Loading...
HomeMy WebLinkAboutPR 24104: THE REMOVAL OF TIKTOK FROM THE CITY OF PORT ARTHUR DEVICES City of ort rtltu�� Texas www.PortArthurTx.gov INTEROFFICE MEMORANDUM Date: January 9,2025 To: The Honorable Mayor and City Council Through: Ronald Burton, City Manager // From: Dr. Albert T. Thigpen, CAS, IPMA-SCP Assistant City Manager—Administration RE: Proposed Resolution No. 24104 Introduction: This agenda item seeks City Council's adoption of a "Covered Applications and Prohibited Technology Policy" to fulfill the requirements of Senate Bill 1893 and the Office of the Governor's directive regarding the installation and use of prohibited technologies on devices used to conduct business. Background: As Required by Governor Greg Abbott's directive and Senate Bill 1893, this policy establishes a covered applications policy that prohibits using covered applications on City of Port Arthur devices. Budget Impact: The creation of the policy does not have a budgetary impact. The systems used to monitor and manage covered devices specified in Senate Bill 1893 are licensed per device. Therefore, the costs for licenses required to enforce the policy will increase proportionately to the quantity of City-owned devices. Recommendation: The recommendation is for the City Council to adopt the"Covered Applications and Prohibited Technology Policy" in compliance with Senate Bill 1893 as directed by the Office of the Governor. "Remember,we are here to serve the Citizens of Port Arthur" P.O.Box 1089 X Port Arthur,Texas 77641-1089 X 409.983.8101 X FAX 409.982.6743 P.R. No. 24104 12/31/24 TNR RESOLUTION NO. A RESOLUTION ADOPTING A POLICY IN COMPLIANCE WITH S.B. 1893 TO PROHIBIT THE INSTALLATION AND REQUIRE THE REMOVAL OF TIKTOK OR OTHER COVERED APPLICATIONS ON DEVICES OWNED OR LEASED BY THE CITY OF PORT ARTHUR WHEREAS, the Texas Legislature enacted Senate Bill 1893, which mandates governmental entities to implement policies prohibiting the installation of TikTok or other covered applications on any device owned or leased by the governmental entity and to require the removal of such applications from said devices; and WHEREAS, TikTok and similar covered applications pose potential cybersecurity risks to governmental operations, including unauthorized access to sensitive or confidential information; and WHEREAS, the City of Port Arthur is committed to safeguarding the integrity, security, and confidentiality of its information technology systems and networks; and WHEREAS, the adoption of a policy to comply with S.B. 1893 will enhance the City's ability to protect its digital infrastructure and reduce vulnerabilities to cyber threats; and WHEREAS, the City of Port Arthur hereby adopts the Policy Prohibiting the Installation and Requiring the Removal of Covered Applications, attached hereto as Exhibit "A" and incorporated herein by reference, to comply with the requirements of S.B. 1893 Exhibit"B." NOW,THEREFORE,BE IT RESOLVED BY THE CITY COUNCIL OF THE CITY OF PORT ARTHUR, TEXAS: SECTION 1. That the facts and opinions in the preamble are true and correct. SECTION 2. That the City of Port Arthur hereby adopts the Policy Prohibiting the Installation and Requiring the Removal of Covered Applications, attached hereto as Exhibit "A" and incorporated herein by reference, to comply with the requirements of S.B. 1893. SECTION 3. That the adopted policy shall: 1. Prohibit the installation or use of TikTok or any covered application on any device owned or leased by the City of Port Arthur, including but not limited to computers, smartphones, tablets, and other electronic devices. 2. If currently installed, TikTok or any covered application must be immediately removed from all devices owned or leased by the City of Port Arthur. SECTION 4. That the City Manager is directed to oversee the implementation of this policy, including: Policy Prohibiting the Installation and Requiring the Removal of Covered Applications on Devices Owned or Leased by the City of Port Arthur P.R. No. 24104 12/31/24 TNR 1. Ensure all City-owned or leased devices are audited to confirm compliance. 2. Providing employees with guidance and resources to support adherence to the policy. 