Attachment

LEGISLATIVE, FINANCE, AND ADMINISTRATION COMMITTEE AGENDA DECEMBER 10, 2012 - 6:00 P.M. CITY HALL COUNCIL CHAMBERS 15 LOOCKERMAN PLAZA DOVER, DELAWARE Public comments are welcomed on any item and will be permitted at appropriate times. When possible, please notify the City Clerk (736-7008 or e-mail at CityClerk@dover.de.us) should you wish to be recognized. AGENDA ADDITIONS/DELETIONS 1. Reduced Rates for All-Electric Homes in December, January, and February (Committee Referred Back to Staff on September 10, 2012 for a More In-depth Analysis, and That Staff Determine the Cost for the City to Administer Such a Program (Including Whether an Additional Employee Would Be Necessary) and the Number of Houses That Would Be Involved, and Provide a Cost Analysis to Determine Whether the Program Would Be Cost Effective for the City, Based on the Additional Cost to the City Versus the Savings That Would Be Realized by the Customers) 2. Review of City of Dover Identity Theft Prevention Policy 3. Adjournment by 6:30 P.M. /tm S:\AGENDAS-MINUTES-PACKETS\Committee-Packets\2012\LF&A\12-10-2012\12-10-2012 LF&A.wpd THE AGENDA ITEMS AS LISTED MAY NOT BE CONSIDERED IN SEQUENCE. THIS AGENDA IS SUBJECT TO CHANGE TO INCLUDE THE ADDITION OR THE DELETION OF ITEMS, INCLUDING EXECUTIVE SESSIONS.

Memorandum Office of the City Manager PO Box 475 Dover, DE 19903 Phone: (302) 736-7005 FAX: (302) 736-7002 E-mail: skoenig@dover.de.us To: Members of the Legislative, Finance & Administration Committee From: Scott D. Koenig, P.E., City Manager Date: December 4, 2012 Subject: Reduced Rates for All-Electric Homes in December, January and February In September, the Legislative, Finance & Administration Committee requested that I complete a more in-depth analysis of the possibility of reduced rates for all-electric homes in the months of December, January and February of each year. Attachment #1 is a rate & fee trend for the electric utility from 2002/03 to 2010/11. For the purposes of analysis, I focused on years 2002/03, 2003/04 & 2004/05 which represent the last years of the Winter/Summer rate schedules. If the summer rate of 0.0924 is considered the base rate, then the Winter<1000 rate of 0.0880 represents a 4.7619% rate reduction and the Winter>1000 rate of 0.0808 represents a 12.5541% rate reduction. If these % reductions are applied to the usage profile in Attachment #2, then the sample customer in Attachment #2 would receive an estimated savings of $36.60 per month in the months of December, January and February. This represents a composite reduction of approximately 9.79% on each monthly bill. In short, if this past reduction were to be applied as calculated, the annual impact of the rate adjustment would be approximately $109.80 per typical all-electric household. I would again reiterate that the winter/summer rate schedules were abandoned in Fiscal Year 2005/06. From that point forward, all energy costs have gravitated toward a blended cost. We no longer distinguish between winter and summer rates in our tariff. Residential customers purchase energy only. There is no demand charge associated with any of our residential customers. The most recent rate study did not afford for this type of rate reduction for all- electric homes so the impact on other customers has not been calculated; however, all revenue lost from a rate reduction must be made up from other residential customers; otherwise, our revenue projections will be compromised. I also contacted DEMEC to determine if other utilities in this area provided such a program. DEMEC officials indicated that they did not have knowledge of any such programs. It is for these reasons that I again must recommend against further consideration of the request for reduced rates for all-electric homes. Should the committee continue to request such a program be implemented, then I recommend that a pilot credit program be considered as follows: 1) Homeowners must have an independent verification of the all-electric home condition by a third party. This verification will include a notarized correspondence indicating the home has been inspected and the all-electric condition has been verified by a contractor licenses to conduct business within the City of Dover.

