Article 84.

Various Technology Regulations.

§ 143-800.  State entities and ransomware payments.

(a) No State agency or local government entity shall submit payment or otherwise communicate with an entity that has engaged in a cybersecurity incident on an information technology system by encrypting data and then subsequently offering to decrypt that data in exchange for a ransom payment.

(b) Any State agency or local government entity experiencing a ransom request in connection with a cybersecurity incident shall consult with the Department of Information Technology in accordance with G.S. 143B-1379.

(c) The following definitions apply in this section:

(1) Local government entity. - A local political subdivision of the State, including, but not limited to, a city, a county, a local school administrative unit as defined in G.S. 115C-5, or a community college.

(2) State agency. - Any agency, department, institution, board, commission, committee, division, bureau, officer, official, or other entity of the executive, judicial, or legislative branches of State government. The term includes The University of North Carolina and any other entity for which the State has oversight responsibility. (2021-180, s. 38.13(a).)

§ 143-805.  Prohibit viewing of pornography on government networks and devices.

(a) Notwithstanding G.S. 14-456 and G.S. 14-456.1, a public agency shall not permit the viewing of pornography by its employees on a network of that public agency. Notwithstanding G.S. 14-456 and G.S. 14-456.1, the judicial branch shall not permit the viewing of pornography by its employees on a network of the judicial branch. Notwithstanding G.S. 14-456 and G.S. 14-456.1, the legislative branch shall not permit the viewing of pornography by its employees on a network of the legislative branch.

(b) Notwithstanding G.S. 14-456 and G.S. 14-456.1, no public agency shall permit an employee, elected official, or appointee of that public agency to view pornography on a device owned, leased, maintained, or otherwise controlled by that public agency. Notwithstanding G.S. 14-456 and G.S. 14-456.1, no public agency shall permit a student of that public agency to view pornography on a device owned, leased, maintained, or otherwise controlled by that public agency. Notwithstanding G.S. 14-456 and G.S. 14-456.1, the judicial branch shall not permit an employee, elected official, or appointee of the judicial branch to view pornography on a device owned, leased, maintained, or otherwise controlled by the judicial branch. Notwithstanding G.S. 14-456 and G.S. 14-456.1, the legislative branch shall not permit an employee, elected official, or appointee of the legislative branch to view pornography on a device owned, leased, maintained, or otherwise controlled by the legislative branch.

(c) Each public agency shall adopt a policy governing the use of its network and devices owned, leased, maintained, or otherwise controlled by that public agency. The judicial and legislative branches shall adopt a policy governing the use of that branch's networks and devices owned, leased, maintained, or otherwise controlled by those branches.

Each policy required by this subsection shall delineate the disciplinary actions that will be taken in response to a violation of that policy.

(d) Subsections (a) and (b) of this section shall not apply to an official or employee that is engaged in any of the following activities in the course of that official's or employee's official duties:

(1) Investigating or prosecuting crimes, offering or participating in law enforcement training, or performing actions related to other law enforcement purposes.

(2) Identifying potential security or cybersecurity threats.

(3) Protecting human life.

(4) Establishing, testing, and maintaining firewalls, protocols, and otherwise implementing this section.

(5) Participating in judicial or quasi-judicial proceedings.

(6) Conducting or participating in an externally funded research project at one of the constituent institutions of The University of North Carolina.

(7) Researching issues related to the drafting or analysis of the laws of this State as necessary to fulfill the requirements of the employee's official duties.

(e) This section shall not apply to the user of an authorized account paying for use of communications services under Article 16A of Chapter 160A of the General Statutes, including those communications services exempted under G.S. 160A-340.2(b) or (c).

(f) Annually, no later than August 1 and in the format required by the State Chief Information Officer, each public agency shall report information to the State Chief Information Officer on the number of incidences of unauthorized viewing or attempted viewing of pornography on that public agency's network; whether or not the unauthorized viewing was by an employee, elected official, appointee, or student of that public agency; and whether or not any of the unauthorized viewing was on a device owned, leased, maintained, or otherwise controlled by that public agency. Annually, no later than October 1, the State Chief Information Officer shall compile and report to the Joint Legislative Oversight Committee on Information Technology the information submitted in accordance with this subsection.

(g) The following definitions apply in this section:

(1) Device. - Any cellular phone, desktop or laptop computer, or other electronic equipment capable of connecting to a network.

(2) Material. - As defined in G.S. 14-190.13.

(3) Network. - Any of the following, whether through owning, leasing, maintaining, or otherwise controlling:

a. The interconnection of communication systems with a computer through remote or local terminals, or a complex consisting of two or more interconnected computers or telephone switching equipment.

b. Internet service.

c. Internet access.

(4) Pornography. - Any material depicting sexual activity.

(5) Public agency. - Any of the following:

a. All State agencies and offices of the members of the Council of State, including all boards, departments, divisions, constituent institutions of The University of North Carolina, community colleges, and other units of government in the executive branch.

b. Units of local government as defined in G.S. 159-7.

c. Public authorities as defined in G.S. 159-7.

d. Public school units as defined in G.S. 115C-5.

(6) Sexual activity. - As defined in G.S. 14-190.13.  (2024-26, s. 7(a).)