Securing the Homeland Security Supply Chain Act of 2019

IB Union Calendar No. 146 116TH CONGRESS 1ST SESSION H. R. 3320 [Report No. 116–188] To amend the Homeland Security Act of 2002 to authorize the Secretary of Homeland Security to implement certain requirements for information relating to supply chain risk, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JUNE 18, 2019 Mr. KING of New York (for himself, Mr. THOMPSON of Mississippi, Miss RICE of New York, Mr. CORREA, Mr. ROGERS of Alabama, Mr. ROSE of New York, and Mr. PAYNE) introduced the following bill; which was referred to the Committee on Homeland Security AUGUST 27, 2019 Additional sponsors: Mr. MCCAUL and Mr. HAGEDORN AUGUST 27, 2019 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed [Strike out all after the enacting clause and insert the part printed in italic] [For text of introduced bill, see copy of bill as introduced on June 18, 2019] VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6652 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 2 •HR 3320 RH A BILL To amend the Homeland Security Act of 2002 to authorize the Secretary of Homeland Security to implement certain requirements for information relating to supply chain risk, and for other purposes. VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6652 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 3 •HR 3320 RH Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Securing the Homeland 4 Security Supply Chain Act of 2019’’. 5 SEC. 2. DEPARTMENT OF HOMELAND SECURITY REQUIRE- 6 MENTS FOR INFORMATION RELATING TO 7 SUPPLY CHAIN RISK. 8 (a) IN GENERAL.—Subtitle D of title VIII of the 9 Homeland Security Act of 2002 (6 U.S.C. 391 et seq.) is 10 amended by adding at the end the following new section: 11 ‘‘SEC. 836. REQUIREMENTS FOR INFORMATION RELATING 12 TO SUPPLY CHAIN RISK. 13 ‘‘(a) AUTHORITY.—Subject to subsection (b), the Sec- 14 retary may— 15 ‘‘(1) carry out a covered procurement action; 16 ‘‘(2) limit, notwithstanding any other provision 17 of law, in whole or in part, the disclosure of informa- 18 tion, including classified information, relating to the 19 basis for carrying out such an action; and 20 ‘‘(3) exclude, in whole or in part, a source car- 21 ried out in the course of such an action applicable to 22 a covered procurement of the Department. 23 ‘‘(b) DETERMINATION AND NOTIFICATION.—Except as 24 authorized by subsection (c) to address an urgent national 25 VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6203 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 4 •HR 3320 RH security interest, the Secretary may exercise the authority 1 provided in subsection (a) only after— 2 ‘‘(1) obtaining a joint recommendation, in un- 3 classified or classified form, from the Chief Acquisi- 4 tion Officer and the Chief Information Officer of the 5 Department, including a review of any risk assess- 6 ment made available by an appropriate person or en- 7 tity, including the national risk management center 8 at the Cybersecurity and Infrastructure Security 9 Agency, that there is a significant supply chain risk 10 in a covered procurement; 11 ‘‘(2) notifying any source named in the joint rec- 12 ommendation described in paragraph (1) advising— 13 ‘‘(A) that a recommendation has been ob- 14 tained; 15 ‘‘(B) to the extent consistent with the na- 16 tional security and law enforcement interests, the 17 basis for such recommendation; 18 ‘‘(C) that, within 30 days after receipt of 19 notice, such source may submit information and 20 argument in opposition to such recommendation; 21 and 22 ‘‘(D) of the procedures governing the consid- 23 eration of such submission and the possible exer- 24 cise of the authority provided in subsection (a); 25 VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6203 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 5 •HR 3320 RH ‘‘(3) notifying the relevant components of the De- 1 partment that such risk assessment has demonstrated 2 significant supply chain risk to a covered procure- 3 ment; 4 ‘‘(4) making a determination in writing, in un- 5 classified or classified form, that after considering 6 any information submitted by a source under para- 7 graph (2), and in consultation with the Chief Infor- 8 mation Officer of the Department, that— 9 ‘‘(A) use of authority under subsection 10 (a)(1) is necessary to protect national security 11 by reducing supply chain risk; 12 ‘‘(B) less intrusive measures are not reason- 13 ably available to reduce such risk; 14 ‘‘(C) a decision to limit disclosure of infor- 15 mation under subsection (a)(2) is necessary to 16 protect national security interest; and 17 ‘‘(D) the use of such authorities will apply 18 to a single covered procurement or a class of cov- 19 