|
BILL # HB 2696 |
TITLE: critical infrastructure; foreign adversary; prohibition |
|
SPONSOR: Kupper |
STATUS: As Amended by House TI |
|
PREPARED BY: Benjamin Beutler |
|
This bill would prohibit software used for critical infrastructure in Arizona from being produced by an entity that is headquartered or controlled by a foreign adversary of the United States. The bill would limit government entities and critical infrastructure service providers use of certain electronic equipment, vendors, and contracts. The Attorney General (AG) and Arizona Commerce Authority (ACA) are given certification and publication responsibilities under the bill.
Estimated Impact
We estimate that the bill would increase state costs, but we cannot determine the total magnitude until additional state agencies respond to our requests for information. We did a fiscal analysis on a similar bill last year but did not receive any agency feedback at the time.
This year, the AG has responded with an estimated General Fund impact of $424,300 ongoing for 3 FTE Positions and $49,500 one-time for equipment costs. The AG states the cost estimate is the minimum resources necessary and could be significantly higher depending on the workload associated with the new functions under the bill. This estimate does not include any assumptions for ongoing litigation, such as expert witnesses and outside counsel. In addition, the estimate does not address the potential cost for the AG to collect certifications from critical infrastructure providers or publish a list of equipment that does not meet the bills requirements.
After an initial review, the Department of Public Safety (DPS) states that none of their telecommunications equipment or software would be in violation of the requirements in the bill, with the caveat that their analysis may change after their review is complete. DPS is still in the process of reviewing operational equipment (e.g., speed detection and camera systems) for compliance with the bill's stipulations. DPS plans to complete a full review of its technology before quantifying a cost to the department for the bill.
To the extent that existing telecommunications equipment owned by state entities would need to be replaced, the bill would generate additional one-time capital costs. Besides the AG and DPS, we have asked the Arizona Department of Administration (ADOA), Department of Military and Emergency Affairs, Department of Forestry and Fire Management, and Department of Transportation for their analysis of the fiscal impact. The agencies have not yet responded. We cannot quantify the magnitude of the fiscal impact without the agencies' responses, as we lack detailed data on agencies' use of critical communications software or hardware from the bill's prohibited entities.
The bill would generate ongoing operating costs for the ACA to track certifications required of companies that access critical infrastructure and critical communications infrastructure providers. The bill allows the ACA to charge a certification fee for companies to access critical infrastructure, which may offset some of the additional operating costs. The ACA has not yet responded to our request for the fiscal impact.
Based on information provided to our office by ADOA during the prior legislative session, our understanding is that none of the state's critical communications equipment is manufactured by a federally banned corporation. We are waiting for ADOA to clarify whether any of the state's software used for critical infrastructure is produced by a foreign adversary or state-owned Wi-Fi router or modem systems are owned by a foreign adversary.
Local Government Impact
The League of Arizona Cities and Towns and County Supervisors Association do not have the necessary data related to these functions to provide estimated costs for local governments.
2/13/25