Senate Bill S8793

                             
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   8793
 
                             I N  S E N A T E
 
                              January 8, 2026
                                ___________
 
 Introduced  by  Sen.  COONEY -- read twice and ordered printed, and when
   printed to be committed to the Committee on Rules
 
 AN ACT to amend the state finance law and the general municipal law,  in
   relation  to  prohibiting procurement of certain technology that poses
   security threats; and to amend a chapter of the laws of 2025  amending
   the  state  finance  law  and  the  general  municipal law relating to
   prohibiting procurement of  certain  technology  that  poses  security
   threats, as proposed in legislative bills numbers S. 3259 and A. 2237,
   in  relation  to the authority of the office of information technology
   services to issue certain guidance relating thereto
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Section 163-e of the state finance law, as added by a chap-
 ter  of  the laws of 2025 amending the state finance law and the general
 municipal law relating to prohibiting procurement of certain  technology
 that poses security threats, as proposed in legislative bills numbers S.
 3259 and A. 2237, is amended to read as follows:
   §  163-e.  Restriction  on purchasing certain technology which poses a
 security threat. 1. (a) Notwithstanding any  inconsistent  provision  of
 law, the state and any department, bureau, board, commission, authority,
 and  any  other  agency  or instrumentality of the state shall not enter
 into or renew any contract or  agreement  to  procure  [information  and
 communications]  technology, including hardware, systems, devices, soft-
 ware, or services that include embedded or incidental information  tech-
 nology,  which  are  prohibited  from  federal  procurement  pursuant to
 section 889 of Public Law 115-232 of 2018.
   (b) The term ["information and communications technology" means:
   (i) information technology, as defined in section 11101 of title 40;
   (ii) information systems, as defined in 44 U.S.C. 3502; and
   (iii) telecommunications equipment and telecommunications services, as
 those terms are defined in section 3 of the Communications Act  of  1934
 (47 U.S.C. 153).
   (c)  The  term  "information  and communications technology" shall not
 include automated-decision making systems] "TECHNOLOGY" SHALL  HAVE  THE
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD01015-02-6
 S. 8793                             2
 
 SAME  MEANING  AS SUCH TERM IS DEFINED IN SUBDIVISION TEN OF SECTION ONE
 HUNDRED SIXTY OF THIS ARTICLE.
   2.  The  [chief  information officer] OFFICE OF INFORMATION TECHNOLOGY
 SERVICES shall, in consultation with the division of  homeland  security
 and emergency services and the office of general services, establish and
 update  regularly  a list of restricted [information and communications]
 technology. Technology on this list shall not be procured by  any  state
 agency,  state  or  local  authority,  or political subdivision unless a
 waiver is issued pursuant to subdivision three of this  section  or  the
 [chief  information  officer]  OFFICE OF INFORMATION TECHNOLOGY SERVICES
 determines that the technology  shall  only  be  restricted  in  limited
 circumstances.
   The list shall:
   (a)  contain [information and communications] technologies that pose a
 security risk to the state of New York or its political subdivisions. In
 determining whether [information and  communications]  technology  poses
 such a risk, the [chief information officer] OFFICE OF INFORMATION TECH-
 NOLOGY  SERVICES  shall  consult relevant federal sources, including the
 department of defense  inspector general report no.  DODIG-2019-106,  as
 well as any other source that shall be determined to be relevant; AND
   (b)  [describe  the  scope  of each restriction, such as whether it is
 generally prohibited or prohibited  in  certain  circumstances  or  from
 certain entities;
   (c)  include an explanation as to why items were included on the list;
 and
   (d)] be published online and communicated to all relevant  procurement
 officers  in all state agencies, state authorities, and political subdi-
 visions.
   3. The [commissioner] OFFICE OF INFORMATION  TECHNOLOGY  SERVICES,  IN
 COLLABORATION  WITH  THE  DIVISION  of  homeland  security and emergency
 services, the [commissioner of the]  office  of  general  services,  the
 [adjutant  general,  the chief information officer] DIVISION OF MILITARY
 AND NAVAL AFFAIRS, AND the chief cyber officer,  [the  chief  technology
 officer  of the city of New York and any federal agency authorized under
 section 889 of Public Law 115-232 of 2018,] may provide  a  waiver  from
 this section if:
   (a)  any  such entity determines the waiver is in the interests of the
 state or political subdivision;
   (b) no compliant product or service is available to  be  procured  as,
 and  when,  needed at United States market prices or a price that is not
 considered prohibitively expensive; and
   (c) such waiver could not reasonably be  expected  to  compromise  the
 security or integrity of a computer network operated by an instrumental-
 ity of the state.
   (D)  ANY STATE AGENCY, STATE OR LOCAL AUTHORITY, OR POLITICAL SUBDIVI-
 SION SEEKING A WAIVER FROM ANY FEDERAL AGENCY AUTHORIZED  UNDER  SECTION
 889 OF PUBLIC LAW 115-232 OF 2018 MUST PROVIDE NOTICE OF ANY SUCH WAIVER
 GRANTED  TO  THE OFFICE OF INFORMATION TECHNOLOGY SERVICES WITHIN THIRTY
 DAYS OF WAIVER APPROVAL.
   4. AN UNMANNED AERIAL VEHICLE OR OTHER EQUIPMENT OR  SERVICE  RELATING
 TO THE OPERATION OF AN UNMANNED AERIAL VEHICLE FROM A BUSINESS OR ENTITY
 THAT  WOULD OTHERWISE BE SUBJECT TO RESTRICTION UNDER SUBDIVISION ONE OR
 TWO OF THIS SECTION MUST BE EXEMPT FROM SUCH RESTRICTION IF:
   (A) ANY PHOTOGRAPH, IMAGE, RECORDING OR OTHER INFORMATION COLLECTED BY
 THE STATE AGENCY, STATE OR LOCAL  AUTHORITY,  OR  POLITICAL  SUBDIVISION
 S. 8793                             3
 