3. Enforcing disciplinary measures as outlined in the policy for violations. SECTION 5. That suppose any provision of this resolution or the attached policy is held invalid. In that case, the remainder of this resolution and policy shall not be affected and shall remain in full force and effect. All ordinances or policies in conflict with this resolution are hereby repealed to the extent of the conflict. Relevant personnel policies shall also be amended accordingly. SECTION 6. That this resolution shall take effect immediately upon passage, as it does not require publication. SECTION 7. That a copy of the caption of this Resolution be spread upon the Minutes of the City Council. READ, ADOPTED, AND APPROVED on this day of January A.D., 2025, at a Meeting of the City Council of the City of Port Arthur by the following vote: AYES: Mayor: Councilmembers: NOES: Thurman Bill Bartie, Mayor ATTEST: Sherri Bellard, City Secretary Policy Prohibiting the Installation and Requiring the Removal of Covered Applications on Devices Owned or Leased by the City of Port Arthur P.R. No. 24104 12/31/24 TNR APPROVED AS TO Roxann Pais Cotroneo, City Attorney APPROVED FODMINISTRATION: Ronald Burtoti7PM, kr anager Oki Fay You{y�g, GCIO, P P Information Technolo Director Policy Prohibiting the Installation and Requiring the Removal of Covered Applications on Devices Owned or Leased by the City of Port Arthur P.R. No. 24104 12/31/24 TNR EXHIBIT "A" Policy Prohibiting the Installation and Requiring the Removal of Covered Applications Policy Prohibiting the Installation and Requiring the Removal of Covered Applications on Devices Owned or Leased by the City of Port Arthur snA�. aes-. wi�3 �, < ysSu ,z�`� City of Port Arthur Covered Applications and Prohibited Technology Policy Date: December 31 , 2024 Version: 2.0 CONTENTS 1.0 Introduction 3 1.1 Purpose 3 2.0 Covered Applications Policy for Governmental Entities 3 2.1 Scope and Definitions 3 2.2 Covered Applications on Government-Owned or Leased Devices 4 2.3 Ongoing and Emerging Technology Threats 4 2.4 Bring Your Own Device Policy 5 2.5 Covered Application Exceptions 5 3.0 Policy Compliance 5 4.0 Policy Review 6 2 1.0 INTRODUCTION 1.1 PURPOSE On December 7, 2022, Governor Greg Abbott required all state agencies to ban the video-sharing application TikTok from all state-owned and state-issued devices and networks. Governor Abbott also directed the Texas Department of Public Safety (DPS) and the Texas Department of Information Resources (DIR) to develop a plan to guide state agencies on managing personal devices used to conduct state business. This policy is established in compliance with S.B. 1893 to ensure the cybersecurity and operational integrity of the City of Port Arthur by prohibiting the installation and requiring the removal of TikTok and other covered applications on devices owned or leased by the City. 2.0 COVERED APPLICATIONS POLICY FOR GOVERNMENTAL ENTITIES 2.1 SCOPE AND DEFINITIONS Pursuant to Senate Bill 1893, governmental entities, as defined below, must establish a covered applications policy: • A department, commission, board, office, or other agency in the executive or legislative branch of state government created by the constitution or a statute, including an institution of higher education as defined by Education Code Section 61.003. • The Supreme Court,the Court of Criminal Appeals, a Court of Appeals, a district Court,the Texas Judicial Council, or another agency in the judicial branch of state government. • A political subdivision of this state, including a municipality, county, or special purpose district. Personnel: This policy applies to all City of Port Arthur full—and part-time employees, contractors,paid or unpaid interns, and other users of government networks. All applicable parties are responsible for complying with this policy, including all employees, elected officials, contractors, consultants, and other individuals who utilize City Devices for work-related purposes. City Devices: All devices owned, leased, or otherwise controlled by the City of Port Arthur, including but not limited to: • Smartphones • Tablets • Desktop and laptop computers • Any other network or internet-capable devices used for official City business. 3 A covered application is: • The social media service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited. • A social media application or service specified by proclamation of the governor under Government Code Section 620.005. • Any social media application, software, or platform, including but not limited to TikTok, identified by the State of Texas or the City of Port Arthur as posing a cybersecurity risk or otherwise subject to this policy. 