[116th Congress Public Law 124] [From the U.S. Government Publishing Office] [[Page 157]] SECURE AND TRUSTED COMMUNICATIONS NETWORKS ACT OF 2019 [[Page 134 STAT. 158]] Public Law 116-124 116th Congress An Act To prohibit certain Federal subsidies from being used to purchase communications equipment or services posing national security risks, to provide for the establishment of a reimbursement program for the replacement of communications equipment or services posing such risks, and for other purposes. <<NOTE: Mar. 12, 2020 - [H.R. 4998]>> Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, <<NOTE: Secure and Trusted Communications Networks Act of 2019.>> SECTION 1. <<NOTE: 47 USC 1601 note.>> SHORT TITLE. This Act may be cited as the ``Secure and Trusted Communications Networks Act of 2019''. SEC. 2. <<NOTE: 47 USC 1601.>> DETERMINATION OF COMMUNICATIONS EQUIPMENT OR SERVICES POSING NATIONAL SECURITY RISKS. (a) Publication of Covered Communications Equipment or Services List.-- <<NOTE: Deadline. Web posting.>> Not later than 1 year after the date of the enactment of this Act, the Commission shall publish on its website a list of covered communications equipment or services. (b) Publication by Commission.--The Commission shall place on the list published under subsection (a) any communications equipment or service, if and only if such equipment or service-- (1) is produced or provided by any entity, if, based exclusively on the determinations described in paragraphs (1) through (4) of subsection (c), such equipment or service produced or provided by such entity poses an unacceptable risk to the national security of the United States or the security and safety of United States persons; and (2) is capable of-- (A) routing or redirecting user data traffic or permitting visibility into any user data or packets that such equipment or service transmits or otherwise handles; (B) causing the network of a provider of advanced communications service to be disrupted remotely; or (C) otherwise posing an unacceptable risk to the national security of the United States or the security and safety of United States persons. (c) Reliance on Certain Determinations.--In taking action under subsection (b)(1), the Commission shall place on the list any communications equipment or service that poses an unacceptable risk to the national security of the United States or the security and safety of United States persons based solely on one or more of the following determinations: (1) A specific determination made by any executive branch interagency body with appropriate national security expertise, [[Page 131 STAT. 159]] including the Federal Acquisition Security Council established under section 1322(a) of title 41, United States Code. (2) A specific determination made by the Department of Commerce pursuant to Executive Order No. 13873 (84 Fed. Reg. 22689; relating to securing the information and communications technology and services supply chain). (3) The communications equipment or service being covered telecommunications equipment or services, as defined in section 889(f)(3) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115-232; 132 Stat. 1918). (4) A specific determination made by an appropriate national security agency. (d) Updating of List.-- (1) In general.--The Commission shall periodically update the list published under subsection (a) to address changes in the determinations described in paragraphs (1) through (4) of subsection (c). (2) Monitoring of determinations.--The Commission shall monitor the making or reversing of the determinations described in paragraphs (1) through (4) of subsection (c) in order to place additional communications equipment or services on the list published under subsection (a) or to remove communications equipment or services from such list. If a determination described in any such paragraph that provided the basis for a determination by the Commission under subsection (b)(1) with respect to any communications equipment or service is reversed, the Commission shall remove such equipment or service from such list, except that the Commission may not remove such equipment or service from such list if any other determination described in any such paragraph provides a basis for inclusion on such list by the Commission under subsection (b)(1) with respect to such equipment or service. (3) Public notification.-- <<NOTE: Time period.>> For each 12-month period during which the list published under subsection (a) is not updated, the Commission shall notify the public that no updates were necessary during such period to protect national security or to address changes in the determinations described in paragraphs (1) through (4) of subsection (c). SEC. <<NOTE: 47 USC 1602.>> 3. PROHIBITION ON USE OF CERTAIN FEDERAL SUBSIDIES. (a) In General.-- (1) Prohibition.