| 1 | 1 | | HOUSE BILL NO. 4235 A bill to prohibit the use of certain applications on government-issued devices; to require public employers to take certain actions related to prohibited applications; to prohibit certain employees or officers from downloading or accessing certain applications; to provide exceptions; and to provide for the powers and duties of certain state and local governmental officers and entities. the people of the state of michigan enact: Sec. 1. This act may be cited as the "prohibited applications on government-issued devices act". Sec. 3. The legislature finds that a proper and legitimate state purpose is served when efforts are taken to secure the system, network, or server of a public employer. Therefore, the legislature determines and declares that this act fulfills an important state interest. Sec. 5. As used in this act: (a) "Department" means the department of technology, management, and budget. (b) "Employee or officer" means an individual who performs labor or services for a public employer for salary, wages, or other remuneration. (c) "Foreign country of concern" means any of the following: (i) The People's Republic of China. (ii) The Russian Federation. (iii) The Islamic Republic of Iran. (iv) The Democratic People's Republic of Korea. (v) The Republic of Cuba. (vi) The Venezuelan regime of Nicol?s Maduro. (vii) The Syrian Arab Republic. (viii) Any agency of or any other entity under significant control of an entity listed under subdivisions (i) to (vii). (d) "Foreign principal" means any of the following: (i) The government or an official of the government of a foreign country of concern. (ii) A political party, a member of a political party, or any subdivision of a political party in a foreign country of concern. (iii) A partnership, an association, a corporation, an organization, or a combination of persons organized under the laws of or having its principal place of business in a foreign country of concern, or an affiliate or a subsidiary of a partnership, an association, a corporation, an organization, or a combination of persons organized under the laws of or having its principal place of business in a foreign country of concern. (iv) Any individual who is domiciled in a foreign country of concern and is not a citizen or a lawful permanent resident of the United States. (e) "Government-issued device" means a cellular telephone, a desktop computer, a laptop computer, or other electronic device that is capable of connecting to the internet owned or leased by a public employer and issued to an employee or officer for work-related purposes. (f) "Prohibited application" means an internet application that meets the following criteria: (i) The internet application is created, maintained, or owned by a foreign principal and participates in activities that include, but are not limited to, any of the following: (A) Collects keystrokes or sensitive personal, financial, proprietary, or business data. (B) Compromises emails and acts as a vector for ransomware deployment. (C) Conducts cyber-espionage against a public employer. (D) Conducts surveillance and tracks individual users. (E) Uses algorithmic modifications to conduct disinformation or misinformation campaigns. (ii) The department considers the internet application to present a security risk in the form of unauthorized access to or temporary unavailability of the public employer's records, digital assets, systems, networks, servers, or information. (g) "Public employer" means this state, a local unit of government or other political subdivision of this state, any intergovernmental, metropolitan, or local department, agency, or authority, or other local political subdivision, a school district, a public school academy, or an intermediate school district, as those terms are defined in sections 4 to 6 of the revised school code, 1976 PA 451, MCL 380.4 to 380.6, a community college or junior college described in section 7 of article VIII of the state constitution of 1963, or an institution of higher education described in section 4 of article VIII of the state constitution of 1963. Sec. 7. (1) Except as otherwise provided in subsection (3), a public employer shall do all of the following: (a) Block a prohibited application from public access on any network and virtual private network owned, operated, or maintained by that public employer. (b) Restrict access to any prohibited application on a government-issued device. (c) Retain the ability to remotely wipe and uninstall any prohibited application from a government-issued device that is believed to have been adversely impacted, either intentionally or unintentionally, by a prohibited application. (2) A person, including an employee or officer, shall not download or access a prohibited application on a government-issued device. This subsection does not apply to a law enforcement officer if the use of the prohibited application is necessary to protect the public safety or conduct an investigation within the scope of the law enforcement officer's employment. (3) A public employer may request a waiver from the department to allow a designated employee or officer to download or access a prohibited application on a government-issued device. A request for a waiver under this subsection must be in writing and include all of the following: (a) A description of the activity to be conducted and the state interest furthered by the activity. (b) The maximum number of government-issued devices and employees or officers to which the waiver will apply. (c) The