| 69 | | - | Be it enacted by the Legislature of the State of Arizona: Section 1. Title 18, chapter 1, article 1, Arizona Revised Statutes, is amended by adding section 18-105, to read: START_STATUTE18-105. Software; critical infrastructure; critical communications infrastructure; annual list; definitions A. any software that is used for critical INFRASTRUCTURE in this state may not be produced by a company that is headquartered in a foreign adversary or that is under the control of a foreign adversary. B. Any critical communications INFRASTRUCTURE within this state may not include any equipment that is manufactured by a federally banned corporation. C. Any equipment of critical communications INFRASTRUCTURE in this state that is currently manufactured by a federally banned corporation shall be replaced with equipment that is not manufactured by a federally banned corporation. D. on or before january 1 of each year, If a critical communications infrastructure provider is a participant in the secure and trusted communications networks reimbursement program pursuant to 47 United states code section 1601 (P.L. 116-124, 134 stat. 158), the critical communications INFRASTRUCTURE provider shall certify to the Arizona commerce authority any instances of prohibited critical COMMUNICATIONS equipment use pursuant to subsection b of this section, along with the geographic COORDINATES of the areas served by the prohibited equipment. if the critical communications INFRASTRUCTURE provider is certified by the arizona commerce authority, The critical communications infrastructure provider shall submit a status report to the Arizona commerce authority every quarter detailing compliance with the SECURE AND TRUSTED COMMUNICATIONS NETWORKS REIMBURSEMENT PROGRAM pursuant to this subsection. on or before Arizona commerce authorityif the critical communications INFRASTRUCTURE provider is certified by the arizona commerce authority, Arizona commerce authorityEach quarter, The arizona commerce authority shall produce a map of this state detailing the areas that are serviced by critical communications INFRASTRUCTURE that includes equipment that is manufactured by a federally banned CORPORATION. D. By january 1 of each year, If a critical communications infrastructure provider is a participant in the federal secure and trusted communications networks reimbursement program pursuant to 47 United states code 1601 (P.L 118-159), the provider shall certify to the ______ any instances of prohibited critical COMMUNICATIONS equipment use or services along with the geographic COORDINATES of the areas served by the prohibited equipment or services. The critical communications infrastructure provider shall submit a status report to the ______ every quarter detailing compliance with the FEDERAL SECURE AND TRUSTED COMMUNICATIONS NETWORKS REIMBURSEMENT PROGRAM pursuant to this subsection. Each quarter, The _____ shall produce a map of this state detailing the areas that are serviced by critical communications INFRASTRUCTURE manufactured by a federally banned CORPORATION. E. Any communications provider that REMOVEs, discontinues or replaces any communications EQUIPMENT that is prohibited by this section is not required to obtain an additional permit from any state agency or political subdivision of this state for the removal, DISCONTINUANCE or replacement of the prohibited EQUIPMENT. F. a governmental entity or critical INFRASTRUCTURE service PROVIDER in this state may not enter into or renew a contract with a VENDOR OF Wi-fi ROUTERS, MODEM SYSTEMS, lidar technology, school bus infraction detection systemS, speed detection systemS, traffic infraction detector systemS OR any other camera systemS, BATTERY technology or smart meter TECHNOLOGY or a vendor of any other technology[E.] [F.] a governmental entity {{or critical INFRASTRUCTURE service PROVIDER}} in this state may not enter into or renew a contract with a {{VENDOR OF}} Wi-fi {{router}}{{ROUTERS}}, [or modem system vendor] [MODEM {{SYSTEM}}{{SYSTEMS}}, lidar {{system}}{{technology, school bus infraction detection systemS, speed detection systemS, traffic infraction detector systemS OR any other camera systemS}}, {{camera system,}} BATTERY {{system}}{{technology}} or smart meter {{vendor}}{{TECHNOLOGY}} or a vendor of any other technology]or, modem system vendorMODEM SYSTEM, lidar system, camera system, BATTERY system, or smart meter vendor or a vendor of any other technology if any of the following applies: 1. The VENDOR is owned by the government of a FOREIGN adversary. 