ered procurements, and otherwise specifies the 20 scope of such determination; 21 ‘‘(5) providing to the Committee on Homeland 22 Security of the House of Representatives and the 23 Committee on Homeland Security and Governmental 24 Affairs of the Senate a classified or unclassified notice 25 VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6203 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 6 •HR 3320 RH of the determination made under paragraph (4) that 1 includes— 2 ‘‘(A) the joint recommendation described in 3 paragraph (1); 4 ‘‘(B) a summary of any risk assessment re- 5 viewed in support of such joint recommendation; 6 and 7 ‘‘(C) a summary of the basis for such deter- 8 mination, including a discussion of less intrusive 9 measures that were considered and why such 10 measures were not reasonably available to reduce 11 supply chain risk; 12 ‘‘(6) notifying the Director of the Office of Man- 13 agement and Budget, and the heads of other Federal 14 agencies as appropriate, in a manner and to the ex- 15 tent consistent with the requirements of national secu- 16 rity; and 17 ‘‘(7) taking steps to maintain the confidentiality 18 of any notifications under this subsection. 19 ‘‘(c) PROCEDURES TO ADDRESS URGENT NATIONAL 20 SECURITY INTERESTS.—In any case in which the Secretary 21 determines that national security interests require the im- 22 mediate exercise of the authorities under subsection (a), the 23 Secretary— 24 VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6203 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 7 •HR 3320 RH ‘‘(1) may, to the extent necessary to address any 1 such national security interest, and subject to the con- 2 ditions specified in paragraph (2)— 3 ‘‘(A) temporarily delay the notice required 4 by subsection (b)(2); 5 ‘‘(B) make the determination required by 6 subsection (b)(4), regardless of whether the notice 7 required by subsection (b)(2) has been provided 8 or whether the notified source at issue has sub- 9 mitted any information in response to such no- 10 tice; 11 ‘‘(C) temporarily delay the notice required 12 by subsections (b)(4) and (b)(5); and 13 ‘‘(D) exercise the authority provided in sub- 14 section (a) in accordance with such determina- 15 tion; and 16 ‘‘(2) shall take actions necessary to comply with 17 all requirements of subsection (b) as soon as prac- 18 ticable after addressing the urgent national security 19 interest that is the subject of paragraph (1), includ- 20 ing— 21 ‘‘(A) providing the notice required by sub- 22 section (b)(2); 23 ‘‘(B) promptly considering any information 24 submitted by the source at issue in response to 25 VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6203 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 8 •HR 3320 RH such notice, and making any appropriate modi- 1 fications to the determination required by sub- 2 section (b)(4) based on such information; and 3 ‘‘(C) providing the notice required by sub- 4 sections (b)(5) and (b)(6), including a descrip- 5 tion of such urgent national security, and any 6 modifications to such determination made in ac- 7 cordance with subparagraph (B). 8 ‘‘(d) ANNUAL REVIEW OF DETERMINATIONS.—The 9 Secretary shall annually review all determinations made 10 under subsection (b). 11 ‘‘(e) DELEGATION.—The Secretary may not delegate 12 the authority provided in subsection (a) or the responsi- 13 bility identified in subsection (d) to an official below the 14 Deputy Secretary. 15 ‘‘(f) LIMITATION OF REVIEW.—Notwithstanding any 16 other provision of law, no action taken by the Secretary 17 under subsection (a) may be subject to review in a bid pro- 18 test before the Government Accountability Office or in any 19 Federal court. 20 ‘‘(g) CONSULTATION.—In developing procedures and 21 guidelines for the implementation of the authorities de- 22 scribed in this section, the Secretary shall review the proce- 23 dures and guidelines utilized by the Department of Defense 24 to carry out similar authorities. 25 VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6203 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 9 •HR 3320 RH ‘‘(h) DEFINITIONS.—In this section: 1 ‘‘(1) COVERED ARTICLE.—The term ‘covered ar- 2 ticle’ means: 3 ‘‘(A) Information technology, including 4 cloud computing services of all types. 5 ‘‘(B) Telecommunications equipment. 6 ‘‘(C) Telecommunications services. 7 ‘‘(D) The processing of information on a 8 Federal or non-Federal information system, sub- 9 ject to the requirements of the Controlled Unclas- 10 sified Information program of the Department. 11 ‘‘(E) Hardware, systems, devices, software, 12 or services that include embedded or incidental 13 information technology. 14 ‘‘(2) COVERED PROCUREMENT.