HB2696 - 571R

Be it enacted by the Legislature of the State of Arizona:

Section 1. Title 18, chapter 1, article 1, Arizona Revised Statutes, is amended by adding section 18-105, to read:

START_STATUTE18-105. Software; critical infrastructure; critical communications infrastructure; annual list; definitions

A. any software that is used for critical INFRASTRUCTURE in this state may not be produced by a company that is headquartered in the people's republic of china or that is under the control of the people's republic of china.

B. Any critical communications INFRASTRUCTURE within this state may not include any equipment that is manufactured by a corporation domiciled in the people's republic of china.

C. Any equipment of critical communications INFRASTRUCTURE in this state that is currently manufactured by a corporation domiciled in the people's republic of china shall be replaced with equipment that is not manufactured by a corporation domiciled in the people's republic of china.

D. on or before january 1 of each year, If a critical communications infrastructure provider is a participant in the secure and trusted communications networks reimbursement program pursuant to 47 United states code section 1601 (P.L. 116-124, 134 stat. 158), the critical communications INFRASTRUCTURE provider shall certify to the corporation commission any instances of prohibited critical COMMUNICATIONS equipment use pursuant to subsection b of this section, along with the geographic COORDINATES of the areas served by the prohibited equipment. if the critical communications INFRASTRUCTURE provider is certified by the corporation commission, The critical communications infrastructure provider shall submit a status report to the corporation commission every quarter detailing compliance with the SECURE AND TRUSTED COMMUNICATIONS NETWORKS REIMBURSEMENT PROGRAM pursuant to this subsection. Each quarter, The corporation commission shall produce a map of this state detailing the areas that are serviced by critical communications INFRASTRUCTURE that includes equipment that is manufactured by a CORPORATION domiciled in the people's republic of china.

E. Any communications provider that REMOVEs, discontinues or replaces any communications EQUIPMENT that is prohibited by this section is not required to obtain an additional permit from any state agency or political subdivision of this state for the removal, DISCONTINUANCE or replacement of the prohibited EQUIPMENT.

F. a governmental entity or critical INFRASTRUCTURE service PROVIDER in this state may not enter into or renew a contract with a VENDOR OF Wi-fi ROUTERS, MODEM SYSTEMS, lidar technology, camera-based school bus infraction detection systemS, speed detection systemS, traffic infraction detector systemS OR any other camera systemS, BATTERY technology or smart meter TECHNOLOGY or a vendor of any other technology if any of the following applies:

1. The VENDOR is owned by the government of the people's republic of china.

2. The government of the people's republic of china has a controlling interest in the vendor.

3. The vendor is selling a product that is produced by the government of the people's republic of china or a company domiciled in the people's REPUBLIC of china.

4. The vendor's PRODUCT includes cellular internet-of-things modules from the people's REPUBLIC of china.

5. The vendor's product includes a product produced by a chinese military company Operating in the United States as identified by section 1260h of the William m. Thornberry national defense authorization act for fiscal year 2021 (P.L. 116-283; 134 stat. 3388).

G. On or before march 31, 2026 and each year thereafter, Each GOVERNMENTAL ENTITY AND critical INFRASTRUCTURE service provider in this state shall certify to the corporation COMMISSION that the provider does not use any technology that includes cellular internet-of-things modules or any wi-fi router or modem SYSTEM, lidar technology, camera-based school bus infraction detection system, speed detection system, traffic infraction detector system or any other camera system, battery technology or smart meter technology that is produced by any of the following:

1. A company that is owned by the government of the people's republic of china.

2. A company in which the people's republic of china has a controlling interest.

3. The GOVERNMENT OF the people's REPUBLIC of china or A COMPANY DOMICILED IN the people's republic of china.

H. On or before December 31, 2025 and each year thereafter, the corporation COMMISSION shall publish a list of all technologies that are prohibited pursuant to this section and shall post the list on the corporation COMMISSION'S website.

I. EXCEPT AS PROVIDED IN SUBSECTION J OF THIS SECTION, EACH GOVERNMENTAL ENTITY AND CRITICAL INFRASTRUCTURE SERVICE PROVIDER IN THIS STATE SHALL REMOVE ANY TECHNOLOGY THAT IS INCLUDED BY THE corporation COMMISSION ON THE PROHIBITED TECHNOLOGIES LIST PURSUANT TO SUBSECTION H OF THIS SECTION WITHIN NINETY DAYS after the corporation COMMISSION publishes THE LIST.

j. a government entity or critical infrastructure provider may continue to purchase and use ANY prohibited technologY PURSUANT TO THIS SECTION if all of the following apply:

1. there ARE no other reasonable providerS OF the prohibited technology.

2. the purchase or use of the prohibited technology is preapproved by the corporation commission.

