FIRSTREGULARSESSION
HOUSEBILLNO.1231
103RDGENERALASSEMBLY
INTRODUCEDBYREPRESENTATIVESIMMONS.
2618H.01I JOSEPHENGLER,ChiefClerk
ANACT
Toamendchapter1,RSMo,byaddingtheretotwonewsectionsrelatingtotheinfrastructure
security,withpenaltyprovisions.
BeitenactedbytheGeneralAssemblyofthestateofMissouri,asfollows:
SectionA.Chapter1,RSMo,isamendedbyaddingtheretotwonewsections,tobe
2knownassections1.1400and1.1410,toreadasfollows:
1.1400.1.Thissectionshallbeknownandmaybecitedasthe"Missouri
2CriticalInfrastructureProtectionAct".
3 2.Asusedinthissection,thefollowingtermsmean:
4 (1)"Company",afor-profitsoleproprietorship,organization,association,
5corporation,partnership,jointventure,limitedpartnership,limitedliability
6partnership,orlimitedliabilitycompany,includingawhollyownedsubsidiary,
7majority-ownedsubsidiary,parentcompany,oraffiliateofthoseentitiesorbusiness
8associationsthatexiststomakeaprofit;oranon-profitorganization;
9 (2)"Criticalinfrastructure",systemsandassets,whetherphysicalorvirtual,so
10vitaltothestateofMissouriortheUnitedStatesthattheincapacityordestructionof
11suchsystemsandassetswouldhaveadebilitatingimpactonstateornationalsecurity,
12stateornationaleconomicsecurity,orstateornationalpublichealth.Acritical
13infrastructuremaybepubliclyorprivatelyowned,andincludesbutisnotlimitedto:
14 (a)Gasandoilproduction,storage,ordeliverysystems;
15 (b)Watersupply,refinement,storage,ordeliverysystems;
16 (c)Telecommunicationsnetworks;
17 (d)Electricalpowerdeliverysystems;
EXPLANATION—Matterenclosedinbold-facedbrackets[thus] intheabovebillisnotenactedandis
intendedtobeomittedfromthelaw.Matterinbold-facetypeintheabovebillisproposedlanguage. 18 (e)Emergencyservices;
19 (f)Transportationsystemsandservices;and
20 (g)Personaldataorotherclassifiedinformationstoragesystems,including
21cybersecurity;
22 (3)"Cybersecurity",themeasurestakentoprotectacomputer,computer
23network,computersystem,orothertechnologyinfrastructureagainstunauthorizeduse
24oraccess;
25 (4)"Domicile",eitherthecountryinwhichacompanyisregistered,wherethe
26company'saffairsareprimarilycompleted,orwherethemajorityofownershipshareis
27held;
28 (5)"Foreignadversary",anindividualorgovernmentidentifiedasaforeign
29adversaryin15CFR7.4;
30 (6)"Foreignprincipal",anyofthefollowing:
31 (a)Thegovernmentoranyofficialofthegovernmentofaforeignadversary;
32 (b)Apoliticalpartyormemberofapoliticalpartyoranysubdivisionofa
33politicalpartyofaforeignadversary;
34 (c)Apartnership,association,corporation,organization,orothercombination
35ofpersonsorganizedunderthelawsoforhavingitsprincipalplaceofbusinessinthe
36countryofaforeignadversary,orasubsidiaryofsuchentity,orownedorcontrolled
37whollyorinpartbyanyperson,entity,orcollectionofpersonsorentitiesofaforeign
38adversary;
39 (d)Anypersonwhoisdomiciledinthecountryofaforeignadversaryandisnot
40acitizenorlawfulpermanentresidentoftheUnitedStates;or
41 (e)Anyperson,entity,orcollectionofpersonsorentities,describedin
42paragraphs(a)to(d)havingacontrollinginterestinapartnership,association,
43corporation,organization,trust,oranyotherlegalentityorsubsidiaryformedforthe
44purposeofowningrealproperty;
45 (7)"Software",anyprogramorroutine,oranysetofoneormoreprogramsor
46routines,thatisusedorintendedforusetocauseoneormorecomputersorpiecesof
47computer-relatedperipheralequipment,oranycombinationthereof,toperformatask
48orsetoftasks,asitrelatestostateinfrastructure,oranyoperationalsoftware.
49 3.Acompanyorotherentityconstructing,repairing,operating,orotherwise
50havingsignificantaccesstocriticalinfrastructureshallnotenterintoanagreement
51relatingtocriticalinfrastructureinthisstatewithaforeignprincipalfromthecountry
52ofaforeignadversaryiftheagreementwouldallowtheforeignprincipalfromaforeign
53adversarycountrytodirectlyorremotelyaccessorcontrolcriticalinfrastructureinthis
54state.
