MICROCHIPS Act of 2019

II 116TH CONGRESS 1ST SESSION S. 2316 To require a plan for strengthening the supply chain intelligence function, to establish a National Supply Chain Intelligence Center, and for other purposes. IN THE SENATE OF THE UNITED STATES JULY 30, 2019 Mr. CRAPO (for himself and Mr. WARNER) introduced the following bill; which was read twice and referred to the Select Committee on Intelligence A BILL To require a plan for strengthening the supply chain intel- ligence function, to establish a National Supply Chain Intelligence Center, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Manufacturing, Invest- 4 ment, and Controls Review for Computer Hardware, Intel- 5 lectual Property, and Supply Act of 2019’’ or the 6 ‘‘MICROCHIPS Act of 2019’’. 7 VerDate Sep 11 2014 00:52 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2316.IS S2316 kjohnson on DSK79L0C42 with BILLS 2 •S 2316 IS SEC. 2. FINDINGS AND SENSE OF CONGRESS. 1 (a) FINDINGS.—Congress makes the following find- 2 ings: 3 (1) Fifth generation telecommunications tech- 4 nology (commonly referred to as ‘‘5G’’), as well as 5 other emerging technologies, will revolutionize the 6 technology industry, becoming a vital part of day-to- 7 day business and life, and requires secure supply 8 chains for the national security of the United States. 9 (2) An insecure supply chain for products sup- 10 plied to the United States Government can lead to 11 a degradation of critical infrastructure and tech- 12 nology items that are essential to the defense of the 13 United States. 14 (3) The United States Government confronts 15 adversaries who seek to offset the military strength 16 of the United States through asymmetric, nonkinetic 17 actions that compromise and neutralize the decision- 18 making systems, processes, and warfighting capabili- 19 ties of the United States. 20 (4) These adversaries take advantage of the 21 open and democratic system of the United States 22 that prioritizes governmental transparency to con- 23 nect citizens with the actions of the Government. 24 VerDate Sep 11 2014 00:52 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2316.IS S2316 kjohnson on DSK79L0C42 with BILLS 3 •S 2316 IS (5) The National Defense Strategy identified 1 Russia and China as primary strategic competitors 2 of the United States. 3 (6) Russia and China seek to steal sensitive de- 4 fense information from the United States through 5 the use of blended espionage operations in the sup- 6 ply chain, supply chain activities, and cyberspace, 7 and through insider threat human actors. 8 (7) The actions of Russia and China go well be- 9 yond theft of critical military technology, threatening 10 the integrity and readiness of information and weap- 11 ons systems and potentially enabling key elements of 12 the strategies of an adversary to defeat the Armed 13 Forces of the United States across the spectrum of 14 conflict. 15 (8) According to some estimates, cybersecurity 16 spending in the United States from 2017 to 2021 17 will exceed $1,000,000,000,000 among the public 18 and private sectors. 19 (9) Even with these large investments in cyber- 20 security, the United States remains vulnerable to ad- 21 vanced cyber actors like Russia and China. 22 (10) Since 2013, more than 6,000,000 indi- 23 vidual data records have been compromised every 24 VerDate Sep 11 2014 00:52 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2316.IS S2316 kjohnson on DSK79L0C42 with BILLS 4 •S 2316 IS day through data breaches, with nearly half of these 1 losses occurring in the Government sector. 2 (11) Large expenditures of resources and a pro- 3 tective strategy that relies on firewalls and bound- 4 aries that can be breached by a persistent actor are 5 clearly insufficient and completely ignore the supply 6 chain vector. 7 (12) Military weapons systems are not immune 8 to cyber vulnerabilities. 9 (13) An October 2018 Government Account- 10 ability Office report found that nearly all weapons 11 systems of the United States have cyber 12 vulnerabilities the scale of which the Department of 13 Defense is ‘‘just beginning to grapple with’’. 14 (14) Furthermore, the report stated that de- 15 spite multiple warnings since the early 1990s, ‘‘cy- 16 bersecurity has not been a focus of weapon systems 17 acquisitions’’. 18 (15) There have been numerous press stories 19 about data breaches and theft of United States sen- 20 sitive technology that prove that cyber vulnerabilities 21 are real and not theoretical. 22 (16) The Department of Defense will spend 23 more than $1,600,000,000,000 to develop and field 24 its current portfolio of weapons systems. 