2. The government of a FOREIGN adversary has a controlling interest in the vendor. 3. The vendor is selling a product that is produced by the government of a foreign adversary, a company domiciled in a foreign adversary or a company owned or controlled by a company domiciled in a foreign adversary. 4. The vendor's PRODUCT includes cellular internet-of-things modules from a foreign adversary. 5. The vendor's product includes a product produced by a chinese military company Operating in the United States as identified by section 1260h of the William m. Thornberry national defense authorization act for fiscal year 2021 (P.L. 116-283; 134 stat. 3388). Operating in the United States as identified by section 1260h of the William m. Thornberry national defense authorization act for fiscal year 2021 (P.L. 116-283; 134 stat. 3388).4. The vendor's PRODUCT includes cellular internet of things modules from a foreign adversary. 5. The vendor's product includes a product produced by a chinese military company. G. On or before march 31, 2026 and each year thereafter, Each GOVERNMENTAL ENTITY AND critical INFRASTRUCTURE service provider in this state shall certify to the attorney general that the provider does not use any technology that includes cellular internet-of-things modules or any wi-fi router or modem SYSTEM, lidar technology, school bus infraction detection system, speed detection system, traffic infraction detector system or any other camera system, battery technology or smart meter technology{{wi-fi router or modem}}{{technology that includes cellular internet-of-things modules or any wi-fi router or modem SYSTEM, lidar technology, school bus infraction detection system, speed detection system, traffic infraction detector system or any other camera system, battery technology or smart meter technology}} that is produced by any of the following: 1. A company that is owned by the government of a foreign adversary. 2. A company in which a foreign adversary has a controlling interest. 3. The GOVERNMENT OF A FOREIGN ADVERSARY, A COMPANY DOMICILED IN A FOREIGN ADVERSARY OR A COMPANY OWNED OR CONTROLLED BY A COMPANY DOMICILED IN A FOREIGN ADVERSARY. H. On or before December 31, 2025 , and each year thereafter, the attorney general shall publish a list of all technologies that are prohibited pursuant to this section and shall post the list on the attorney general's website. I. EXCEPT AS PROVIDED IN SUBSECTION J OF THIS SECTION, EACH GOVERNMENTAL ENTITY AND CRITICAL INFRASTRUCTURE SERVICE PROVIDER IN THIS STATE SHALL REMOVE ANY TECHNOLOGY THAT IS INCLUDED BY THE ATTORNEY GENERAL ON THE PROHIBITED TECHNOLOGIES LIST PURSUANT TO SUBSECTION H OF THIS SECTION WITHIN NINETY DAYS after the attorney general publishes THE LIST. j. a government entity or critical infrastructure provider may continue to purchase and use ANY prohibited technologY PURSUANT TO THIS SECTION if all of the following apply: 1. there ARE no other reasonable providerS OF the prohibited technology. 2. the purchase or use of the prohibited technology is preapproved by the ARIZONA commerce authority. 3. not purchasing or using the prohibited technology would pose a greater threat to thIS state than the threat associated with the prohibited technology. K.{{I. EXCEPT AS PROVIDED IN SUBSECTION J OF THIS SECTION, EACH GOVERNMENTAL ENTITY AND CRITICAL INFRASTRUCTURE SERVICE PROVIDER IN THIS STATE SHALL REMOVE ANY TECHNOLOGY THAT IS INCLUDED BY THE ATTORNEY GENERAL ON THE PROHIBITED TECHNOLOGIES LIST PURSUANT TO SUBSECTION H OF THIS SECTION WITHIN NINETY DAYS OF THE PUBLISHINGafter the attorney general publishes THE LIST.