IoT Standards Leadership Act of 2019

I 116TH CONGRESS 1ST SESSION H. R. 3811 To direct the Secretary of Commerce to conduct a study and submit to Congress a report on the processes of international standards-setting with respect to internet-connected devices, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JULY 17, 2019 Ms. MATSUI (for herself and Mr. MCCAUL) introduced the following bill; which was referred to the Committee on Foreign Affairs A BILL To direct the Secretary of Commerce to conduct a study and submit to Congress a report on the processes of international standards-setting with respect to internet- connected devices, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘IoT Standards Leader- 4 ship Act of 2019’’. 5 SEC. 2. SENSE OF CONGRESS. 6 It is the sense of Congress that— 7 VerDate Sep 11 2014 19:29 Jul 27, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H3811.IH H3811 pamtmann on DSKBFK8HB2PROD with BILLS 2 •HR 3811 IH (1) United States policy has allowed industry in 1 the United States to innovate and lead the global 2 technology sector; 3 (2) as governments have sought to use country- 4 specific standards to hinder the innovation and in- 5 fluence of United States technology, the United 6 States should demonstrate leadership and be a vocal 7 supporter of the open, voluntary, consensus-based 8 international standards system; 9 (3) the United States should support multi- 10 stakeholder standards-development processes and ro- 11 bust involvement in international standards-setting 12 bodies and organizations with respect to internet- 13 connected devices (commonly known as the ‘‘Internet 14 of Things’’ or ‘‘IoT’’); 15 (4) the United States should support standards 16 that enable interoperability among devices and sys- 17 tems and are country-agnostic and vendor-neutral; 18 (5) the United States should maintain and fos- 19 ter United States leadership in international stand- 20 ards-setting bodies and organizations with respect to 21 internet-connected devices; 22 (6) the United States should work with govern- 23 ments and nongovernmental stakeholders to deter 24 the establishment of government-driven, country-spe- 25 VerDate Sep 11 2014 19:29 Jul 27, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3811.IH H3811 pamtmann on DSKBFK8HB2PROD with BILLS 3 •HR 3811 IH cific standards, which can be detrimental to inter- 1 operability and security; 2 (7) the convergence of traditional information 3 technology devices, networks, and systems with 4 internet-connected devices, networks, and systems, 5 including consumer and industrial internet-connected 6 devices, networks, and systems, may create cyberse- 7 curity and interoperability challenges, including 8 cyber exposure gap challenges, with respect to which 9 United States leadership in international standards- 10 setting bodies and organizations can lead to stronger 11 protection of networks to support the security of 12 internet-connected devices; and 13 (8) the United States should support standards- 14 development processes for internet-connected device 15 security that focus on prioritized, flexible, repeat- 16 able, performance-based, and cost-effective ap- 17 proaches to cyber hygiene and managing risk. 18 SEC. 3. STUDY AND REPORT. 19 (a) STUDY.—The Secretary of Commerce shall con- 20 duct a study of the international standards-setting bodies 21 and organizations that set standards with respect to inter- 22 net-connected devices and of the appropriate means to en- 23 sure robust United States leadership in the processes of 24 VerDate Sep 11 2014 19:29 Jul 27, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3811.IH H3811 pamtmann on DSKBFK8HB2PROD with BILLS 4 •HR 3811 IH such bodies and organizations. In conducting the study, 1 the Secretary shall assess— 2 (1) the involvement of the United States in 3 such processes; 4 (2) efforts of countries to create country-spe- 5 cific standards with respect to internet-connected de- 6 vices that are not aligned with international stand- 7 ards-setting processes and international standards; 8 (3) the progress, if any, that has been made in 9 developing international standards with respect to 10 internet-connected devices; 11 (4) how to support consistent United States 12 private and public sector participation in such bodies 13 and organizations; and 14 (5) the extent to which international standards 15 for internet-connected devices focus on prioritized, 16 flexible, repeatable, performance-based, and cost-ef- 17 fective approaches to cyber hygiene and managing 18 risk. 19 (b) REPORT.—Not later than 180 days after the date 20 of the enactment of this Act, the Secretary shall submit 21 to the Committee on Energy and Commerce of the House 22 of Representatives and the Committee on Commerce, 23 Science, and Transportation of the Senate a report that 24 contains— 25 VerDate Sep 11 2014 19:29 Jul 27, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H3811.IH H3811 pamtmann on DSKBFK8HB2PROD with BILLS 5 •HR 3811 IH (1) the results of the study required by sub- 1 section (a); 2 (2) recommendations to promote the leadership 3 of the United States and all relevant nongovern- 4 mental stakeholders in the processes of international 5 standards-setting bodies and organizations for set- 6 ting standards with respect to internet-connected de- 7 vices; and 8 (3) an assessment of whether and how the lead- 9 ership of the Secretary, working with governmental 10 and nongovernmental stakeholders, can— 11 (A) promote and strengthen international 12 standards with respect to internet-connected de- 13 vices; and 14 (B) discourage the development of country- 15 specific standards with respect to internet-con- 16 nected devices that could hinder interoperability 17 and security. 18 SEC. 4. DEFINITIONS. 19 In this Act: 20 (1) CYBER EXPOSURE GAP.—The term ‘‘cyber 21 exposure gap’’ means the cybersecurity and vulner- 22 ability management challenges organizations face in 23 seeing and understanding cybersecurity risk across 24 the full range of internet-connected platforms of 25 VerDate Sep 11 2014 19:29 Jul 27, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H3811.IH H3811 pamtmann on DSKBFK8HB2PROD with BILLS 6 •HR 3811 IH such organizations, including information tech- 1 nology, internet-connected devices, operational tech- 2 nology, mobile, and cloud computing platforms. 3 (2) INTERNET-CONNECTED DEVICE.—The term 4 ‘‘internet-connected device’’ means a physical object 5 that— 6 (A) is capable of connecting to the inter- 7 net, either directly or indirectly through a net- 8 work, to communicate information; 9 (B) has computer-processing capabilities 10 for collecting, sending, receiving, or analyzing 11 data; and 12 (C) is not a general-purpose computing de- 13 vice, including a personal computing system or 14 a smart mobile communications device. 15 Æ VerDate Sep 11 2014 19:29 Jul 27, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6301 E:\BILLS\H3811.IH H3811 pamtmann on DSKBFK8HB2PROD with BILLS