--A Federal subsidy that is made available through a program administered by the Commission and that provides funds to be used for the capital expenditures necessary for the provision of advanced communications service may not be used to-- (A) purchase, rent, lease, or otherwise obtain any covered communications equipment or service; or (B) maintain any covered communications equipment or service previously purchased, rented, leased, or otherwise obtained. (2) Timing.-- <<NOTE: Applicability. Effective date. Time period.>> Paragraph (1) shall apply with respect to any covered communications equipment or service beginning on the date that is 60 days after the date on which the Commission places such equipment or service on the list required by section 2(a). In the case of any covered communications equipment or service that is on the initial list published under such section, [[Page 131 STAT. 160]] such equipment or service shall be treated as being placed on the list on the date on which such list is published. (b) Completion of Proceeding.-- <<NOTE: Deadline.>> Not later than 180 days after the date of the enactment of this Act, the Commission shall adopt a Report and Order to implement subsection (a). If the Commission has, before the date of the enactment of this Act, taken action that in whole or in part implements subsection (a), the Commission is not required to revisit such action, but only to the extent such action is consistent with this section. SEC. <<NOTE: 47 USC 1603.>> 4. SECURE AND TRUSTED COMMUNICATIONS NETWORKS REIMBURSEMENT PROGRAM. (a) In General.--The Commission shall establish a reimbursement program, to be known as the ``Secure and Trusted Communications Networks Reimbursement Program'', to make reimbursements to providers of advanced communications service to replace covered communications equipment or services. (b) Eligibility.--The Commission may not make a reimbursement under the Program to a provider of advanced communications service unless the provider-- (1) has 2,000,000 or fewer customers; and (2) makes all of the certifications required by subsection (d)(4). (c) Use of Funds.-- (1) In general.--A recipient of a reimbursement under the Program shall use reimbursement funds solely for the purposes of-- (A) <<NOTE: Time periods.>> permanently removing covered communications equipment or services purchased, rented, leased, or otherwise obtained before-- (i) in the case of any covered communications equipment or services that are on the initial list published under section 2(a), August 14, 2018; or (ii) in the case of any covered communications equipment or services that are not on the initial list published under section 2(a), the date that is 60 days after the date on which the Commission places such equipment or services on the list required by such section; (B) replacing the covered communications equipment or services removed as described in subparagraph (A) with communications equipment or services that are not covered communications equipment or services; and (C) disposing of the covered communications equipment or services removed as described in subparagraph (A) in accordance with the requirements under subsection (d)(7). (2) Limitations.--A recipient of a reimbursement under the Program may not-- (A) <<NOTE: Time periods.>> use reimbursement funds to remove, replace, or dispose of any covered communications equipment or service purchased, rented, leased, or otherwise obtained on or after-- (i) in the case of any covered communications equipment or service that is on the initial list published under section 2(a), August 14, 2018; or (ii) in the case of any covered communications equipment or service that is not on the initial list [[Page 131 STAT. 161]] published under section 2(a), the date that is 60 days after the date on which the Commission places such equipment or service on the list required by such section; or (B) purchase, rent, lease, or otherwise obtain any covered communications equipment or service, using reimbursement funds or any other funds (including funds derived from private sources). (d) Implementation.-- (1) Suggested replacements.-- (A) Development of list.--The Commission shall develop a list of suggested replacements of both physical and virtual communications equipment, application and management software, and services or categories of replacements of both physical and virtual communications equipment, application and management software and services. (B) Neutrality.--The list developed under subparagraph (A) shall be technology neutral and may not advantage the use of reimbursement funds for capital expenditures over operational expenditures, to the extent that the Commission determines that communications services can serve as an adequate substitute for the installation of communications equipment. (2) Application process.-- (A) In general.--The Commission shall develop an application process and related forms and materials for the Program. (B) Cost estimate.-- (i) <<NOTE: Requirements.>> Initial estimate.