IB 

Union Calendar No. 136 

117TH CONGRESS 

1ST SESSION H. R. 2685 

[Report No. 117–186] 

To direct the Assistant Secretary of Commerce for Communications and 

Information to submit to Congress a report examining the cybersecurity 

of mobile service networks, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 20, 2021 

Ms. ESHOO (for herself and Mr. KINZINGER) introduced the following bill; 

which was referred to the Committee on Energy and Commerce 

NOVEMBER 30, 2021 

Additional sponsors: Mr. MCNERNEY and Mr. SOTO

NOVEMBER 30, 2021 

Reported with an amendment; committed to the Committee of the Whole 

House on the State of the Union and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on April 20, 2021] 


pbinns on DSKJLVW7X2PROD with BILLS
2 

•HR 2685 RH

A BILL 

To direct the Assistant Secretary of Commerce for Communications and Information to submit to Congress a report 

examining the cybersecurity of mobile service networks, 

and for other purposes. 


pbinns on DSKJLVW7X2PROD with BILLS
3 

•HR 2685 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Understanding Cyberse5 curity of Mobile Networks Act’’. 

6 SEC. 2. REPORT ON CYBERSECURITY OF MOBILE SERVICE 

7 NETWORKS. 

8 (a) IN GENERAL.—Not later than 1 year after the date 

9 of the enactment of this Act, the Assistant Secretary, in con10 sultation with the Department of Homeland Security, shall 

11 submit to the Committee on Energy and Commerce of the 

12 House of Representatives and the Committee on Commerce, 

13 Science, and Transportation of the Senate a report exam14 ining the cybersecurity of mobile service networks and the 

15 vulnerability of such networks and mobile devices to 

16 cyberattacks and surveillance conducted by adversaries. 

17 (b) MATTERS TO BE INCLUDED.—The report required 

18 by subsection (a) shall include the following: 

19 (1) An assessment of the degree to which pro20 viders of mobile service have addressed, are address21 ing, or have not addressed cybersecurity 

22 vulnerabilities (including vulnerabilities the exploi23 tation of which could lead to surveillance conducted 

24 by adversaries) identified by academic and inde25 pendent researchers, multistakeholder standards and 


pbinns on DSKJLVW7X2PROD with BILLS
4 

•HR 2685 RH

1 technical organizations, industry experts, and Federal 

2 agencies, including in relevant reports of— 

3 (A) the National Telecommunications and 

4 Information Administration; 

5 (B) the National Institute of Standards and 

6 Technology; and 

7 (C) the Department of Homeland Security, 

8 including— 

9 (i) the Cybersecurity and Infrastruc10 ture Security Agency; and 

11 (ii) the Science and Technology Direc12 torate. 

13 (2) A discussion of— 

14 (A) the degree to which customers (includ15 ing consumers, companies, and government agen16 cies) consider cybersecurity as a factor when con17 sidering the purchase of mobile service and mo18 bile devices; and 

19 (B) the commercial availability of tools, 

20 frameworks, best practices, and other resources 

21 for enabling such customers to evaluate risk and 

22 price tradeoffs. 

23 (3) A discussion of the degree to which providers 

24 of mobile service have implemented cybersecurity best 

25 practices and risk assessment frameworks. 


pbinns on DSKJLVW7X2PROD with BILLS
5 

•HR 2685 RH

1 (4) An estimate and discussion of the prevalence 

2 and efficacy of encryption and authentication algo3 rithms and techniques used in each of the following: 

4 (A) Mobile service. 

5 (B) Mobile communications equipment or 

6 services. 

7 (C) Commonly used mobile phones and 

8 other mobile devices. 

9 (D) Commonly used mobile operating sys10 tems and communications software and applica11 tions. 

12 (5) Barriers for providers of mobile service to 

13 adopt more efficacious encryption and authentication 

14 algorithms and techniques and to prohibit the use of 

15 older encryption and authentication algorithms and 

16 techniques with established vulnerabilities in mobile 

17 service, mobile communications equipment or services, 

18 and mobile phones and other mobile devices. 

19 (6) The prevalence, usage, and availability of 

20 technologies that authenticate legitimate mobile serv21 ice and mobile communications equipment or services 

22 to which mobile phones and other mobile devices are 

23 connected. 

24 (7) The prevalence, costs, commercial avail25 ability, and usage by adversaries in the United States 


pbinns on DSKJLVW7X2PROD with BILLS
6 

•HR 2685 RH

1 of cell site simulators (often known as international 

2 mobile subscriber identity-catchers) and other mobile 

3 service surveillance and interception technologies. 

