I 

118TH CONGRESS 

1ST SESSION H. R. 6106 

To create a risk framework to evaluate foreign mobile applications of concern, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

OCTOBER 26, 2023 

Ms. SHERRILL (for herself, Mr. BERGMAN, Mr. KRISHNAMOORTHI, Mrs. 

HINSON, Mr. NEWHOUSE, Mr. GARAMENDI, Mr. CROW, Mr. FINSTAD, 

Mr. CARSON, and Ms. TOKUDA) introduced the following bill; which was 

referred to the Committee on Armed Services 

A BILL 

To create a risk framework to evaluate foreign mobile 

applications of concern, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Bolstering America’s 

5 Defenses Against Potentially Perilous Software Act’’ or 

6 the ‘‘BAD APPS Act’’. 

7 SEC. 2. RISK FRAMEWORK FOR FOREIGN MOBILE APPLICA8 TIONS OF CONCERN. 

9 (a) IN GENERAL.—The Secretary of Defense shall— 


ssavage on DSKBC07HB2PROD with BILLS
2 

•HR 6106 IH

1 (1) create categorical definitions of foreign mo2 bile applications of concern with respect to personnel 

3 or operations of the Department of Defense, distin4 guishing among categories such as applications for 

5 shopping, social media, entertainment, or health; 

6 and 

7 (2) create a risk framework with respect to De8 partment personnel or operations that assesses each 

9 foreign mobile application (or, if appropriate, group10 ing of similar such applications) that is from a coun11 try of concern for any potential impact on Depart12 mental personnel and Departmental operations, in13 corporating considerations of— 

14 (A) the manner and extent of data collec15 tion by the application; 

16 (B) the ability of the application to influ17 ence the user with the applications content to 

18 the detriment of the United States; 

19 (C) the manner and extent of foreign own20 ership or control of the application or data col21 lected by the application; 

22 (D) any foreign government interests asso23 ciated with the applications; 

24 (E) a software bill of materials with a 

25 focus on known or assessed malicious software 


ssavage on DSKBC07HB2PROD with BILLS
3 

•HR 6106 IH

1 embedded in the application, including in prior 

2 versions of the application or in other applica3 tions created by the owners of such application; 

4 (F) any known impact from prior use of 

5 the application to Department personnel or op6 erations; and 

7 (G) the foreign mobile application of con8 cern residing on a United States Government 

9 device or a personally owned device while in 

10 proximity to Department operations or activi11 ties or in the personal custody of personnel dur12 ing Department sanctioned activities. 

13 (b) CONSIDERATIONS.—In developing the categorical 

14 definitions and risk framework described in subsection (a), 

15 the Secretary of Defense— 

16 (1) shall include in the risk framework foreign 

17 mobile applications of concern— 

18 (A) from countries that the Secretary de19 termines to be engaged in consistent, unauthor20 ized conduct that is detrimental to the national 

21 security or foreign policy of the United States; 

22 (B) that are accessible to be downloaded 

23 from major mobile device application market24 places by Department personnel; and 


ssavage on DSKBC07HB2PROD with BILLS
4 

•HR 6106 IH

1 (C) originating from, authored in, owned 

2 by, or otherwise associated with countries or en3 tities that are designated on the list maintained 

4 and set forth in Supplement No. 4 to part 744 

5 of the Export Administration Regulations; 

6 (2) may include additional countries or indi7 vidual foreign mobile applications with malicious and 

8 banned capabilities from other countries to the ex9 tent the Secretary determines appropriate; and 

10 (3) shall consider distinguishing within the risk 

11 framework the particular interests of a country de12 scribed in paragraph (1) or (2) in the use of a for13 eign mobile application of concern of such country 

14 (regardless of device or owner) by— 

15 (A) users located at facilities of the De16 partment of Defense of varying levels of sensi17 tivity; 

18 (B) users conducting authorized operations 

19 or movements of Department of Defense mate20 riel; or 

21 (C) specific civilian employees of the De22 partment or contractors whom the Secretary 

23 determines likely to be a target of a foreign 

24 actor. 


ssavage on DSKBC07HB2PROD with BILLS
5 

•HR 6106 IH

1 (c) GUIDANCE AND UPDATES.—The Secretary of De2 fense shall— 

3 (1) issue guidance to all Department personnel 

4 incorporating the categories of foreign mobile appli5 cations of concern and advising how to mitigate the 

6 risks identified by the risk framework with respect 

7 to such applications; 

8 (2) routinely update the categorical definitions 

9 and risk framework promulgated pursuant to sub10 section (a), at least on an annual basis; and 

11 (3) prescribe, if feasible, regulations that appro12 priately mitigate risks from applications on devices 

13 provided by the Department of Defense or on any 

14 device used during an activity described in sub15 section (b)(3)(B) or at locations described under 

16 (b)(3)(A). 

Æ 


ssavage on DSKBC07HB2PROD with BILLS