|
REFERENCE TITLE: drones; prohibition; autonomous vehicles |
|
State of Arizona Senate Fifty-sixth Legislature Second Regular Session 2024
|
|
SB 1500 |
|
|
|
Introduced by Senator Farnsworth
|
An Act
amending title 41, chapter 41, article 2, Arizona Revised Statutes, by adding sections 41-4274 and 41-4275; relating to critical infrastructure.
(TEXT OF BILL BEGINS ON NEXT PAGE)
Be it enacted by the Legislature of the State of Arizona:
Section 1. Title 41, chapter 41, article 2, Arizona Revised Statutes, is amended by adding sections 41-4274 and 41-4275, to read:
41-4274. Drones; prohibition; research and accountability; violation; classification; penalties; definitions
A. An agency may not purchase, acquire or otherwise use a drone or any related equipment produced by either of the following:
1. A manufacturer domiciled in, owned or controlled by a country of concern.
2. A company owned by or domiciled in a country of concern.
B. Notwithstanding subsection A of this section, An agency may purchase, acquire or otherwise use a drone produced by a manufacturer domiciled in, owned or controlled by a country of concern if the drone is used by an agency in this state for research and accountability purposes only. When using a drone pursuant to this section, the agency shall weigh the goals of the research against the risk to any networks or data.
C. BEFORE An agency may use a drone pursuant to subsection B of this section, the agency shall provide written notice to the department not later than thirty days BEFORE using the drone. Each notice shall state the intended purpose of the use, the participants and any benefits of the research. The agency, on request of the department, shall provide access to any research findings.
D. A drone or the drone's software that is used by an agency shall be used in compliance with all other applicable data standards as required by law and the agency's policies and procedures and may connect to any of the following:
1. the internet, only for the PURPOSE of command and control, coordination or other communications to ground control stations or systems RELATED to the mission of the drone. If a drone connects to the internet pursuant to this PARAGRAPH, the agency shall require That the command and control, coordination or other communications to ground control stations or systems be secure, monitored and isolated from any NETWORKS in which the agency's data is held.
2. A computer or the network of an agency if both of the following apply:
(a) The drone or the drone's software is isolated in a way that prevents access to the internet and any network where the agency's data is held.
(b) The drone or the drone's software uses removable memory to connect to the computer or network that is ISOLATED in a way that prevents access to a network where the agency's data is held.
E. Any transfer of data between an isolated network described in subsection D, paragraph 2 of this section and the network where the agency's data is held requires the following:
1. An initial scan using antivirus or antimalware software for malicious code on the computer connected directly or indirectly to the drone.
2. The use of antivirus and antimalware software during a data transfer.
3. A scan of the destination of the transferred data using antivirus and antiMALWARE software for malicious code.
F. A DRONE OR THE DRONE'S SOFTWARE THAT IS USED BY AN AGENCY may not connect with a telephone, tablet or other mobile device that is issued by an agency or that connects to an agency's network.
G. In addition to the requirements of subsections D and E of this section, a tier two drone or any RELATED services or equipment shall use a federal INFORMATION process standard complaint ENCRYPTION ALGORITHM for all communications to and from the tier two drone.
H. The critical components of a tier two drone may not be produced by a MANUFACTURER domiciled in or owned or controlled by or otherwise connected to a country of concern.
I. In addition to the requirements of subsections D, E, F and G of this section, The data storage of a tier three drone shall be restricted to the geographic LOCATION of the United States. Remote access to data storage, other than open data, from outside the united states is prohibited unless approved in writing by the director of an agency or the director's designee.
J. The department, in consultation with other state, local and federal authorities, shall identify the geographic coordinates of sensitive INSTALLATIONS WITHIN this state for the purpose of prohibiting drone usage over the SENSITIVE locations.
K. Any providers of flight mapping software or other programs for operating a drone shall geofence this state's SENSITIVE locations to prevent any drones from flying over this state's SENSITIVE locations. This subsection does not apply to Drones that are used by law enforcement agencies in this state.