length of time necessary for the waiver. A waiver granted under this subsection must be limited to a time frame of not more than 1 year, but the department may approve an extension. (d) Risk mitigation actions that will be taken to prevent access to sensitive data, including methods to ensure that the activity does not connect to a state system, network, or server. (e) A description of the circumstances under which the waiver applies. Sec. 9. (1) Not later than 90 days after the effective date of this act, the department shall do both of the following: (a) Compile and maintain a list of all prohibited applications, and publish the list on its website. The department shall update the list compiled and maintained under this subdivision quarterly, and provide notice of any update to all public employers. (b) Establish procedures for granting or denying a waiver under section 7(3). (2) Not later than 15 calendar days after the department issues or updates the list of prohibited applications under subsection (1)(a), an employee or officer who uses a government-issued device must remove, delete, or uninstall any prohibited application on the list of prohibited applications from the employee's or officer's government-issued device. Sec. 11. The department shall promulgate rules to implement this act under the administrative procedures act of 1969, 1969 PA 306, MCL 24.201 to 24.328. Enacting section 1. This act takes effect July 1, 2025. |
|---|
| 2 | 2 | | |
|---|
| 3 | 3 | | |
|---|
| 4 | 4 | | |
|---|
| 5 | 5 | | |
|---|
| 6 | 6 | | |
|---|
| 7 | 7 | | |
|---|
| 8 | 8 | | |
|---|
| 9 | 9 | | |
|---|
| 10 | 10 | | |
|---|
| 11 | 11 | | |
|---|
| 12 | 12 | | |
|---|
| 13 | 13 | | |
|---|
| 14 | 14 | | |
|---|
| 15 | 15 | | |
|---|
| 16 | 16 | | |
|---|
| 17 | 17 | | |
|---|
| 18 | 18 | | |
|---|
| 19 | 19 | | |
|---|
| 20 | 20 | | |
|---|
| 21 | 21 | | |
|---|
| 22 | 22 | | |
|---|
| 23 | 23 | | HOUSE BILL NO. 4235 |
|---|
| 24 | 24 | | |
|---|
| 25 | 25 | | |
|---|
| 26 | 26 | | |
|---|
| 27 | 27 | | A bill to prohibit the use of certain applications on government-issued devices; to require public employers to take certain actions related to prohibited applications; to prohibit certain employees or officers from downloading or accessing certain applications; to provide exceptions; and to provide for the powers and duties of certain state and local governmental officers and entities. |
|---|
| 28 | 28 | | |
|---|
| 29 | 29 | | the people of the state of michigan enact: |
|---|
| 30 | 30 | | |
|---|
| 31 | 31 | | Sec. 1. This act may be cited as the "prohibited applications on government-issued devices act". |
|---|
| 32 | 32 | | |
|---|
| 33 | 33 | | Sec. 3. The legislature finds that a proper and legitimate state purpose is served when efforts are taken to secure the system, network, or server of a public employer. Therefore, the legislature determines and declares that this act fulfills an important state interest. |
|---|
| 34 | 34 | | |
|---|
| 35 | 35 | | Sec. 5. As used in this act: |
|---|
| 36 | 36 | | |
|---|
| 37 | 37 | | (a) "Department" means the department of technology, management, and budget. |
|---|
| 38 | 38 | | |
|---|
| 39 | 39 | | (b) "Employee or officer" means an individual who performs labor or services for a public employer for salary, wages, or other remuneration. |
|---|
| 40 | 40 | | |
|---|
| 41 | 41 | | (c) "Foreign country of concern" means any of the following: |
|---|
| 42 | 42 | | |
|---|
| 43 | 43 | | (i) The People's Republic of China. |
|---|
| 44 | 44 | | |
|---|
| 45 | 45 | | (ii) The Russian Federation. |
|---|
| 46 | 46 | | |
|---|
| 47 | 47 | | (iii) The Islamic Republic of Iran. |
|---|
| 48 | 48 | | |
|---|
| 49 | 49 | | (iv) The Democratic People's Republic of Korea. |
|---|
| 50 | 50 | | |
|---|
| 51 | 51 | | (v) The Republic of Cuba. |
|---|
| 52 | 52 | | |
|---|
| 53 | 53 | | (vi) The Venezuelan regime of Nicol?s Maduro. |
|---|
| 54 | 54 | | |
|---|
| 55 | 55 | | (vii) The Syrian Arab Republic. |
|---|
| 56 | 56 | | |
|---|
| 57 | 57 | | (viii) Any agency of or any other entity under significant control of an entity listed under subdivisions (i) to (vii). |
|---|
| 58 | 58 | | |
|---|
| 59 | 59 | | (d) "Foreign principal" means any of the following: |
|---|
| 60 | 60 | | |
|---|
| 61 | 61 | | (i) The government or an official of the government of a foreign country of concern. |
|---|
| 62 | 62 | | |
|---|
| 63 | 63 | | (ii) A political party, a member of a political party, or any subdivision of a political party in a foreign country of concern. |
|---|
| 64 | 64 | | |
|---|
| 65 | 65 | | (iii) A partnership, an association, a corporation, an organization, or a combination of persons organized under the laws of or having its principal place of business in a foreign country of concern, or an affiliate or a subsidiary of a partnership, an association, a corporation, an organization, or a combination of persons organized under the laws of or having its principal place of business in a foreign country of concern. |
|---|
| 66 | 66 | | |
|---|
| 67 | 67 | | (iv) Any individual who is domiciled in a foreign country of concern and is not a citizen or a lawful permanent resident of the United States. |
|---|
| 68 | 68 | | |
|---|
| 69 | 69 | | (e) "Government-issued device" means a cellular telephone, a desktop computer, a laptop computer, or other electronic device that is capable of connecting to the internet owned or leased by a public employer and issued to an employee or officer for work-related purposes. |
|---|
| 70 | 70 | | |
|---|