—The term ‘cov- 15 ered procurement’ means— 16 ‘‘(A) a source selection for a covered article 17 involving either a performance specification, as 18 provided in subsection (a)(3)(B) of section 3306 19 of title 41, United States Code, or an evaluation 20 factor, as provided in subsection (c)(1)(A) of 21 such section, relating to supply chain risk, or 22 with respect to which supply chain risk consider- 23 ations are included in the Department’s deter- 24 VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6203 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 10 •HR 3320 RH mination of whether a source is a responsible 1 source as defined in section 113 of such title; 2 ‘‘(B) the consideration of proposals for and 3 issuance of a task or delivery order for a covered 4 article, as provided in section 4106(d)(3) of title 5 41, United States Code, with respect to which the 6 task or delivery order contract includes a con- 7 tract clause establishing a requirement relating 8 to supply chain risk; 9 ‘‘(C) any contract action involving a con- 10 tract for a covered article with respect to which 11 such contract includes a clause establishing re- 12 quirements relating to supply chain risk; or 13 ‘‘(D) any procurement made via Govern- 14 ment Purchase Care for a covered article when 15 supply chain risk has been identified as a con- 16 cern. 17 ‘‘(3) COVERED PROCUREMENT ACTION.—The 18 term ‘covered procurement action’ means any of the 19 following actions, if such action takes place in the 20 course of conducting a covered procurement: 21 ‘‘(A) The exclusion of a source that fails to 22 meet qualification requirements established pur- 23 suant to section 3311 of title 41, United States 24 VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6203 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 11 •HR 3320 RH Code, for the purpose of reducing supply chain 1 risk in the acquisition or use of a covered article. 2 ‘‘(B) The exclusion of a source that fails to 3 achieve an acceptable rating with regard to an 4 evaluation factor providing for the consideration 5 of supply chain risk in the evaluation of pro- 6 posals for the award of a contract or the issuance 7 of a task or delivery order. 8 ‘‘(C) The determination that a source is not 9 a responsible source based on considerations of 10 supply chain risk. 11 ‘‘(D) The decision to withhold consent for a 12 contractor to subcontract with a particular 13 source or to direct a contractor to exclude a par- 14 ticular source from consideration for a sub- 15 contract. 16 ‘‘(4) INFORMATION SYSTEM.—The term ‘informa- 17 tion system’ has the meaning given such term in sec- 18 tion 3502 of title 44, United States Code. 19 ‘‘(5) INFORMATION TECHNOLOGY.—The term ‘in- 20 formation technology’ has the meaning given such 21 term in section 11101 of title 40, United States Code. 22 ‘‘(6) RESPONSIBLE SOURCE.—The term ‘respon- 23 sible source’ has the meaning given such term in sec- 24 tion 113 of title 41, United States Code. 25 VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6203 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 12 •HR 3320 RH ‘‘(7) SUPPLY CHAIN RISK.—The term ‘supply 1 chain risk’ means the risk that a malicious actor may 2 sabotage, maliciously introduce an unwanted func- 3 tion, extract or modify data, or otherwise manipulate 4 the design, integrity, manufacturing, production, dis- 5 tribution, installation, operation, or maintenance of a 6 covered article so as to surveil, deny, disrupt, or oth- 7 erwise manipulate the function, use, or operation of 8 the information technology or information stored or 9 transmitted on the covered articles. 10 ‘‘(8) TELECOMMUNICATIONS EQUIPMENT.—The 11 term ‘telecommunications equipment’ has the mean- 12 ing given such term in section 3(52) of the Commu- 13 nications Act of 1934 (47 U.S.C. 153(52)). 14 ‘‘(9) TELECOMMUNICATIONS SERVICE.—The term 15 ‘telecommunications service’ has the meaning given 16 such term in section 3(53) of the Communications Act 17 of 1934 (47 U.S.C. 153(53)). 18 ‘‘(i) EFFECTIVE DATE.—The requirements of this sec- 19 tion shall take effect on the date that is 90 days after the 20 date of the enactment of this Act and shall apply to— 21 ‘‘(1) contracts awarded on or after such date; 22 and 23 VerDate Sep 11 2014 20:08 Aug 27, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6203 E:\BILLS\H3320.RH H3320 pamtmann on DSKBC07HB2PROD with BILLS 13 •HR 3320 RH ‘‘(2) task and delivery orders issued on or after 1 such date pursuant to contracts awarded before, on, 2 or after such date.’’. 3 (b) RULEMAKING.—Section 553 of title 5, United 4 States Code, and section 1707 of title 41, United States 5 Code, shall not apply [Text truncated for display. Full text available on Congress.gov.]