Utah Locked Foreign Technology Out of Critical Systems and Rewrote the Rules for Opening Your Digital Life.

What can one electronic record reveal about a person?

A location trail shows where someone sleeps and worships. Messages show relationships. Search and purchase histories show fears, health concerns, finances, and daily habits.

House Bill 261 revises Utah's Electronic Information Privacy Act, changing how law enforcement obtains, copies, uses, retains, and discloses covered information. It also revises the duties and protections of providers responding to legal process.

Picture detectives seeking months of location data from a phone provider. The request can reveal a person's home, workplace, church, medical visits, political meetings, and private relationships. The warrant should identify the account, the period, the suspected crime, and the categories of data so the search does not become a general exploration of the person's life.

The provider stands between the government and the account holder. It needs legal process clear enough to verify, a way to challenge an overbroad demand, and protection when it complies in good faith. The person needs notice when the law allows it and a meaningful remedy when information is obtained or kept outside the authorized scope.

The warrant is the front door to that digital house. It should identify the account, information, time period, and suspected offense. Retention and later use should remain tied to the authorized investigation. Providers need an order they can verify, and individuals need notice and a remedy when government exceeds it, subject to narrow reviewable exceptions.

Copying creates a second privacy decision after collection. Data relevant to one investigation can contain years of unrelated messages and records. Utah should require deletion of information outside the case, document any later use, and demand fresh legal authority before investigators repurpose the data for an unrelated inquiry.

House Bill 165 directs the Utah Cyber Center to develop guidance on foreign-adversary threats to critical infrastructure. Covered systems cannot use equipment already banned under federal rules. The state may also conduct voluntary security assessments involving foreign-adversary technology.

Picture a water utility discovering communications equipment from a federally prohibited manufacturer inside the system that controls pumps or treatment operations. HB165 gives the state a framework for identifying the risk and keeping banned technology out of infrastructure whose failure could endanger an entire community.

Federal lists can change, so Utah operators need timely notice, model numbers, replacement schedules, and a process for resolving mistaken classifications. A small utility may also need technical and financial help replacing embedded equipment without interrupting essential service.

“Voluntary” should mean written consent and a defined scope. The assessment needs limits on data handling, correction procedures, and separation from unrelated enforcement.

A utility that declines an assessment should not lose unrelated grants, permits, or favorable treatment through informal pressure. When it agrees, the written scope should identify systems tested, data copied, people with access, retention, remediation, and whether findings can be shared with another agency.

Utah strengthened two security boundaries. One keeps hostile technology out of critical networks. The other governs when the state may enter a person's electronic records.

Security protects liberty when the government respects the warrant line as carefully as the firewall.

This is our read of the laws. We encourage you to read them yourself and reach your own conclusions.