25 VerDate Sep 11 2014 00:52 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2316.IS S2316 kjohnson on DSK79L0C42 with BILLS 5 •S 2316 IS (17) Conducting acquisitions without making 1 security resiliency a key discriminator in capability 2 development and contract award decisions could po- 3 tentially lead to additional losses of technological ad- 4 vantages of the Armed Forces and negate efforts to 5 improve the capabilities of the Armed Forces to 6 meet the National Defense Strategy. 7 (18) Software, hardware, and services supply 8 chains have proven to be major means through 9 which adversaries seek to gain access to weapons 10 systems and information and communications tech- 11 nology platforms and systems of the United States. 12 (19) Vulnerabilities in these critical areas intro- 13 duce unacceptable risks to human life and the ability 14 of the Armed Forces to execute the missions the 15 public of the United States expects of them. 16 (20) The establishment of the Protecting Crit- 17 ical Technology Task Force of the Department of 18 Defense and the Information and Communication 19 Technology Supply Chain Risk Management Task 20 Force of the Department of Homeland Security is a 21 welcome first step, but the United States Govern- 22 ment requires a fundamental security culture 23 change. 24 VerDate Sep 11 2014 00:52 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2316.IS S2316 kjohnson on DSK79L0C42 with BILLS 6 •S 2316 IS (21) The innovative technologies that will help 1 the Armed Forces, economy, and industry of the 2 United States maintain competitive advantages over 3 the competitors of the United States are developed 4 in private industry and in academia. 5 (22) Engagement to find solutions with indus- 6 try stakeholders and allied countries to mitigate the 7 clear, present, and rapidly evolving threats to the 8 national security of the United States is necessary. 9 (23) A national center to unify efforts across 10 the whole of government to strategically warn of and 11 support the mitigation of threats to supply chains 12 and supply chain activities is vital to the cybersecu- 13 rity, critical infrastructure, and national security of 14 the United States. 15 (b) SENSE OF CONGRESS.—It is the sense of Con- 16 gress that— 17 (1) the United States Government should en- 18 deavor to deliver warfighting capabilities to oper- 19 ational forces without having critical information or 20 technology wittingly or unwittingly lost, stolen, or 21 modified; 22 (2) the Department of Defense and the whole 23 of the United States Government should adapt to 24 the challenges presented by adversaries while main- 25 VerDate Sep 11 2014 00:52 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2316.IS S2316 kjohnson on DSK79L0C42 with BILLS 7 •S 2316 IS taining as much transparency with the people of the 1 United States as possible; 2 (3) stronger effort should be placed on securing 3 the vast supply chains of the contractors responsible 4 for developing and producing the defense related ca- 5 pabilities of the United States; 6 (4) the efforts of the Department of Defense, 7 the Department of Homeland Security, and the Fed- 8 eral Acquisition Security Council to protect critical 9 technologies should be action oriented with clear out- 10 come expectations and chains of accountability; 11 (5) technology protection should begin long be- 12 fore a contract is signed between a contractor and 13 the United States Government; 14 (6) the United States Government should im- 15 prove its ability to collaborate to protect both the 16 open research environment and emerging military 17 technologies; and 18 (7) the United States Government should focus 19 on supply chain security to ensure that military sys- 20 tems and systems required for sensitive activities are 21 not acquired or operated in a compromised state. 22 VerDate Sep 11 2014 00:52 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2316.IS S2316 kjohnson on DSK79L0C42 with BILLS 8 •S 2316 IS SEC. 3. PLAN FOR STRENGTHENING THE SUPPLY CHAIN IN- 1 TELLIGENCE FUNCTION. 2 (a) IN GENERAL.—Not later than 180 days after the 3 date of the enactment of this Act, the Director of the Na- 4 tional Counterintelligence and Security Center, in coordi- 5 nation with the Director of the Defense Counterintel- 6 ligence and Security Agency and other interagency part- 7 ners, shall submit to Congress a plan for strengthening 8 the supply chain intelligence function. 9 (b) ELEMENTS.—The plan submitted under sub- 10 section (a) shall address the following: 11 (1) Such recommendations as the Director of 12 the National Counterintelligence and Security Cen- 13 ter may have with respect to— 14 (A) the appropriate workforce model, in- 15 cluding size, mix, and seniority, from the ele- 16 ments of the intelligence community and other 17 interagency partners; and 18 (B) the appropriate governance structure 19 within the intelligence community and with 20 interagency partners. 