}} j. a government entity or critical infrastructure provider may continue to purchase and use ANY prohibited technologY PURSUANT TO THIS SECTION if all of the following apply: 1. there ARE no other reasonable providerS OF the prohibited technology. 2. the purchase or use of the prohibited technology is preapproved by the ARIZONA commerce authority. 3. not purchasing or using the prohibited technology would pose a greater threat to thIS state than the threat associated with the prohibited technology.}} [H.] {{[I.]}}{{K.}} FOR THE PURPOSES OF THIS SECTION: 1. "COMPANY" MEANS: (a) A SOLE PROPRIETORSHIP, ORGANIZATION, ASSOCIATION, CORPORATION, PARTNERSHIP, JOINT VENTURE, LIMITED PARTNERSHIP, LIMITED LIABILITY PARTNERSHIP OR LIMITED LIABILITY COMPANY, INCLUDING A WHOLLY OWNED SUBSIDIARY, MAJORITY-OWNED SUBSIDIARY, PARENT COMPANY OR AFFILIATE OF THOSE ENTITIES OR BUSINESS ASSOCIATIONS, THAT EXISTS TO MAKE A PROFIT. (b) A nonprofit organization. 2. "Critical communications INFRASTRUCTURE" means all physical broadband infrastructure and equipment that supports the transmission of information and that allows the user to ENGAGE in communications, including service provided directly to the public. 3. "CRITICAL INFRASTRUCTURE": (a) MEANS SYSTEMS AND ASSETS, WHETHER publicly or privately owned and whether PHYSICAL OR VIRTUAL, THAT ARE SO VITAL TO THIS STATE AND THE UNITED STATES THAT THE INCAPACITY OR DESTRUCTION OF THOSE SYSTEMS AND ASSETS WOULD HAVE A DEBILITATING IMPACT ON SECURITY, ECONOMIC SECURITY or public hEALTH OR SAFETY. (b) INCLUDES: (i) GAS AND OIL PRODUCTION, STORAGE OR DELIVERY SYSTEMS. (ii) WATER SUPPLY REFINEMENT, STORAGE OR DELIVERY SYSTEMS. (iii) ELECTRICAL POWER DELIVERY SYSTEMS. (iv) TELECOMMUNICATIONS NETWORKS. (v) TRANSPORTATION SYSTEMS AND SERVICES. (vi) PERSONAL DATA OR OTHERWISE CLASSIFIED INFORMATION STORAGE SYSTEMS, INCLUDING CYBERSECURITY. (vii) Emergency services. 4. "Domiciled" means located in a country where either the company is registered, the company's affairs are primarily completed or the majority of the company's ownership shares are held. 5. "Federally Banned Corporation" means any company that is banned by the Federal communications commission. 6. "foreign ADVERSARY" means a country that is determined to be a foreign adversary pursuant to 15 code of federal regulations section 791.4. END_STATUTE Sec. 2. Title 41, chapter 1, article 5, Arizona Revised Statutes, is amended by adding section 41-197, to read: START_STATUTE41-197. Critical infrastructure; sale, transfer or investment; attorney general; injunction; judicial denial of sale, transfer or investment; definitions A. An owner of critical INFRASTRUCTURE in this state shall notify the attorney general of any proposed sale to, transfer of ownership to or investment in critical infrastructure by a foreign adversary or an entity domiciled outside of the united states. The attorney general shall INVESTIGATE the sale, transfer of ownership or investment in the critical INFRASTRUCTURE within thirty days after RECEIVING the notice provided pursuant to this subsection. If the attorney general finds that the proposed sale, transfer or investment threatens the SECURITY of critical INFRASTRUCTURE in this state, the economic SECURITY of this state or the public health or safety, the attorney general shall file a request for an injunction opposing the proposed sale, transfer or investment. B. If a court of competent jurisdiction finds that the sale, transfer of ownership or investment in the critical infrastructure pursuant to subsection A of this section poses a reasonable threat to this state, the court shall deny the proposed sale, transfer or investment. C. FOR THE PURPOSES OF THIS SECTION: 1. "CRITICAL INFRASTRUCTURE": (a) MEANS SYSTEMS AND ASSETS, WHETHER publicly or privately owned and whether PHYSICAL OR VIRTUAL, THAT ARE SO VITAL TO THIS STATE AND THE UNITED STATES THAT THE INCAPACITY OR DESTRUCTION OF THOSE SYSTEMS AND ASSETS WOULD HAVE A DEBILITATING IMPACT ON SECURITY, ECONOMIC SECURITY or PUBLIC HEALTH OR SAFETY. (b) INCLUDES: (i) GAS AND OIL PRODUCTION, STORAGE OR DELIVERY SYSTEMS. (ii) WATER SUPPLY REFINEMENT, STORAGE OR DELIVERY SYSTEMS. (iii) ELECTRICAL POWER DELIVERY SYSTEMS. (iv) TELECOMMUNICATIONS NETWORKS. (v) TRANSPORTATION SYSTEMS AND SERVICES. (vi) PERSONAL DATA OR OTHERWISE CLASSIFIED INFORMATION STORAGE SYSTEMS, INCLUDING CYBERSECURITY. (vii) Emergency services. 