HB1231 2 55 4.Agovernmentalentityshallnotenterintoacontractorotheragreement
56relatingtocriticalinfrastructureinthisstatewithacompanythatisaforeignprincipal
57fromaforeignadversarycountryiftheagreementwouldallowtheforeignprincipal
58fromaforeignadversarycountrytodirectlyorremotelyaccessorcontrolcritical
59infrastructureinthisstate.
60 5.Notwithstandingsubsections3and4ofthissection,anentityorgovernmental
61entitymayenterintoacontractoragreementrelatingtocriticalinfrastructurewitha
62foreignprincipalfromaforeignadversarycountryoruseproductsorservicesproduced
63byaforeignprincipalfromaforeignadversarycountryif:
64 (1)Thereisnootherreasonableoptionforaddressingtheneedrelevanttostate
65criticalinfrastructure;
66 (2)Thecontractispre-approvedbythedepartmentofpublicsafety;and
67 (3)Notenteringintosuchacontractoragreementwouldposeagreaterthreatto
68thestatethanthethreatassociatedwithenteringintothecontract.
69 6.Beforeaccessingcriticalinfrastructure,acompanyshallfileacertification
70formwithandpayacertificationfeetothedepartmentofpublicsafety.The
71departmentofpublicsafetyshalldevelopaformtofulfilltherequirementsofthis
72subsection.
73 7.Tomaintainregistrationasacompanywithaccesstocriticalinfrastructure,a
74companyshall:
75 (1)Identifyallemployeepositionsintheorganizationthathaveaccesstocritical
76infrastructure;
77 (2)Obtainfromthedepartmentofpublicsafetyorprivatevendor,foreach
78employeethatwillhaveaccesstocriticalinfrastructure,acriminalbackgroundcheck
79andanyotherbackgroundinformationconsiderednecessarybythecompanyor
80requiredbythedepartmentofpublicsafetytoprotectcriticalinfrastructurefrom
81foreignadversaryinfiltrationorinterference;
82 (3)Prohibitforeignnationalsfromaforeignadversarynationfromaccessto
83criticalinfrastructure;
84 (4)Discloseanyownershipof,partnershipwith,orcontrolfromanyentitynot
85domiciledwithintheUnitedStates;
86 (5)Storeandprocessalldatageneratedbysuchcriticalinfrastructureon
87domesticservers;
88 (6)Notusecloudserviceprovidersordatacentersthatareforeignentities;
89 (7)Immediatelyreportanycyberattack,securitybreach,orsuspiciousactivity
90tothedepartmentofpublicsafety;and
91 (8)Becompliantwithsubsections3to5ofthissection.
HB1231 3 92 8.Thedepartmentofpublicsafetyshallbenotifiedbytheownerofacritical
93infrastructureinstallationofanyproposedsaleortransferoforinvestmentinsuch
94criticalinfrastructuretoanentitydomiciledoutsideoftheUnitedStatesoranentity
95withanyforeignadversaryownership.
96 9.Thedepartmentofpublicsafetyshallhavenomorethanthirtydaysfollowing
97thenoticetoinvestigatetheproposedsale,transfer,orinvestment.Ifthedepartmentof
98publicsafetyreasonablybelievesthatsuchproposedsale,transfer,orinvestmentwill
99threatenstatecriticalinfrastructuresecurity,stateeconomicsecurity,statepublic
100health,oranycombinationofthosematters,theattorneygeneral,onbehalfofthe
101departmentofpublicsafety,shallfilearequestforinjunctionopposingtheproposed
102sale,transfer,orinvestmentwiththesupremecourtofMissouri.
103 10.Ifthesupremecourtfindsthatsuchsale,transfer,orinvestmentposesa
104reasonablethreattostatecriticalinfrastructuresecurity,stateeconomicsecurity,state
105ornationalpublichealth,oranycombinationofthosematters,thesupremecourtshall
106issueadenialofapproval.
107 11.Thedepartmentofpublicsafetyshallacttonotifycriticalinfrastructure
108entitiesofknownorsuspectedcyberthreats,vulnerabilities,andadversarialactivitiesin
109orderto:
110 (1)Identifyandclosesimilarexploitsinsimilarcriticalinfrastructure
111installationorprocesses,especiallyafterbeingnotifiedofactivityundersubdivision
112(7)ofsubsection7ofthissection;
113 (2)Maintainoperationsecurityandnormalfunctioningofcritical
114infrastructure;and
115 (3)Protecttherightsofprivatecriticalinfrastructureentities,includingby
116reducingtheextenttowhichtradesecretsorotherproprietaryinformationisshared
117betweenentities,totheextentthatsuchprecautiondoesnotinhibittheabilityofthe
118departmentofpublicsafetytoeffectivelycommunicatethethreatofaknownor
119suspectedexploitoradversarialactivity.