| 71 | 71 | | (f) "Prohibited application" means an internet application that meets the following criteria: |
|---|
| 72 | 72 | | |
|---|
| 73 | 73 | | (i) The internet application is created, maintained, or owned by a foreign principal and participates in activities that include, but are not limited to, any of the following: |
|---|
| 74 | 74 | | |
|---|
| 75 | 75 | | (A) Collects keystrokes or sensitive personal, financial, proprietary, or business data. |
|---|
| 76 | 76 | | |
|---|
| 77 | 77 | | (B) Compromises emails and acts as a vector for ransomware deployment. |
|---|
| 78 | 78 | | |
|---|
| 79 | 79 | | (C) Conducts cyber-espionage against a public employer. |
|---|
| 80 | 80 | | |
|---|
| 81 | 81 | | (D) Conducts surveillance and tracks individual users. |
|---|
| 82 | 82 | | |
|---|
| 83 | 83 | | (E) Uses algorithmic modifications to conduct disinformation or misinformation campaigns. |
|---|
| 84 | 84 | | |
|---|
| 85 | 85 | | (ii) The department considers the internet application to present a security risk in the form of unauthorized access to or temporary unavailability of the public employer's records, digital assets, systems, networks, servers, or information. |
|---|
| 86 | 86 | | |
|---|
| 87 | 87 | | (g) "Public employer" means this state, a local unit of government or other political subdivision of this state, any intergovernmental, metropolitan, or local department, agency, or authority, or other local political subdivision, a school district, a public school academy, or an intermediate school district, as those terms are defined in sections 4 to 6 of the revised school code, 1976 PA 451, MCL 380.4 to 380.6, a community college or junior college described in section 7 of article VIII of the state constitution of 1963, or an institution of higher education described in section 4 of article VIII of the state constitution of 1963. |
|---|
| 88 | 88 | | |
|---|
| 89 | 89 | | Sec. 7. (1) Except as otherwise provided in subsection (3), a public employer shall do all of the following: |
|---|
| 90 | 90 | | |
|---|
| 91 | 91 | | (a) Block a prohibited application from public access on any network and virtual private network owned, operated, or maintained by that public employer. |
|---|
| 92 | 92 | | |
|---|
| 93 | 93 | | (b) Restrict access to any prohibited application on a government-issued device. |
|---|
| 94 | 94 | | |
|---|
| 95 | 95 | | (c) Retain the ability to remotely wipe and uninstall any prohibited application from a government-issued device that is believed to have been adversely impacted, either intentionally or unintentionally, by a prohibited application. |
|---|
| 96 | 96 | | |
|---|
| 97 | 97 | | (2) A person, including an employee or officer, shall not download or access a prohibited application on a government-issued device. This subsection does not apply to a law enforcement officer if the use of the prohibited application is necessary to protect the public safety or conduct an investigation within the scope of the law enforcement officer's employment. |
|---|
| 98 | 98 | | |
|---|
| 99 | 99 | | (3) A public employer may request a waiver from the department to allow a designated employee or officer to download or access a prohibited application on a government-issued device. A request for a waiver under this subsection must be in writing and include all of the following: |
|---|
| 100 | 100 | | |
|---|
| 101 | 101 | | (a) A description of the activity to be conducted and the state interest furthered by the activity. |
|---|
| 102 | 102 | | |
|---|
| 103 | 103 | | (b) The maximum number of government-issued devices and employees or officers to which the waiver will apply. |
|---|
| 104 | 104 | | |
|---|
| 105 | 105 | | (c) The length of time necessary for the waiver. A waiver granted under this subsection must be limited to a time frame of not more than 1 year, but the department may approve an extension. |
|---|
| 106 | 106 | | |
|---|
| 107 | 107 | | (d) Risk mitigation actions that will be taken to prevent access to sensitive data, including methods to ensure that the activity does not connect to a state system, network, or server. |
|---|
| 108 | 108 | | |
|---|
| 109 | 109 | | (e) A description of the circumstances under which the waiver applies. |
|---|
| 110 | 110 | | |
|---|
| 111 | 111 | | Sec. 9. (1) Not later than 90 days after the effective date of this act, the department shall do both of the following: |
|---|
| 112 | 112 | | |
|---|
| 113 | 113 | | (a) Compile and maintain a list of all prohibited applications, and publish the list on its website. The department shall update the list compiled and maintained under this subdivision quarterly, and provide notice of any update to all public employers. |
|---|
| 114 | 114 | | |
|---|
| 115 | 115 | | (b) Establish procedures for granting or denying a waiver under section 7(3). |
|---|
| 116 | 116 | | |
|---|
| 117 | 117 | | (2) Not later than 15 calendar days after the department issues or updates the list of prohibited applications under subsection (1)(a), an employee or officer who uses a government-issued device must remove, delete, or uninstall any prohibited application on the list of prohibited applications from the employee's or officer's government-issued device. |
|---|
| 118 | 118 | | |
|---|
| 119 | 119 | | Sec. 11. The department shall promulgate rules to implement this act under the administrative procedures act of 1969, 1969 PA 306, MCL 24.201 to 24.328. |
|---|
| 120 | 120 | | |
|---|
| 121 | 121 | | Enacting section 1. This act takes effect July 1, 2025. |
|---|