 FROM  THE OPERATION OF THE UNMANNED AERIAL VEHICLE OR OTHER EQUIPMENT OR
 SERVICE RELATING TO THE OPERATION OF THE UNMANNED AERIAL VEHICLE:
   (I) IS STORED AND MAINTAINED EXCLUSIVELY WITHIN THE UNITED STATES; AND
   (II)  IS NOT ACCESSIBLE TO THE BUSINESS OR ENTITY THAT WOULD OTHERWISE
 BE SUBJECT TO RESTRICTION; OR
   (III) IS OPERATED USING  SOFTWARE  DEVELOPED  AND  MAINTAINED  IN  THE
 UNITED STATES.
   (B)  THE  PROVISIONS  OF  THIS  SUBDIVISION  SHALL NOT BE CONSTRUED TO
 DISCOURAGE THE PURCHASE OR ACQUISITION OF ANY UNMANNED AERIAL VEHICLE OR
 OTHER EQUIPMENT OR SERVICE RELATING TO  THE  OPERATION  OF  AN  UNMANNED
 AERIAL VEHICLE THAT IS MANUFACTURED IN THE UNITED STATES.
   5. Nothing in this section shall be construed:
   (a)  to  require any [information and communications] technology resi-
 dent in equipment, systems, or services as of the day before the  effec-
 tive date of this section to be removed or replaced;
   (b)  to  prohibit  or  limit  the utilization of such [information and
 communications] technology throughout the  lifecycle  of  such  existing
 equipment; or
   (c) to require the recipient of a state contract, grant, loan, or loan
 guarantee  to  replace [information and communications] technology resi-
 dent in equipment, systems, or services before  the  effective  date  of
 this section.
   § 2. Section 103-h of the general municipal law, as added by a chapter
 of  the  laws  of  2025  amending  the state finance law and the general
 municipal law relating to prohibiting procurement of certain  technology
 that poses security threats, as proposed in legislative bills numbers S.
 3259 and A.  2237, is amended to read as follows:
   §  103-h.  Restriction  on purchasing certain technology which poses a
 security threat. 1. (a) Notwithstanding any  inconsistent  provision  of
 law  a  political subdivision shall not enter into or renew any contract
 or agreement to procure  [information  and  communications]  technology,
 including hardware, systems, devices, software, or services that include
 embedded or incidental information technology, which are prohibited from
 federal  procurement  pursuant  to  section 889 of Public Law 115-232 of
 2018, or which are included on the list created pursuant to  subdivision
 two of section one hundred sixty-three-e of the state finance law.
   (b) The term ["information and communications technology" means:
   (i) information technology, as defined in 40 U.S.C. 11101;
   (ii) information systems, as defined in 44 U.S.C. 3502; and
   (iii) telecommunications equipment and telecommunications services, as
 those  terms  are defined in section 3 of the Communications Act of 1934
 (47 U.S.C. 153)] "TECHNOLOGY" SHALL HAVE THE SAME MEANING AS  SUCH  TERM
 IS  DEFINED IN SUBDIVISION TEN OF SECTION ONE HUNDRED SIXTY OF THE STATE
 FINANCE LAW.
   2. The [commissioner] OFFICE OF INFORMATION  TECHNOLOGY  SERVICES,  IN
 COLLABORATION  WITH  THE  DIVISION  of  homeland  security and emergency
 services, the [commissioner of the]  office  of  general  services,  the
 [adjutant  general,  the chief information officer] DIVISION OF MILITARY
 AND NAVAL AFFAIRS, AND the chief cyber officer,  [the  chief  technology
 officer  of the city of New York and any federal agency authorized under
 section 889 of Public Law 115-232 of 2018,] may provide  a  waiver  from
 this section if:
   (a)  any  such  entity determines the waiver is in the interest of the
 political subdivision;
 S. 8793                             4
 
