Texas 2025 - 89th Regular

Texas Senate Bill SB78 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	89R2505 MPF-F
2	2	By: Hall S.B. No. 78
3	3
4	4
5	5
6	6
7	7	A BILL TO BE ENTITLED
8	8	AN ACT
9	9	relating to the security of election systems.
10	10	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
11	11	SECTION 1. Chapter 279, Election Code, is amended by
12	12	amending Sections 279.002 and 279.003 and adding Sections 279.004
13	13	and 279.005 to read as follows:
14	14	Sec. 279.002. ELECTION CYBERSECURITY: SECRETARY OF STATE.
15	15	(a) The secretary of state shall adopt rules defining classes of
16	16	protected election data and establishing best practices for
17	17	identifying, [and] reducing, and eliminating the risk to the
18	18	electronic use, storage, and transmission of election data and the
19	19	security of election systems, including:
20	20	(1) methods of encrypting data at rest and during
21	21	transmission; and
22	22	(2) restricting access to sensitive election data to
23	23	only users with a specific need to access that data.
24	24	(a-1) The secretary of state shall appoint a dedicated
25	25	cybersecurity expert to implement cybersecurity measures to
26	26	protect all election data and other election-related data held by
27	27	the state or a county in the state, including technology that
28	28	blocks, notifies, and reports on unauthorized attempts to access or
29	29	transfer data.
30	30	(b) The secretary of state shall direct the cybersecurity
31	31	expert to offer training on best practices:
32	32	(1) on a biennial [an annual] basis, to all
33	33	appropriate personnel or contractors with [in] the secretary of
34	34	state's office with access to sensitive election data; and
35	35	(2) on request, to county election officers and any
36	36	employees or contractors of the county election officers with
37	37	access to sensitive election data [in this state].
38	38	(b-1) Access to sensitive election data shall be revoked for
39	39	any employee or contractor that is required to receive training
40	40	under Subsection (b) but does not complete the training.
41	41	(c) If the secretary of state becomes aware of a breach of
42	42	cybersecurity that impacts election data, the secretary shall
43	43	immediately notify the governor, lieutenant governor, speaker of
44	44	the house of representatives, and members of the standing
45	45	committees of each house of the legislature with jurisdiction over
46	46	elections. The secretary shall direct the cybersecurity expert to
47	47	conduct an investigation of the breach and report any findings to
48	48	the governor, lieutenant governor, speaker of the house of
49	49	representatives, and members of the standing committees of each
50	50	house of the legislature with jurisdiction over elections.
51	51	(d) During an investigation conducted under Subsection (c),
52	52	access to the election system is restricted to only individuals
53	53	designated by the secretary of state until the standing committees
54	54	confirm that the breach has been mitigated.
55	55	(e) If the investigation under Subsection (c) reveals that
56	56	individuals' personal data has been breached, the secretary of
57	57	state shall promptly notify the affected individuals by written
58	58	letter of the occurrence and extent of the breach.
59	59	(f) The secretary of state, in cooperation with the
60	60	cybersecurity expert, shall contract with a provider of
61	61	cybersecurity assessments to biennially conduct an assessment of
62	62	the cybersecurity of the state's election system.
63	63	(g) The cybersecurity expert shall implement cybersecurity
64	64	measures to ensure that all devices with access to election data
65	65	held by the state comply to the highest extent possible with rules
66	66	adopted by the secretary of state under Subsection (a).
67	67	Sec. 279.003. ELECTION CYBERSECURITY: COUNTY ELECTION
68	68	OFFICERS. (a) A county election officer shall biennially
69	69	[annually] request training on cybersecurity from the
70	70	cybersecurity expert appointed by the secretary of state under
71	71	Section 279.002. The secretary of state shall pay the costs
72	72	associated with the training with available state funds.
73	73	(b) A county election officer shall contract with a provider
74	74	of cybersecurity assessments to biennially conduct [request] an
75	75	assessment of the cybersecurity of the county's election system
76	76	[from a provider of cybersecurity assessments if the secretary of
77	77	state recommends an assessment and the necessary funds are
78	78	available].
79	79	(b-1) The county election officer shall deliver a report on
80	80	any recommended improvements to the county's election system by the
81	81	assessment conducted under Subsection (b) to the secretary of
82	82	state.
83	83	(c) If a county election officer becomes aware of a breach
84	84	of cybersecurity that impacts election data, the officer shall
85	85	immediately notify the secretary of state. If the secretary of
86	86	state is made aware of a breach under this section, access to
87	87	sensitive election data in the county shall be restricted to
88	88	specific personnel during an investigation by the secretary.
89	89	(d) A [To the extent that state funds are available for the
90	90	purpose, a] county election officer shall implement cybersecurity
91	91	measures to ensure that all devices with access to election data
92	92	comply to the highest extent possible with rules adopted by the
93	93	secretary of state under Section 279.002.
94	94	Sec. 279.004. INTERNAL PERSONNEL VIOLATION. If a data
95	95	breach under this section is conducted by an employee of the
96	96	secretary of state's or county election officer's office, the
97	97	employee may not be provided access to election-related data until
98	98	an investigation under this section is concluded. If an
99	99	investigation determines that the employee intentionally breached
100	100	an election system, the secretary of state may pursue all available
101	101	legal remedies against the employee, including criminal
102	102	prosecution.
103	103	Sec. 279.005. COMPUTER NETWORK CONNECTIVITY. (a) Except
104	104	as expressly authorized by this code, an election system that is
105	105	capable of being connected to the Internet or any other computer
106	106	network may not be used in an election held in this state, except
107	107	for the use of a visible wired connection to an isolated local area
108	108	network within the building.
109	109	(b) The cybersecurity expert appointed by the secretary of
110	110	state under Section 279.002 shall annually verify compliance with
111	111	this section by each county conducting an election in this state.
112	112	SECTION 2. Section 123.034, Election Code, is amended to
113	113	read as follows:
114	114	Sec. 123.034. MAINTENANCE AND STORAGE OF EQUIPMENT. (a)
115	115	The governing body of a political subdivision shall provide for the
116	116	proper maintenance and storage of the equipment that the
117	117	subdivision acquires for use in the operation of a voting system.
118	118	(b) Equipment used in the operation of a voting system must
119	119	have a documented chain of custody and be stored in a locked
120	120	facility with video surveillance monitoring the storage facility at
121	121	all times.
122	122	SECTION 3. As soon as practicable after the effective date
123	123	of this Act, the secretary of state shall:
124	124	(1) adopt the rules required by Section 279.002(a),
125	125	Election Code, as amended by this Act; and
126	126	(2) appoint a cybersecurity expert in accordance with
127	127	Section 279.002(a-1), Election Code, as added by this Act.
128	128	SECTION 4. This Act takes effect September 1, 2025.