Expressing the sense of the House of Representatives that all stakeholders in the deployment of 5G communications infrastructure should carefully consider adherence to the recommendations of "The Prague Proposals".

H. Res. 575 In the House of Representatives, U. S., January 8, 2020. Whereas 5G, the next generation (5th generation) in wireless technology, promises the next evolution of communica- tions and information technology services, applications, and capabilities across every sector of business, govern- ment, entertainment, and communications; Whereas the United States, Europe, China, and others are racing toward 5G adoption and upgrading existing net- works, which will drive subsequent advances in artificial intelligence, machine learning, smart homes, smart cities, robotics, autonomous vehicles, and quantum computers; Whereas 5G will make possible the automatization of every- day activities and the use of the full potential of the Internet of Things; Whereas these developments, while evolutionary, could include risks to important public interests, including privacy, data security, public safety, and national security; Whereas in a highly connected world, disruption of the integ- rity, confidentiality, or availability of communications or even the disruption of the communications service itself can seriously hamper everyday life, societal functions, the economy, and national security; 2 •HRES 575 EH Whereas the security of 5G networks is crucial for national security, economic security, and other United States na- tional interests and global stability; Whereas operators of communications infrastructure depend on a complex supply chain of technology from a global market of suppliers and service providers; Whereas government security officials and experts from 32 countries came together in Prague in May of 2019 to work out guidelines for the deployment and security of 5G networks; Whereas representatives agreed that ‘‘[m]ajor security risks emanate from the cross-border complexities of an increas- ingly global supply chain which provides [information and communications technology] equipment. These risks should be considered as part of the risk assessment based on relevant information and should seek to prevent pro- liferation of compromised devices and the use of mali- cious code and functions.’’; and Whereas the Prague 5G Security Conference adopted security recommendations, which have come to be known as ‘‘The Prague Proposals’’: Now, therefore, be it Resolved, SECTION 1. SENSE OF THE HOUSE OF REPRESENTATIVES. The House of Representatives— (1) urges all stakeholders in the deployment of 5G communications infrastructure to carefully consider ad- herence to the recommendations of ‘‘The Prague Pro- posals’’ (as described in section 2) as they procure prod- ucts and services across their supply chain; and 3 •HRES 575 EH (2) encourages the President and Federal agencies to promote global trade and security policies that are consistent with ‘‘The Prague Proposals’’ and urge our allies to embrace the recommendations of ‘‘The Prague Proposals’’ for their 5G infrastructure. SEC. 2. PRAGUE PROPOSALS. The text of ‘‘The Prague Proposals’’ is as follows: ‘‘(1) POLICY.— ‘‘(A) Communication networks and services should be designed with resilience and security in mind. They should be built and maintained using international, open, consensus-based standards and risk-informed cybersecurity best practices. Clear globally interoperable cyber security guidance that would support cyber security products and services in increasing resilience of all stakeholders should be promoted. ‘‘(B) Every country is free, in accordance with international law, to set its own national security and law enforcement requirements, which should re- spect privacy and adhere to laws protecting infor- mation from improper collection and misuse. ‘‘(C) Laws and policies governing networks and connectivity services should be guided by the prin- ciples of transparency and equitability, taking into 4 •HRES 575 EH account the global economy and interoperable rules, with sufficient oversight and respect for the rule of law. ‘‘(D) The overall risk of influence on a supplier by a third country should be taken into account, no- tably in relation to its model of governance, the ab- sence of cooperation agreements on security, or similar arrangements, such as adequacy decisions, as regards data protection, or whether this country is a party to multilateral, international or bilateral agreements on cybersecurity, the fight against cybercrime, or data protection. ‘‘(2) TECHNOLOGY.— ‘‘(A) Stakeholders should regularly conduct vulnerability assessments and risk mitigation within all components and network systems, prior to prod- uct release and during system operation, and pro- mote a culture of find/fix/patch to mitigate identi- fied vulnerabilities and rapidly deploy fixes or patches. ‘‘(B) Risk assessments of supplier’s products should take into account all relevant factors, includ- ing applicable legal environment and other aspects of supplier’s ecosystem, as these factors may be rel- 5 •HRES 575 EH evant to stakeholders’ efforts to maintain the high- est possible level of cyber security. ‘‘(C) When building up resilience and security, it should be taken into consideration that malicious cyber activities do not always require the exploi- tation of a technical vulnerability, e.g. in the event of insider attack. ‘‘(D) In order to increase the benefits of global communication, States should adopt policies to en- able efficient and secure network data flows. ‘‘(E) Stakeholders should take into consider- ation technological changes accompanying 5G net- works roll out, e.g. use of edge computing and soft- ware defined network/network function virtualization, and its impact on overall security of communication channels. ‘‘(F) Customer—whether the government, op- erator, or manufacturer—must be able to be in- formed about the origin and pedigree of components and software that affect the security level of the product or service, according to state of art and rel- evant commercial and technical practices, including transparency of maintenance, updates, and remedi- ation of the products and services. ‘‘(3) ECONOMY.— 6 •HRES 575 EH ‘‘(A) A diverse and vibrant communications equipment market and supply chain are essential for security and economic resilience. ‘‘(B) Robust investment in research and devel- opment benefits the global economy and techno- logical advancement and is a way to potentially in- crease diversity of technological solutions with posi- tive effects on security of communication networks. ‘‘(C) Communication networks and network services should be financed openly and trans- parently using standard best practices in procure- ment, investment, and contracting. ‘‘(D) State-sponsored incentives, subsidies, or financing of 5G communication networks and serv- ice providers should respect principles of fairness, be commercially reasonable, conducted openly and transparently, based on open market competitive principles, while taking into account trade obliga- tions. ‘‘(E) Effective oversight on key financial and investment instruments influencing telecommuni- cation network development is critical. ‘‘(F) Communication networks and network service providers should have transparent owner- 7 •HRES 575 EH ship, partnerships, and corporate governance struc- tures. ‘‘(4) SECURITY, PRIVACY, AND RESILIENCE.— ‘‘(A) All stakeholders including industry should work together to promote security and resilience of national critical infrastructure networks, systems, and connected devices. ‘‘(B) Sharing experience and best practices, in- cluding assistance, as appropriate, with mitigation, investigation, response, and recovery from network attacks, compromises, or disruptions should be pro- moted. ‘‘(C) Security and risk assessments of vendors and network technologies should take into account rule of law, security environment, vendor malfea- sance, and compliance with open, interoperable, se- cure standards, and industry best practices to pro- mote a vibrant and robust cyber security supply of products and services to deal with the rising chal- lenges. ‘‘(D) Risk management framework in a man- ner that respects data protection principles to en- 8 •HRES 575 EH sure privacy of citizens using network equipment and services should be implemented.’’. Attest: Clerk.