SUPPLY CHAIN Act of 2019

II 116TH CONGRESS 1ST SESSION S. 1457 To provide for interagency coordination on risk mitigation in the communica- tions equipment and services marketplace and the supply chain thereof, and for other purposes. IN THE SENATE OF THE UNITED STATES MAY 14, 2019 Mrs. BLACKBURN (for herself and Mr. CORNYN) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To provide for interagency coordination on risk mitigation in the communications equipment and services market- place and the supply chain thereof, and for other pur- poses. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Sharing Urgent, Po- 4 tentially Problematic Locations that Yield Communica- 5 tions Hazards in American Internet Networks Act of 6 2019’’ or the ‘‘SUPPLY CHAIN Act of 2019’’. 7 VerDate Sep 11 2014 05:27 May 23, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1457.IS S1457 kjohnson on DSK79L0C42 with BILLS 2 •S 1457 IS SEC. 2. INTERAGENCY COORDINATION ON RISK MITIGA- 1 TION IN THE COMMUNICATIONS EQUIPMENT 2 AND SERVICES MARKETPLACE AND THE SUP- 3 PLY CHAIN THEREOF. 4 (a) DEFINITIONS.—In this section: 5 (1) APPROPRIATE COMMITTEES OF CON- 6 GRESS.—The term ‘‘appropriate committees of Con- 7 gress’’ means— 8 (A) the Committee on Commerce, Science, 9 and Transportation, the Committee on Foreign 10 Relations, the Committee on Armed Services, 11 the Committee on the Judiciary, the Committee 12 on Homeland Security and Governmental Af- 13 fairs, and the Select Committee on Intelligence 14 of the Senate; and 15 (B) the Committee on Energy and Com- 16 merce, the Committee on Foreign Affairs, the 17 Committee on Armed Services, the Committee 18 on the Judiciary, the Committee on Homeland 19 Security, and the Permanent Select Committee 20 on Intelligence of the House of Representatives. 21 (2) APPROPRIATE FEDERAL ENTITY.—The 22 term ‘‘appropriate Federal entity’’ means— 23 (A) the Department of Defense; 24 (B) the Department of Energy; 25 (C) the Department of Homeland Security; 26 VerDate Sep 11 2014 05:27 May 23, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1457.IS S1457 kjohnson on DSK79L0C42 with BILLS 3 •S 1457 IS (D) the Department of Justice; 1 (E) the Department of Transportation; 2 (F) the Department of the Treasury; and 3 (G) the Office of the Director of National 4 Intelligence. 5 (3) CLASSIFIED INFORMATION.—The term 6 ‘‘classified information’’ means any information or 7 material that has been determined by the Federal 8 Government pursuant to an Executive order, statute, 9 or regulation, to require protection against unau- 10 thorized disclosure for reasons of national security. 11 (4) COMMUNICATIONS EQUIPMENT AND SERV- 12 ICES.—The term ‘‘communications equipment and 13 services’’ includes any hardware, software, or other 14 product or service primarily intended to fulfill or en- 15 able the function of information processing and com- 16 munications by electronic means, including trans- 17 mission and display, including over the internet. 18 (5) RISK.—The term ‘‘risk’’ means any aspect 19 or property of the components of communications 20 equipment and services or the associated supply 21 chain that may be used to gain unauthorized access 22 to a communications network, disrupt a communica- 23 tions network, disrupt the manufacture of commu- 24 nications equipment, disrupt consensus-driven indus- 25 VerDate Sep 11 2014 05:27 May 23, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1457.IS S1457 kjohnson on DSK79L0C42 with BILLS 4 •S 1457 IS try standards for communications equipment and 1 services, or otherwise harm a communications net- 2 work or the users of the network, including gaining 3 unauthorized access to data or redirecting data. 4 (6) SECRETARY.—The term ‘‘Secretary’’ means 5 the Secretary of Commerce. 6 (7) SUPPLY CHAIN.—The term ‘‘supply chain’’, 7 with respect to communications equipment and serv- 8 ices— 9 (A) means the network of persons and ac- 10 tivities from source to delivery of the equipment 11 and services; and 12 (B) includes— 13 (i) vendors, suppliers, and providers of 14 the equipment and services; and 15 (ii) persons who manufacture, assem- 16 ble, develop, or test the equipment and 17 services. 18 (b) ONGOING REVIEW.—Consistent with the protec- 19 tion of classified information, the Secretary shall, in co- 20 ordination with the head of each appropriate Federal enti- 21 ty, conduct an ongoing review of risks to the communica- 22 tions equipment and services marketplace and the supply 23 chain thereof. 24 VerDate Sep 11 2014 05:27 May 23, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1457.IS S1457 kjohnson on DSK79L0C42 with BILLS 5 •S 1457 IS (c) LONG-TERM SCENARIO AND STRATEGIC PLAN- 1 NING.— 2 (1) DEVELOPMENT, ISSUANCE, AND IMPLEMEN- 3 TATION OF PROCEDURES.