Toth Election Bill Makes Counties Pay For Security Reviews

The text as introduced · 1,049 words

By: Toth
H.B. No. 1007

A BILL TO BE ENTITLED

AN ACT

relating to the security of election systems.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Chapter 279, Election Code, is amended by

amending Sections 279.002 and 279.003 and adding Sections 279.004

and 279.005 to read as follows:

Sec. 279.002. ELECTION CYBERSECURITY: SECRETARY OF STATE.

(a) The secretary of state shall adopt rules defining classes of

protected election data and establishing best practices for

identifying , [ and ] reducing , and eliminating the risk to the

electronic use, storage, and transmission of election data and the

security of election systems , including:

(1) methods of encrypting data at rest and during

transmission; and

(2) restricting access to sensitive data to only users

with a specific need to access that data .

(a-1) The secretary of state shall appoint a dedicated

cybersecurity expert to implement cybersecurity measures to

protect all election data and other election-related data held by

the state or a county in the state, including technology that

blocks, notifies, and reports on unauthorized attempts to access or

transfer data.

(b) The secretary of state shall direct the cybersecurity

expert to offer training on best practices:

(1) on a biennial [ an annual ] basis, to all

appropriate personnel or contractors with [ in ] the secretary of

state's office with access to sensitive information ; and

(2) on request, to county election officers and any

employees or contractors of the county election officers with

access to sensitive information [ in this state ].

(b-1) Access to sensitive data shall be revoked for any

employee or contractor that is required to receive training under

Subsection (b) but does not complete the training.

(c) If the secretary of state becomes aware of a breach of

cybersecurity that impacts election data, the secretary shall

immediately notify the governor, lieutenant governor, speaker of

the house of representatives, and members of the standing

committees of each house of the legislature with jurisdiction over

elections. The secretary shall direct the cybersecurity expert to

conduct an investigation of the breach and report any findings to

the governor, lieutenant governor, speaker of the house of

representatives, and standing committees of the legislature with

jurisdiction over elections.

(d) During an investigation conducted under Subsection (c),

access to the election system is restricted to only individuals

designated by the secretary of state until the standing committees

confirm that the breach has been mitigated.

(e) If the investigation under Subsection (c) reveals that

individuals' personal data has been breached, the secretary of

state shall promptly notify the affected individuals by written

letter of the occurrence and extent of the breach.

(f) The secretary of state, in cooperation with the

cybersecurity expert, shall contract with a provider of

cybersecurity assessments to biennially conduct an assessment of

the cybersecurity of the state's election system.

(g) The cybersecurity expert shall implement cybersecurity

measures to ensure that all devices with access to election data

held by the state comply to the highest extent possible with rules

adopted by the secretary of state under Subsection (a).

Sec. 279.003. ELECTION CYBERSECURITY: COUNTY ELECTION

OFFICERS. (a) A county election officer shall biennially

[ annually ] request training on cybersecurity from the

cybersecurity expert [ secretary of state ]. The secretary of state

shall pay the costs associated with the training with available

state funds.

(b) A county election officer shall contract with a provider

of cybersecurity assessments to biennially conduct [ request ] an

assessment of the cybersecurity of the county's election system

[ from a provider of cybersecurity assessments if the secretary of

state recommends an assessment and the necessary funds are

available ].

(b-1) The county election officer shall deliver a report on

any recommended improvements to the county's election system by the

assessment conducted under Subsection (b) to the secretary of

state.

(c) If a county election officer becomes aware of a breach

of cybersecurity that impacts election data, the officer shall

immediately notify the secretary of state. During an investigation

by the secretary of state made aware of a breach under this section,

access to sensitive data in the county shall be restricted to

specific personnel.

(d) A [ To the extent that state funds are available for the

purpose, a ] county election officer shall implement cybersecurity

measures to ensure that all devices with access to election data

comply to the highest extent possible with rules adopted by the

secretary of state under Section 279.002.

Sec. 279.004. INTERNAL PERSONNEL VIOLATION. If a data

breach under this section is conducted by an employee of the

secretary of state's or county election officer's office, the

employee may not be provided access to election-related data until

an investigation under this section is concluded. If an

investigation determines that the employee intentionally breached

an election system, the secretary of state may pursue all available

legal remedies against the employee, including criminal

prosecution.

Sec. 279.005. COMPUTER NETWORK CONNECTIVITY. (a) Except

as expressly authorized by this code, an election system that is

capable of being connected to the Internet or any other computer

network may not be used, except for the use of a visible wired

connection to an isolated local area network within the building.

(b) The cybersecurity expert appointed by the secretary of

state under Section 279.002 shall annually verify compliance with

this section by each county conducting an election in this state.

SECTION 2. Section 123.034, Election Code, is amended to

read as follows:

Sec. 123.034. MAINTENANCE AND STORAGE OF EQUIPMENT. (a)

The governing body of a political subdivision shall provide for the

proper maintenance and storage of the equipment that the

subdivision acquires for use in the operation of a voting system.

(b) Equipment used in the operation of a voting system must

have a documented chain of custody and be stored in a locked

facility with video surveillance monitoring the storage facility at

all times.

SECTION 3. As soon as practicable after the effective date

of this Act, the secretary of state shall:

(1) adopt the rules required by Section 279.002(a),

Election Code, as amended by this Act; and

(2) appoint a cybersecurity expert in accordance with

Section 279.002(a-1), Election Code, as added by this Act.

SECTION 4. This Act takes effect September 1, 2025.