9 | 3 | | |
---|
10 | 4 | | |
---|
11 | 5 | | |
---|
12 | 6 | | |
---|
13 | 7 | | A BILL TO BE ENTITLED |
---|
14 | 8 | | AN ACT |
---|
15 | 9 | | relating to a prohibition on governmental contracts with companies |
---|
16 | 10 | | of foreign adversaries for certain information and communications |
---|
17 | 11 | | technology; authorizing a civil penalty; creating a criminal |
---|
18 | 12 | | offense. |
---|
19 | 13 | | BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
---|
20 | 14 | | SECTION 1. The heading to Chapter 2275, Government Code, is |
---|
21 | 15 | | amended to read as follows: |
---|
22 | 16 | | CHAPTER 2275. PROHIBITION ON CONTRACTS WITH CERTAIN FOREIGN-OWNED |
---|
23 | 17 | | COMPANIES IN CONNECTION WITH CRITICAL INFRASTRUCTURE AND |
---|
24 | 18 | | INFORMATION AND COMMUNICATIONS TECHNOLOGY |
---|
25 | 19 | | SECTION 2. Chapter 2275, Government Code, is amended by |
---|
26 | 20 | | designating Sections 2275.0101 through 2275.0103 as Subchapter A |
---|
27 | 21 | | and adding a subchapter heading to read as follows: |
---|
28 | 22 | | SUBCHAPTER A. PROHIBITION ON CERTAIN CONTRACTS IN CONNECTION WITH |
---|
29 | 23 | | CRITICAL INFRASTRUCTURE |
---|
30 | 24 | | SECTION 3. Section 2275.0101, Government Code, is amended |
---|
31 | 25 | | to read as follows: |
---|
32 | 26 | | Sec. 2275.0101. DEFINITIONS. In this subchapter [chapter]: |
---|
33 | 27 | | (1) "Company" means a sole proprietorship, |
---|
34 | 28 | | organization, association, corporation, partnership, joint |
---|
35 | 29 | | venture, limited partnership, limited liability partnership, or |
---|
36 | 30 | | limited liability company, including a wholly owned subsidiary, |
---|
37 | 31 | | majority-owned subsidiary, parent company, or affiliate of those |
---|
38 | 32 | | entities or business associations, that exists to make a profit. |
---|
39 | 33 | | (2) "Critical infrastructure" means a communication |
---|
40 | 34 | | infrastructure system, cybersecurity system, electric grid, |
---|
41 | 35 | | hazardous waste treatment system, or water treatment facility. |
---|
42 | 36 | | (3) "Cybersecurity" means the measures taken to |
---|
43 | 37 | | protect a computer, computer network, computer system, or other |
---|
44 | 38 | | technology infrastructure against unauthorized use or access. |
---|
45 | 39 | | (4) "Designated country" means a country designated by |
---|
46 | 40 | | the governor as a threat to critical infrastructure under Section |
---|
47 | 41 | | 2275.0103. |
---|
48 | 42 | | (5) "Governmental entity" means a state agency, a |
---|
49 | 43 | | political subdivision, or an independent organization certified |
---|
50 | 44 | | under Section 39.151, Utilities Code, to perform a function |
---|
51 | 45 | | described by Section 39.151(a), Utilities Code. |
---|
52 | 46 | | (6) "Affiliate," with respect to a company entering |
---|
53 | 47 | | into an agreement in which the critical infrastructure is electric |
---|
54 | 48 | | grid equipment, has the meaning assigned by the protocols of the |
---|
55 | 49 | | independent organization certified under Section 39.151, Utilities |
---|
56 | 50 | | Code, for the ERCOT power region. |
---|
57 | 51 | | SECTION 4. Section 2275.0103(a), Government Code, is |
---|
58 | 52 | | amended to read as follows: |
---|
59 | 53 | | (a) The governor, after consultation with the public safety |
---|
60 | 54 | | director of the Department of Public Safety, may designate a |
---|
61 | 55 | | country as a threat to critical infrastructure for purposes of this |
---|
62 | 56 | | subchapter [chapter]. |
---|
63 | 57 | | SECTION 5. Chapter 2275, Government Code, is amended by |
---|
64 | 58 | | adding Subchapter B to read as follows: |
---|
65 | 59 | | SUBCHAPTER B. PROHIBITION ON CERTAIN CONTRACTS IN CONNECTION WITH |
---|
66 | 60 | | INFORMATION AND COMMUNICATIONS TECHNOLOGY |
---|
67 | 61 | | Sec. 2275.0201. DEFINITIONS. In this subchapter: |
---|
89 | | - | and its components that is: |
---|
90 | | - | (A) designed to facilitate by electronic means |
---|
91 | | - | the processing, storage, retrieval, communication, transmission, |
---|
92 | | - | or display of information or data; and |
---|
93 | | - | (B) capable of storing data, communicating |
---|
94 | | - | independently, controlling systems, or engaging in two-way |
---|
95 | | - | communication with a foreign adversary. |
---|
96 | | - | (6) "Scrutinized company" means a company or a wholly |
---|
| 77 | + | and its components that is designed to facilitate by electronic |
---|
| 78 | + | means the processing, storage, retrieval, communication, |
---|
| 79 | + | transmission, or display of information or data. |
---|
| 80 | + | (5) "Scrutinized company" means a company or a wholly |
---|
