SB2514

The DPS unit: Its statutory mission is to help prevent harassment and coercion of Texas residents, strengthen state agencies and protect critical infrastructure from threatening actions by adversarial foreign governments. The director may appoint employees. The unit must collaborate with local governments and federal agencies to operate the Texas Fusion Center, refer appropriate cases for prosecution, and report to the governor and legislature by December 1 of each even-numbered year on threats during the preceding two years and effective responses. State agencies and local law-enforcement agencies must provide relevant information when requested. A prosecution referral is not itself a conviction or a separate definition of a crime. Final law, sections 411.551–.555.

Sensitive information obtained or produced for the report must be stored securely and is exempt from public disclosure under the Public Information Act. With the DPS director’s approval, it may be shared with federal, state or local law enforcement; that sharing is not treated as voluntary public disclosure under section 552.007. This is not a declaration that every record held by DPS is secret. Final law, sections 411.556–.558; Voluntary-disclosure rule.

Gifts, travel and contacts: An employee or volunteer of a state agency or Texas political subdivision may not accept transportation to or lodging in a foreign-adversary country paid for by that adversary because of the person’s public position. They also may not accept a gift or item of value from a person representing a foreign adversary for any purpose, including the specified conference and travel reimbursements. They must report each interaction, communication or meeting with a person acting on behalf of a foreign adversary to the Texas Ethics Commission within 30 days. The commission must provide reports to the attorney general or DPS on request. The trigger is representation of or action on behalf of an adversary—not foreign nationality alone. Final law, section 572.070(b)–(d); Chapter definitions.

For these restrictions and the training provision, a foreign adversary is a country identified as a national-security risk in at least one of the three most recent U.S. intelligence-community Annual Threat Assessments, or designated by the governor after consulting the DPS director. The act does not provide a fixed country list. Its DPS-unit definition of foreign-adversary operations separately concerns threatening actions by adversarial foreign governments. This briefing does not certify a current country list or whether a particular person represents such a government. Final law, sections 411.551 and 572.070(a); Federal annual-report provision.

Reporting reaches earlier contacts: The reporting duty covers interactions on or after March 1, 2025. For covered contacts before the September 1 effective date, the act allowed 30 days after that effective date to report. That transition does not mean accepting a pre-effective-date gift was itself retroactively made the new offense; the enacted transition specifically addresses reporting. Final law, section 4.

Training: Certified cybersecurity programs must add instruction about foreign adversaries and coordinated influence operations, specifically including the Chinese Communist Party’s United Front Work Department; targeting of state and local government; recognizing suspected operations; relevant informational resources; and reporting to the Ethics Commission and law enforcement. The Department of Information Resources was required to adopt implementing rules by December 1, 2025. The new content applies to program certifications on or after May 1, 2026; earlier certifications remain governed by the law applicable when certified. It is not a new May 1 deadline for every individual to finish training. Final law, sections 3 and 5; Existing training-certification framework.

Changes during passage: The Senate substitute replaced the introduced strategy-and-tracking structure with the unit’s final mission, biennial reporting and Fusion Center duties. It expanded the country-definition reference from one assessment to three and added gubernatorial designation, expressly required a knowing violation, changed the proposed Class A misdemeanor to a state jail felony, and moved the training requirement into cybersecurity certification. The only indexed floor amendment—Hughes’s Senate F1, adopted May 5—moved the training-certification transition from January 1 to May 1, 2026. That change survived; the Senate-passed, House committee and final operative texts matched. Introduced; Senate substitute; Senate F1; Disposition; All versions; Final law.

Compare the published text versions in the official text index. A change is not attributed to a specific amendment here without a verified record.

The intended public benefit is protection from coercion and other foreign-adversary threats. Agencies gain coordination and reporting duties; covered employees and volunteers face compliance burdens and criminal exposure for knowing violations. Actual prosecutions, improved security, hiring and agency compliance are not established by enactment. The latest fiscal note expects no significant state fiscal implication and says DPS and the information-resources department can absorb costs with existing resources. It also assumes no significant state correctional or local enforcement, prosecution, supervision or confinement impact. May 12 latest fiscal note; Final law.

The introduced bill’s earlier estimate was an $11,066,853 General Revenue-related cost for the 2026–27 biennium and 19 additional full-time-equivalent positions. That estimate concerned the earlier structure; it is not the estimate for the enacted version and is not an appropriation made by this act. Earlier fiscal note; Substitute fiscal note; Latest fiscal note.