 |
ARIZONA STATE SENATE
Fifty-Sixth Legislature, Second Regular Session
drones; prohibition; autonomous vehicles
Purpose
Preempts the state from using light detection and ranging equipment, including drones, that is manufactured in or by a company domiciled in a country of concern (CoC) from being used for state infrastructure or included in any state procurement or state-authorized autonomous vehicle, excluding the restricted use of a drone, and outlines related requirements, prohibitions and penalties for the removal and replacement of prohibited equipment, data transfers and sensitive locations.
Background
It is unlawful for a person to operate a model aircraft or a civil unmanned aircraft if the operation: 1) is prohibited by a federal law or regulation that governs aeronautics, including Federal Aviation Administration regulations; or 2) interferes with a law enforcement, firefighter or emergency services operation. Furthermore, it is also unlawful for a person to operate or use an unmanned aircraft or unmanned aircraft system to intentionally photograph or loiter over or near a critical facility in the furtherance of any criminal offence. A city or town is prohibited from enacting or adopting any ordinance, policy or rule that relates to the ownership or operation of an unmanned aircraft or unmanned aircraft system or otherwise engage in the regulation of the ownership or operation of an unmanned aircraft or an unmanned aircraft system. An unmanned aircraft is an aircraft, including an aircraft commonly known as a drone, that is operated without the possibility of direct human intervention from within or on the aircraft (A.R.S. § 13-3729).
Critical
infrastructure is systems and assets, whether physical or virtual, that are
so vital to Arizona and the United States that the incapacity or destruction of
those systems and assets would have a debilitating impact on security, economic
security, public health or safety (A.R.S.
§ 41-1801).
There is no anticipated fiscal impact to the state General Fund associated with this legislation.
Provisions
Prohibited Light Detection and Ranging Equipment
1. Prohibits any light detection and ranging equipment manufactured in or by a company domiciled, or owned by a company domiciled, in a CoC from being:
a) used for any new state infrastructure constructed in Arizona; or
b) included in procurement made by an agency or a political subdivision of the state.
2. Requires any existing state infrastructure that is currently using prohibited light detection and ranging equipment to remove and replace the equipment within 90 days of the effective date of this legislation.
3. Preempts an autonomous vehicle that includes any light detection and ranging equipment manufactured in or by a company domiciled in a CoC from being issued any certification, license or regulatory approval concerning the vehicle's approval, use or operation in Arizona.
4. Defines light detection and ranging equipment as a remote sensing method that uses the emission of laser light, through pulsed lasers to detect and measure the range of surrounding objects, often for the purpose of producing real-time, high-resolution three directional maps of a device's physical environment.
5. Includes, in the definition of light detection and ranging equipment, automation and smart infrastructure applications, autonomous vehicles, drones, port cranes, drawbridges, traffic signals, airport security systems and other sensitive sites.
6. Defines a CoC as China, Cuba, Iran, North Korea, Russia, Saudi Arabia, Syria or Venezuela.
Prohibited Drones
7. Prohibits any state, county, local or municipal governmental entity (agency) from purchasing, acquiring or using a drone, or any related equipment, produced by either:
a) a manufacturer domiciled in, owned or controlled by a CoC; or
b) a company owned by or domiciled in a CoC.
8. Allows an agency to use a prohibited drone if the agency:
a) weighs the goals of the research against the risk to any networks or data when using a drone;
b) uses the drone for research and accountability purposes only; and
c) provides written notice to the Arizona Department of Homeland Security (AZDOHS) at least 30 days before using a drone.
9. Requires each notice to state the intended purpose of the use, the participants and any benefits of the research.
10. Directs an agency to provide access to any research findings on request by AZDOHS.
11. Requires a drone, or the drone's software, that is used by an agency to be used in compliance with all other applicable data standards as required by law and the agency's policies and procedures.
12. Authorizes a drone, or the drone's software, that is used by an agency to connect to:
a) the internet, only for the purpose of command and control, coordination or other communications to ground control stations or systems related to the mission of the drone; and
b) a computer or the network of an agency if the drone or the drone's software:
i. is isolated in a way that prevents access to the internet and any network where the agency's data is held; and
ii. uses removable memory to connect to the computer or network that is isolated in a way that prevents access to a network where the agency's data is held.
13. Stipulates that, if a drone connects to the internet, the agency must require that the command and control, coordination or other communications to ground control stations or systems be secure, monitored and isolated from any networks in which the agency's data is held.
14. Requires any transfer of data between an isolated network and the network where the agency's data is held to use antivirus or antimalware software:
a) for an initial scan for malicious code on the computer connected directly or indirectly to the drone;
b) during a data transfer; and
c) to scan the destination of the transferred data for malicious code.
15. Prohibits remote access to data storage, other than open data, from outside the United States, unless approved in writing by an agency director, or the director's designee.
16. Prohibits a drone or the drone's software that is used by an agency from connecting with a telephone, tablet or other mobile device that is issued by an agency or that connects to an agency's network.
17. Requires the AZDOHS, in consultation with other state, local and federal authorities, to identify the geographic coordinates of sensitive installations within Arizona for the purpose of prohibiting drone usage over the sensitive locations.
18. Directs the providers of flight mapping software or other programs for operating a drone to geofence Arizona's sensitive locations to prevent any drones from flying over the state's sensitive locations.
19. Requires a tier two drone, or any related services or equipment, to use a federal information process standard (FIPS) complaint encryption algorithm for all communications to and from the tier two drone.
20. Prohibits the critical components of a tier two drone from being produced by a manufacturer domiciled in or owned or controlled by or otherwise connected to a CoC.
21. Restricts the data storage of a tier three drone to the geographic location of the United States.
22. Subjects, to a class 1 misdemeanor, a provider of any flight mapping software that allows a user to fly a drone over a sensitive location, unless the user is a law enforcement agency in the state.
23. Subjects, to a class 1 misdemeanor, a user of a drone not using flight mapping software who flies a drone over a sensitive location, excluding:
a) a law enforcement agency in the state; and
b) drone users who have permission of the authority in charge of the sensitive location to operate a drone in, on or above the sensitive location.
24. Defines an agency as any state, county, local or municipal governmental entity.
25. Defines a CoC as China, Cuba, Iran, North Korea, Russia, Saudi Arabia, Syria or Venezuela and includes any other entity or agent under significant control of a CoC.
Miscellaneous
26. Defines domiciled as either the country where a company is registered, where the company affairs are primarily completed or where the majority of ownership share is held.
27. Defines critical infrastructure and state critical infrastructure as systems and assets, whether physical or virtual, that are so vital to Arizona and the United States that the incapacity or destruction of those systems and assets would have a debilitating impact on security, economic security, public health or safety and includes:
a) gas and oil production, storage or delivery systems;
b) water supply refinement, storage or delivery systems;
c) electrical power delivery systems;
d) telecommunications networks;
e) transportation systems and services; and
f) personal data or otherwise classified information storage systems, including cybersecurity.
29. Defines state transportation infrastructure as including airports, roadways, railways, ports and public transit, as prescribed.
30. Defines drone as an unmanned aircraft, watercraft, ground vehicle or robotic device that is controlled by a human operator or that operates autonomously through computer software or other programming.
31. Defines a tier three drone as a drone that collects, transmits or receives any data, including visual and auditory data.
32. Defines a tier two drone as a drone that collects, transmits or receives only flight control data, excluding visual and auditory data.
33. Defines a critical component as a drone component related to cameras, data storage, data transmission devices, gimbals, ground control systems, network connectivity, radio or operating software, including cell phone or tablet applications.
34. Excludes, from the definition of critical component, passive electronics, resistors, nondate transmitting motors, batteries or wiring.
35. Defines flight mapping software as any program or ground control system that allows for users to either:
a) input a set of coordinates or locations to which the drone will autonomously fly in a predetermined flight pattern; or
b) control the flight path or destination of the drone from any device other than a dedicated handheld controller within sight of the drone.
36. Defines geofence as a virtual geographic boundary that is:
a) defined by the global positioning system, radio frequency identification or some other location positioning technology; and
b) created to prevent the use of drones within a restricted geographic area.
37. Defines open data as data that is fully discoverable and usable by the public.
38. Excludes, from the definition of open data, data that:
a) an agency assesses a fee for its distribution; or
b) is restricted from public disclosure based on federal or state laws and regulations, including laws and regulations related to privacy, confidentiality, security, personal health, business, trade secret information and exemptions from state public records laws.
39. Defines sensitive location as any location in Arizona where the use of a drone is prohibited and that must be geofenced by companies that provide flight mapping software to prevent unauthorized use of drones.
40. Stipulates that a sensitive location includes all military locations, power stations, critical infrastructure and any other locations.
41. Defines research and accountability purposes as research on drone hardware, operating systems, software, communications systems and protocols, components and data practices for the purpose of understanding the existence and extent of potential threats and vulnerabilities.
42. Defines data, instructional technology and autonomous vehicle.
43. Becomes effective on the general effective date.
Prepared by Senate Research
February 5, 2024
KJA/sdr