Sharing Urgent, Potentially Problematic Locations that Yield Communications Hazards in American Internet Networks Act of 2019

To provide for interagency coordination on risk mitigation in the communications equipment and services marketplace and the supply chain thereof, and for other purposes. 1. Short title This Act may be cited as the Sharing Urgent, Potentially Problematic Locations that Yield Communications Hazards in American Internet Networks Act of 2019 SUPPLY CHAIN Act of 2019 2. Interagency coordination on risk mitigation in the communications equipment and services marketplace and the supply chain thereof (a) Definitions In this section: (1) Appropriate committees of Congress The term appropriate committees of Congress (A) the Committee on Commerce, Science, and Transportation, the Committee on Foreign Relations, the Committee on Armed Services, the Committee on the Judiciary, the Committee on Homeland Security and Governmental Affairs, and the Select Committee on Intelligence of the Senate; and (B) the Committee on Energy and Commerce, the Committee on Foreign Affairs, the Committee on Armed Services, the Committee on the Judiciary, the Committee on Homeland Security, and the Permanent Select Committee on Intelligence of the House of Representatives. (2) Appropriate Federal entity The term appropriate Federal entity (A) the Department of Defense; (B) the Department of Energy; (C) the Department of Homeland Security; (D) the Department of Justice; (E) the Department of Transportation; (F) the Department of the Treasury; and (G) the Office of the Director of National Intelligence. (3) Classified information The term classified information (4) Communications equipment and services The term communications equipment and services (5) Risk The term risk (6) Secretary The term Secretary (7) Supply chain The term supply chain (A) means the network of persons and activities from source to delivery of the equipment and services; and (B) includes— (i) vendors, suppliers, and providers of the equipment and services; and (ii) persons who manufacture, assemble, develop, or test the equipment and services. (b) Ongoing review Consistent with the protection of classified information, the Secretary shall, in coordination with the head of each appropriate Federal entity, conduct an ongoing review of risks to the communications equipment and services marketplace and the supply chain thereof. (c) Long-Term scenario and strategic planning (1) Development, issuance, and implementation of procedures Not later than 180 days after the date of enactment of this section, consistent with the protection of classified information, the Secretary, in coordination with the head of each appropriate Federal entity, shall— (A) develop and issue procedures to regularly facilitate— (i) long-term scenario and strategic planning with private entities that have appropriate security clearances to review classified information about risks, including by— (I) assessing the severity of risks posed to the marketplace of individual components of communications equipment and services and the supply chain thereof; (II) identifying counterfeit communications equipment and services in the marketplace; (III) assessing the ability of foreign governments or third parties to exploit the marketplace in a manner that raises risks; (IV) identifying— (aa) emerging risks and long-term trends in the marketplace of individual components or standards of communications equipment and services and the supply chain thereof; and (bb) strategies to mitigate risks described in item (aa); and (V) analyzing opportunities for asymmetric advantage; (ii) the— (I) preparation of unclassified information that raises awareness of risks, including, as appropriate, unclassified versions of any information shared under clause (i); and (II) dissemination by the Secretary of the unclassified information described in subclause (I) to private entities that do not have appropriate security clearances; and (iii) the voluntary sharing from private entities to the Secretary of information about risks to the marketplace; and (B) carry out the procedures developed and issued under subparagraph (A). (2) Manner of presentation The information shared with private entities under paragraph (1)(A)(i) shall be presented in a manner that identifies, assesses, and prioritizes risks, the mitigation of risks, and opportunities for asymmetric advantage. (3) Information shared with or provided to the Federal Government (A) No waiver of privilege or protection The provision of information to the Federal Government by a private entity under clause (i) or (iii) of paragraph (1)(A) shall not constitute a waiver of any applicable privilege or protection provided by law, including trade secret protection. (B) Proprietary information Information provided to the Federal Government by a private entity under clause (i) or (iii) of paragraph (1)(A) shall be considered the commercial, financial, and proprietary information of the private entity. (C) Exemption from disclosure under FOIA Information provided to the Federal Government by a private entity under clause (i) or (iii) of paragraph (1)(A) shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code. (D) Exemption from Federal regulatory authority Information provided to the Federal Government by a private entity under clause (i) or (iii) of paragraph (1)(A) shall not be used by any Federal entity to regulate, including through an enforcement action, the lawful activities of the private entity. (E) Protection from liability No cause of action shall lie or be maintained in any court against a private entity, and such action shall be promptly dismissed, if the action is related to or arises out of the provision of information to the Federal Government by the private entity under clause (i) or (iii) of paragraph (1)(A). (d) Report to Congress (1) In general Not later than 1 year after the date of enactment of this section, and biennially thereafter, the Secretary, in coordination with the head of each appropriate Federal entity, shall submit to the appropriate committees of Congress a report on the implementation of this section. (2) Contents The report required under paragraph (1) shall— (A) include any recommendations that the Secretary, in collaboration with the heads of the appropriate Federal entities, may have for improvements or modifications to the procedures developed and issued under this section; (B) evaluate the effectiveness of the procedures developed and issued under subsection (c)(1)(A); (C) identify processes and procedures that improve the ability of private entities and the Federal Government to adapt to emerging risks to the marketplace; (D) provide technical guidance on procurement of communications equipment and services offered by private entities in order to mitigate vulnerabilities; (E) include recommendations to streamline the provision of security clearances for relevant private sector actors; and (F) assess coordination between the heads of the appropriate Federal entities, including by identifying distinct competencies and jurisdictions of each appropriate Federal entity. (3) Form of reports Each report submitted under paragraph (1) shall be in unclassified form, but may include a classified annex. (e) Rule of construction Nothing in this section shall be construed to authorize the Secretary or the head of any other Federal agency to issue new regulations.

Summary: Sharing Urgent, Potentially Problematic Locations that Yield Communications Hazards in American Internet Networks Act of 2019 or the SUPPLY CHAIN Act of 2019 This bill requires the Department of Commerce to coordinate with various federal entities to conduct an ongoing review of risks to the communications-equipment-and-services marketplace and its supply chain.