House Bill 279

AN ACT TO PROHIBIT STATE EMPLOYEES WHO HAVE BEEN ISSUED ELECTRONIC DEVICES FOR THE PURPOSE OF PERFORMING WORK-RELATED FUNCTIONS FROM DOWNLOADING OR USING THE TIKTOK APPLICATION ON ANY DEVICE ISSUED BY THE STATE; TO REQUIRE THE REMOVAL OF SUCH APPLICATION FROM GOVERNMENT-ISSUED DEVISES; TO REQUIRE THE MISSISSIPPI DEPARTMENT OF INFORMATION TECHNOLOGY SERVICES, IN CONSULTATION WITH THE DIRECTOR OF INFORMATION TECHNOLOGY WITHIN THE DEPARTMENT OF FINANCE AND ADMINISTRATION, TO DEVELOP STANDARDS AND GUIDELINES FOR ALL STATE AGENCIES REQUIRING THE REMOVAL OF ANY COVERED APPLICATION FROM INFORMATION TECHNOLOGY CONSISTENT WITH THE ACCEPTABLE USE POLICY SPECIFIED IN LAW; TO BRING FORWARD SECTION 25-53-191, MISSISSIPPI CODE OF 1972, FOR THE PURPOSE OF POSSIBLE AMENDMENTS; AND FOR RELATED PURPOSES.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MISSISSIPPI:

SECTION 1. This act shall be known and may be cited as the "No TikTok on Government Devices Act."

SECTION 2. As used in this section, the following terms shall have the meaning ascribed in this subsection, unless the context of use clearly requires otherwise:

(a) "Covered application" means the social networking service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited.

(b) "State agency" means any agency, department, commission, board, institution, council, office, bureau, division, committee or subcommittee of the state or other instrumentality of the state. However, the term "state agency" does not include counties or municipalities.

(c) "State-issued devices" mean all systems and devices, including laptops, cellular telephones, mobile tablets, E-readers, pagers or personal digital assistant device having wireless communication capability, that are issued, owned, leased or otherwise controlled by the state or used by employees of state agencies for the purpose of conducting state business.

(d) "Information technology":

(i) With respect to a state agency, means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the state agency, if the equipment is used by the state agency directly or is used by a contractor under a contract with the state agency that requires:

1. The use of that equipment; or

2. The use of that equipment to a significant extent in the performance of a service or the furnishing of a product; and

(ii) Includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services and support services and related resources.

SECTION 3. (1) Not later than sixty (60) days after the date of the effective date of this act, the Executive Director of the Mississippi Department of Information Technology Services, in consultation with the Director of Information Technology within the Department of Finance and Administration, shall develop standards and guidelines for state agencies requiring the removal of any covered application from information technology consistent with the acceptable use policy required for the use of all wireless communication devices under Section 25-53-191.

(2) The standards and guidelines developed under subsection (1) shall include:

(a) Exceptions for law enforcement activities, national security interests and activities, and security researchers; and

(b) For any authorized use of a covered application under an exception, requirements for state agencies to develop and document risk mitigation actions for such use.

SECTION 4. Section 25-53-191, Mississippi Code of 1972, is brought forward as follows:

25-53-191. (1) For the purposes of this section, the following terms shall have the meanings ascribed to them in this section unless the context otherwise clearly requires:

(a) "Department" means the Mississippi Department of Information Technology.

(b) "State agency" means any agency, department, commission, board, bureau, institution or other instrumentality of the state.

(c) "Wireless communication device" means a cellular telephone, pager or a personal digital assistant device having wireless communication capability.

(2) Before a wireless communication device may be assigned, issued or made available to an agency officer or employee, the agency head, or his designee, shall sign a statement certifying the need or reason for issuing the device. No officer or employee of any state agency, except for an officer or employee of the Mississippi Emergency Management Agency, shall be assigned or issued more than one (1) such wireless communication device. No officer or employee of any state agency to whom has been assigned, issued or made available the use of a wireless communication device, the cost of which is paid through the use of public funds, shall use such device for personal use.

(3) A state agency shall not reimburse any officer or employee for use of his or her personal wireless communication device.

(4) Every state agency that, at the expense of the state agency, assigns, issues or makes available to any of its officers or employees a wireless communication device shall obtain and maintain detailed billing for every wireless communication device account. A list of approved vendors for the procurement of wireless communication devices and the delivery of wireless communication device services shall be developed for all state agencies by the Mississippi Department of Information Technology Services in conjunction with the Wireless Communication Commission created in Section 25-53-171. The department, in conjunction with the Wireless Communication Commission, shall exercise the option of selecting one (1) vendor from which to procure wireless communication devices and to provide wireless communication device services, or if it deems such to be most advantageous to the state agencies, it may select multiple vendors. The department, in conjunction with the Wireless Communication Commission, shall select a vendor or vendors on the basis of lowest and best bid proposals. A state agency may not procure a wireless communication device from any vendor or contract for wireless communication device services with any vendor unless the vendor appears on the list approved by the department, in conjunction with the Wireless Communication Commission. A contract entered into in violation of this section shall be void and unenforceable.

(5) The department shall promulgate a model acceptable use policy defining the appropriate use of all wireless communication devices. The acceptable use policy should specify that these resources, including both devices and services, are provided at the state agency's expense as tools for accomplishing the business missions of the state agency; that all those resources are for business use; and that more than incidental personal use of those resources is prohibited. The acceptable use policy should require that each official and employee issued one (1) of the above devices or authorized to access one (1) of the above services sign the policy and that the signed copy be placed in the personnel file of the official or employee. The acceptable use policy should also require that the use of these resources be tracked, verified and signed by the official or employee and the supervisor of the official or employee at each billing cycle or other appropriate interval. All state agencies shall adopt the model policy or adopt a policy that is, at minimum, as stringent as the model policy and shall provide a copy of the policy to the department.

(6) All state agencies shall purchase or acquire only the lowest cost cellular telephone, pager or personal digital assistance device which will carry out its intended use.

(7) The University of Mississippi Medical Center and its employees, the Mississippi State University Extension Service and its agents and faculty members, the Mississippi State University Agricultural and Forestry Experiment Station and its faculty members, the Mississippi State University Forestry and Wildlife Research Center and its faculty members, and the Mississippi State University College of Veterinary Medicine and its faculty members shall be exempt from the application of this section.

(8) The State Auditor shall conduct necessary audits to ensure compliance with the provisions of this section.

SECTION 5. This act shall take effect and be in force from and after its passage.