2) Homeowners must also complete the All-Electric Home Verification Form and return it to the City of Dover by September 30 of each year. (Sample Form – Attachment #3) 3) A credit of 5% will be issued on the utility bill for usage in the months of December, January and February. The cumulative credit will be issued on the April bill. 4) This program is subject to annual review by staff and Council. I have serious concerns regarding the implementation of a pilot credit program as I believe it places an undue burden on each of the other residential customers. If there are any further questions regarding this matter, please let me know at your earliest convenience. cc: City Clerk’s Office

ATTACHMENT #3 CITY OF DOVER – OFFICE OF CITY MANAGER ALL-ELECTRIC HOME RATE CREDIT FORM TO BE RETURNED NO LATER THAN SEPTEMBER 30 Property Owner’s Name: Property Owner’s Address: Property Owner’s Telephone Number: Property Owner’s Billing Account Number: The undersigned residential electric customer(s) do hereby make application for a rate credit of 5% based on the total electrical consumption at the referenced address during the months of December, January and February for the property located at : Property Address: ___________________________________________________________________ THE APPLICANTS DO HEREBY SWEAR OR AFFIRM: 1. I am the legal owner of the property and it is used as the applicant’s primary residence. 2. That as of September 30; they reside on said property and the property is used exclusively for residential purposes; 3. That applicant understands that a credit will be applied to their April bill for the cumulative value of the credit.  APPLICANT MUST ATTACH A COPY OF THE THIRD PARTY VERIFICATION OF THE ALL- ELECTRIC HOME CONDITION SIGNED BY A CONTRACTOR LICENSED TO CONDUCT BUSINESS WITHIN THE CITY OF DOVER. Applicant Signature Date Applicant Signature Date MAIL TO: City of Dover, Attn: City Manager’s Office P.O. Box 475, Dover, DE 19903 Phone: (302) 736-7005 _______________________________________________________________________________________________ OFFICE USE ONLY APPROVED: DENIED: DATE Scott D. Koenig, P.E., City Manager

Memorandum City Manager P. O. Box 475 City Hall/ The Plaza Dover, Delaware 19903-0475 Phone: (302) 736-7026 Fax: (302) 736-4217 E-mail: skoenig@dover.de.us TO: Members of the Legislative, Finance & Administration Committee FROM: Scott D. Koenig, P.E., City Manager DATE: December 10, 2012 SUBJECT: Annual Review of Identity Theft Prevention Policy The City of Dover Privacy Committee held their annual meeting on November 14, 2012. Members attending the meeting were: Carolyn Courtney, Denise Devine, Kathy Divver, Hollie Ford, Kim Hawkins, Traci McDowell, Maretta Purnell, Tim Stump, and Andy Siegel. There were no incidents of identity theft reported during the last year. One recommendation was made to the change the frequency of meetings to “. . as necessary, if any significant issues of identity theft arise.” This change is noted in Part 9 – Administration. No other changes were recommended and the committee approved the Identity Theft Prevention Policy with the above noted change. /hf Attachments cc: Members of the Privacy Committee

CITY OF DOVER IDENTITY THEFT PREVENTION POLICY Subject: New Identity Theft Prevention Program for City of Dover Purpose: To create and implement an Identity Theft Prevention Program for the City of Dover that will identify, detect, prevent and mitigate, and update Red Flags that signal the possibility of identity theft in connection with the opening of a covered account or any existing covered account. Effective Date: November 1, 2008 Approved by Council: October 27, 2008 November 23, 2009 October 15, 2010 October 24, 2011 1

