HB2134 - 572R

Be it enacted by the Legislature of the State of Arizona:

Section 1. Title 18, chapter 1, article 1, Arizona Revised Statutes, is amended by adding section 18-105, to read:

START_STATUTE18-105. Software; critical infrastructure; critical communications infrastructure; annual prohibited technologies list; definitions

A. Any software that is used for critical infrastructure in this state may not be produced by a Chinese company.

B. On or before January 1 of each year, if a critical communications infrastructure provider is a participant in the secure and trusted communications networks reimbursement program pursuant to 47 United States Code section 1601, the critical communications infrastructure provider shall certify to the corporation commission any instance of prohibited critical communications infrastructure equipment use, along with the geographic coordinates of the areas served by the prohibited equipment. If the critical communications infrastructure provider is certified by the corporation commission, the critical communications infrastructure provider shall submit a status report to the corporation commission at the same time that any report is sent to the federal government in compliance with the secure and trusted communications networks reimbursement program pursuant to this subsection. Each quarter, the corporation commission shall produce a map of this state that details the geographic areas serviced by critical communications infrastructure and that includes areas where equipment that is manufactured by a Chinese company is located.

C. Any critical communications infrastructure provider that removes, discontinues or replaces any equipment that is prohibited by this section is not required to obtain an additional permit from any state agency or political subdivision of this state for the removal, discontinuance or replacement of the prohibited equipment.

D. A governmental entity or a critical infrastructure service provider in this state may not enter into or renew a contract with a Chinese company if the contract provides the Chinese company with direct or indirect access to the critical infrastructure.

E. On or before March 31, 2027 and each year thereafter, each governmental entity and critical infrastructure service provider in this state shall certify to the corporation commission that the provider has not attached to the critical infrastructure or connected to any operating system that is used by the critical infrastructure service provider any additional technology that is prohibited by the corporation commission and that was not in use in this state before the effective date of this section.

F. On or before December 31, 2026 and each year thereafter, the corporation commission shall publish a list of all technologies that are prohibited pursuant to this section from being attached to critical infrastructure or connected to the operating system that is used by the critical infrastructure and shall post the list on the corporation commission's website. The list must include, at a minimum, any wi-fi router and modem system, any camera-based school bus infraction detection system, speed detection system, traffic infraction detector system and other camera system, battery technology or smart meter technology, solar inverters and any product that contains cellular internet-of-things modules that are produced by a Chinese company.

G. Except as provided in subsection H of this section, if monies are appropriated and distributed to facilitate the removal, each governmental entity and critical infrastructure service provider in this state shall remove any technology that the corporation commission includes on the prohibited technologies list pursuant to subsection F of this section.

H. A governmental entity or critical infrastructure service provider in this state may continue to purchase and use any prohibited technology pursuant to this section if all of the following apply:

1. There are no other reasonable providers of the prohibited technology.

2. The purchase or use of the prohibited technology is preapproved by the corporation commission.

3. Not purchasing or using the prohibited technology would pose a greater threat to this state than the threat associated with the prohibited technology.

I. For the purposes of this section:

1. "Chinese company":

(a) Means any company, other than a United States person or United States subsidiary as defined in 15 Code of Federal Regulations section 772.1, that is any of the following:

(i) Domiciled, incorporated, issued or listed in the People's Republic of China.

(ii) Headquartered in the People's Republic of China.

(iii) Has its principal place of business in the People's Republic of China.

(iv) Controlled by the government of the People's Republic of China, the Chinese Communist Party or the Chinese military, or any instrumentality thereof, including the State-owned Assets Supervision and Administration Commission of the State Council or the National Social Security Fund.

(v) Majority-owned by an entity controlled by the government of the People's Republic of China, the Chinese Communist Party or the Chinese military, or any instrumentality thereof, including the State-owned Assets Supervision and Administration Commission of the State Council or the National Social Security Fund.

(b) Does not include a parent, subsidiary or affiliate company of an entity prescribed in SUBDIVISION (a) of this paragraph if the parent, subsidiary or affiliate company does not meet the criteria listed in SUBDIVISION (a) of this paragraph and does not recognize more than fifty percent of the parent's, subsidiary's or affiliate company's total annual global revenue from China and Hong Kong combined.

2. "Critical communications infrastructure" means all physical broadband infrastructure and equipment that supports the transmission of information and that allows the user to engage in communications, including service provided directly to the public.

3. "Critical infrastructure" means infrastructure that is owned or operated by this state, a political subdivision of this state or a publicly regulated utility and that is any of the following:

(a) A gas and oil production, storage or delivery system.

(b) A water supply refinement, storage or delivery system.

(d) A telecommunications network.

(e) A transportation system and service.

(f) A personal data storage system, including cybersecurity.

(g) An emergency service.

4. "Domiciled" means located in a country where either the company is registered, the company's affairs are primarily completed or the majority of the company's ownership shares are held.

5. "School bus infraction detection system" means an automated system installed on a school bus that consists of cameras, sensors and software designed to detect, record and document traffic violations, INCLUDING illegally passing the bus when its stop arm is extended and warning lights are activated, to enhance student safety and enforce compliance with traffic laws. END_STATUTE

Sec. 2. Title 44, Arizona Revised Statutes, is amended by adding chapter 42, to read:

CHAPTER 42

CRITICAL INFRASTRUCTURE

ARTICLE 1. PROHIBITED AGREEMENTS

START_STATUTE44-8051. Definition of critical infrastructure

In this chapter, unless the context otherwise requires, "critical infrastructure" means infrastructure that is owned or operated by this state, a political subdivision of this state or a publicly regulated utility and that is any of the following:

1. A gas and oil production, storage or delivery system.

2. A water supply refinement, storage or delivery system.

3. An electrical power delivery system.

4. A telecommunications network.

5. A transportation system and service.

6. A personal data storage system, including cybersecurity.

7. An emergency service. END_STATUTE

START_STATUTE44-8052. Critical infrastructure; prohibited agreements and contracts; exceptions; secure and dedicated communications channel

A. Except as provided in subsection B of this section, a governmental entity or a publicly regulated utility in this state may not enter into an agreement or contract involving critical infrastructure in this state with the people's republic of China if under the agreement or contract the people's republic of China, directly or remotely, would be able to access or control critical infrastructure in this state.

B. A governmental entity or a publicly regulated utility in this state may enter into an agreement or contract involving critical infrastructure in this state with the people's republic of China if any of the following applies:

1. No other reasonable option exists for addressing a need that is relevant to critical infrastructure in this state.

2. The agreement or contract is preapproved by the corporation commission.

3. Not entering into the agreement or contract would pose a greater threat to this state than the threat associated with entering into the agreement or contract.

C. The corporation commission shall establish a secure and dedicated communications channel for critical infrastructure providers and military installations across this state to connect with the corporation commission and the office of the governor in the event of an emergency that damages critical communications infrastructure. For the purposes of this subsection, "critical communications infrastructure" has the same meaning prescribed in section 18-105. END_STATUTE

Sec. 3. Short title

This act may be cited as the "Arizona Critical Infrastructure Protection Act".