88R24128 JCG-D     By: Anderson H.B. No. 3289     Substitute the following for H.B. No. 3289:     By:  Smithee C.S.H.B. No. 3289       A BILL TO BE ENTITLED   AN ACT   relating to prohibiting the use of certain social media   applications and services on devices owned or leased by state   agencies.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  Subtitle B, Title 6, Government Code, is amended   by adding Chapter 674 to read as follows:   CHAPTER 674.  USE OF CERTAIN SOCIAL MEDIA APPLICATIONS AND SERVICES   ON STATE AGENCY DEVICES PROHIBITED          Sec. 674.001.  DEFINITIONS. In this chapter:                (1)  "Prohibited application" means:                      (A)  a social media application or service   included on the list published by the Department of Information   Resources under Section 674.005; or                      (B)  a social media application or service   specified by executive order of the governor under Section 674.004.                (2)  "State agency" means:                      (A)  a department, commission, board, office, or   other agency that is in the executive or legislative branch of state   government and that was created by the constitution or a statute,   including an institution of higher education as defined by Section   61.003, Education Code; or                      (B)  the supreme court, the court of criminal   appeals, a court of appeals, or the Texas Judicial Council or   another agency in the judicial branch of state government.          Sec. 674.002.  PROHIBITION; MODEL POLICY. (a)  Subject to   Section 674.003, a state agency shall adopt a policy prohibiting   the installation or use of a prohibited application on any device   owned or leased by the state agency and requiring the removal of   prohibited applications from those devices.          (b)  The Department of Information Resources and the   Department of Public Safety shall jointly develop a model policy   for state agencies to use in developing the policy required by   Subsection (a).          Sec. 674.003.  EXCEPTIONS; MITIGATING MEASURES.  (a)  A   policy adopted under Section 674.002 may include an exception   allowing the installation and use of a prohibited application to   the extent necessary:                (1)  for providing law enforcement;                (2)  for developing or implementing information   security measures; or                (3)  to allow other legitimate governmental uses as   jointly determined by the Department of Information Resources and   the Department of Public Safety.          (b)  A policy allowing the installation and use of a   prohibited application under Subsection (a) must require:                (1)  the use of measures to mitigate risks to the   security of state agency information during the use of the   prohibited application; and                (2)  the documentation of those measures.          (c)  The administrative head of a state agency must approve   in writing the installation and use of a prohibited application   under an exception described by Subsection (a) by employees of the   state agency and report the approval to the Department of   Information Resources.          Sec. 674.004.  APPLICATIONS IDENTIFIED BY GOVERNOR'S ORDER.   The governor by executive order may identify social media   applications or services that pose a threat to the security of the   state's sensitive information, critical infrastructure, or both.          Sec. 674.005.  APPLICATION IDENTIFIED BY DEPARTMENT OF   INFORMATION RESOURCES AND DEPARTMENT OF PUBLIC SAFETY. (a)  The   Department of Information Resources and the Department of Public   Safety, in consultation with the office of the governor, shall   jointly identify social media applications or services that pose a   threat to the security of the state's sensitive information,   critical infrastructure, or both.          (b)  The Department of Information Resources shall publish   annually and maintain on the department's publicly accessible   Internet website a list of the prohibited applications identified   under Subsection (a).          SECTION 2.  Not later than the 60th day after the date the   Department of Information Resources and the Department of Public   Safety make available the model policy required by Section   674.002(b), Government Code, as added by this Act, each state   agency shall adopt the policy required by Section 674.002(a),   Government Code, as added by this Act.          SECTION 3.  This Act takes effect immediately if it receives   a vote of two-thirds of all the members elected to each house, as   provided by Section 39, Article III, Texas Constitution.  If this   Act does not receive the vote necessary for immediate effect, this   Act takes effect September 1, 2023.