PART 1 STATEMENT OF POLICY The Fair and Accurate Credit transaction Act (the FACT Act), which amends the Fair Credit reporting Act (FCRA) established numerous requirements that provide protection for the victims of identity theft, provide more information to consumers about credit reports and credit scoring, limits sharing of information with affiliates, and protects consumer medical and other information. POLICY It is policy of the City of Dover to:  Respond to fraud and activity duty alerts.  Properly dispose of consumer report information.  Provide information to victims of identity theft.  Properly handle notice of identity theft.  Respond to any notification received from identity theft, to prevent refurbishing blocked information.  Truncate the last 5 digits of a debit or credit card.  Comply with the rules regarding sharing information with affiliates.  Provide an oral, written, or electronic notice to those who receive less favorable terms.  Provide the required notice and credit scores.  Provide the notice regarding negative information.  Take appropriate action when the utility receives a notice of discrepancy in the consumer’s address.  Comply with red flag guidelines.  Protect medical information in the utility system. The Privacy Officer, with assistance from the Privacy Committee members, is responsible for developing appropriate written procedures and internal controls to assure compliance with the act. The senior officer of each department is responsible for implementing and complying with these procedures and internal controls. 2

PART 2 DEFINITIONS Covered Account: For purposes of this Policy, the term means an account that the City of Dover offers or maintains, primarily for personal, family or household purposes, that involves or is designed to permit multiple payments or transactions and any other account that the City of Dover offers or maintains for which there is a reasonably foreseeable risk to customers or the safety and soundness of the City of Dover from identity theft, including financial, operational, compliance, reputation, or litigation risks. Identity Theft: For purposes of this Policy, the term means a fraud committed or attempted by using personal identifying information (name, social security number, etc.) of another person without authority. This fraudulent activity may include opening deposit accounts with counterfeit checks, establishing credit card accounts, establishing lines of credit, or gaining access to the victim’s accounts with the intent of depleting balances. Privacy Officer: The person appointed the responsibility to oversee the procedures of this policy including periodic assessments, at least annually, employee training, and annual reporting. Red Flag: For purposes of this Policy, the term means a pattern, practice, or specific activity that indicates the possible existence, intent, or risk of identity theft. Part 3 provides a specific description of which Red Flags are applicable to this policy. 3

PART 3 PRIVACY COMMITTEE On October 15, 2008 the Privacy Committee was formed under the leadership of the Senior City Administrator. Each representative qualifies under a “need to know” guideline. For security, only employees who have been carefully screened and/or have a successful tenure with the utility will qualify. Representation from key areas included: Title Responsibilities/ Areas of Expertise Privacy Officer - Will coordinate activities of the committee/ develop Customer Service Manager and evaluation of program. Reports to the City Manager. Supply resources to establish proactive identity theft program Assistant Finance Director Payroll, Expert in the flow of funds. Information Technology Data and Network Security – Expert in SCADA/network administration. Director Human Resources Director Personnel Information; Identity Theft Training. Records Administrator/ Expert in fraud investigation. Day to day processes in opening new accounts and monitoring activity on Customer Service Manager existing accounts; Billing & Collections. Parks & Recreation Day to day processes in opening new accounts and monitoring activity on Administrative Assistant existing accounts. Inspections/Permitting Day to day processes in opening new accounts and monitoring activity on Clerk existing accounts. Day to day processes in opening new accounts and monitoring activity on Electric existing accounts City Clerk Records Retention Updated: October 13, 2011 4