2. "Domiciled" means located in a country where either the entity is registered, the entity's affairs are primarily completed or the majority of the entity's ownership shares are held. 3. "foreign ADVERSARY" means a country that is determined to be a foreign adversary pursuant to 15 code of federal regulations section 791.4. END_STATUTE Sec. 3. Title 44, Arizona Revised Statutes, is amended by adding chapter 42, to read: CHAPTER 42 CRITICAL INFRASTRUCTURE ARTICLE 1. PROHIBITED AGREEMENTS START_STATUTE44-8051. Definitions In this article, unless the context otherwise requires: 1. "COMPANY" MEANS: (a) A SOLE PROPRIETORSHIP, ORGANIZATION, ASSOCIATION, CORPORATION, PARTNERSHIP, JOINT VENTURE, LIMITED PARTNERSHIP, LIMITED LIABILITY PARTNERSHIP OR LIMITED LIABILITY COMPANY, INCLUDING A WHOLLY OWNED SUBSIDIARY, MAJORITY-OWNED SUBSIDIARY, PARENT COMPANY OR AFFILIATE OF THOSE ENTITIES OR BUSINESS ASSOCIATIONS, THAT EXISTS TO MAKE A PROFIT. (b) A nonprofit organization. 2. "CRITICAL INFRASTRUCTURE": (a) MEANS SYSTEMS AND ASSETS, WHETHER publicly or privately owned and whether PHYSICAL OR VIRTUAL, THAT ARE SO VITAL TO THIS STATE AND THE UNITED STATES THAT THE INCAPACITY OR DESTRUCTION OF THOSE SYSTEMS AND ASSETS WOULD HAVE A DEBILITATING IMPACT ON SECURITY, ECONOMIC SECURITY or PUBLIC HEALTH OR SAFETY. (b) INCLUDES: (i) GAS AND OIL PRODUCTION, STORAGE OR DELIVERY SYSTEMS. (ii) WATER SUPPLY REFINEMENT, STORAGE OR DELIVERY SYSTEMS. (iii) ELECTRICAL POWER DELIVERY SYSTEMS. (iv) TELECOMMUNICATIONS NETWORKS. (v) TRANSPORTATION SYSTEMS AND SERVICES. (vi) PERSONAL DATA OR OTHERWISE CLASSIFIED INFORMATION STORAGE SYSTEMS, INCLUDING CYBERSECURITY. (vii) Emergency services. 3. "foreign ADVERSARY" means a country that is determined to be a foreign adversary pursuant to 15 code of federal regulations section 791.4. 4. "foreign principal" means any of the following: (a) the government or any official of a foreign adversary or a foreign political party. (b) a partnership, association, corporation, organization or other combination of persons organized under the laws of or having its principal place of business in a foreign adversary. (c) Any person who is domiciled in a foreign country and who is not a citizen or lawful permanent resident of the united states. END_STATUTE START_STATUTE44-8052. Critical infrastructure; prohibited agreements and contracts; exceptions; access; certification forms; fee A. Except as provided in subsection B of this section, a company or A governmental entity in this state may not enter into an agreement or contract involving critical infrastructure in this state with a foreign principal from a foreign adversary if under the agreement or contract the foreign principal, DIRECTLY or remotely, would be able to access or control critical infrastructure in this state. B. A company or a governmental entity in this state may ENTER INTO AN AGREEMENT or contract INVOLVING CRITICAL INFRASTRUCTURE IN THIS STATE WITH A FOREIGN PRINCIPAL FROM A FOREIGN ADVERSARY if any of the following applies: 1. No other reasonable option exists for addressing a need that is relevant to critical infrastructure in this state. 2. The agreement or contract is preapproved by the department of administration. 