reflected in the cost allocation. Mr. Savage argued that the planning function had inherently been an enterprise-wide CIO function, and neither the cost allocation nor the job itself would change by including CIO functions in the job description.
Senator Tiffany asked if planning was direct billed. Mr. Savage replied that planning was not direct billed, and Ms. Person added that it was an assessment allocated statewide. Senator Tiffany requested that Mr. Savage and Ms. Person work with staff to clarify the cost allocation for the position.
Senator Tiffany mentioned the reserves and indicated that, according to the information provided by staff, the reserve budgeted for FY2003-2004 was approximately $8.2 million, but the budgeted amount for the 60-day reserve was approximately $5.1 million. She acknowledged that the Department wanted to use the reserve to buy equipment, which would be approximately $1 million; however, the reserve amount should fall between $5.1 million and $8.2 million so the rate would need to be reduced by approximately $1.5 million because the reserves were too high.
Mr. Savage expressed his willingness to work with staff to determine the appropriate amount in reserve and said the 60-day reserve was the goal, but he reminded the Subcommittee that the federal payback needed to be taken into account. That payback would be between $1.1 million and $1.5 million. Senator Tiffany and Mr. Savage agreed to work on the reserve totals to reach the optimum amount. Mr. Savage added that his department was very aware that upon closing the budgets, the rate model would change and he was prepared for that eventuality.
Senator Tiffany addressed decision unit E-276, the reinstatement of five Nevada Operations Multi-Automated Data Systems (NOMADS) programmers in the Applications Design and Development Budget Account 1365. She commented that the Governor’s requested 3 percent cost reduction had resulted in the elimination of the five NOMADS programmers, which were now going to be reinstated. She indicated there were not any problems with that decision unit as the Welfare Division had identified sufficient programming tasks to support the five programmers.
Decision unit E-805, which was the recommendation for the reclassification of four positions, was discussed. Senator Tiffany commented that she was not satisfied that the position reclassifications were justified. Reclassification required a change in the scope of the job, not an increase in amount of time required for the job. Mr. Savage said that with the increase in workload and the decrease in staff, the scope of work for those positions had changed. Senator Tiffany requested clarification of how those tasks had changed, specifically in regard to the two Database Management Specialist (DBMS) II positions being changed to DBMS III positions. Ms. Person indicated the NPD-19 personnel forms had been submitted, which identified the change in job duties and justified the upgrade. She said that the staff members were performing the job classifications for the DBMS III position and with the training the staff members had undergone over the years, the upgrade was appropriate.
Senator Tiffany asked what additional training the employees had received. Ms. Person said she would review the records for specific training, but she explained that the normal training technical staff participated in during the years, combined with the increased job duties, was justification for the position reclassifications. Senator Tiffany reiterated that reclassification depended on scope, not workload, and Mr. Savage insisted there had been a change in scope and that change in scope was reflected in the NPD-19 forms submitted to the Department of Personnel. Senator Tiffany repeated that she was not sure the reclassification had been justified and she asked Mr. Savage to provide additional information to staff. Ms. Person interjected that part of the confusion might be due to her use of the term “workload,” which she had been using to describe the expansion of duties. Senator Tiffany emphasized that a change in scope was different than workload and repeated her request for additional information.
Senator Tiffany said a decision needed to be made regarding decision units E‑903 and E-906, which recommended 16 position transfers. Mr. Savage explained that those transfers would move the positions into alignment with the focus of the work. He indicated that information had been provided to the Subcommittee.
Senator Tiffany addressed decision unit E-720, the purchase of two Oracle servers. She asked why the servers were needed, and Mr. Blomstrom replied that there were Oracle database administrators, and there were many different applications which used the Oracle database program. The request for the servers would allow DoIT to perform testing and developing on a server separate from the production database server, which would eliminate a significant risk.
Senator Tiffany asked why the Department needed two servers. Mr. Blomstrom explained that the machines were fairly small, and when an upgrade or a modification was made to an existing Oracle-based application program, the program was run off-line with a snapshot of recent data. Having two machines ensured that information would not be lost and was essentially a quality control monitor.
