HSB 704

This bill requires that government agencies only use a drone that meets minimum security requirements unless the government agency uses the drone for research and accountability purposes and notifies the department of homeland security and emergency management (HSEMD) in writing. The bill prohibits a government agency from purchasing, acquiring, or using a drone produced by a manufacturer domiciled in a country of concern, defined in the bill, or that a government agency reasonably believes to be owned or controlled by a country of concern or a company domiciled in a country of concern. The bill requires a government agency using a tier one drone to follow certain precautions when connecting the drone to the internet, a computer, or a network. A government agency is prohibited from connecting a tier one drone or the drone’s software to the internet unless it is for purposes of command and control, coordination, or other communication to ground control stations. The command and control, coordination, or other ground control systems to which a drone is connected must be secured and monitored or isolated from networks where the data of a government agency is held. _____ internet or a network where a government agency’s data is held or that the computer or network to which the drone connects is isolated to prevent such access. When a government agency transfers data to a network where government data is held, the government agency must conduct scans for malicious code and use antivirus and antimalware software during the data transfer. The bill also prohibits a government agency from connecting a tier one drone or the drone’s software with a telephone, tablet, or other mobile device that was issued by a government agency or that connects to a government agency network unless the device is used solely for command and control, coordination, or other communication to ground control stations and does not connect to a government agency network. A government agency using a tier two drone must comply with all security requirements for a tier one drone, use an encryption algorithm that complies with federal standards for all communication to and from a drone, and refrain from purchasing critical drone components from a manufacturer owned, controlled by, or connected to a country of concern. A government agency using a tier three drone must comply with all security requirements for tier one and two drones and store all data in the United States. A government agency must not use a tier three drone to remotely access data from outside the United States without written approval from the agency’s top official. The bill restricts drone usage over sensitive locations, defined in the bill. The bill prohibits a user of a drone from flying the drone over a sensitive location unless the user is a law enforcement officer or the user is authorized by the authority in charge of the sensitive location. A provider of flight-mapping software must geofence the state’s sensitive locations. A violation of these provisions is a serious misdemeanor. A serious misdemeanor is punishable by confinement for no more than one year and a fine of at least $430 but not more than $2,560. _____ To continue using a noncompliant drone after the passage of the bill, an agency must provide written notice to HSEMD every six months about such use. A government agency must not use a noncompliant drone after July 1, 2029.