3. Not entering into the agreement would pose a greater threat to this state than the threat ASSOCIATED with entering into the agreement or contract. C. In order to access critical INFRASTRUCTURE in this state, a company shall file a certification form prescribed by the Arizona commerce authority and pay a certification fee. D. To maintain registration as a company with access to critical INFRASTRUCTURE in this state, a company may NOT USE CLOUD SERVICE PROVIDERS OR DATA CENTERS THAT ARE FOREIGN ENTITIES and shall do all of the following: 1. Identify all employees OF THE COMPANY who have access to critical INFRASTRUCTURE in this state. 2. Before hiring an employee or before allowing an employee to continue to have access to critical INFRASTRUCTURE in this state, obtain from a private entity any criminal history recordS INFORMATION relating to the employee and any other background information necessary to protect critical INFRASTRUCTURE in this state from infiltration or interference by a foreign adversary. 3. Prohibit foreign nationals from a FOREIGN adversary from ACCESSING any critical INFRASTRUCTURE. 4. DISCLOSE any ownership of, partnerships with or control from any entity that is not domiciled in the united states. 5. Store and process all data generated by critical INFRASTRUCTURE on domestic servers. 6. Immediately report any cyberattack, security breach or suspicious activity to the Arizona commerce AUTHORITY. E. The Arizona commerce AUTHORITY shall establish a secure and dedicated communications channel for critical INFRASTRUCTURE providers and military installations across this state to connect with the Arizona commerce authority and office of the governor in the event of an emergency that damages CRITICAL COMMUNICATIONS INFRASTRUCTURE. FOR THE PURPOSES OF THIS PARAGRAPH, "CRITICAL COMMUNICATIONS INFRASTRUCTURE" HAS THE SAME MEANING PRESCRIBED IN SECTION 18-105.that damages CRITICAL COMMUNICATIONS INFRASTRUCTURE. FOR THE PURPOSES OF THIS PARAGRAPH, "CRITICAL COMMUNICATIONS INFRASTRUCTURE" HAS THE SAME MEANING PRESCRIBED IN SECTION 18-105. END_STATUTE4. DISCLOSE any ownership of, partnerships with or control from any entity that is not domiciled in the united states. 5. Store and process all data generated by critical INFRASTRUCTURE on domestic servers. 6. Not use cloud service providers or data centers that are foreign entities. 7. Immediately report any cyberattack, security breach or suspicious activity to the _____. E. The _____ shall establish a secure and dedicated communications channel for critical INFRASTRUCTURE providers and military installations across this state to connect with the ______ and office of the governor in the event of an emergency that damages communications critical INFRASTRUCTURE.C. In order to access critical INFRASTRUCTURE, a company shall file a certification form with and pay a certification fee to the _____. The _______ shall prescribe the registration form to be filed pursuant to this section. D. To maintain registration as a company with access to critical INFRASTRUCTURE in this state, a company shall do all of the following: 1. Identify all employee positions that have access to critical INFRASTRUCTURE. 2. Before hiring an employee or before allowing an employee to continue to have access to critical INFRASTRUCTURE, obtain from the department of public safety or a private entity, any criminal history records relating to the employee and any other background information considered necessary to protect critical INFRASTRUCTURE in this state from infiltration or interference by a foreign adversary. 3. Prohibit foreign nationals from an adversary nation from ACCESSING any critical INFRASTRUCTURE. 4. D 4. in order to access critical INFRASTRUCTURE, a company shall file a certification form with and pay a certification fee to the ___. The____ shall prescribe the registration form to be filed pursuant to this section. Sec. 4. Short title This act may be cited as the "Arizona Critical Infrastructure Protection Act". |
|---|