L. It is a class 1 MISDEMEANOR for a provider of any flight mapping software to allow a user to fly a drone over a sensitive location, unless the user is a law enforcement agency in this state.
M. It is a class 1 MISDEMEANOR for a user of a drone not using flight mapping software to fly a drone over a SENSITIVE location. This subsection does not apply to a law enforcement agency in this state or to drone users who have permission of the AUTHORITY in charge of the SENSITIVE location to operate a drone in, on or above the SENSITIVE location.
N. For the purposes of this section:
1. "AGENCY" MEANS ANY STATE, COUNTY, LOCAL OR MUNICIPAL GOVERNMENTAL ENTITY.
(a) means any of the following:
(i) CHINA.
(ii) CUBA.
(iii) IRAN.
(iv) NORTH KOREA.
(v) RUSSIA.
(vi) SAUDI ARABIA.
(vii) vENEZUELA.
(viii) sYRIA.
(b) Includes any other entity or agent under significant control of a country of concern.
3. "Critical component":
(a) Means a drone component RELATED to any of the following:
(i) Radio.
(ii) DATa transmission devices.
(iii) Cameras.
(iv) Gimbals.
(v) Ground control systems.
(vi) Operating software, including cell phone or tablet applications.
(vii) Network connectivity.
(viii) DATA storage.
(b) Does not include:
(i) passive electronics.
(ii) Resistors.
(iii) Nondata transmitting motors.
(iv) Batteries.
(v) Wiring.
(a) means systems and assets, whether physical or virtual, that are so vital to this state and the United States that the incapacity or destruction of those systems and assets would have a debilitating impact on security, economic security, public health or safety.
(b) Includes:
(i) Gas and oil production, storage or delivery systems.
(ii) Water supply refinement, storage or delivery systems.
(iii) Electrical power delivery systems.
(iv) Telecommunications networks.
(v) Transportation systems and services.
(vi) Personal data or otherwise classified information storage systems, including cybersecurity.
5. "Data" means any information, documents, media or MACHINE-READABLE material, regardless of physical form or characteristics, that is created or obtained by an agency in the course of official agency business.
6. "Drone" means an unmanned aircraft, watercraft, ground vehicle or robotic device that is controlled by a human operator or that OPERATES autonomously through computer software or other programming.
7. "Flight mapping software" means any program or ground control system that allows for users to do either of the FOLLOWING:
(a) Input a set of COORDINATES or locations to which the drone will autonomously fly in a predetermined flight pattern.
(b) Control the flight path or destination of the drone from any device other than a dedicated handheld controller within sight of the drone.
8. "Geofence" means a virtual geographic BOUNDARY that is DEFINED by the global positioning system, radio frequency identification or some other location positioning technology and that is created to prevent the use of drones within a restricted geographic area.
9. "Instructional technology" means an interactive device that is used by a school, that assists in INSTRUCTING a class or a group of students and that includes the necessary hardware and software to operate the interactive device.
10. "Open data":
(a) means data that is fully discoverable and usable by the public.
(b) Does not include data that an agency is statutorily authorized to assess a fee for its distribution or data that is restricted from public disclosure based on federal or state laws and regulations, including laws and regulations related to any of the following:
(i) privacy.
(ii) confidentiality.
(iii) security.
(iv) personal health.
(v) business.
(vi) trade secret information.
(vii) Exemptions from state public records laws.
11. "Research and ACCOUNTABILITY purposes":
(a) means research on drone hardware, operating systems, software, communications systems and protocols, components and data practices for the purpose of understanding the existence and extent of potential threats and vulnerabilities.
(b) includes research conducted at the direction of a state government agency or a federal agency, or a party contracted by a state government agency or federal agency to conduct the research.
12. "SENSITIVE location":
(a) Means any location in this state where the use of a drone is prohibited and that must be geofenced by companies that provide flight mapping software to prevent unauthorized use of drones.