2.2 COVERED APPLICATIONS ON GOVERNMENT-OWNED OR LEASED DEVICES Except where approved exceptions apply, the use or installation of covered applications is prohibited on all government-owned or-leased devices,including cell phones,tablets,desktop and laptop computers, and other internet-capable devices. The City of Port Arthur will identify,track, and manage all government-owned or-leased devices, including mobile phones,tablets,laptops,desktop computers,or any other internet-capable devices to: a. Prohibit the installation of a covered application. b. Prohibit the use of a covered application. c. Remove a covered application from a government-owned or-leased device that was on the device before the passage of S.B. 1893 (88th Leg, R.S.). d. Remove an application from a government-owned or-leased device if the Governor issues a proclamation identifying it as a covered application. The City of Port Arthur will manage all government-owned or leased mobile devices by implementing the security measures listed below: a. Restrict access to "app stores" or unauthorized software repositories to prevent the installation of unauthorized applications. b. Maintain the ability to wipe non-compliant or compromised mobile devices remotely. c. Maintain the ability to uninstall unauthorized software from mobile devices remotely. d. Other Governmental Entity-implemented security measures. 2.3 ONGOING AND EMERGING TECHNOLOGY THREATS To protect the government's sensitive information and critical infrastructure against ongoing and emerging technological threats,DPS and DIR will regularly monitor and evaluate additional social media applications or services that pose a risk to this state. 4 DIR will annually submit to the Governor a list of social media applications and services identified as posing a risk to Texas. The Governor may proclaim items on this list as covered applications subject to this policy. If the Governor identifies an item on the DIR-posted list described by this section, then The City of Port Arthur will remove and prohibit the covered application. The City of Port Arthur may also prohibit social media applications or services in addition to those specified by the governor's proclamation. 2.4 BRING YOUR DEVICE POLICY If the City of Port Arthur has a"Bring Your Own Device"(BYOD)program,then the City of Port Arthur may consider prohibiting the installation or operation of covered applications on employee- owned devices used to conduct government business. 2.5 COVERED APPLICATION EXCEPTIONS The City of Port Arthur may permit exceptions authorizing the installation and use of a covered application on government-owned or -leased devices consistent with the authority provided by Government Code Chapter 620. Government Code Section 620.004 only allows the City of Port Arthur to install and use a covered application on an applicable device to the extent necessary for: (1) Providing law enforcement; or (2) Developing or implementing information security measures. If the City of Port Arthur authorizes an exception allowing for the installation and use of a covered application, the City must take measures to mitigate the risks posed to the state during the application's use. The City of Port Arthur must document any measures it took to mitigate the risks posed to the state by using the covered application. Exceptions: Exceptions to this policy may be granted only in limited circumstances, such as law enforcement investigations or other City operations requiring the use of a covered application.All exceptions must be approved in writing by the City Manager or designee. 3.0 POLICY COMPLIANCE All City of Port Arthur employees and applicable parties shall sign a document annually confirming their understanding of the City's covered applications and prohibited technology policies. 5 Non-Compliance: Failure to comply with this policy may result in disciplinary action,up to and including teijiiination of employment or contract. Mandatory Removal: Any covered applications currently installed on City Devices must be removed immediately upon notification of this policy's enactment. Failure to remove such applications constitutes a violation of this policy. 4.0 POLICY REVIEW This policy will be reviewed annually and updated as necessary to reflect changes in state law, additions to applications identified under Government Code Section 620.006, updates to the prohibited technology list posted to DIR's website, or to suit the needs of the City of Port Arthur. 6 P.R. No. 24104 12/31/24 TNR EXHIBIT "B" S.B. 1893 Policy Prohibiting the Installation and Requiring the Removal of Covered Applications on Devices Owned or Leased by the City of Port Arthur S.B. No. 1893 AN ACT relating to prohibiting the use of certain social media applications and services on devices owned or leased by governmental entities. BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: SECTION 1. Subtitle A, Title 6, Government Code, is amended by adding Chapter 620 to read as follows: CHAPTER 620. USE OF CERTAIN SOCIAL MEDIA APPLICATIONS AND SERVICES ON GOVERNMENTAL ENTITY DEVICES PROHIBITED Sec. 620.001. DEFINITIONS. In this chapter: (1) "Covered application" means: (A) the social media service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited; or (B) a social media application or