| 80 | + | Be it enacted by the Legislature of the State of Arizona: Section 1. Title 18, chapter 1, article 1, Arizona Revised Statutes, is amended by adding section 18-105, to read: START_STATUTE18-105. Software; critical infrastructure; critical communications infrastructure; annual list; definitions A. any software that is used for critical INFRASTRUCTURE in this state may not be produced by a company that is headquartered in a foreign adversary or that is under the control of a foreign adversary. B. Any critical communications INFRASTRUCTURE within this state may not include any equipment that is manufactured by a federally banned corporation. C. Any equipment of critical communications INFRASTRUCTURE in this state that is currently manufactured by a federally banned corporation shall be replaced with equipment that is manufactured in the united states. D. Any communications provider that REMOVEs, discontinues or replaces any communications EQUIPMENT that is prohibited by this section is not required to obtain an additional permit from any state agency or political subdivision of this state for the removal, DISCONTINUANCE or replacement of the prohibited EQUIPMENT. E. a governmental entity in this state may not enter into or renew a contract with a Wi-fi router or modem system vendor if any of the following applies: 1. The VENDOR is owned by the government of a FOREIGN adversary. 2. The government of a FOREIGN adversary has a controlling interest in the vendor. 3. The vendor is selling a product that is produced by the government of a foreign adversary, a company domiciled in a foreign adversary or a company owned or controlled by a company domiciled in a foreign adversary. F. Each critical INFRASTRUCTURE service provider in this state shall certify to the attorney general that the provider does not use any wi-fi router or modem that is produced by any of the following: 1. A company that is owned by the government of a foreign adversary. 2. A company in which a foreign adversary has a controlling interest. 3. The GOVERNMENT OF A FOREIGN ADVERSARY, A COMPANY DOMICILED IN A FOREIGN ADVERSARY OR A COMPANY OWNED OR CONTROLLED BY A COMPANY DOMICILED IN A FOREIGN ADVERSARY. G. On or before December 31, 2025, and each year thereafter, the attorney general shall publish a list of all wi-fi routers and modems that are prohibited pursuant to this section and shall post the list on the attorney general's website. H. FOR THE PURPOSES OF THIS SECTION: 1. "COMPANY" MEANS: (a) A SOLE PROPRIETORSHIP, ORGANIZATION, ASSOCIATION, CORPORATION, PARTNERSHIP, JOINT VENTURE, LIMITED PARTNERSHIP, LIMITED LIABILITY PARTNERSHIP OR LIMITED LIABILITY COMPANY, INCLUDING A WHOLLY OWNED SUBSIDIARY, MAJORITY-OWNED SUBSIDIARY, PARENT COMPANY OR AFFILIATE OF THOSE ENTITIES OR BUSINESS ASSOCIATIONS, THAT EXISTS TO MAKE A PROFIT. (b) A nonprofit organization. 2. "Critical communications INFRASTRUCTURE" means all physical broadband infrastructure and equipment that supports the transmission of information and that allows the user to ENGAGE in communications, including service provided directly to the public. 3. "CRITICAL INFRASTRUCTURE": (a) MEANS SYSTEMS AND ASSETS, WHETHER publicly or privately owned and whether PHYSICAL OR VIRTUAL, THAT ARE SO VITAL TO THIS STATE AND THE UNITED STATES THAT THE INCAPACITY OR DESTRUCTION OF THOSE SYSTEMS AND ASSETS WOULD HAVE A DEBILITATING IMPACT ON SECURITY, ECONOMIC SECURITY or public hEALTH OR SAFETY. (b) INCLUDES: (i) GAS AND OIL PRODUCTION, STORAGE OR DELIVERY SYSTEMS. (ii) WATER SUPPLY REFINEMENT, STORAGE OR DELIVERY SYSTEMS. (iii) ELECTRICAL POWER DELIVERY SYSTEMS. (iv) TELECOMMUNICATIONS NETWORKS. (v) TRANSPORTATION SYSTEMS AND SERVICES. (vi) PERSONAL DATA OR OTHERWISE CLASSIFIED INFORMATION STORAGE SYSTEMS, INCLUDING CYBERSECURITY. (vii) Emergency services. 4. "Domiciled" means located in a country where either the company is registered, the company's affairs are primarily completed or the majority of the company's ownership shares are held. 5. "Federally Banned Corporation" means any company that is banned by the Federal communications commission. 