PART 4 IDENTIFICATION OF RELEVANT RED FLAGS After careful examination of our accounts, including the methods by which we open and access accounts, and our past experience with identity theft, the following events/occurrences reasonably indicate the potential for identity theft and should be considered "Red Flags" for purposes of this policy: A. Alerts, notifications, or other warnings received from consumer reporting agencies or service providers, such as fraud detections services. For the purposes of this policy the City of Dover will be utilizing TransUnion as our service provider to identify the “Red Flags” listed below: 1. A fraud or active duty alert is included with a consumer report. 2. A consumer reporting agency provides a notice of credit freeze in response to a request for a consumer report. 3. A consumer reporting agency provides a notice of address discrepancy (See Part 7). 4. A consumer report indicates a pattern of activity that is inconsistent with the history and usual pattern of activity of an applicant or customer, such as: a. A recent and significant increase in the volume of inquiries; b. An unusual number of recently established credit relationships; c. A material change in the use of credit, especially with respect to recently established credit relationships; or d. An account that was closed for cause or identified for abuse of account privileges by a financial institution or creditor. B. The presentation of suspicious documents, such as: 1. Documents provided for identification appear to have been altered or forged. 2. The photograph or physical description on the identification is not consistent with the appearance of the applicant or customer presenting the identification. 3. Other information on the identification is not consistent with information provided by the person opening a new covered account or customer presenting the identification. 4. Other information on the identification is not consistent with readily accessible information that is on file. For example, the signatures do not match the signature card on file or a recent check. 5. An application appears to have been altered or forged, or gives the appearance of having been destroyed and reassembled. C. The presentation of suspicious personal identifying information, such as a suspicious address changes: 1. Personal identifying information provided is inconsistent when compared against external information sources used by the City of Dover. For example: a. The address does not match any address in the consumer report; or b. The Social Security Number (SSN) has not been issued, or c. The Social Security Number is listed on the Social Security Administration's Death Master File. 5

2. Personal identifying information provided by the customer is not consistent with other personal identifying information provided by the customer. For example, there is a lack of correlation between the date of birth and the Social Security Number. 3. Personal identifying information provided is associated with known fraudulent activity as indicated by internal or third-party sources used by the City of Dover. For example: a. The address on an application is the same as the address provided on a fraudulent application; or b. The phone number on an application is the same as the number provided on a fraudulent application. 4. Personal identifying information provided is of a type commonly associated with fraudulent activity as indicated by internal or third-party sources used by the financial institution or creditor. For example: a. The address on an application is fictitious, a mail drop, or a prison; or the phone number is invalid, or is associated with a pager or answering service. 5. The Social Security Number provided is the same as that submitted by other persons opening an account or other customers. 6. The address or telephone number provided is the same as or similar to the account number or telephone number submitted by an unusually large number of other persons opening accounts or other customers. 7. The person opening the covered account or the customer fails to provide all required personal identifying information on an application or in response to notification that the application is incomplete. 8. Personal identifying information provided is not consistent with personal identifying information that is on file with the City of Dover. 9. If the City of Dover uses challenge questions, the person opening the covered account or the customer cannot provide authenticating information beyond that which generally would be available from a wallet or consumer report. D. The unusual use of, or other suspicious activity related to, a covered account: 1. Shortly following the notice of a change of address for a covered account, the City of Dover receives a request for adding: a. Additional properties to the account; or b. Additional authorized users on the account. 2. A new account is used in a manner commonly associated with known patterns of fraud patterns. For example: The customer fails to make the first payment or makes an initial payment but no subsequent payments. 6

3. A covered account is used in a manner that is not consistent with established patterns of activity on the account. (Stable history shows irregularities.) For example; Nonpayment when there is no history of late or missed payments. 4. A covered account that has been inactive or has had low activity for a reasonably lengthy period of time is used or unexpectedly jumps to high consumption (taking into consideration the type of account, the expected pattern of usage and other relevant factors). 5. Mail sent to the customer is returned repeatedly as undeliverable although transactions continue to be conducted in connection with the customer's covered account. 6. The City of Dover is notified that the customer is not receiving their bills. 7. The City of Dover is notified of unauthorized charges or transactions in connection with a customer's covered account. E. Notice from customers, victims of identity theft, law enforcement authorities, or other persons regarding possible identity theft in connection with covered accounts held by the City of Dover: 1. The City of Dover is notified by a customer, a victim of identity theft, a law enforcement authority, or any other person that it has opened a fraudulent account for a person engaged in identity theft. 7

