|
REFERENCE TITLE: critical Infrastructure; foreign adversary; prohibition |
|
State of Arizona House of Representatives Fifty-seventh Legislature First Regular Session 2025
|
|
HB 2696 |
|
|
|
Introduced by Representatives Kupper: Blackman, Carbone, Gress, Heap, Marshall
|
An Act
amending title 18, chapter 1, article 1, Arizona Revised Statutes, by adding section 18-105; amending title 41, chapter 1, article 5, Arizona Revised Statutes, by adding sections 41-197 and 41-197.01; amending title 44, Arizona Revised Statutes, by adding chapter 42; relating to critical infrastructure.
(TEXT OF BILL BEGINS ON NEXT PAGE)
Be it enacted by the Legislature of the State of Arizona:
Section 1. Title 18, chapter 1, article 1, Arizona Revised Statutes, is amended by adding section 18-105, to read:
18-105. Software; critical infrastructure; critical communications infrastructure; annual list; definitions
A. any software that is used for critical INFRASTRUCTURE in this state may not be produced by a company that is headquartered in a foreign adversary or that is under the control of a foreign adversary.
B. Any critical communications INFRASTRUCTURE within this state may not include any equipment that is manufactured by a federally banned corporation.
C. Any equipment of critical communications INFRASTRUCTURE in this state that is currently manufactured by a federally banned corporation shall be replaced with equipment that is manufactured in the united states.
D. Any communications provider that REMOVEs, discontinues or replaces any communications EQUIPMENT that is prohibited by this section is not required to obtain an additional permit from any state agency or political subdivision of this state for the removal, DISCONTINUANCE or replacement of the prohibited EQUIPMENT.
1. The VENDOR is owned by the government of a FOREIGN adversary.
2. The government of a FOREIGN adversary has a controlling interest in the vendor.
3. The vendor is selling a product that is produced by the government of a foreign adversary, a company domiciled in a foreign adversary or a company owned or controlled by a company domiciled in a foreign adversary.
F. Each critical INFRASTRUCTURE service provider in this state shall certify to the attorney general that the provider does not use any wi-fi router or modem that is produced by any of the following:
1. A company that is owned by the government of a foreign adversary.
2. A company in which a foreign adversary has a controlling interest.
3. The GOVERNMENT OF A FOREIGN ADVERSARY, A COMPANY DOMICILED IN A FOREIGN ADVERSARY OR A COMPANY OWNED OR CONTROLLED BY A COMPANY DOMICILED IN A FOREIGN ADVERSARY.
G. On or before December 31, 2025, and each year thereafter, the attorney general shall publish a list of all wi-fi routers and modems that are prohibited pursuant to this section and shall post the list on the attorney general's website.
H. FOR THE PURPOSES OF THIS SECTION:
1. "COMPANY" MEANS:
(a) A SOLE PROPRIETORSHIP, ORGANIZATION, ASSOCIATION, CORPORATION, PARTNERSHIP, JOINT VENTURE, LIMITED PARTNERSHIP, LIMITED LIABILITY PARTNERSHIP OR LIMITED LIABILITY COMPANY, INCLUDING A WHOLLY OWNED SUBSIDIARY, MAJORITY-OWNED SUBSIDIARY, PARENT COMPANY OR AFFILIATE OF THOSE ENTITIES OR BUSINESS ASSOCIATIONS, THAT EXISTS TO MAKE A PROFIT.
(b) A nonprofit organization.
2. "Critical communications INFRASTRUCTURE" means all physical broadband infrastructure and equipment that supports the transmission of information and that allows the user to ENGAGE in communications, including service provided directly to the public.
3. "CRITICAL INFRASTRUCTURE":
(a) MEANS SYSTEMS AND ASSETS, WHETHER publicly or privately owned and whether PHYSICAL OR VIRTUAL, THAT ARE SO VITAL TO THIS STATE AND THE UNITED STATES THAT THE INCAPACITY OR DESTRUCTION OF THOSE SYSTEMS AND ASSETS WOULD HAVE A DEBILITATING IMPACT ON SECURITY, ECONOMIC SECURITY or public hEALTH OR SAFETY.
(b) INCLUDES:
(i) GAS AND OIL PRODUCTION, STORAGE OR DELIVERY SYSTEMS.
(ii) WATER SUPPLY REFINEMENT, STORAGE OR DELIVERY SYSTEMS.
(iii) ELECTRICAL POWER DELIVERY SYSTEMS.
(iv) TELECOMMUNICATIONS NETWORKS.