6. "foreign ADVERSARY" means a country that is determined to be a foreign adversary pursuant to 15 code of federal regulations section 791.4. END_STATUTE Sec. 2. Title 41, chapter 1, article 5, Arizona Revised Statutes, is amended by adding sections 41-197 and 41-197.01, to read: START_STATUTE41-197. Critical infrastructure; sale, transfer or investment; attorney general; injunction; judicial denial of sale, transfer or investment; definitions A. An owner of critical INFRASTRUCTURE in this state shall notify the attorney general of any proposed sale to, transfer of ownership to or investment in critical infrastructure by a foreign adversary or an entity domiciled outside of the united states. The attorney general shall INVESTIGATE the sale, transfer of ownership or investment in the critical INFRASTRUCTURE within thirty days after RECEIVING the notice provided pursuant to this subsection. If the attorney general finds that the proposed sale, transfer or investment threatens the SECURITY of critical INFRASTRUCTURE in this state, the economic SECURITY of this state or the public health or safety, the attorney general shall file a request for an injunction opposing the proposed sale, transfer or investment. B. If a court of competent jurisdiction finds that the sale, transfer of ownership or investment in the critical infrastructure pursuant to subsection A of this section poses a reasonable threat to this state, the court shall deny the proposed sale, transfer or investment. C. FOR THE PURPOSES OF THIS SECTION: 1. "CRITICAL INFRASTRUCTURE": (a) MEANS SYSTEMS AND ASSETS, WHETHER publicly or privately owned and whether PHYSICAL OR VIRTUAL, THAT ARE SO VITAL TO THIS STATE AND THE UNITED STATES THAT THE INCAPACITY OR DESTRUCTION OF THOSE SYSTEMS AND ASSETS WOULD HAVE A DEBILITATING IMPACT ON SECURITY, ECONOMIC SECURITY or PUBLIC HEALTH OR SAFETY. (b) INCLUDES: (i) GAS AND OIL PRODUCTION, STORAGE OR DELIVERY SYSTEMS. (ii) WATER SUPPLY REFINEMENT, STORAGE OR DELIVERY SYSTEMS. (iii) ELECTRICAL POWER DELIVERY SYSTEMS. (iv) TELECOMMUNICATIONS NETWORKS. (v) TRANSPORTATION SYSTEMS AND SERVICES. (vi) PERSONAL DATA OR OTHERWISE CLASSIFIED INFORMATION STORAGE SYSTEMS, INCLUDING CYBERSECURITY. (vii) Emergency services. 2. "Domiciled" means located in a country where either the entity is registered, the entity's affairs are primarily completed or the majority of the entity's ownership shares are held. 3. "foreign ADVERSARY" means a country that is determined to be a foreign adversary pursuant to 15 code of federal regulations section 791.4. END_STATUTE START_STATUTE197-01. Governmental entities; prohibited vendors; traffic cameras; light detection and ranging technology; annual list; definitions A. a governmental entity in this state may not enter into or renew a contract with a vendor of a school bus infraction detection system, a speed detection system, a traffic infraction detector or any other vendor of camera equipment used for enforcing traffic laws in this state if any of the following applies: 1. The VENDOR is owned by the government of a FOREIGN adversary. 2. The government of a FOREIGN adversary has a controlling interest in the vendor. 3. The vendor is selling a product that is produced by the government of a foreign adversary, a company domiciled in a foreign adversary or a company owned or controlled by a company domiciled in a foreign adversary. B. a governmental entity in this state may not enter into or renew a contract with a light detection and RANGING TECHNOLOGY vendor if any of the following applies: 1. The VENDOR is owned by the government of a FOREIGN adversary. 2. The government of a FOREIGN adversary has a controlling interest in the vendor. 