120 12.Allsoftwareusedinstateinfrastructurelocatedwithinorservingthisstate
121shallnotincludeanysoftwareproducedbyacompanyheadquarteredinandsubjectto
122thelawsofaforeignadversaryoracompanyunderthedirectionorcontrolofaforeign
123adversary.Anystateinfrastructureproviderthatremoves,discontinues,orreplaces
124anyprohibitedsoftwareshallnotberequiredtoobtainanyadditionalpermitsfromany
125stateagencyorpoliticalsubdivisionfortheremoval,discontinuance,orreplacementof
126suchsoftwareaslongasthestateagencyorpoliticalsubdivisionisproperlynotifiedof
127thenecessaryreplacementsandthereplacementsoftwareissimilartotheexisting
128software.
HB1231 4 129 13.AfterAugust28,2025,agovernmentalentityorcriticalinfrastructure
130providershallnotknowinglyenterintoorrenewacontractwithavendorif:
131 (1)Thecontractingvendorisownedbythegovernmentofaforeignadversary;
132 (2)Thegovernmentofaforeignadversaryhasacontrollinginterestinthe
133contractingvendor;or
134 (3)Thecontractingvendorissellingaproductproducedbyagovernmentofa
135foreignadversary,acompanyprimarilydomiciledinthecountryofaforeignadversary,
136oracompanyownedorcontrolledbyacompanyprimarilydomiciledinthecountryofa
137foreignadversary.
138 14.AfterAugust28,2025,agovernmentalentityorcriticalinfrastructure
139providershallnotknowinglyenterintoorrenewacontractwithavendorthatisowned
140bythegovernmentofaforeignadversary,primarilydomiciledwithinthecountryofa
141foreignadversary,ownedorcontrolledbyacompanyprimarilydomiciledinthe
142countryofaforeignadversary,orinwhichthegovernmentofaforeignadversaryhasa
143controllinginterestforanyofthefollowingproductsorservices:
144 (1)Schoolbusinfractiondetectionsystems;
145 (2)Speeddetectionsystemsortrafficinfractiondetectors;
146 (3)Anycamerasystemusedforenforcingtrafficlaws;
147 (4)Videosurveillanceequipmentorsoftwaretechnology;
148 (5)Lightdetectionandrangingtechnology(LiDAR);and
149 (6)Wi-Firoutersormodemsystems.
150 15.Thedepartmentofpublicsafetyshallcreateapubliclistingofproductsand
151companiesprohibitedundersubsection14ofthissectionforgovernmentalentitiesand
152criticalinfrastructureproviders.
153 16.AfterAugust28,2025,eachcriticalinfrastructureproviderinMissourishall
154certifytothedepartmentofpublicsafetythattheyareincompliancewithsection14of
155thissection.
1.1410.1.Thissectionshallbeknownandmaybecitedasthe"MissouriSecure
2CommunicationsAct."
3 2.Asusedinthissection,thefollowingtermsmean:
4 (1)"Communicationsprovider"anycorporation,publicorprivate,that
5operatesanysystemsupportingthetransmissionofinformationofauser'schoosing,
6regardlessofthetransmissionmediumortechnologyemployed,thatconnectionstoa
7networkpermittingtheendusertoengageincommunicationsincluding,butnotlimited
8to,serviceprovideddirectlytothepublicortosuchclassesofusersastobeeffectively
9availabledirectlytothepublic;
HB1231 5 10 (2)"Criticalcommunicationsinfrastructure",allphysicalbroadband
11infrastructureandequipmentthatsupportsthetransmissionofinformationofa
12user'schoosing,regardlessofthetransmissionmediumortechnologyemployed,that
13connectstoanetworkthatpermitstheendusertoengageincommunicationsincluding,
14butnotlimitedto,serviceprovideddirectlytothepublicortosuchclassesofusersasto
15beeffectivelyavailabletothepublic;
16 (3)"Federallybannedcorporation",anycompanyordesignatedequipment
17bannedbytheFederalCommunicationsCommissionincluding,butnotlimitedto,any
18equipmentorservicedeemedtoposeathreattonationalsecurityandidentifiedonthe
19coveredlistdevelopedasrequiredin47CFRSection1.50002andpublishedbythe
20PublicSafetyandHomelandSecurityBureauoftheFederalCommunications
21Commissionasrequiredin47U.S.C.1601etseq.