(v) TRANSPORTATION SYSTEMS AND SERVICES.
(vi) PERSONAL DATA OR OTHERWISE CLASSIFIED INFORMATION STORAGE SYSTEMS, INCLUDING CYBERSECURITY.
(vii) Emergency services.
4. "Domiciled" means located in a country where either the company is registered, the company's affairs are primarily completed or the majority of the company's ownership shares are held.
5. "Federally Banned Corporation" means any company that is banned by the Federal communications commission.
6. "foreign ADVERSARY" means a country that is determined to be a foreign adversary pursuant to 15 code of federal regulations section 791.4.
Sec. 2. Title 41, chapter 1, article 5, Arizona Revised Statutes, is amended by adding sections 41-197 and 41-197.01, to read:
41-197. Critical infrastructure; sale, transfer or investment; attorney general; injunction; judicial denial of sale, transfer or investment; definitions
A. An owner of critical INFRASTRUCTURE in this state shall notify the attorney general of any proposed sale to, transfer of ownership to or investment in critical infrastructure by a foreign adversary or an entity domiciled outside of the united states. The attorney general shall INVESTIGATE the sale, transfer of ownership or investment in the critical INFRASTRUCTURE within thirty days after RECEIVING the notice provided pursuant to this subsection. If the attorney general finds that the proposed sale, transfer or investment threatens the SECURITY of critical INFRASTRUCTURE in this state, the economic SECURITY of this state or the public health or safety, the attorney general shall file a request for an injunction opposing the proposed sale, transfer or investment.
B. If a court of competent jurisdiction finds that the sale, transfer of ownership or investment in the critical infrastructure pursuant to subsection A of this section poses a reasonable threat to this state, the court shall deny the proposed sale, transfer or investment.
C. FOR THE PURPOSES OF THIS SECTION:
1. "CRITICAL INFRASTRUCTURE":
(a) MEANS SYSTEMS AND ASSETS, WHETHER publicly or privately owned and whether PHYSICAL OR VIRTUAL, THAT ARE SO VITAL TO THIS STATE AND THE UNITED STATES THAT THE INCAPACITY OR DESTRUCTION OF THOSE SYSTEMS AND ASSETS WOULD HAVE A DEBILITATING IMPACT ON SECURITY, ECONOMIC SECURITY or PUBLIC HEALTH OR SAFETY.
(b) INCLUDES:
(i) GAS AND OIL PRODUCTION, STORAGE OR DELIVERY SYSTEMS.
(ii) WATER SUPPLY REFINEMENT, STORAGE OR DELIVERY SYSTEMS.
(iii) ELECTRICAL POWER DELIVERY SYSTEMS.
(iv) TELECOMMUNICATIONS NETWORKS.
(v) TRANSPORTATION SYSTEMS AND SERVICES.
(vi) PERSONAL DATA OR OTHERWISE CLASSIFIED INFORMATION STORAGE SYSTEMS, INCLUDING CYBERSECURITY.
(vii) Emergency services.
2. "Domiciled" means located in a country where either the entity is registered, the entity's affairs are primarily completed or the majority of the entity's ownership shares are held.
3. "foreign ADVERSARY" means a country that is determined to be a foreign adversary pursuant to 15 code of federal regulations section 791.4.
197-01. Governmental entities; prohibited vendors; traffic cameras; light detection and ranging technology; annual list; definitions
A. a governmental entity in this state may not enter into or renew a contract with a vendor of a school bus infraction detection system, a speed detection system, a traffic infraction detector or any other vendor of camera equipment used for enforcing traffic laws in this state if any of the following applies:
1. The VENDOR is owned by the government of a FOREIGN adversary.
2. The government of a FOREIGN adversary has a controlling interest in the vendor.
3. The vendor is selling a product that is produced by the government of a foreign adversary, a company domiciled in a foreign adversary or a company owned or controlled by a company domiciled in a foreign adversary.
B. a governmental entity in this state may not enter into or renew a contract with a light detection and RANGING TECHNOLOGY vendor if any of the following applies:
1. The VENDOR is owned by the government of a FOREIGN adversary.
2. The government of a FOREIGN adversary has a controlling interest in the vendor.
3. The vendor is selling a product that is produced by the government of a foreign adversary, a company domiciled in a foreign adversary or a company owned or controlled by a company domiciled in a foreign adversary.
C. On or before December 31, 2025 and each year thereafter, the attorney general shall publish a list of all traffic camera vendors and light detection and ranging technology vendors that are prohibited pursuant to this section and shall post the list on the attorney general's website.
