Loading...
HomeMy WebLinkAboutRes 2024-18 Adopting a Covered Applications and Prohibitied Technology PolicyCity of West University Place Harris County, Texas RESOLUTION NO. 2024-18 A RESOLUTION OF THE CITY COUNCIL OF THE CITY OF WEST UNIVERSITY PLACE, TEXAS, ADOPTING A COVERED APPLICATIONS AND PROHIBITIED TECHNOLOGY POLICY AS REQUIRED BY TEXAS SENATE BILL 1893 OF THE 88th LEGISLATURE. WHEREAS, the City Council (the "Council") of the City of West University Place, Texas (the "City") understands that the City is a "political subdivision" of the State of Texas for the purposes of Senate Bill 1893 of the 881h Texas Legislature (the `Bill"); and WHEREAS, the Council intends to satisfy the requirement of the Bill that the City adopt a policy regarding the use of Tik-Tok by City employees; and WHEREAS, the Council finds that the policy attached to this Resolution as "Exhibit A" (the "Policy") satisfies the requirements of the Bill and desires to adopt the Policy; and, NOW,THEREFORE, THE CITY COUNCIL OF THE CITY OF WEST UNIVERSITY PLACE, TEXAS RESOLVES: Section 1. THAT the Recitals and Exhibits to this Resolution are true and correct and are incorporated herein for all intents and purposes. Section 2. THAT the Policy attached to this Resolution as "Exhibit A" be adopted by the City. Section 3. THAT the City Secretary is hereby authorized and directed keep a copy of the Policy in the office of the City Secretary and to make the Policy available upon request. PASSED, APPROVED, and RESOLVED this 7 day of 4 "L., 2024. FOR THE CITY OF WEST UNIVERSITY PLACE: THELMA A. GILLIAM, CITY SECRETARY SUSAN SA LE, MAYOR RES -- WEST UNIVERSITY PLACE — Covered Applications and Prohibited Technology Policy— 11.7.24 Page 1 EXHIBIT A — Covered Applications and Prohibited Technology Policy RES -- WEST UNIVERSITY PLACE - Covered Applications and Prohibited Technology Policy 11.7.24 Page 2 City of West University Place Covered Applications and Prohibited Technology Policy November 2024 1.0 INTRODUCTION On December 7, 2022, Governor Greg Abbott required all state agencies to ban the video sharing application TikTok from all state-owned and state -issued devices and networks over the Chinese Communist Party's ability to use the application for surveilling Texans. Governor Abbott also directed the Texas Department of Public Safety (DPS) and the Texas Department of Information Resources (DIR) to develop a plan providing state agencies guidance on managing personal devices used to conduct state business. Following the issuance of the Governor's directive, the 88th Texas Legislature passed Senate Bill 1893, which prohibits the use of covered applications on governmental entity devices. As required by the Governor's directive and Senate Bill 1893, this model policy establishes a template that entities subject to the directive or bill may mimic to prohibit the installation or use of covered applications or prohibited technologies on applicable devices. 2.0 COVERED APPLICATIONS POLICY FOR THE CITY OF WEST UNIVERSITY PLACE 2.1 SCOPE AND DEFINITIONS Pursuant to Senate Bill 1893, any political subdivision of this state, including a municipality, county, or special purpose district, must establish a covered applications policy. Therefore, this policy applies to all City of West University Plate (the "City") full- and part-time employees, contractors, paid or unpaid interns, and other users of City networks. All City employees are responsible for complying with this policy. A covered application is: • The social media service TikTok or any successor application or service developed or provided by ByteDance Limited, or an entity owned by ByteDance Limited. • A social media application or service specified by proclamation of the Governor under Government Code Section 620.005. 2 2.2 COVERED APPLICATIONS ON CITY -OWNED OR LEASED DEVICES Except where approved exceptions apply, the use or installation of covered applications is prohibited on all City -owned or -leased devices, including cell phones, tablets, desktop and laptop computers, and other internet-capable devices. The City will identify, track, and manage all City -owned or -leased devices including mobile phones, tablets, laptops, desktop computers, or any other internet-capable devices to: a. Prohibit the installation of a covered application. b. Prohibit the use of a covered application. c. Remove a covered application from a City -owned or -leased device that was on the device prior to the passage of S.B. 1893 (88th Leg, R.S.). d. Remove an application from a City -owned or -leased device if the Governor issues a proclamation identifying it as a covered application. The City will manage all City -owned or leased mobile devices by maintaining the ability to implement the security measures listed below as applicable: a. Restrict access to "app stores" or unauthorized software repositories to prevent the installation of unauthorized applications; b. Maintain the ability to remotely wipe non-compliant or compromised mobile devices; c. Maintain the ability to remotely uninstall unauthorized software from mobile devices; or d. Other City -implemented security measures as needed. 2.3 ONGOING AND EMERGING TECHNOLOGY THREATS To provide protection against ongoing and emerging technological threats to the City's sensitive information and critical infrastructure, DPS and DIR will regularly monitor and evaluate additional social media applications or services that pose a risk to this state. DIR will annually submit to the Governor a list of social media applications and services identified as posing a risk to Texas. The Governor may proclaim items on this list as covered applications that are subject to this policy. If the Governor identifies an item on the DIR-posted list described by this section, then the City will remove and prohibit the covered application. The City may also prohibit social media applications or services in addition to those specified by proclamation of the Governor. 3 2.4 BRING YOUR OWN DEVICE POLICY If the City adopts, or has adopted, a "Bring Your Own Device" (BYOD) program, then the City may consider prohibiting the installation or operation of covered applications on employee -owned devices that are used to conduct City business. 2.5 COVERED APPLICATION EXCEPTIONS The City may permit exceptions authorizing the installation and use of a covered application on a City -owned or -leased device consistent with the authority provided by Government Code Chapter 620. Government Code Section 620.004 only allows the City to install and use a covered application on an applicable device to the extent necessary: (1) For providing law enforcement; or (2) For developing or implementing information security measures. If the City authorizes an exception allowing for the installation and use of a covered application, then the City must use measures to mitigate the risks posed to the State during the application's use including any measures that the City deems appropriate and reasonable to support the purpose of this policy. The City shall document whichever measures it took to mitigate the risks posed to the State during the use of the covered application. The City requires any employee or official to consult with its attorney prior to seeking an exception to installing an application covered by this policy. 2.6 BRING YOUR OWN DEVICE POLICY 1F THE CITY 15 NOT SUBJECT TO THE GOVERNORS PROHIBITED TECHNOLOGY DIRECTIVE If the City is deemed to not be subject to the Governor's prohibited technology directive but is subject to Senate Bill 1893, then the City may prohibit the installation or operation of prohibited technologies and covered applications on employee -owned devices that are used to conduct City business. If the City adopts, or has adopted, a "Bring Your Own Device" (BYOD) program, then the City shall institute a "Bring Your Own Device" (BYOD) policy requiring the enrollment of these personal devices in the City's program before their continued use in conducting City business. 4 3.0 POLICY COMPLIANCE The City will verify compliance with this policy through various methods, including but not limited to, IT/security system reports and feedback to leadership. An employee found to have violated this policy may be subject to disciplinary action, including termination of employment. 4.0 POLICY REVIEW This policy will be reviewed annually and updated as necessary to reflect changes in state law, additions to applications identified under Government Code Section 620.006, updates to the prohibited technology list posted to DIR's website, or to suit the needs of the City.