service specified by proclamation of the governor under Section 620.005. (2) "Governmental entity" means: (A) a department, commission, board, office, or other agency that is in the executive or legislative branch of state government and that was created by the constitution or a statute, including an institution of higher education as defined by Section 61.003, Education Code; (B) the supreme court, the court of criminal appeals, a court of appeals, a district court, or the Texas Judicial Council or another agency in the judicial branch of state government; or (C) a political subdivision of this state, including a municipality, county, or special purpose district. Sec. 620.002. DEFINING SECURITY RISK TO THIS STATE. For purposes of this chapter, a social media application or service poses a risk to this state if: (1) the provider of the application or service may be required by a foreig.government, or an entity associated with a foreign government, to provide confidential or private personal information collected by the provider through the application or service to the foreign government or associated entity without substantial due process rights or similar legal protections; or (2) the application or service poses a similar risk to the security of this state's sensitive information, critical infrastructure, or both, as an application or service described by Section 620.001 (1)(A). Sec. 620.003. PROHIBITION; MODEL POLICY. (a) Subject to Section 620.004, a governmental entity shall adopt a policy prohibiting the installation or use of a covered application on any device owned or leased by the governmental entity and requiring the removal of covered applications from those devices. (b) The Department of Information Resources and the Department of Public Safety shall jointly develop a model policy for governmental entities to use in developing the policy required by Subsection (a) . Sec. 620.004. EXCEPTIONS; MITIGATING MEASURES. (a) A policy adopted under Section 620.003 may provide for the installation and use of a covered application to the extent necessary for: (1) providing law enforcement; or (2) developing or implementing information security measures. (b) A policy allowing the installation and use of a covered application under Subsection (a) must require: (1) the use of measures to mitigate risks posed to this state during the use of the covered application; and (2) the documentation of those measures. Sec. 620.005. APPLICATIONS IDENTIFIED BY GOVERNOR'S PROCLAMATION. The governor by proclamation may identify social media applications or services that pose a risk to this state as described by Section 620.002. Sec. 620.006. APPLICATION IDENTIFIED BY DEPARTMENT OF INFORMATION RESOURCES AND DEPARTMENT OF PUBLIC SAFETY. (a) The Department of Information Resources and the Department of Public Safety shall jointly identify social media applications or services that pose a risk to this state as described by Section 620.002. (b) The Department of Information Resources shall: (1) annually submit a list of applications and services identified under Subsection (a) to the governor; (2) publish the list on the department's publicly_ accessible Internet website; and (2) periodically update the list on that website. SECTION 2. Not later than the 60th day after the date the Department of Information Resources and the Department of Public Safety make available the model policy required by Section 620.003 (b) , Government Code, as added by this Act, each governmental entity shall adopt the policy required by Section 620.003 (a) , Government Code, as added by this Act. SECTION 3. This Act takes effect immediately if it receives a vote of two-thirds of all the members elected to each house, as provided by Section 39, Article III, Texas Constitution. If this Act does not receive the vote necessary for immediate effect, this Act takes effect September 1, 2023. President of the Senate Speaker of the House I hereby certify that S.B. No. 1893 passed the Senate on April 18, 2023, by the following vote: Yeas 31, Nays 0; May 16, 2023, Senate refused to concur in House amendments and requested appointment of Conference Committee; May 17, 2023, House granted request of the Senate; May 27, 2023, Senate adopted Conference Committee Report by the following vote: Yeas 30, Nays 1. Secretary of the Senate I hereby certify that S.B. No. 1893 passed the House, with amendments, on May 9, 2023, by the following vote: Yeas 144, Nays 0, two present not voting; May 17, 2023, House granted request of the Senate for appointment of Conference Committee; May 28, 2023, House adopted Conference Committee Report by the following vote: Yeas 139, Nays 2, two present not voting. Chief Clerk of the House Approved: