| |
| |
|
|
A BILL TO BE ENTITLED
|
|
|
AN ACT
|
|
|
relating to prohibiting the use of certain social media |
|
|
applications and services on devices owned or leased by state |
|
|
agencies. |
|
|
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|
|
SECTION 1. Subtitle B, Title 6, Government Code, is amended |
|
|
by adding Chapter 674 to read as follows: |
|
|
CHAPTER 674. USE OF CERTAIN SOCIAL MEDIA APPLICATIONS AND SERVICES |
|
|
ON STATE AGENCY DEVICES PROHIBITED |
|
|
Sec. 674.001. DEFINITIONS. In this chapter: |
|
|
(1) "Prohibited application" means: |
|
|
(A) a social media application or service |
|
|
included on the list published by the Department of Information |
|
|
Resources under Section 674.005; or |
|
|
(B) a social media application or service |
|
|
specified by executive order of the governor under Section 674.004. |
|
|
(2) "State agency" means: |
|
|
(A) a department, commission, board, office, or |
|
|
other agency that is in the executive or legislative branch of state |
|
|
government and that was created by the constitution or a statute, |
|
|
including an institution of higher education as defined by Section |
|
|
61.003, Education Code; or |
|
|
(B) the supreme court, the court of criminal |
|
|
appeals, a court of appeals, or the Texas Judicial Council or |
|
|
another agency in the judicial branch of state government. |
|
|
Sec. 674.002. PROHIBITION; MODEL POLICY. (a) Subject to |
|
|
Section 674.003, a state agency shall adopt a policy prohibiting |
|
|
the installation or use of a prohibited application on any device |
|
|
owned or leased by the state agency and requiring the removal of |
|
|
prohibited applications from those devices. |
|
|
(b) The Department of Information Resources and the |
|
|
Department of Public Safety shall jointly develop a model policy |
|
|
for state agencies to use in developing the policy required by |
|
|
Subsection (a). |
|
|
Sec. 674.003. EXCEPTIONS; MITIGATING MEASURES. (a) A |
|
|
policy adopted under Section 674.002 may include an exception |
|
|
allowing the installation and use of a prohibited application to |
|
|
the extent necessary: |
|
|
(1) for providing law enforcement; |
|
|
(2) for developing or implementing information |
|
|
security measures; or |
|
|
(3) to allow other legitimate governmental uses as |
|
|
jointly determined by the Department of Information Resources and |
|
|
the Department of Public Safety. |
|
|
(b) A policy allowing the installation and use of a |
|
|
prohibited application under Subsection (a) must require: |
|
|
(1) the use of measures to mitigate risks to the |
|
|
security of state agency information during the use of the |
|
|
prohibited application; and |
|
|
(2) the documentation of those measures. |
|
|
(c) The administrative head of a state agency must approve |
|
|
in writing the installation and use of a prohibited application |
|
|
under an exception described by Subsection (a) by employees of the |
|
|
state agency and report the approval to the Department of |
|
|
Information Resources. |
|
|
Sec. 674.004. APPLICATIONS IDENTIFIED BY GOVERNOR'S ORDER. |
|
|
The governor by executive order may identify social media |
|
|
applications or services that pose a threat to the security of the |
|
|
state's sensitive information, critical infrastructure, or both. |
|
|
Sec. 674.005. APPLICATION IDENTIFIED BY DEPARTMENT OF |
|
|
INFORMATION RESOURCES AND DEPARTMENT OF PUBLIC SAFETY. (a) The |
|
|
Department of Information Resources and the Department of Public |
|
|
Safety, in consultation with the office of the governor, shall |
|
|
jointly identify social media applications or services that pose a |
|
|
threat to the security of the state's sensitive information, |
|
|
critical infrastructure, or both. |
|
|
(b) The Department of Information Resources shall publish |
|
|
annually and maintain on the department's publicly accessible |
|
|
Internet website a list of the prohibited applications identified |
|
|
under Subsection (a). |
|
|
SECTION 2. Not later than the 60th day after the date the |
|
|
Department of Information Resources and the Department of Public |
|
|
Safety make available the model policy required by Section |
|
|
674.002(b), Government Code, as added by this Act, each state |
|
|
agency shall adopt the policy required by Section 674.002(a), |
|
|
Government Code, as added by this Act. |
|
|
SECTION 3. This Act takes effect immediately if it receives |
|
|
a vote of two-thirds of all the members elected to each house, as |
|
|
provided by Section 39, Article III, Texas Constitution. If this |
|
|
Act does not receive the vote necessary for immediate effect, this |
|
|
Act takes effect September 1, 2023. |