SB1585 - Relating to a prohibition on governmental contracts with companies of foreign adversaries for certain information and communications technology; authorizing a civil penalty; creating a criminal offense.

      By: Hughes, et al. S.B. No. 1585     (McQueeney)           A BILL TO BE ENTITLED   AN ACT   relating to a prohibition on governmental contracts with companies   of foreign adversaries for certain information and communications   technology; authorizing a civil penalty; creating a criminal   offense.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  The heading to Chapter 2275, Government Code, is   amended to read as follows:   CHAPTER 2275. PROHIBITION ON CONTRACTS WITH CERTAIN FOREIGN-OWNED   COMPANIES IN CONNECTION WITH CRITICAL INFRASTRUCTURE AND   INFORMATION AND COMMUNICATIONS TECHNOLOGY          SECTION 2.  Chapter 2275, Government Code, is amended by   designating Sections 2275.0101 through 2275.0103 as Subchapter A   and adding a subchapter heading to read as follows:   SUBCHAPTER A. PROHIBITION ON CERTAIN CONTRACTS IN CONNECTION WITH   CRITICAL INFRASTRUCTURE          SECTION 3.  Section 2275.0101, Government Code, is amended   to read as follows:          Sec. 2275.0101.  DEFINITIONS. In this subchapter [ chapter ]:                (1)  "Company" means a sole proprietorship,   organization, association, corporation, partnership, joint   venture, limited partnership, limited liability partnership, or   limited liability company, including a wholly owned subsidiary,   majority-owned subsidiary, parent company, or affiliate of those   entities or business associations, that exists to make a profit.                (2)  "Critical infrastructure" means a communication   infrastructure system, cybersecurity system, electric grid,   hazardous waste treatment system, or water treatment facility.                (3)  "Cybersecurity" means the measures taken to   protect a computer, computer network, computer system, or other   technology infrastructure against unauthorized use or access.                (4)  "Designated country" means a country designated by   the governor as a threat to critical infrastructure under Section   2275.0103.                (5)  "Governmental entity" means a state agency, a   political subdivision, or an independent organization certified   under Section 39.151, Utilities Code, to perform a function   described by Section 39.151(a), Utilities Code.                (6)  "Affiliate," with respect to a company entering   into an agreement in which the critical infrastructure is electric   grid equipment, has the meaning assigned by the protocols of the   independent organization certified under Section 39.151, Utilities   Code, for the ERCOT power region.          SECTION 4.  Section 2275.0103(a), Government Code, is   amended to read as follows:          (a)  The governor, after consultation with the public safety   director of the Department of Public Safety, may designate a   country as a threat to critical infrastructure for purposes of this   subchapter [ chapter ].          SECTION 5.  Chapter 2275, Government Code, is amended by   adding Subchapter B to read as follows:   SUBCHAPTER B. PROHIBITION ON CERTAIN CONTRACTS IN CONNECTION WITH   INFORMATION AND COMMUNICATIONS TECHNOLOGY           Sec. 2275.0201.  DEFINITIONS. In this subchapter:                 (1)     "Company"   has the meaning assigned by Section   2275.0101.                 (2)     "Control" means the direct or indirect power,   whether or not exercised, to determine, direct, or decide important   matters affecting a company through the ownership of a majority or a   dominant minority of the total outstanding voting interest in the   company, board representation, proxy voting, special share,   contractual arrangement, formal or informal arrangement to act in   concert, or other means of exercising power.                 (3)  "Foreign adversary" means:                       (A)  the People's Republic of China; or                       (B)     any country listed on the entity list under   Supplement No. 4 to 15 C.F.R. Part 744 because there is reasonable   cause to believe the country is involved, has been involved, or   poses a significant risk of being or becoming involved in   activities contrary to the national security or foreign policy   interests of the United States of America.                 (4)     "Governmental entity" has the meaning assigned by   Section 2251.001.                 (5)     "Information or communications technology or   service" means a product or service that:                       (A)     is designed to facilitate by electronic means   the processing, storage, retrieval, communication, transmission,   or display of information or data; and                       (B)  allows a foreign adversary to:                             (i)  store data;                               (ii)     communicate independently of the   product or service;                               (iii)  independently control systems; or                             (iv)     independently engage in two-way   communication.                   (6)     "Scrutinized company" means a company or a wholly   owned subsidiary or majority-owned subsidiary of a company that is:                       (A)     identified on the covered list under 47   C.F.R. Section 1.50002 as producing or providing communications   equipment or a service that poses an unacceptable risk to the   national security of the United States or the security and safety of   United States persons; or                       (B)     as provided by 15 C.F.R. Part 791, not a   United States person and has been subject to a determination by the   United States secretary of commerce, or the secretary's designee,   as involved in a transaction related to an information or   communications technology or service that posed an undue or   unacceptable risk.                 (7)     "Two-way communication"   means, with respect to an   information or communications technology or service, systems or   components that facilitate the bidirectional exchange of   information which may include remote or unauthorized access.           Sec.   2275.0202.     CONTRACTS WITH SCRUTINIZED COMPANIES   PROHIBITED; EXCEPTION. (a)   Except as provided by Subsection (b), a   scrutinized company may not submit a bid for a contract or enter   into a contract with a governmental entity relating to an   information or communications technology or service.           (b)     A governmental entity may enter into a contract relating   to an information or communications technology or service with a   scrutinized company if the governmental entity, with the approval   of the governor, determines:                 (1)     the only vendors available to provide the   information or communications technology or service are   scrutinized companies;                 (2)     the cost to this state of finding and contracting   with a vendor that is not a scrutinized company would be so   disproportionately high that the use of a vendor that is a   scrutinized company would be overwhelmingly in the best interest of   this state; or                 (3)     any goods or services that originate with a   scrutinized company and may be used in the performance of the   contract constitute a de minimis amount of the total value of the   goods and services provided under the contract and pose no risk to   the security of this state.           Sec.   2275.0203.     VERIFICATION REQUIRED. (a)   A vendor   submitting a bid for a contract relating to an information or   communications technology or service shall include in the bid a   written verification that the vendor:                 (1)  is not a scrutinized company;                 (2)     will not contract with a scrutinized company for   any aspect of its performance under the contract; and                 (3)     will not procure products or services from or that   originate with a scrutinized company for use in the performance of   the contract.           (b)     A governmental entity may not enter into a contract   relating to an information or communications technology or service   with a vendor that fails to provide the verification required by   Subsection (a).           Sec.   2275.0204.     FALSE VERIFICATION; VIOLATION. (a) A   governmental entity that determines that a vendor holding a   contract with the entity was ineligible to have the contract   awarded under Section 2275.0202 because the vendor's written   verification was false shall notify the vendor that the vendor is in   violation of this subchapter. The notice must include the basis for   the entity's determination that the vendor is in violation of this   subchapter.           (b)     Not later than the 60th day after the date a vendor   receives a notice under Subsection (a), the vendor may provide a   written response to the governmental entity with evidence that the   vendor's verification was not false and that the vendor is not in   violation of this subchapter. If a vendor does not provide a   response in the manner provided by this subsection, the entity's   determination under Subsection (a) becomes a final determination.           (c)     Not later than the 60th day after the date the   governmental entity receives a vendor's response as provided under   Subsection (b), the governmental entity shall review the response   and notify the vendor of the entity's final determination based on   the evidence provided by the vendor.           (d)     A governmental entity, on making a final determination   that a vendor violated this subchapter, shall:                 (1)     refer the matter to the attorney general, a   district attorney, or a county attorney, as applicable, for   enforcement under Sections 2275.0207 and 2275.0208; and                 (2)     notify the comptroller of the final determination   for purposes of Section 2275.0206.           Sec.   2275.0205.     CONTRACT TERMINATION FOR FALSE   VERIFICATION;   BARRING FROM STATE CONTRACTS. (a)   A governmental   entity, on making a final determination that a vendor violated this   subchapter, shall immediately terminate the contract without   further obligation to the vendor.           (b)     A vendor that violates this subchapter may not respond   to a solicitation for or be awarded a contract for goods or services   by any governmental entity until the fifth anniversary of the date   the vendor receives a final determination under Section 2275.0204. & [Text truncated for display. Full text available on LegiScan.]