PART 5 DETECTION, PREVENTION AND MITIGATION A. Detection In an effort to ensure proper detection of any Red Flags, all customers (consumers) must provide at least the following information/documentation before any new covered account will be opened: 1. Full Name; 2. Date of birth (individual); 3. Address, (a residential or business street address for an individual; for an individual who does not have a residential or business street address, an Army Post Office (APO) or Fleet Post Office (FPO) box number, or the residential or business street address of next of kin or of another contact individual; or for a person other than an individual (such as a corporation, partnership, or trust), a principal place of business, local office, or other physical location; and; 4. Identification number, which shall be: (i) For a U.S. person, a taxpayer identification number; or (ii) For a non-U.S. person, one or more of the following: a taxpayer identification number; passport number and country of issuance; alien identification card number; or number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard. For any account holder of a covered account for which the above information is not already on file at the City of Dover, the customer will be contacted within a reasonable period of time after discovering the missing information to obtain the necessary information. To assist with detection of Red Flags, the City of Dover will implement the appropriate computer programs tailored to the City of Dover business needs to help authenticate customers, monitor transactions, and change of address requests. B. Preventing and Mitigating Identity Theft In the event a Red Flag is detected, the City of Dover is committed to preventing the occurrence of identity theft and taking the appropriate steps to mitigate any harm caused thereby. In order to respond appropriately to the detection of a Red Flag, the City of Dover shall consider any aggravating circumstance(s) that may heighten the risk of identity theft. After assessing the degree of risk posed, the City of Dover will respond to the Red Flag in an appropriate manner, which may include: 1. Monitoring a covered account for evidence of identity theft; 2. Contacting the customer; 3. Changing any passwords, security codes, or other security devices that permit access to a covered account; 4. Reopening a covered account with a new account number; 5. Not opening a new covered account; 6. Closing an existing covered account; 8

7. With-holding service, 8. Not attempting to collect on a covered account or not selling a covered account to a debt collector; 9. Notifying law enforcement; or 10. Determining that no response is warranted under the particular circumstances. All incidents and resolutions shall be tracked and documented. For the protection of our customers, all service providers hired by the City of Dover to perform any activity in connection with any covered account must also take appropriate steps to prevent identity theft. To this end, the City of Dover will only contract with service providers that have implemented and follow a similar identity theft prevention policy. PART 6 TRAINING EMPLOYEES IN IDENTITY THEFT PREVENTION A. Employees to be trained Training will be provided to all employees that work with covered accounts and/or who handle sensitive personal identification information to enable them to detect, prevent and mitigate theft identity. B. Training Materials The following workbooks, which are made a part of this policy and provided in the appendix, will be used for periodic policy assessment and training tools: 1. Identity Theft Prevention Programs in American Utilities: Guidelines for Compliance with Red Flags – Employee Workbook for Safeguarding Customer Information. 2. Identity Theft Prevention Programs in American Utilities: Guidelines for Compliance with Red Flags – Employee Workbook for Safeguarding Customer Information Supervisor Edition. 9

PART 7 PROGRAM UPDATES The City of Dover is committed to maintaining an Identity Theft Prevention Policy that is current with the ever-changing crime of identity theft. To that end, the City of Dover will reassess this policy on a periodic (annual) basis. In reassessing this policy, the City of Dover will add/delete Red Flags in Part 4, as necessary, to reflect changes in risks to customers or to the safety and soundness of the City of Dover from identity theft. The determination to make changes to this policy will be within the discretion of the responsible parties, identified in Part 3 of this policy, but after careful consideration of the following: 1. The City of Dover's past experience(s) with identity theft; 2. Changes in methods of identity theft; 3. Changes in methods to detect, prevent, and mitigate identity theft; 4. Changes in the types of accounts that the City of Dover offers or maintains; and 5. Changes in the business arrangements of the City of Dover, including mergers, acquisitions, alliances, joint ventures, and service provider arrangements. PART 8 ADDITIONAL LEGAL REQUIREMENTS A. Consumer Addresses 1. Address Confirmation The City of Dover shall furnish the consumer's address that the City of Dover has reasonably confirmed is accurate to consumer reporting agencies as part of the information that the City of Dover regularly furnishes for the reporting period in which the City of Dover establishes a relationship with the consumer. In an effort to ensure that the City of Dover maintains accurate address information for its consumers and to ensure the City of Dover provides accurate address information of our consumers to reporting agencies, at least one of the following steps must be taken prior to providing the consumer's address to the consumer reporting agency: a. Verify the address on file with the consumer; b. Confirm the address being sent to the consumer reporting agency matches the address the City of Dover has on file for that particular consumer; c. Compare the address with information received from any third-party source; or d. Verify by other means that are reasonably available at the time. 2. Address Discrepancies Because the City of Dover is a user of consumer reports, at least one of the following steps must be taken when the City of Dover receives notice from any consumer reporting agency that a substantial difference exists between the address for the consumer that the City of Dover provided and the address(es) in the consumer reporting agency's file for that particular consumer: a. Compare the differing address with the City of Dover 's file, by either (1) confirming that the address information provided by the City of Dover to the consumer reporting agency is the 10

