H.R. 1709

119th CONGRESS 1st Session

To direct the Assistant Secretary of Commerce for Communications and Information to submit to Congress a report examining the cybersecurity of mobile service networks, and for other purposes.

IN THE HOUSE OF REPRESENTATIVES

Table of contents

• H.R. 1709
  • SEC. 1. Short title
  • SEC. 2. Report on cybersecurity of mobile service networks

SEC. 1. Short title

• This Act may be cited as the Understanding Cybersecurity of Mobile Networks Act.

SEC. 2. Report on cybersecurity of mobile service networks

• (a) In general
  • Not later than 1 year after the date of the enactment of this Act, the Assistant Secretary, in consultation with the Department of Homeland Security, shall submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report examining the cybersecurity of mobile service networks and the vulnerability of such networks and mobile devices to cyberattacks and surveillance conducted by adversaries.
• (b) Matters To be included
  • The report required by subsection (a) shall include the following:
    • An assessment of the degree to which providers of mobile service have addressed, are addressing, or have not addressed cybersecurity vulnerabilities (including vulnerabilities the exploitation of which could lead to surveillance conducted by adversaries) identified by academic and independent researchers, multistakeholder standards and technical organizations, industry experts, and Federal agencies, including in relevant reports of—
      • the National Telecommunications and Information Administration;
      • the National Institute of Standards and Technology; and
      • the Department of Homeland Security, including—
        • (i) the Cybersecurity and Infrastructure Security Agency; and
        • (ii) the Science and Technology Directorate.
    • A discussion of—
      • the degree to which customers (including consumers, companies, and government agencies) consider cybersecurity as a factor when considering the purchase of mobile service and mobile devices; and
      • the commercial availability of tools, frameworks, best practices, and other resources for enabling such customers to evaluate cybersecurity risk and price tradeoffs.
    • A discussion of the degree to which providers of mobile service have implemented cybersecurity best practices and risk assessment frameworks.
    • An estimate and discussion of the prevalence and efficacy of encryption and authentication algorithms and techniques used in each of the following:
      • Mobile service.
      • Mobile communications equipment or services.
      • Commonly used mobile phones and other mobile devices.
      • Commonly used mobile operating systems and communications software and applications.
    • A discussion of the barriers for providers of mobile service to adopt more efficacious encryption and authentication algorithms and techniques and to prohibit the use of older encryption and authentication algorithms and techniques with established vulnerabilities in mobile service, mobile communications equipment or services, and mobile phones and other mobile devices.
    • An estimate and discussion of the prevalence, usage, and availability of technologies that authenticate legitimate mobile service and mobile communications equipment or services to which mobile phones and other mobile devices are connected.
    • An estimate and discussion of the prevalence, costs, commercial availability, and usage by adversaries in the United States of cell site simulators (often known as international mobile subscriber identity catchers) and other mobile service surveillance and interception technologies.
• (c) Consultation
  • In preparing the report required by subsection (a), the Assistant Secretary shall, to the degree practicable, consult with—
    • the Federal Communications Commission;
    • the National Institute of Standards and Technology;
    • the intelligence community;
    • the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security;
    • the Science and Technology Directorate of the Department of Homeland Security;
    • academic and independent researchers with expertise in privacy, encryption, cybersecurity, and network threats;
    • participants in multistakeholder standards and technical organizations (including the 3rd Generation Partnership Project and the Internet Engineering Task Force);
    • international stakeholders, in coordination with the Department of State as appropriate;
    • providers of mobile service, including small providers (or the representatives of such providers) and rural providers (or the representatives of such providers);
    • manufacturers, operators, and providers of mobile communications equipment or services and mobile phones and other mobile devices;
    • developers of mobile operating systems and communications software and applications; and
    • other experts that the Assistant Secretary considers appropriate.
• (d) Scope of report
  • The Assistant Secretary shall—
    • limit the report required by subsection (a) to mobile service networks;
    • exclude consideration of 5G protocols and networks in the report required by subsection (a);
    • limit the assessment required by subsection (b)(1) to vulnerabilities that have been shown to be—
      • exploited in non-laboratory settings; or
      • feasibly and practicably exploitable in real-world conditions; and
    • consider in the report required by subsection (a) vulnerabilities that have been effectively mitigated by manufacturers of mobile phones and other mobile devices.
• (e) Form of report
  • (1) Classified information
    • The report required by subsection (a) shall be produced in unclassified form but may contain a classified annex.
  • (2) Potentially exploitable unclassified information
    • The Assistant Secretary shall redact potentially exploitable unclassified information from the report required by subsection (a) but shall provide an unredacted form of the report to the committees described in such subsection.
• (f) Definitions
  • In this section:
    • The term includes— adversary
    • The term means the Assistant Secretary of Commerce for Communications and Information.
    • The term means a partnership, association, trust, joint venture, corporation, group, subgroup, or other organization. entity
    • The term has the meaning given that term in section 3 of the National Security Act of 1947 (). intelligence community 50 U.S.C. 3003
    • The term means any equipment or service that is essential to the provision of mobile service. mobile communications equipment or service
    • The term means, to the extent provided to United States customers, either or both of the following services: mobile service
    • The term means an individual or entity. person
    • The term means— United States person