Senator Tiffany questioned the need for two. She asked if there had been new programs or additions to the database programs that would require two rather than one. Mr. Blomstrom replied that the workload had not changed very much, but the two servers would provide redundancy, and if one needed to be repaired, the other would still be in operation. Senator Tiffany asked if there was an immediate need for the Oracle servers to backup the servers the Department had currently. Mr. Blomstrom explained that the servers would not backup the production database servers, they would be used for testing and development.
Senator Tiffany commented that the request for two servers would imply that there were many change requests for the Oracle database. Mr. Blomstrom said he did not have the exact number of change requests, but those were an ongoing occurrence for several Oracle-based application programs. The two machines would allow the Department to run testing and development programs on a separate server so if there were problems, it would not affect the production server. Senator Tiffany remarked that it seemed the Department had asked for two in order to negotiate that number down to one.
Mr. Beers said that Oracle was a database and not an operating system, and he asked what “the box” was. Mr. Blomstrom explained that the box was an NT server, and there were multiple applications on that production box. Mr. Beers clarified that the Department had multiple databases operating on a single NT server and indicated that increased the risk. Mr. Beers said he felt the Department should receive one Oracle server.
Senator Tiffany indicated the program analyst, Jim Rodriguez, would explain the options surrounding decision unit E-715, the mainframe upgrade in the Computing Division Budget Account 1385. Mr. Rodriguez explained that the Department had provided information regarding costs and risks of various alternatives. The Department had identified seven options. However, only two of the options had been deemed viable. The first option was the lease-purchase of a Z-900 replacement mainframe computer. That was the recommendation from DoIT, and the differential cost for the upgraded cost and the current operating cost would be $1.5 million. The Z-900 replacement met the technical specifications set by the Department, and it met the time frame durations—the system would not need to be replaced for seven years. The second option was a technical upgrade to the current R35 mainframe. That would increase the capacity of the mainframe and upgrade the generation of the computer to an R36 rather than an R35. The estimated cost would be $600,000 rather than the aforementioned $1.5 million for the Z-900. The Department had highlighted certain risks associated with that option. The primary risk identified by the Department was that the software might not be supported by the vendor through the biennium and that software would need to be upgraded. The specific concern was the technical support for the DB2 Version 8. IBM was the vendor for that and had not yet stated how long DB2 Version 8 would be supported.
Mr. Rodriguez said the issues to be considered by the Subcommittee were the cost and the technical issues. There was approximately a $900,000 cost differential between upgrading the current system to an R36 and the lease-purchase for a Z-900. There was also a concern that with the R36 upgrade the operating system would not be supported through the biennium. Mr. Rodriguez noted that the estimated end of support date for the operating system as well as DB2 Version 8 was August 2005, which would cover the biennium; however, the risk was that the date given for the end of support would actually be sooner as August 2005 was an estimate.
Senator Tiffany said a decision needed to be made whether to upgrade the R35 to R36 or to lease-purchase the Z-900. Senator Coffin said he favored the option that would provide the longest term of serviceability. Senator Tiffany remarked that she favored the upgrade through the biennium, and then a replacement in the next biennium. She pointed out that the replacement would likely be less expensive in two years. Mr. Beers and Mrs. Chowning agreed that the upgrade appeared to be the best option.
Additionally, Senator Tiffany pointed out that there might be other choices on the Z-900 in two years. Mr. Beers agreed and added that he was concerned the next biennium’s revenue might not reach the projected level. Mr. Savage said that, assuming the support lasted through August 2005, the upgrade was a viable option from an operational standpoint. He emphasized that there was a risk that if the cost of the Z-900 was not reduced then the R35 upgrade option would cost approximately $500,000 more than the Z-900 option.
Mr. Beers said he did not think there was a significant risk that the support would end because that would not be in IBM’s best interests. He addressed Mr. Savage’s comments regarding the increased cost and said the current trend dictated that the cost of the Z-900 would go down. Mr. Savage agreed but added that the rate of decrease might be less than expected. He reiterated that it was a viable option, but there were risks.
Senator Tiffany questioned the lease-purchase agreement and asked if the lease-purchase should continue. Mr. Blomstrom stated that in either case a three-year, or even a four-year lease-to-purchase agreement would be the best option, as the Department would own the equipment at the end. A regular lease did not have any residual value. Senator Tiffany asked if the Department would recommend a lease-purchase for two years with the upgrade. Ms. Person recommended the lease-purchase and said the time period was negotiable.