same information the City of Dover obtains and uses to verify the consumer's identity in accordance with the requirements of the Customer Information Program (CIP) rules (31 USC 5318(1) (31 CPR 103.121»; or (2) comparing the differing addresses with the City of Dover records and files, including applications, change of address notifications, other customer account records, or retained CIP documentation; or (3) comparing the differing addresses with information the City of Dover may have received from a third-party source; or b. Verify the information in the consumer report provided by the consumer reporting agency with the consumer. B. Other requirements should be addressed below based on entity type Examples: a. For financial institutions and creditors that are subject to 31 U.S.C. 5318(g), filing a Suspicious Activity Report in accordance with applicable law and regulation; b. Implementing any requirements under 15 U.S.C. 1681c-l(h)regarding the circumstances under which credit may be extended when the financial institution or creditor detects a fraud or active duty alert; c. Implementing any requirements for furnishers of information to consumer reporting agencies under 15 U.S.C. 1681s-2, for example, to correct or update inaccurate or incomplete information, and to not report information that the furnisher has reasonable cause to believe is inaccurate; and d. Complying with the prohibitions in 15 U.S.C. l681m on the sale, transfer, and placement for collection of certain debts resulting from identity theft. DISCLAIMER: There may be additional requirements, such as the examples provided above. However, the above examples are not intended to be an exhaustive list. 11

PART 9 ADMINISTRATION The Privacy Committee By signing below, (I/this) individual(s)/committee/board1 of the City of Dover acknowledges that we will be responsible for overseeing the implementation, management, and updating of this new policy and shall have the following responsibilities: 1. Assign specific responsibility for the Program's implementation, including appropriate training for staff; At least annually, The Assigned person/staff must report to the Privacy Committee and provide an update on the policy's effectiveness, any service provider arrangements, and significant incidents involving identity theft and the City of Dover's response, and recommendations for ways to improve the program. The committee shall meet, as necessary, if any significant issues of identity theft arise. 2. Review reports prepared by staff to ensure that the City of Dover remains compliant with its legal responsibility to maintain an Identity Theft Prevention Program; and 3. Approve material changes to this program as necessary to address changing identity theft risks. ____________________________________________________________ ______________________________________________ Name(s) Title ____________________________________________________________________________ Authorized Signature(s) ____________________________________________________________________________ Date ______________________________________ 1 Rules require oversight by the board of directors, an appropriate committee of the board, or a designated employee of senior management. 12

Identity Theft Prevention Program Incident Report Prepared by: Date: (Employee designated to track and record information) Committee Members: It is the policy of the City of Dover to provide an Identity Theft Prevention Program for customers and employees. The purpose of this report is to promote continued evaluation of effectiveness of current policies and procedures in compliance with the FACT Act (2003). This document will be used to drive recommendations for changes to the program due to evolving risk and methods of theft. 13

Employee Describe Incident or Mitigation Date Scope Employee Management Response Trained “Significant Event” 14