4 (c) CONSULTATION.—In preparing the report required 

5 by subsection (a), the Assistant Secretary shall, to the degree 

6 practicable, consult with— 

7 (1) the Federal Communications Commission; 

8 (2) the National Institute of Standards and 

9 Technology; 

10 (3) the intelligence community; 

11 (4) the Cybersecurity and Infrastructure Secu12 rity Agency of the Department of Homeland Security; 

13 (5) the Science and Technology Directorate of the 

14 Department of Homeland Security; 

15 (6) academic and independent researchers with 

16 expertise in privacy, encryption, cybersecurity, and 

17 network threats; 

18 (7) participants in multistakeholder standards 

19 and technical organizations (including the 3rd Gen20 eration Partnership Project and the Internet Engi21 neering Task Force); 

22 (8) international stakeholders, in coordination 

23 with the Department of State as appropriate; 

24 (9) providers of mobile service, including small 

25 providers (or the representatives of such providers) 


pbinns on DSKJLVW7X2PROD with BILLS
7 

•HR 2685 RH

1 and rural providers (or the representatives of such 

2 providers); 

3 (10) manufacturers, operators, and providers of 

4 mobile communications equipment or services and 

5 mobile phones and other mobile devices; 

6 (11) developers of mobile operating systems and 

7 communications software and applications; and 

8 (12) other experts that the Assistant Secretary 

9 considers appropriate. 

10 (d) SCOPE OF REPORT.—The Assistant Secretary 

11 shall— 

12 (1) limit the report required by subsection (a) to 

13 mobile service networks; 

14 (2) exclude consideration of 5G protocols and 

15 networks in the report required by subsection (a); 

16 (3) limit the assessment required by subsection 

17 (b)(1) to vulnerabilities that have been shown to be— 

18 (A) exploited in non-laboratory settings; or 

19 (B) feasibly and practicably exploitable in 

20 real-world conditions; and 

21 (4) consider in the report required by subsection 

22 (a) vulnerabilities that have been effectively mitigated 

23 by manufacturers of mobile phones and other mobile 

24 devices. 

25 (e) FORM OF REPORT.— 


pbinns on DSKJLVW7X2PROD with BILLS
8 

•HR 2685 RH

1 (1) CLASSIFIED INFORMATION.—The report re2 quired by subsection (a) shall be produced in unclas3 sified form but may contain a classified annex. 

4 (2) POTENTIALLY EXPLOITABLE UNCLASSIFIED

5 INFORMATION.—The Assistant Secretary shall redact 

6 potentially exploitable unclassified information from 

7 the report required by subsection (a) but shall provide 

8 an unredacted form of the report to the committees 

9 described in such subsection. 

10 (f) AUTHORIZATION OF APPROPRIATIONS.—There is 

11 authorized to be appropriated to carry out this section 

12 $500,000 for fiscal year 2022. Such amount is authorized 

13 to remain available through fiscal year 2023. 

14 (g) DEFINITIONS.—In this section: 

15 (1) ADVERSARY.—The term ‘‘adversary’’ in16 cludes— 

17 (A) any unauthorized hacker or other in18 truder into a mobile service network; and 

19 (B) any foreign government or foreign non20 government person engaged in a long-term pat21 tern or serious instances of conduct significantly 

22 adverse to the national security of the United 

23 States or security and safety of United States 

24 persons. 


pbinns on DSKJLVW7X2PROD with BILLS
9 

•HR 2685 RH

1 (2) ASSISTANT SECRETARY.—The term ‘‘Assist2 ant Secretary’’ means the Assistant Secretary of Com3 merce for Communications and Information. 

4 (3) ENTITY.—The term ‘‘entity’’ means a part5 nership, association, trust, joint venture, corporation, 

6 group, subgroup, or other organization. 

7 (4) INTELLIGENCE COMMUNITY.—The term ‘‘in8 telligence community’’ has the meaning given that 

9 term in section 3 of the National Security Act of 1947 

10 (50 U.S.C. 3003). 

11 (5) MOBILE COMMUNICATIONS EQUIPMENT OR

12 SERVICE.—The term ‘‘mobile communications equip13 ment or service’’ means any equipment or service that 

14 is essential to the provision of mobile service. 

15 (6) MOBILE SERVICE.—The term ‘‘mobile serv16 ice’’ means, to the extent provided to United States 

17 customers, either or both of the following services: 

18 (A) Commercial mobile service (as defined 

19 in section 332(d) of the Communications Act of 

20 1934 (47 U.S.C. 332(d))). 

21 (B) Commercial mobile data service (as de22 fined in section 6001 of the Middle Class Tax 

23 Relief and Job Creation Act of 2012 (47 U.S.C. 

24 1401)). 


pbinns on DSKJLVW7X2PROD with BILLS
10 

•HR 2685 RH

1 (7) PERSON.—The term ‘‘person’’ means an in2 dividual or entity. 

3 (8) UNITED STATES PERSON.—The term ‘‘United 

4 States person’’ means— 

5 (A) an individual who is a United States 

6 citizen or an alien lawfully admitted for perma7 nent residence to the United States; 

8 (B) an entity organized under the laws of 

9 the United States or any jurisdiction within the 

10 United States, including a foreign branch of 

11 such an entity; or 

12 (C) any person in the United States. 


pbinns on DSKJLVW7X2PROD with BILLS

pbinns on DSKJLVW7X2PROD with BILLS
Union Calendar No. 136 

117TH CONGRESS 

1ST SESSION H. R. 2685 

[Report No. 117–186] 

A BILL 

To direct the Assistant Secretary of Commerce for 

mobile service networks, and for other purposes. Congress a report examining the cybersecurity of Communications and Information to submit to 

NOVEMBER 30, 2021 

Reported with an amendment; committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union 


pbinns on DSKJLVW7X2PROD with BILLS