26505849, 60GG-2.0075 - Florida Administrative Rules, Law, Code, Register

Home

Florida Department of State and Division of Library and Information Services

Notice: 26505849

Notice of Proposed Rule

Department:

DEPARTMENT OF MANAGEMENT SERVICES

Division:

Florida Digital Service

Chapter:

STATE OF FLORIDA CYBERSECURITY STANDARDS

Overview

RULE:

60GG-2.0075

Unmanned Aerial Systems (UAS) Minimum Security Requirements

PURPOSE:

The proposed rule sets forth the minimum security standards for governmental agency drone use as required by Chapter 2021-165, Laws of Florida.

SUMMARY:

On July 1, 2021, Chapter 2021-165, Laws of Florida, went into effect as a result of legislation passed during the 2021 Legislative Session. This law requires the Department to develop minimum security standards, including a list of approved manufacturers, for governmental agency drone use. The intent of this legislation was to protect the confidentiality, integrity, and availability of data collected, transmitted, or stored by a drone, specifically with regard to the potential for subterfuge by foreign adversaries. A staff analysis specifically noted that the United States Army discontinued use of drones manufactured by “Da Jiang Innovations (DJI), the world’s largest supplier of drones, including all DJI drones and systems that use DJI components or software, after alleging in a memo that the company shared critical infrastructure and law enforcement data with the Chinese government.” See, https://myfloridahouse.gov/Sections/Documents/loaddoc.aspx?FileName=h1049z2.CIV.DOCX&DocumentType=Analysis&BillNumber=1049&Session=2021.

On October 5, 2022, under the statutory requirement of the 2021 National Defense Authorization Act, the U.S. Department of Defense identified DJI as a Chinese military company operating directly or indirectly in the United States. See, https://www.defense.gov/News/Releases/Release/Article/3180636/dod-releases-list-of-peoples-republic-of-china-prc-military-companies-in-accord/. A 2022 Washington Post article goes further in stating that “[t]he Pentagon previously said the Chinese drones pose a national security threat, citing ‘an increased awareness of cyber vulnerabilities’ in the aircraft.” See, https://www.washingtonpost.com/national-security/2022/02/01/china-funding-drones-dji-us-regulators/.

Although DJI disputes the claims, it is still true that People’s Republic of China National Intelligence Law of 2017, Article 7, requires that “any organization or citizen shall support, assist and cooperate with the state intelligence work in accordance with the [National Intelligence] Law, and keep the secrets of the national intelligence work from becoming known to the public.”

Although much of the concern that led to the legislation has centered around DJI, which has the largest market share in the U.S. drone market, that company is just one example. The risk is not limited solely to DJI’s work with the Chinese government. The risk is present because of the data a drone may collect, where the data is stored, how the data is communicated, and the networks it uses to do so—and the possibility of exploitation at each of those steps. The risk is heightened in instances where the hardware and/or software are linked to a foreign country of concern but it still exists in drones manufactured elsewhere. 

The State of Florida and governmental agencies hold a variety of data on Floridians, strategically important information about facilities, and sensitive data such as investigatory materials for law enforcement purposes, to name a few.  Balancing the interest in protecting the data of the State of Florida, Floridians, and partners, against the ease of use of drone technology is the intent of the statutory language and this rule. 

Following multiple in-person and virtual meetings, numerous written correspondence, and three in-person workshops across the State of Florida, the Department has considered numerous public comments from stakeholders, including state agencies, law enforcement, universities, manufacturers, mosquito control districts, and others. Having considered the broad cross section of drone use cases and statutory language, this rulemaking sets forth minimum security standards for governmental agency drone use with sufficient flexibility to distinguish between the risk presented by various kinds of drones and uses. 

Although compliance with the rule requires an analysis of the capabilities of a drone in the context of its intended use, the U.S. Department of Defense has created a list of drones it has validated as secure that are likely to comply with the requirements of this rule provided they are used in a manner consistent with this rule.

RULEMAKING AUTHORITY:

934.50, F.S.

LAW:

934.50, F.S.

PRINT PUBLISH DATE:

12/12/2022 Vol. 48/239

COMMENTS:

From 12/12/2022 To 1/2/2023 (21 Days)
The public comment period for this notice has already expired.

REFERENCE MATERIALS:

No reference(s).

Under Florida law, E-mail addresses are public records. If you do not want your E-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone or in writing.