101 | | - | (B) identified on the covered list under 47 |
---|
102 | | - | C.F.R. Section 1.50002 as producing or providing communications |
---|
103 | | - | equipment or a service that poses an unacceptable risk to the |
---|
104 | | - | national security of the United States or the security and safety of |
---|
105 | | - | United States persons; or |
---|
106 | | - | (C) as provided by 15 C.F.R. Part 791, not a |
---|
107 | | - | United States person and has been subject to a determination by the |
---|
108 | | - | United States secretary of commerce, or the secretary's designee, |
---|
109 | | - | as involved in a transaction related to an information or |
---|
110 | | - | communications technology or service that posed an undue or |
---|
111 | | - | unacceptable risk. |
---|
112 | | - | (7) "Two-way communication" means, with respect to an |
---|
113 | | - | information or communications technology or service, systems or |
---|
114 | | - | components that facilitate the bidirectional exchange of |
---|
115 | | - | information which may include remote or unauthorized access. |
---|
| 85 | + | (B) a publicly traded company for which the |
---|
| 86 | + | government of a foreign adversary has the ability to: |
---|
| 87 | + | (i) exercise control over the company; |
---|
| 88 | + | (ii) appoint or discharge a board member, |
---|
| 89 | + | officer, or director; or |
---|
| 90 | + | (iii) exercise any other right not |
---|
| 91 | + | available to a retail investor holding an equivalent share of |
---|
| 92 | + | ownership; or |
---|
| 93 | + | (C) a privately held company in which the |
---|
| 94 | + | government of a foreign adversary holds any share of ownership. |
---|
116 | 95 | | Sec. 2275.0202. CONTRACTS WITH SCRUTINIZED COMPANIES |
---|
117 | 96 | | PROHIBITED; EXCEPTION. (a) Except as provided by Subsection (b), a |
---|
118 | 97 | | scrutinized company may not submit a bid for a contract or enter |
---|
119 | 98 | | into a contract with a governmental entity relating to an |
---|
120 | 99 | | information or communications technology or service. |
---|
121 | 100 | | (b) A governmental entity may enter into a contract relating |
---|
122 | 101 | | to an information or communications technology or service with a |
---|
123 | 102 | | scrutinized company if the governmental entity, with the approval |
---|
124 | 103 | | of the governor, determines: |
---|
125 | 104 | | (1) the only vendors available to provide the |
---|
126 | 105 | | information or communications technology or service are |
---|
127 | 106 | | scrutinized companies; |
---|
128 | 107 | | (2) the cost to this state of finding and contracting |
---|
129 | 108 | | with a vendor that is not a scrutinized company would be so |
---|
130 | 109 | | disproportionately high that the use of a vendor that is a |
---|
131 | 110 | | scrutinized company would be overwhelmingly in the best interest of |
---|
132 | 111 | | this state; or |
---|
133 | 112 | | (3) any goods or services that originate with a |
---|
134 | 113 | | scrutinized company and may be used in the performance of the |
---|
135 | 114 | | contract constitute a de minimis amount of the total value of the |
---|
136 | 115 | | goods and services provided under the contract and pose no risk to |
---|
137 | 116 | | the security of this state. |
---|
138 | 117 | | Sec. 2275.0203. VERIFICATION REQUIRED. (a) A vendor |
---|
139 | 118 | | submitting a bid for a contract relating to an information or |
---|
140 | 119 | | communications technology or service shall include in the bid a |
---|
141 | 120 | | written verification that the vendor: |
---|
142 | 121 | | (1) is not a scrutinized company; |
---|
143 | 122 | | (2) will not contract with a scrutinized company for |
---|
144 | 123 | | any aspect of its performance under the contract; and |
---|
145 | 124 | | (3) will not procure products or services from or that |
---|
146 | 125 | | originate with a scrutinized company for use in the performance of |
---|
147 | 126 | | the contract. |
---|
148 | 127 | | (b) A governmental entity may not enter into a contract |
---|
149 | 128 | | relating to an information or communications technology or service |
---|
150 | 129 | | with a vendor that fails to provide the verification required by |
---|
151 | 130 | | Subsection (a). |
---|
152 | 131 | | Sec. 2275.0204. FALSE VERIFICATION; VIOLATION. (a) A |
---|
153 | 132 | | governmental entity that determines that a vendor holding a |
---|
154 | 133 | | contract with the entity was ineligible to have the contract |
---|
155 | 134 | | awarded under Section 2275.0202 because the vendor's written |
---|
156 | 135 | | verification was false shall notify the vendor that the vendor is in |
---|
157 | 136 | | violation of this subchapter. The notice must include the basis for |
