Texas 2023 - 88th Regular

Texas Senate Bill SB2001 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	88R13152 MPF-F
2	2	By: Hall S.B. No. 2001
3	3
4	4
5	5	A BILL TO BE ENTITLED
6	6	AN ACT
7	7	relating to the security of election systems.
8	8	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
9	9	SECTION 1. Chapter 279, Election Code, is amended by
10	10	amending Sections 279.002 and 279.003 and adding Sections 279.004
11	11	and 279.005 to read as follows:
12	12	Sec. 279.002. ELECTION CYBERSECURITY: SECRETARY OF STATE.
13	13	(a) The secretary of state shall adopt rules defining classes of
14	14	protected election data and establishing best practices for
15	15	identifying, [and] reducing, and eliminating the risk to the
16	16	electronic use, storage, and transmission of election data and the
17	17	security of election systems, including:
18	18	(1) methods of encrypting data at rest and during
19	19	transmission; and
20	20	(2) restricting access to sensitive data to only users
21	21	with a specific need to access that data.
22	22	(a-1) The secretary of state shall appoint a dedicated
23	23	cybersecurity expert to implement cybersecurity measures to
24	24	protect all election data and other election-related data held by
25	25	the state or a county in the state, including technology that
26	26	blocks, notifies, and reports on unauthorized attempts to access or
27	27	transfer data.
28	28	(b) The secretary of state shall direct the cybersecurity
29	29	expert to offer training on best practices:
30	30	(1) on a biennial [an annual] basis, to all
31	31	appropriate personnel or contractors with [in] the secretary of
32	32	state's office with access to sensitive information; and
33	33	(2) on request, to county election officers and any
34	34	employees or contractors of the county election officers with
35	35	access to sensitive information [in this state].
36	36	(b-1) Access to sensitive data shall be revoked for any
37	37	employee or contractor that is required to receive training under
38	38	Subsection (b) but does not complete the training.
39	39	(c) If the secretary of state becomes aware of a breach of
40	40	cybersecurity that impacts election data, the secretary shall
41	41	immediately notify the governor, lieutenant governor, speaker of
42	42	the house of representatives, and members of the standing
43	43	committees of each house of the legislature with jurisdiction over
44	44	elections. The secretary shall direct the cybersecurity expert to
45	45	conduct an investigation of the breach and report any findings to
46	46	the governor, lieutenant governor, speaker of the house of
47	47	representatives, and standing committees of the legislature with
48	48	jurisdiction over elections.
49	49	(d) During an investigation conducted under Subsection (c),
50	50	access to the election system is restricted to only individuals
51	51	designated by the secretary of state until the standing committees
52	52	confirm that the breach has been mitigated.
53	53	(e) If the investigation under Subsection (c) reveals that
54	54	individuals' personal data has been breached, the secretary of
55	55	state shall promptly notify the affected individuals by written
56	56	letter of the occurrence and extent of the breach.
57	57	(f) The secretary of state, in cooperation with the
58	58	cybersecurity expert, shall contract with a provider of
59	59	cybersecurity assessments to biennially conduct an assessment of
60	60	the cybersecurity of the state's election system.
61	61	(g) The cybersecurity expert shall implement cybersecurity
62	62	measures to ensure that all devices with access to election data
63	63	held by the state comply to the highest extent possible with rules
64	64	adopted by the secretary of state under Subsection (a).
65	65	Sec. 279.003. ELECTION CYBERSECURITY: COUNTY ELECTION
66	66	OFFICERS. (a) A county election officer shall biennially
67	67	[annually] request training on cybersecurity from the
68	68	cybersecurity expert [secretary of state]. The secretary of state
69	69	shall pay the costs associated with the training with available
70	70	state funds.
71	71	(b) A county election officer shall contract with a provider
72	72	of cybersecurity assessments to biennially conduct [request] an
73	73	assessment of the cybersecurity of the county's election system
74	74	[from a provider of cybersecurity assessments if the secretary of
75	75	state recommends an assessment and the necessary funds are
76	76	available].
77	77	(b-1) The county election officer shall deliver a report on
78	78	any recommended improvements to the county's election system by the
79	79	assessment conducted under Subsection (b) to the secretary of
80	80	state.
81	81	(c) If a county election officer becomes aware of a breach
82	82	of cybersecurity that impacts election data, the officer shall
83	83	immediately notify the secretary of state. During an investigation
84	84	by the secretary of state made aware of a breach under this section,
85	85	access to sensitive data in the county shall be restricted to
86	86	specific personnel.
87	87	(d) A [To the extent that state funds are available for the
88	88	purpose, a] county election officer shall implement cybersecurity
89	89	measures to ensure that all devices with access to election data
90	90	comply to the highest extent possible with rules adopted by the
91	91	secretary of state under Section 279.002.
92	92	Sec. 279.004. INTERNAL PERSONNEL VIOLATION. If a data
93	93	breach under this section is conducted by an employee of the
94	94	secretary of state's or county election officer's office, the
95	95	employee may not be provided access to election-related data until
96	96	an investigation under this section is concluded. If an
97	97	investigation determines that the employee intentionally breached
98	98	an election system, the secretary of state may pursue all available
99	99	legal remedies against the employee, including criminal
100	100	prosecution.
101	101	Sec. 279.005. COMPUTER NETWORK CONNECTIVITY. (a) Except
102	102	as expressly authorized by this code, an election system that is
103	103	capable of being connected to the Internet or any other computer
104	104	network may not be used, except for the use of a visible wired
105	105	connection to an isolated local area network within the building.
106	106	(b) The cybersecurity expert appointed by the secretary of
107	107	state under Section 279.002 shall annually verify compliance with
108	108	this section by each county conducting an election in this state.
109	109	SECTION 2. Section 123.034, Election Code, is amended to
110	110	read as follows:
111	111	Sec. 123.034. MAINTENANCE AND STORAGE OF EQUIPMENT. (a)
112	112	The governing body of a political subdivision shall provide for the
113	113	proper maintenance and storage of the equipment that the
114	114	subdivision acquires for use in the operation of a voting system.
115	115	(b) Equipment used in the operation of a voting system must
116	116	have a documented chain of custody and be stored in a locked
117	117	facility with video surveillance monitoring the storage facility at
118	118	all times.
119	119	SECTION 3. As soon as practicable after the effective date
120	120	of this Act, the secretary of state shall:
121	121	(1) adopt the rules required by Section 279.002(a),
122	122	Election Code, as amended by this Act; and
123	123	(2) appoint a cybersecurity expert in accordance with
124	124	Section 279.002(a-1), Election Code, as added by this Act.
125	125	SECTION 4. This Act takes effect September 1, 2023.