--The Commission shall require an applicant to provide an initial reimbursement cost estimate at the time of application, with supporting materials substantiating the costs. (ii) Updates.--During and after the application review process, the Commission may require an applicant to-- (I) update the initial reimbursement cost estimate submitted under clause (i); and (II) submit additional supporting materials substantiating an updated cost estimate submitted under subclause (I). (C) Mitigation of burden.--In developing the application process under this paragraph, the Commission shall take reasonable steps to mitigate the administrative burdens and costs associated with the application process, while taking into account the need to avoid waste, fraud, and abuse in the Program. (3) Application review process.-- (A) Deadline.-- (i) In general.--Except as provided in clause (ii) and subparagraph (B), the Commission shall approve or deny an application for a reimbursement under the Program not later than 90 days after the date of the submission of the application. (ii) Additional time needed by commission.-- If <<NOTE: Determination.>> the Commission determines that, because an excessive number of applications have been filed at one time, the Commission needs additional time for [[Page 131 STAT. 162]] employees of the Commission to process the applications, the Commission may extend the deadline described in clause (i) for not more than 45 days. (B) Opportunity for applicant to cure deficiency.-- <<NOTE: Determination. Time period. Deadline.>> If the Commission determines that an application is materially deficient (including by lacking an adequate cost estimate or adequate supporting materials), the Commission shall provide the applicant a 15-day period to cure the defect before denying the application. If such period would extend beyond the deadline under subparagraph (A) for approving or denying the application, such deadline shall be extended through the end of such period. (C) Effect of denial.--Denial of an application for a reimbursement under the Program shall not preclude the applicant from resubmitting the application or submitting a new application for a reimbursement under the Program at a later date. (4) Certifications.--An applicant for a reimbursement under the Program shall, in the application of the applicant, certify to the Commission that-- (A) as of the date of the submission of the application, the applicant-- (i) <<NOTE: Plan.>> has developed a plan for-- (I) the permanent removal and replacement of any covered communications equipment or services that are in the communications network of the applicant as of such date; and (II) the disposal of the equipment or services removed as described in subclause (I) in accordance with the requirements under paragraph (7); and (ii) <<NOTE: Timeline.>> has developed a specific timeline (subject to paragraph (6)) for the permanent removal, replacement, and disposal of the covered communications equipment or services identified under clause (i), which timeline shall be submitted to the Commission as part of the application; and (B) <<NOTE: Effective date.>> beginning on the date of the approval of the application, the applicant-- (i) will not purchase, rent, lease, or otherwise obtain covered communications equipment or services, using reimbursement funds or any other funds (including funds derived from private sources); and (ii) in developing and tailoring the risk management practices of the applicant, will consult and consider the standards, guidelines, and best practices set forth in the cybersecurity framework developed by the National Institute of Standards and Technology. (5) Distribution of reimbursement funds.-- (A) In general.--The Commission shall make reasonable efforts to ensure that reimbursement funds are distributed equitably among all applicants for reimbursements under the Program according to the needs of the applicants, as identified by the applications of the applicants. (B) <<NOTE: Determination.>> Notification.--If, at any time during the implementation of the Program, the Commission determines that $1,000,000,000 will not be sufficient to fully [[Page 131 STAT. 163]] fund all approved applications for reimbursements under the Program, the Commission shall immediately notify-- (i) the Committee on Energy and Commerce and the Committee on Appropriations of the House of Representatives; and (ii) the Committee on Commerce, Science, and Transportation and the Committee on Appropriations of the Senate. (6) Removal, replacement, and disposal term.-- (A) Deadline.--Except as provided in subparagraphs (B) and (C), the permanent removal, replacement, and disposal of any covered communications equipment or services identified under paragraph (4)(A)(i) shall be completed not later than 1 year after the date on which the Commission distributes reimbursement funds to the recipient. (B) <<NOTE: Time period.>> General extension.--The [Text truncated for display. Full text available on Congress.gov.]