22 3.Allcriticalcommunicationsinfrastructurelocatedwithinorservingthisstate
23shallnotincludeanyequipmentmanufacturedbyafederallybannedcorporation.
24 4.Allcriticalcommunicationsinfrastructureinoperationwithinorservingthis
25state,includinganycriticalcommunicationsinfrastructurethatisnotpermanently
26disabled,shallhaveallequipmentprohibitedbythissectionremovedandreplacedwith
27equipmentnotprohibitedbythissection.Anycommunicationsproviderthatremoves,
28discontinues,orreplacesanyprohibitedcommunicationsequipmentorserviceshallnot
29berequiredtoobtainanyadditionalpermitsfromanystateagencyorpolitical
30subdivisionfortheremoval,discontinuance,orreplacementofsuchcommunications
31equipmentorserviceaslongasthestateagencyorpoliticalsubdivisionisproperly
32notifiedofthenecessaryreplacementsandthereplacementcommunicationsequipment
33issimilartotheexistingcommunicationsequipment.
34 5.Anycommunicationsproviderprovidingserviceinthisstatethatutilizes
35equipmentfromafederallybannedcorporationshallfilearegistrationformwithand
36payaregistrationfeetothepublicservicecommissionbeforeSeptember1,2025,andon
37Januaryfirstofeachsubsequentyearuntilsuchequipmentisremoved.Thepublic
38servicecommissionshallcreatetheform,whichshallcontain,ataminimum:
39 (1)Thename,address,telephonenumber,andemailaddressofeachpersonwith
40managerialresponsibilityforoperationsinthisstate;and
41 (2)Acertificationofallinstancesofprohibitedcriticalcommunications
42equipmentorservicesprohibitedundersubsection3to5ofsection1.1400;ifthe
43communicationsproviderisaparticipantintheFederalSecureandTrusted
44CommunicationsNetworksReimbursementProgram,establishedunder47U.S.C.
45Section1601,etseq.;andthegeographiccoordinatesoftheareasservedbysuch
46prohibitedequipment.
HB1231 6 47 6.Acommunicationsprovidershallnotifythecommissionofchangestoany
48informationsubmittedundersubsection5ofthissectionwithinsixtydays.
49 7.If,undersubdivision(2)ofsubsection5ofthissection,acommunications
50providercertifiestothepublicservicecommissionthatitisaparticipantintheFederal
51SecureandTrustedCommunicationsNetworksReimbursementProgram,established
52under47U.S.C.Section1601,etseq.,thecommunicationsprovidershallsubmitastatus
53reporttothepublicservicecommissioneveryquarterthatdetailsthecommunications
54provider'scompliancewiththereimbursementprogram.
55 8.Anycommunicationsproviderthatviolatesthissectionshallbesubjecttoa
56fineofnolessthanfivethousanddollarsperdayandnomorethantwenty-fivethousand
57dollarsperdayofnoncompliance.Anycommunicationsproviderthatsubmitsafalse
58registrationformdescribedinthissectionshallbesubjecttoafineofnolessthanten
59thousanddollarsperdayandnomorethantwentythousanddollarsperdayof
60noncompliance.
61 9.Anycommunicationsproviderthatfailstocomplywiththissectionis
62prohibitedfromreceivinganystateorlocalfundsforthedevelopmentorsupportof
63neworexistingcriticalcommunicationsinfrastructure,includingtheMissouri
64communicationsuniversalservicefund,andisprohibitedfromreceivinganyfederal
65fundssubjecttodistributionbystateorlocalgovernmentsforthedevelopmentor
66supportofneworexistingcriticalcommunicationsinfrastructure.
67 10.Thepublicservicecommissionshalldevelopandpublish,onaquarterly
68basis,amapofknownprohibitedcommunicationsequipmentwithinall
69communicationsproviderswithinorservingthisstate.Themapshall:
70 (1)Clearlyshowthelocationoftheprohibitedequipmentandthe
71communicationsareaservicedbytheprohibitedequipment;
72 (2)Identifythecommunicationsproviderresponsiblefortheprohibited
73equipment;
74 (3)Makeclearlylegibletheareasservicedbytheprohibitedequipment;and
75 (4)Describethenatureoftheprohibitedequipmentbystating,atminimum,the
76prohibitedequipmentmanufacturerandequipmenttypeorpurpose.
âś”
HB1231 7