—Not later than 180 days 4 after the date of enactment of this section, con- 5 sistent with the protection of classified information, 6 the Secretary, in coordination with the head of each 7 appropriate Federal entity, shall— 8 (A) develop and issue procedures to regu- 9 larly facilitate— 10 (i) long-term scenario and strategic 11 planning with private entities that have ap- 12 propriate security clearances to review 13 classified information about risks, includ- 14 ing by— 15 (I) assessing the severity of risks 16 posed to the marketplace of individual 17 components of communications equip- 18 ment and services and the supply 19 chain thereof; 20 (II) identifying counterfeit com- 21 munications equipment and services in 22 the marketplace; 23 (III) assessing the ability of for- 24 eign governments or third parties to 25 VerDate Sep 11 2014 05:27 May 23, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1457.IS S1457 kjohnson on DSK79L0C42 with BILLS 6 •S 1457 IS exploit the marketplace in a manner 1 that raises risks; 2 (IV) identifying— 3 (aa) emerging risks and 4 long-term trends in the market- 5 place of individual components or 6 standards of communications 7 equipment and services and the 8 supply chain thereof; and 9 (bb) strategies to mitigate 10 risks described in item (aa); and 11 (V) analyzing opportunities for 12 asymmetric advantage; 13 (ii) the— 14 (I) preparation of unclassified in- 15 formation that raises awareness of 16 risks, including, as appropriate, un- 17 classified versions of any information 18 shared under clause (i); and 19 (II) dissemination by the Sec- 20 retary of the unclassified information 21 described in subclause (I) to private 22 entities that do not have appropriate 23 security clearances; and 24 VerDate Sep 11 2014 05:27 May 23, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S1457.IS S1457 kjohnson on DSK79L0C42 with BILLS 7 •S 1457 IS (iii) the voluntary sharing from pri- 1 vate entities to the Secretary of informa- 2 tion about risks to the marketplace; and 3 (B) carry out the procedures developed and 4 issued under subparagraph (A). 5 (2) MANNER OF PRESENTATION.—The informa- 6 tion shared with private entities under paragraph 7 (1)(A)(i) shall be presented in a manner that identi- 8 fies, assesses, and prioritizes risks, the mitigation of 9 risks, and opportunities for asymmetric advantage. 10 (3) INFORMATION SHARED WITH OR PROVIDED 11 TO THE FEDERAL GOVERNMENT.— 12 (A) NO WAIVER OF PRIVILEGE OR PROTEC- 13 TION.—The provision of information to the 14 Federal Government by a private entity under 15 clause (i) or (iii) of paragraph (1)(A) shall not 16 constitute a waiver of any applicable privilege 17 or protection provided by law, including trade 18 secret protection. 19 (B) PROPRIETARY INFORMATION.—Infor- 20 mation provided to the Federal Government by 21 a private entity under clause (i) or (iii) of para- 22 graph (1)(A) shall be considered the commer- 23 cial, financial, and proprietary information of 24 the private entity. 25 VerDate Sep 11 2014 05:27 May 23, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1457.IS S1457 kjohnson on DSK79L0C42 with BILLS 8 •S 1457 IS (C) EXEMPTION FROM DISCLOSURE 1 UNDER FOIA.—Information provided to the 2 Federal Government by a private entity under 3 clause (i) or (iii) of paragraph (1)(A) shall be 4 exempt from disclosure under section 552(b)(3) 5 of title 5, United States Code. 6 (D) EXEMPTION FROM FEDERAL REGU- 7 LATORY AUTHORITY.—Information provided to 8 the Federal Government by a private entity 9 under clause (i) or (iii) of paragraph (1)(A) 10 shall not be used by any Federal entity to regu- 11 late, including through an enforcement action, 12 the lawful activities of the private entity. 13 (E) PROTECTION FROM LIABILITY.—No 14 cause of action shall lie or be maintained in any 15 court against a private entity, and such action 16 shall be promptly dismissed, if the action is re- 17 lated to or arises out of the provision of infor- 18 mation to the Federal Government by the pri- 19 vate entity under clause (i) or (iii) of paragraph 20 (1)(A). 21 (d) REPORT TO CONGRESS.— 22 (1) IN GENERAL.—Not later than 1 year after 23 the date of enactment of this section, and biennially 24 thereafter, the Secretary, in coordination with the 25 VerDate Sep 11 2014 05:27 May 23, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S1457.IS S1457 kjohnson on DSK79L0C42 with BILLS 9 •S 1457 IS head of each appropriate Federal entity, shall sub- 1 mit to the appropriate committees of Congress a re- 2 port on the implementation of this section. 3 (2) CONTENTS.—The report required under 4 paragraph (1) shall— 5 (A) include any recommendations that the 6 Secretary, in collaboration with the heads of the 7 appropriate Federal entities, may have for im- 8 provements or modifications to the procedures 9 developed and issued under this section; 10 (B) evaluate the effectiveness of the proce- 11 dures developed and issued under subsection 12 (c)(1)(A); 13 (C) identify processes and procedures that 14 improve the ability of private entities and the 15 Federal Government to adapt to emerging risks 16 to the marketplace; 17 (D) provide technical guidance on procure- 18 ment of communications equipment and services 19 offered by private entities in order to mitigate 20 vulnerabilities; 21 (E) include recommendations to streamline 22 the provision of security clearances for relevant 23 private sector actors; and 24 VerDate Sep 11 2014 05:27 May 23, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S1457.IS S1457 kjohnson on DSK79L0C42 with BILLS 10 •S 1457 IS (F) assess coordination between the heads 1 of the appropriate Federal entities, including by 2 identifying distinct competencies and jurisdic- 3 tions of each appropriate Federal entity. 4 (3) FORM OF REPORTS.—Each report sub- 5 mitted under paragraph (1) shall be in unclassified 6 form, but may include a classified annex. 7 (e) RULE OF CONSTRUCTION.—Nothing in this sec- 8 tion shall be construed to authorize the Secretary or the 9 head of any other Federal agency to issue new regulations. 10 Æ VerDate Sep 11 2014 05:27 May 23, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6301 E:\BILLS\S1457.IS S1457 kjohnson on DSK79L0C42 with BILLS