---|
158 | 137 | | the entity's determination that the vendor is in violation of this |
---|
159 | 138 | | subchapter. |
---|
160 | 139 | | (b) Not later than the 60th day after the date a vendor |
---|
161 | 140 | | receives a notice under Subsection (a), the vendor may provide a |
---|
162 | 141 | | written response to the governmental entity with evidence that the |
---|
163 | 142 | | vendor's verification was not false and that the vendor is not in |
---|
164 | 143 | | violation of this subchapter. If a vendor does not provide a |
---|
165 | 144 | | response in the manner provided by this subsection, the entity's |
---|
166 | 145 | | determination under Subsection (a) becomes a final determination. |
---|
167 | 146 | | (c) Not later than the 60th day after the date the |
---|
168 | 147 | | governmental entity receives a vendor's response as provided under |
---|
169 | 148 | | Subsection (b), the governmental entity shall review the response |
---|
170 | 149 | | and notify the vendor of the entity's final determination based on |
---|
171 | 150 | | the evidence provided by the vendor. |
---|
172 | 151 | | (d) A governmental entity, on making a final determination |
---|
173 | | - | that a vendor violated this subchapter, shall: |
---|
174 | | - | (1) refer the matter to the attorney general, a |
---|
175 | | - | district attorney, or a county attorney, as applicable, for |
---|
176 | | - | enforcement under Sections 2275.0207 and 2275.0208; and |
---|
177 | | - | (2) notify the comptroller of the final determination |
---|
178 | | - | for purposes of Section 2275.0206. |
---|
| 152 | + | that a vendor violated this subchapter, shall refer the matter to |
---|
| 153 | + | the attorney general, a district attorney, or a county attorney, as |
---|
| 154 | + | applicable, for enforcement under Sections 2275.0207 and |
---|
| 155 | + | 2275.0208. |
---|
184 | | - | (b) A vendor that violates this subchapter may not respond |
---|
185 | | - | to a solicitation for or be awarded a contract for goods or services |
---|
186 | | - | by any governmental entity until the fifth anniversary of the date |
---|
187 | | - | the vendor receives a final determination under Section 2275.0204. |
---|
188 | | - | Sec. 2275.0206. DEBARMENT BY COMPTROLLER. On receiving |
---|
189 | | - | notice of a final determination under Section 2275.0204 that a |
---|
190 | | - | vendor violated this subchapter, the comptroller shall bar the |
---|
191 | | - | vendor from participating in state contracts until the fifth |
---|
192 | | - | anniversary of the date the vendor receives the final determination |
---|
| 161 | + | (b) A vendor that violates this subchapter is barred from |
---|
| 162 | + | responding to a solicitation for or being awarded a contract for |
---|
| 163 | + | goods or services by any governmental entity until the fifth |
---|
| 164 | + | anniversary of the date the vendor receives a final determination |
---|
194 | 173 | | Sec. 2275.0207. CIVIL PENALTY. (a) A vendor that violates |
---|
195 | 174 | | this subchapter is liable to the state for a civil penalty in an |
---|
196 | 175 | | amount equal to the greater of: |
---|
197 | 176 | | (1) twice the amount of the contract terminated under |
---|
198 | 177 | | Section 2275.0205; or |
---|
199 | 178 | | (2) the amount of loss suffered by the state from |
---|
200 | 179 | | terminating the contract. |
---|
201 | 180 | | (b) The attorney general may bring an action to recover a |
---|
202 | 181 | | civil penalty imposed under this section. |
---|
203 | 182 | | (c) The attorney general may recover reasonable attorney's |
---|
204 | 183 | | fees and court costs in bringing an action under this section. |
---|
205 | 184 | | Sec. 2275.0208. CRIMINAL PENALTY. (a) A vendor that |
---|
206 | 185 | | violates this subchapter commits an offense. |
---|
207 | 186 | | (b) An offense under this section is a state jail felony. |
---|
208 | 187 | | SECTION 6. Subchapter B, Chapter 2275, Government Code, as |
---|
209 | 188 | | added by this Act, applies only to a contract for which the request |
---|
210 | 189 | | for bids or proposals or other applicable expression of interest is |
---|
211 | 190 | | made public on or after the effective date of this Act. A contract |
---|
212 | 191 | | for which the request for bids or proposals or other applicable |
---|
213 | 192 | | expression of interest is made public before that date is governed |
---|
214 | 193 | | by the law in effect on the date the request or other expression of |
---|
215 | 194 | | interest is made public, and the former law is continued in effect |
---|
216 | 195 | | for that purpose. |
---|
217 | 196 | | SECTION 7. This Act takes effect September 1, 2025. |
---|