3. not purchasing or using the prohibited technology would pose a greater threat to thIS state than the threat associated with the prohibited technology.

K. FOR THE PURPOSES OF THIS SECTION:

1. "Cellular internet-of-things module" means a hardware component that includes a cellular radio transceiver and that is designed to provide cellular network connectivity to an internet-of-things device.

2. "COMPANY" MEANS:

(a) A SOLE PROPRIETORSHIP, ORGANIZATION, ASSOCIATION, CORPORATION, PARTNERSHIP, JOINT VENTURE, LIMITED PARTNERSHIP, LIMITED LIABILITY PARTNERSHIP OR LIMITED LIABILITY COMPANY, INCLUDING A WHOLLY OWNED SUBSIDIARY, MAJORITY-OWNED SUBSIDIARY, PARENT COMPANY OR AFFILIATE OF THOSE ENTITIES OR BUSINESS ASSOCIATIONS, THAT EXISTS TO MAKE A PROFIT.

(b) A nonprofit organization.

3. "Critical communications INFRASTRUCTURE" means all physical broadband infrastructure and equipment that supports the transmission of information and that allows the user to ENGAGE in communications, including service provided directly to the public.

4. "CRITICAL INFRASTRUCTURE" means Infrastructure that is owned or operated by this state, a political subdivision of this state or a publicly regulated utility and that is any of the following:

(a) GAS AND OIL PRODUCTION, STORAGE OR DELIVERY SYSTEMS.

(b) WATER SUPPLY REFINEMENT, STORAGE OR DELIVERY SYSTEMS.

(d) TELECOMMUNICATIONS NETWORKS.

(e) TRANSPORTATION SYSTEMS AND SERVICES.

(f) PERSONAL DATA STORAGE SYSTEMS, INCLUDING CYBERSECURITY.

(g) Emergency services.

5. "Domiciled" means located in a country where either the company is registered, the company's affairs are primarily completed or the majority of the company's ownership shares are held.

6. "School bus infraction detection system" means an automated system installed on a school bus consisting of cameras, sensors and software designed to detect, record and document traffic violations, such as illegally passing the bus when its stop arm is extended and warning lights are activated, to enhance student safety and enforce compliance with traffic laws.END_STATUTE

Sec. 2. Title 44, Arizona Revised Statutes, is amended by adding chapter 42, to read:

CHAPTER 42

CRITICAL INFRASTRUCTURE

ARTICLE 1. PROHIBITED AGREEMENTS

START_STATUTE44-8051. Definition of critical infrastructure

In this article, unless the context otherwise requires, "CRITICAL INFRASTRUCTURE" means Infrastructure that is owned or operated by this state, a political subdivision of this state or a publicly regulated utility and that is any of the following:

1. GAS AND OIL PRODUCTION, STORAGE OR DELIVERY SYSTEMS.

2. WATER SUPPLY REFINEMENT, STORAGE OR DELIVERY SYSTEMS.

3. ELECTRICAL POWER DELIVERY SYSTEMS.

4. TELECOMMUNICATIONS NETWORKS.

5. TRANSPORTATION SYSTEMS AND SERVICES.

6. PERSONAL DATA STORAGE SYSTEMS, INCLUDING CYBERSECURITY.

7. Emergency services. END_STATUTE

START_STATUTE44-8052. Critical infrastructure; prohibited agreements and contracts; exceptions

A. Except as provided in subsection B of this section, A governmental entity or a publicly regulated utility in this state may not enter into an agreement or contract involving critical infrastructure in this state with the people's REPUBLIC of china if under the agreement or contract the people's REPUBLIC of china, DIRECTLY or remotely, would be able to access or control critical infrastructure in this state.

B. a governmental entity or a publicly regulated utility in this state may ENTER INTO AN AGREEMENT or contract INVOLVING CRITICAL INFRASTRUCTURE IN THIS STATE WITH the people's REPUBLIC of china if any of the following applies:

1. No other reasonable option exists for addressing a need that is relevant to critical infrastructure in this state.

2. The agreement or contract is preapproved by the corporation COMMISSION.

3. Not entering into the agreement would pose a greater threat to this state than the threat ASSOCIATED with entering into the agreement or contract.

c. The corporation COMMISSION shall establish a secure and dedicated communications channel for critical INFRASTRUCTURE providers and military installations across this state to connect with the corporation COMMISSION and office of the governor in the event of an emergency that damages CRITICAL COMMUNICATIONS INFRASTRUCTURE. FOR THE PURPOSES OF THIS PARAGRAPH, "CRITICAL COMMUNICATIONS INFRASTRUCTURE" HAS THE SAME MEANING PRESCRIBED IN SECTION 18-105. END_STATUTE

Sec. 3. Short title

This act may be cited as the "Arizona Critical Infrastructure Protection Act".