21 (2) The budgetary resources necessary to imple- 22 ment the plan. 23 (3) The authorities necessary to implement the 24 plan. 25 VerDate Sep 11 2014 00:52 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2316.IS S2316 kjohnson on DSK79L0C42 with BILLS 9 •S 2316 IS (c) DEFINITION OF INTELLIGENCE COMMUNITY.—In 1 this section, the term ‘‘intelligence community’’ has the 2 meaning given such term in section 3 of the National Se- 3 curity Act of 1947 (50 U.S.C. 3003). 4 SEC. 4. ESTABLISHMENT OF NATIONAL SUPPLY CHAIN IN- 5 TELLIGENCE CENTER. 6 (a) ESTABLISHMENT OF CENTER.—Title IX of the 7 Intelligence Authorization Act for Fiscal Year 2003 (50 8 U.S.C. 3382 et seq.) is amended by adding at the end 9 the following: 10 ‘‘SEC. 905. NATIONAL SUPPLY CHAIN INTELLIGENCE CEN- 11 TER. 12 ‘‘(a) ESTABLISHMENT OF CENTER.—There is within 13 the National Counterintelligence and Security Center in 14 the Office of the Director of National Intelligence a Na- 15 tional Supply Chain Intelligence Center. 16 ‘‘(b) DIRECTOR OF NATIONAL SUPPLY CHAIN INTEL- 17 LIGENCE CENTER.—There is a Director of the National 18 Supply Chain Intelligence Center, who shall be appointed 19 by the President, in consultation with the Director of Na- 20 tional Intelligence and other interagency partners as the 21 President considers appropriate. 22 ‘‘(c) CENTER PERSONNEL.— 23 ‘‘(1) SENIOR MANAGEMENT.—The Director of 24 the National Supply Chain Intelligence Center shall 25 VerDate Sep 11 2014 00:52 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2316.IS S2316 kjohnson on DSK79L0C42 with BILLS 10 •S 2316 IS ensure that the senior management of the Center in- 1 cludes one or more detailees from each of the fol- 2 lowing: 3 ‘‘(A) The Department of Defense. 4 ‘‘(B) The Department of Justice. 5 ‘‘(C) The Department of Homeland Secu- 6 rity. 7 ‘‘(D) The Department of Commerce. 8 ‘‘(2) DETAIL OR ASSIGNMENT OF PER- 9 SONNEL.— 10 ‘‘(A) IN GENERAL.—With the approval of 11 the Director of the Office of Management and 12 Budget, and in consultation with the congres- 13 sional committees of jurisdiction, the Director 14 of the National Supply Chain Intelligence Cen- 15 ter may request of the head of any department, 16 agency, or element of the Federal Government 17 the detail or assignment of personnel from such 18 department, agency, or element to the National 19 Supply Chain Intelligence Center. 20 ‘‘(B) DUTIES.—Personnel detailed or as- 21 signed under subparagraph (A) shall assist the 22 National Supply Chain Intelligence Center in 23 carrying out the primary missions of the Cen- 24 ter. 25 VerDate Sep 11 2014 00:52 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2316.IS S2316 kjohnson on DSK79L0C42 with BILLS 11 •S 2316 IS ‘‘(C) TERMS.—Personnel detailed or as- 1 signed under subparagraph (A) shall be as- 2 signed or detailed to the National Supply Chain 3 Intelligence Center for a period of not more 4 than 2 years. 5 ‘‘(D) REGULAR EMPLOYMENT.—Any Fed- 6 eral Government employee detailed or assigned 7 under subparagraph (A) shall retain the rights, 8 status, and privileges of his or her regular em- 9 ployment without interruption. 10 ‘‘(d) PRIMARY MISSIONS.—The primary missions of 11 the National Supply Chain Intelligence Center shall be as 12 follows: 13 ‘‘(1) To aggregate all-source intelligence relat- 14 ing to supply chains, including— 15 ‘‘(A) classified and unclassified informa- 16 tion; 17 ‘‘(B) threat information; and 18 ‘‘(C) proprietary and sensitive information, 19 including risk and vulnerability information, 20 voluntarily provided by private entities. 21 ‘‘(2) To share strategic warnings relating to 22 supply chains or supply chain activities, as the Di- 23 rector of the National Supply Chain Intelligence 24 Center considers appropriate and consistent with se- 25 VerDate Sep 11 2014 00:52 Aug 08, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2316.IS S2316 kjohnson on DSK79L0C42 with BILLS 12 •S 2316 IS curity standards for classified information and sen- 1 sitive proprietary information, among— 2 ‘‘(A) the elements of the intelligence com- 3 munity (as defined in section 3 of the National 4 Security Act of 1947 (50 U.S.C. 3003)), com- 5 ponents of the Department of Justice and the 6 Department of Defense, the Federal Acquisition 7 Security Council, and other Federal agencies; 8 ‘‘(B) at-risk industry partners; and 9 ‘‘(C) governments of countries that are al- 10 lies of the United States. 11 ‘‘(3) To serve as the central and shared knowl- 12 edge resource for— 13 ‘‘(A) known and suspected threats to sup- 14 ply chain activities or supply chain integrity 15 from international groups, companies, coun- 16 tries, or other entities; and 17 ‘‘(B) the goals, strategies, capabilities, and 18 networks of contacts and support [Text truncated for display. Full text available on Congress.gov.]