3. The vendor is selling a product that is produced by the government of a foreign adversary, a company domiciled in a foreign adversary or a company owned or controlled by a company domiciled in a foreign adversary. C. On or before December 31, 2025 and each year thereafter, the attorney general shall publish a list of all traffic camera vendors and light detection and ranging technology vendors that are prohibited pursuant to this section and shall post the list on the attorney general's website. D. FOR THE PURPOSES OF THIS SECTION: 1. "Company" means: (a) A SOLE PROPRIETORSHIP, ORGANIZATION, ASSOCIATION, CORPORATION, PARTNERSHIP, JOINT VENTURE, LIMITED PARTNERSHIP, LIMITED LIABILITY PARTNERSHIP OR LIMITED LIABILITY COMPANY, INCLUDING A WHOLLY OWNED SUBSIDIARY, MAJORITY-OWNED SUBSIDIARY, PARENT COMPANY OR AFFILIATE OF THOSE ENTITIES OR BUSINESS ASSOCIATIONS, THAT EXISTS TO MAKE A PROFIT. (b) A nonprofit organization. 2. "Domiciled" means located in a country where the company is registered, the company's affairs are primarily completed or the majority of the company's ownership shares are held. 3. "foreign ADVERSARY" means a country that is determined to be a foreign adversary pursuant to 15 code of federal regulations section 791.4. END_STATUTE Sec. 3. Title 44, Arizona Revised Statutes, is amended by adding chapter 42, to read: CHAPTER 42 CRITICAL INFRASTRUCTURE ARTICLE 1. PROHIBITED AGREEMENTS START_STATUTE44-8051. Definitions In this article, unless the context otherwise requires: 1. "COMPANY" MEANS: (a) A SOLE PROPRIETORSHIP, ORGANIZATION, ASSOCIATION, CORPORATION, PARTNERSHIP, JOINT VENTURE, LIMITED PARTNERSHIP, LIMITED LIABILITY PARTNERSHIP OR LIMITED LIABILITY COMPANY, INCLUDING A WHOLLY OWNED SUBSIDIARY, MAJORITY-OWNED SUBSIDIARY, PARENT COMPANY OR AFFILIATE OF THOSE ENTITIES OR BUSINESS ASSOCIATIONS, THAT EXISTS TO MAKE A PROFIT. (b) A nonprofit organization. 2. "CRITICAL INFRASTRUCTURE": (a) MEANS SYSTEMS AND ASSETS, WHETHER publicly or privately owned and whether PHYSICAL OR VIRTUAL, THAT ARE SO VITAL TO THIS STATE AND THE UNITED STATES THAT THE INCAPACITY OR DESTRUCTION OF THOSE SYSTEMS AND ASSETS WOULD HAVE A DEBILITATING IMPACT ON SECURITY, ECONOMIC SECURITY or PUBLIC HEALTH OR SAFETY. (b) INCLUDES: (i) GAS AND OIL PRODUCTION, STORAGE OR DELIVERY SYSTEMS. (ii) WATER SUPPLY REFINEMENT, STORAGE OR DELIVERY SYSTEMS. (iii) ELECTRICAL POWER DELIVERY SYSTEMS. (iv) TELECOMMUNICATIONS NETWORKS. (v) TRANSPORTATION SYSTEMS AND SERVICES. (vi) PERSONAL DATA OR OTHERWISE CLASSIFIED INFORMATION STORAGE SYSTEMS, INCLUDING CYBERSECURITY. (vii) Emergency services. 3. "foreign ADVERSARY" means a country that is determined to be a foreign adversary pursuant to 15 code of federal regulations section 791.4. 4. "foreign principal" means any of the following: (a) the government or any official of a foreign adversary or a foreign political party. (b) a partnership, association, corporation, organization or other combination of persons organized under the laws of or having its principal place of business in a foreign adversary. (c) Any person who is domiciled in a foreign country and who is not a citizen or lawful permanent resident of the united states. END_STATUTE START_STATUTE44-8052. Critical infrastructure; prohibited agreements and contracts; exceptions; definitions A. Except as provided in subsection B of this section, a company or A governmental entity in this state may not enter into an agreement or contract involving critical infrastructure in this state with a foreign principal from a foreign adversary if under the agreement or contract the foreign principal, DIRECTLY or remotely, would be able to access or control critical infrastructure in this state. B. A company or a governmental entity in this state may ENTER INTO AN AGREEMENT or contract INVOLVING CRITICAL INFRASTRUCTURE IN THIS STATE WITH A FOREIGN PRINCIPAL FROM A FOREIGN ADVERSARY if any of the following applies: 1. No other reasonable option exists for addressing a need that is relevant to critical infrastructure in this state. 2. The agreement or contract is preapproved by the department of administration. 3. Not entering into the agreement would pose a greater threat to this state than the threat ASSOCIATED with entering into the agreement or contract. END_STATUTE Sec. 4. Short title This act may be cited as the "Arizona Critical Infrastructure Protection Act". |
|---|