D. FOR THE PURPOSES OF THIS SECTION:
1. "Company" means:
(a) A SOLE PROPRIETORSHIP, ORGANIZATION, ASSOCIATION, CORPORATION, PARTNERSHIP, JOINT VENTURE, LIMITED PARTNERSHIP, LIMITED LIABILITY PARTNERSHIP OR LIMITED LIABILITY COMPANY, INCLUDING A WHOLLY OWNED SUBSIDIARY, MAJORITY-OWNED SUBSIDIARY, PARENT COMPANY OR AFFILIATE OF THOSE ENTITIES OR BUSINESS ASSOCIATIONS, THAT EXISTS TO MAKE A PROFIT.
(b) A nonprofit organization.
2. "Domiciled" means located in a country where the company is registered, the company's affairs are primarily completed or the majority of the company's ownership shares are held.
3. "foreign ADVERSARY" means a country that is determined to be a foreign adversary pursuant to 15 code of federal regulations section 791.4.
Sec. 3. Title 44, Arizona Revised Statutes, is amended by adding chapter 42, to read:
CHAPTER 42
CRITICAL INFRASTRUCTURE
ARTICLE 1. PROHIBITED AGREEMENTS
In this article, unless the context otherwise requires:
1. "COMPANY" MEANS:
(a) A SOLE PROPRIETORSHIP, ORGANIZATION, ASSOCIATION, CORPORATION, PARTNERSHIP, JOINT VENTURE, LIMITED PARTNERSHIP, LIMITED LIABILITY PARTNERSHIP OR LIMITED LIABILITY COMPANY, INCLUDING A WHOLLY OWNED SUBSIDIARY, MAJORITY-OWNED SUBSIDIARY, PARENT COMPANY OR AFFILIATE OF THOSE ENTITIES OR BUSINESS ASSOCIATIONS, THAT EXISTS TO MAKE A PROFIT.
(b) A nonprofit organization.
2. "CRITICAL INFRASTRUCTURE":
(a) MEANS SYSTEMS AND ASSETS, WHETHER publicly or privately owned and whether PHYSICAL OR VIRTUAL, THAT ARE SO VITAL TO THIS STATE AND THE UNITED STATES THAT THE INCAPACITY OR DESTRUCTION OF THOSE SYSTEMS AND ASSETS WOULD HAVE A DEBILITATING IMPACT ON SECURITY, ECONOMIC SECURITY or PUBLIC HEALTH OR SAFETY.
(b) INCLUDES:
(i) GAS AND OIL PRODUCTION, STORAGE OR DELIVERY SYSTEMS.
(ii) WATER SUPPLY REFINEMENT, STORAGE OR DELIVERY SYSTEMS.
(iii) ELECTRICAL POWER DELIVERY SYSTEMS.
(iv) TELECOMMUNICATIONS NETWORKS.
(v) TRANSPORTATION SYSTEMS AND SERVICES.
(vi) PERSONAL DATA OR OTHERWISE CLASSIFIED INFORMATION STORAGE SYSTEMS, INCLUDING CYBERSECURITY.
(vii) Emergency services.
3. "foreign ADVERSARY" means a country that is determined to be a foreign adversary pursuant to 15 code of federal regulations section 791.4.
4. "foreign principal" means any of the following:
(a) the government or any official of a foreign adversary or a foreign political party.
(b) a partnership, association, corporation, organization or other combination of persons organized under the laws of or having its principal place of business in a foreign adversary.
(c) Any person who is domiciled in a foreign country and who is not a citizen or lawful permanent resident of the united states.
44-8052. Critical infrastructure; prohibited agreements and contracts; exceptions; definitions
A. Except as provided in subsection B of this section, a company or A governmental entity in this state may not enter into an agreement or contract involving critical infrastructure in this state with a foreign principal from a foreign adversary if under the agreement or contract the foreign principal, DIRECTLY or remotely, would be able to access or control critical infrastructure in this state.
B. A company or a governmental entity in this state may ENTER INTO AN AGREEMENT or contract INVOLVING CRITICAL INFRASTRUCTURE IN THIS STATE WITH A FOREIGN PRINCIPAL FROM A FOREIGN ADVERSARY if any of the following applies:
1. No other reasonable option exists for addressing a need that is relevant to critical infrastructure in this state.
2. The agreement or contract is preapproved by the department of administration.
3. Not entering into the agreement would pose a greater threat to this state than the threat ASSOCIATED with entering into the agreement or contract.
Sec. 4. Short title
This act may be cited as the "Arizona Critical Infrastructure Protection Act".