   (b) no compliant product or service is available to  be  procured  as,
 and  when,  needed at United States market prices or a price that is not
 considered prohibitively expensive; and
   (c)  such  waiver  could  not reasonably be expected to compromise the
 security or integrity of a computer network operated by an instrumental-
 ity of the state.
   [4.] (D) ANY POLITICAL SUBDIVISION SEEKING A WAIVER FROM  ANY  FEDERAL
 AGENCY  AUTHORIZED  UNDER SECTION 889 OF PUBLIC LAW 115-232 OF 2018 MUST
 PROVIDE NOTICE OF ANY SUCH WAIVER GRANTED TO THE OFFICE  OF  INFORMATION
 TECHNOLOGY SERVICES WITHIN THIRTY DAYS OF WAIVER APPROVAL.
   3. Nothing in this section shall be construed:
   (a)  to  require any [information and communications] technology resi-
 dent in equipment, systems, or services as of the day before the  effec-
 tive date of this section to be removed or replaced;
   (b)  to  prohibit  or  limit  the utilization of such [information and
 communications] technology throughout the  lifecycle  of  such  existing
 equipment; or
   (c) to require the recipient of a state contract, grant, loan, or loan
 guarantee  to  replace [information and communications] technology resi-
 dent in equipment, systems, or services before  the  effective  date  of
 this section.
   §  3.  Section  3  of a chapter of the laws of 2025 amending the state
 finance law and  the  general  municipal  law  relating  to  prohibiting
 procurement  of  certain  technology  that  poses  security  threats, as
 proposed in legislative bills numbers S. 3259 and A. 2237, is amended to
 read as follows:
   § 3. No later than the effective date  of  this  act,  the  office  of
 [general  services]  INFORMATION  TECHNOLOGY  SERVICES shall [promulgate
 rules and regulations and] issue guidance  to  all  state  agencies  and
 local  procurement  authorities  necessary, including providing  updates
 on prohibited    or  excluded  entities  for  procurement  contracts  in
 conformity  with federal law, rules and regulations, no later than sixty
 days after any entity is prohibited or excluded.
   § 4. Section 4 of a chapter of the laws of  2025  amending  the  state
 finance  law  and  the  general  municipal  law  relating to prohibiting
 procurement of  certain  technology  that  poses  security  threats,  as
 proposed in legislative bills numbers S. 3259 and A. 2237, is amended to
 read as follows:
   § 4. This act shall take effect two years after it shall have become a
 law. Effective immediately, the office of [general services] INFORMATION
 TECHNOLOGY  SERVICES  is authorized to [promulgate rules and regulations
 and] issue guidance to all state agencies and local procurement authori-
 ties necessary for the implementation of this act on its effective date,
 including providing updates  on  prohibited  or  excluded  entities  for
 procurement  contracts  in  conformity with federal law, rules and regu-
 lations.
   § 5. This act shall take effect immediately; provided,  however,  that
 sections  one,  two  and three of this act shall take effect on the same
 date and in the same manner as a chapter of the laws  of  2025  amending
 the  state finance law and the general municipal law relating to prohib-
 iting procurement of certain technology that poses security threats,  as
 proposed in legislative bills numbers S. 3259 and A. 2237, takes effect.