(b) Includes all military locations, power stations, critical infrastructure and any other locations.
13. "Tier three drone" means a drone that collects, transmits or RECEIVES any data, including visual and auditory data.
14. "Tier two drone" means a drone that collects, transmits or RECEIVES only flight control data, excluding visual and auditory data.
41-4275. Light detection and ranging equipment; country of concern; prohibition; autonomous vehicles; definitions
A. Any new state INFRASTRUCTURE constructed in this state may not use any light detection and ranging equipment manufactured in or by a company DOMICILED in a country of concern or a company owned by a company domiciled in a country of concern.
B. Any existing state INFRASTRUCTURE in this state that is currently using any light detection and ranging equipment manufactured in or BY A COMPANY DOMICILED IN A COUNTRY OF CONCERN OR A COMPANY OWNED BY A COMPANY DOMICILED IN A COUNTRY OF CONCERN shall remove and replace the equipment within ninety days after the EFFECTIVE date of this section.
C. No procurement made by an agency or a political subdivision of this state may include any light detection and ranging equipment MANUFACTURED IN OR BY A COMPANY DOMICILED IN A COUNTRY OF CONCERN OR A COMPANY OWNED BY A COMPANY DOMICILED IN A COUNTRY OF CONCERN.
D. NOTWITHSTANDING any other law, an autonomous vehicle that includes any light detection and ranging equipment manufactured in or by a company domiciled in a country of concern may not be issued any certification, license or regulatory approval concerning the autonomous vehicle's approval, use or operation in this state.
E. For the purposes of this section:
1. "Autonomous vehicles" means any vehicle equipped with an automated driving system or hardware or software that is capable of performing part or all of the dynamic driving on a sustained basis, regardless of whether it is limited to a specific operational design domain.
2. "Country of concern" means any of the following:
(a) CHINA.
(b) CUBA.
(c) IRAN.
(d) NORTH KOREA.
(e) RUSSIA.
(f) SAUDI ARABIA.
(g) vENEZUELA.
(h) sYRIA.
3. "Domicile" means either the country where a company is registered, WHERe the company affairs are primarily completed or where the majority of ownership share is held.
4. "Light detection and ranging":
(a) means a remote sensing method that uses the emission of laser light, through pulsed lasers to detect and measure the range of surrounding objects, often for the purpose of producing real-time, high-resolution three DIRECTIONAL maps of the physical environment surrounding the device that applies the technology.
(b) Includes:
(i) automation and smart infrastructure applications.
(ii) autonomous vehicles.
(iii) drones.
(iv) port cranes.
(v) drawbridges.
(vi) traffic signals.
(vii) security systems at AIRPORTS.
(viii) Other SENSITIVE sites.
5. "State Critical infrastructure":
(a) means systems and assets, whether physical or virtual, that are so vital to this state and the United States that the incapacity or destruction of those systems and assets would have a debilitating impact on security, economic security, public health or safety.
(b) Includes:
(i) Gas and oil production, storage or delivery systems.
(ii) Water supply refinement, storage or delivery systems.
(iii) Electrical power delivery systems.
(iv) Telecommunications networks.
(v) Transportation systems and services.
(vi) Personal data or otherwise classified information storage systems, including cybersecurity.
6. "State infrastructure" means the state critical infrastructure and state transportation infrastructure.
7. "State transportation infrastructure" includes all the following:
(a) Airports, including COMMERCIAL and intermodal airports and heliports.
(b) Roadways, including PUBLICLY accessible streets, roads, highways, BRIDGES, signage, tollbooths, weigh stations and traffic signals.
(c) Railways, including all classes of freight rails and PASSENGER rail.
(d) Ports, including inland ports, deepwater ports, inland waterways and levees and all port infrastructure.
(e) Public transit, including buses, ferries, cable cars, trollies and any other TYPES of publicly accessible transportation.