STATE OF NEW YORK ________________________________________________________________________ 9312--A IN ASSEMBLY February 27, 2024 ___________ Introduced by M. of A. RAJKUMAR, ALVAREZ, DICKENS, LEMONDES, K. BROWN -- read once and referred to the Committee on Governmental Operations -- committee discharged, bill amended, ordered reprinted as amended and recommitted to said committee AN ACT to amend the state finance law and the general municipal law, in relation to prohibiting procurement of certain technology that poses security threats The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. The state finance law is amended by adding a new section 2 163-e to read as follows: 3 § 163-e. Restriction on purchasing certain technology which poses a 4 security threat. 1. (a) Notwithstanding any inconsistent provision of 5 law, the state and any department, bureau, board, commission, authority, 6 and any other agency or instrumentality of the state shall not enter 7 into or renew any contract or agreement to procure information and 8 communications technology, including hardware, systems, devices, soft- 9 ware, or services that include embedded or incidental information tech- 10 nology, which are prohibited from federal procurement pursuant to 41 USC 11 4713. 12 (b) The term "information and communications technology" means: 13 (i) information technology, as defined in section 11101 of title 40; 14 (ii) information systems, as defined in 44 U.S.C. 3502; and 15 (iii) telecommunications equipment and telecommunications services, as 16 those terms are defined in section 3 of the Communications Act of 1934 17 (47 U.S.C. 153). 18 (c) The term "information and communications technology" shall not 19 include automated-decision making systems. 20 2. Notwithstanding any inconsistent provision of law, the state and 21 any department, bureau, board, commission, authority, or any other agen- 22 cy or instrumentality of the state shall not enter into or renew any 23 contract or agreement to procure any electronic parts, products, or 24 services, or enter into a contract, or extend or renew a contract, with 25 an entity to procure or obtain electronic parts or products that use any EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD14405-04-4
A. 9312--A 2 1 electronic parts or products that include products, from any entity 2 prohibited from federal contracting (or any subsidiary, affiliates, or 3 successors of such entity) as set forth in Pub. L. 117-263, div. E, 4 title LIX, § 5949; or any entity (or any subsidiary, affiliates, or 5 successors of such entity) designated as prohibited from federal 6 contracting pursuant to Pub. L. 115-232, div. A, title VIII, § 889; or 7 from any entity (or any subsidiary, affiliates, or successors of such 8 entity) determined to be a threat to national security by 9 DODIG-2019-106. 10 3. The commissioner of homeland security and emergency services, the 11 adjutant general, the chief information officer, the chief cyber offi- 12 cer, the chief technology officer of the city of New York and any feder- 13 al agency authorized under 41 USC 4713, may provide a waiver from this 14 section if: 15 (a) any such entity determines the waiver is in the critical state or 16 national security interests; and 17 (b) no compliant product or service is available to be procured as, 18 and when, needed at United States market prices or a price that is not 19 considered prohibitively expensive; and 20 (c) such waiver could not reasonably be expected to compromise the 21 critical state or national security interests. 22 4. Nothing in this section shall be construed: 23 (a) to require any covered products or services resident in equipment, 24 systems, or services as of the day before the effective date of this 25 section to be removed or replaced; 26 (b) to prohibit or limit the utilization of such covered products or 27 services throughout the lifecycle of such existing equipment; or 28 (c) to require the recipient of a state contract, grant, loan, or loan 29 guarantee to replace covered products or services resident in equipment, 30 systems, or services before the effective date of this section. 31 § 2. The general municipal law is amended by adding a new section 32 103-h to read as follows: 33 § 103-h. Restriction on purchasing certain technology which poses a 34 security threat. 1. (a) Notwithstanding any inconsistent provision of 35 law a political subdivision shall not enter into or renew any contract 36 or agreement to procure information and communications technology, 37 including hardware, systems, devices, software, or services that include 38 embedded or incidental information technology, which are prohibited from 39 federal procurement pursuant to 41 USC 4713. 40 (b) The term "information and communications technology" means: 41 (i) information technology, as defined in 40 U.S.C. 11101; 42 (ii) information systems, as defined in 44 U.S.C. 3502; and 43 (iii) telecommunications equipment and telecommunications services, as 44 those terms are defined in section 3 of the Communications Act of 1934 45 (47 U.S.C. 153). 46 2. Notwithstanding any inconsistent provision of law, a political 47 subdivision or any district therein shall not enter into or renew any 48 contract or agreement to procure any electronic parts, products, or 49 services, or enter into a contract, or extend or renew a contract, with 50 an entity to procure or obtain electronic parts or products that use any 51 electronic parts or products that include products or services, in 52 violation of the provisions as set forth in Pub. L. 117-263, div. E, 53 title LIX, § 5949; or from any entity (or any subsidiary, affiliates, or 54 successors of such entity) designated as prohibited from federal 55 contracting pursuant to Pub. L. 115-232, div. A, title VIII, §889; or
A. 9312--A 3 1 from any entity (or any subsidiary, affiliates, or successors of such 2 entity) determined to be a cybersecurity risk by DODIG-2019-106. 3 3. The commissioner of homeland security and emergency services, the 4 adjutant general, the chief information officer, the chief cyber offi- 5 cer, the chief technology officer of the city of New York and any feder- 6 al agency authorized under 41 U.S.C 4713, may provide a waiver from this 7 section if: 8 (a) any such entity determines the waiver is in the critical state or 9 national security interests; and 10 (b) no compliant product or service is available to be procured as, 11 and when, needed at United States market prices or a price that is not 12 considered prohibitively expensive; and 13 (c) such waiver could not reasonably be expected to compromise the 14 critical national security interests of the United States. 15 4. Nothing in this section shall be construed: 16 (a) to require any covered products or services resident in equipment, 17 systems, or services as of the day before the effective date of this 18 section to be removed or replaced; 19 (b) to prohibit or limit the utilization of such covered products or 20 services throughout the lifecycle of such existing equipment; or 21 (c) to require the recipient of a state contract, grant, loan, or loan 22 guarantee to replace covered products or services resident in equipment, 23 systems, or services before the effective date of this section. 24 § 3. No later than the effective date of this act, the office of 25 general services shall promulgate rules and regulations and issue guid- 26 ance to all state agencies and local procurement authorities necessary, 27 including providing updates on prohibited or excluded entities for 28 procurement contracts in conformity with federal law, rules and regu- 29 lations, no later than sixty days after any entity is prohibited or 30 excluded. 31 § 4. This act shall take effect five years after it shall have become 32 a law. Effective immediately, the office of general services is author- 33 ized to promulgate rules and regulations and issue guidance to all state 34 agencies and local procurement authorities necessary for the implementa- 35 tion of this act on its effective date, including providing updates on 36 prohibited or excluded entities for procurement contracts in conformity 37 with federal law, rules and regulations.