Mr. Beers questioned the possibility of an outright purchase rather than a lease-purchase. Mr. Blomstrom said the lease-purchase agreement would be for at least three years, and perhaps even four years, based on the Subcommittee’s recommendation. Mr. Beers commented that leasing actually cost more than buying. He said that if there was not an immediate cash flow restraint, a purchase would be better. Mr. Savage agreed but said the advantage to a long-term lease-purchase agreement would be smaller payments over a period of time. Mr. Beers pointed out that would increase the actual cost, although it would save money in the short-term. Mr. Savage said the Department did not have a preference and the Legislature could decide the best way to save money for the state. Senator Tiffany agreed and asked Mr. Savage to work with staff on the most cost-effective way to do the upgrade.
Senator Tiffany addressed decision unit E-805, the reclassification of ten positions. Mr. Savage explained that E-805 was a result of an increase in workload and a decrease in staff, requiring an increase in the scope of those positions. He said the choice was to pay employees appropriately for the work they were doing or to stop them from doing that work, which was not an option. Senator Tiffany stated that she had a tendency to maintain the status quo, but if there had been a change in the scope of the job, that information needed to be provided to the Subcommittee.
Assemblywoman McClain said the NDP-19 forms had been submitted to the Department of Personnel, and she asked if those had been approved. Mr. Savage assured her that the forms had been submitted, but the Department of Personnel would not approve the request until the change was approved by the Legislature. Ms. McClain commented that seemed out of order as it was a case of money first and qualifications later. Ms. Person agreed the process was confusing, but the Department of Information Technology was following the necessary steps. Senator Tiffany repeated her request for information regarding the change in scope of the positions to be reclassified.
Senator Tiffany indicated the Committee would discuss issues related to the Communications Division, Budget Accounts 1386, 1387, and 1388. She referred to decision unit E-300 and said the Subcommittee needed to decide whether to approve equipment and software purchases for the SilverNet data communications network. Mr. Blomstrom explained that the equipment and software purchases were primarily for replacement and for caseload expansion. He indicated that DoIT was behind in the replacement of equipment and as the caseload had increased, the Department would continue to fall further behind.
Senator Tiffany asked Mr. Blomstrom to list the items in order of importance. Mr. Blomstrom said it was difficult to separate items as they were integrated into the same system and each part was important. Senator Tiffany pointed out the Department had requested 40 different items and she asked that those be listed in order of priority. Mr. Blomstrom agreed to provide that list to the Subcommittee.
Senator Tiffany questioned the effect of the caseload on the equipment. Mr. Blomstrom explained that there had been an increase in the utilization of the SilverNet. Projections indicated there would be an approximate 26 percent increase in traffic in the upcoming biennium. That increased the need for additional ports on the equipment. Mr. Blomstrom indicated that in some cases agencies requested additional services, but generally there was simply more agency utilization of SilverNet.
Senator Tiffany asked if the increase in utilization had necessitated the addition of hardware items to the Department’s request. Mr. Blomstrom explained that there were two approaches to handle that increase in traffic. One was to replace a particular piece of equipment and the other was to upgrade the equipment. Senator Tiffany repeated her request for a prioritized list.
Mr. Rodriguez added further explanation regarding that list. He said he needed a priority list for all hardware requests in all the budget accounts and for all the decision units. The list should reflect which needs were most critical. Mr. Savage indicated that he understood and would provide that information.
Senator Tiffany said the Department of Information Technology was requesting the reclassification of four Computer Network Technician II positions to Computer Network Specialist I positions. She commented that once again she preferred to maintain status quo, but she requested the information regarding the change in scope of the job. Ms. Person agreed to provide that information and added that the positions had enterprise-wide responsibilities and the reclassification would reflect that. Senator Tiffany repeated her request for more information.
Senator Tiffany addressed decision unit E-710, which was the replacement of the telephone monitoring system. Mr. Blomstrom explained that the current call accounting system had been developed ten years earlier and purchased five years earlier and was no longer offered for purchase. Senator Tiffany remarked that the point had been made and indicated the necessary budget issues had been addressed. The meeting was adjourned at 10:33 a.m.
Susan Cherpeski
Committee Secretary
APPROVED BY:
Senator Sandra Tiffany, Chairwoman
DATE:
Assemblywoman Vonne Chowning, Chairwoman
DATE: