Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Understanding Cyberse-
curity of Mobile Networks Act’’. 
SEC. 2. REPORT ON CYBERSECURITY OF MOBILE SERVICE 
NETWORKS. 
(a) IN GENERAL.—Not later than 1 year after the date 
of the enactment of this Act, the Assistant Secretary, in con-
sultation with the Department of Homeland Security, shall 
submit to the Committee on Energy and Commerce of the 
House of Representatives and the Committee on Commerce, 
Science, and Transportation of the Senate a report exam-
ining the cybersecurity of mobile service networks and the 
vulnerability of such networks and mobile devices to 
cyberattacks and surveillance conducted by adversaries. 
(b) MATTERS TO BE INCLUDED.—The report required 
by subsection (a) shall include the following: 
(1) An assessment of the degree to which pro-
viders of mobile service have addressed, are address-
ing, 
or 
have 
not 
addressed 
cybersecurity 
vulnerabilities (including vulnerabilities the exploi-
tation of which could lead to surveillance conducted 
by adversaries) identified by academic and inde-
pendent researchers, multistakeholder standards and 
VerDate Sep 11 2014 
03:11 Dec 02, 2021
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H2685.RH
H2685
pbinns on DSKJLVW7X2PROD with BILLS
technical organizations, industry experts, and Federal 
agencies, including in relevant reports of— 
(A) the National Telecommunications and 
Information Administration; 
(B) the National Institute of Standards and 
Technology; and 
(C) the Department of Homeland Security, 
including— 
(i) the Cybersecurity and Infrastruc-
ture Security Agency; and 
(ii) the Science and Technology Direc-
torate. 
(2) A discussion of— 
(A) the degree to which customers (includ-
ing consumers, companies, and government agen-
cies) consider cybersecurity as a factor when con-
sidering the purchase of mobile service and mo-
bile devices; and 
(B) the commercial availability of tools, 
frameworks, best practices, and other resources 
for enabling such customers to evaluate risk and 
price tradeoffs. 
(3) A discussion of the degree to which providers 
of mobile service have implemented cybersecurity best 
practices and risk assessment frameworks. 
VerDate Sep 11 2014 
03:11 Dec 02, 2021
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H2685.RH
H2685
pbinns on DSKJLVW7X2PROD with BILLS
(4) An estimate and discussion of the prevalence 
and efficacy of encryption and authentication algo-
rithms and techniques used in each of the following: 
(A) Mobile service. 
(B) Mobile communications equipment or 
services. 
(C) Commonly used mobile phones and 
other mobile devices. 
(D) Commonly used mobile operating sys-
tems and communications software and applica-
tions. 
(5) Barriers for providers of mobile service to 
adopt more efficacious encryption and authentication 
algorithms and techniques and to prohibit the use of 
older encryption and authentication algorithms and 
techniques with established vulnerabilities in mobile 
service, mobile communications equipment or services, 
and mobile phones and other mobile devices. 
(6) The prevalence, usage, and availability of 
technologies that authenticate legitimate mobile serv-
ice and mobile communications equipment or services 
to which mobile phones and other mobile devices are 
connected. 
(7) The prevalence, costs, commercial avail-
ability, and usage by adversaries in the United States 
VerDate Sep 11 2014 
03:11 Dec 02, 2021
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H2685.RH
H2685
pbinns on DSKJLVW7X2PROD with BILLS
of cell site simulators (often known as international 
mobile subscriber identity-catchers) and other mobile 
service surveillance and interception technologies. 
(c) CONSULTATION.—In preparing the report required 
by subsection (a), the Assistant Secretary shall, to the degree 
practicable, consult with— 
(1) the Federal Communications Commission; 
(2) the National Institute of Standards and 
Technology; 
(3) the intelligence community; 
(4) the Cybersecurity and Infrastructure Secu-
rity Agency of the Department of Homeland Security; 
(5) the Science and Technology Directorate of the 
Department of Homeland Security; 
(6) academic and independent researchers with 
expertise in privacy, encryption, cybersecurity, and 
network threats; 
(7) participants in multistakeholder standards 
and technical organizations (including the 3rd Gen-
eration Partnership Project and the Internet Engi-
neering Task Force); 
(8) international stakeholders, in coordination 
with the Department of State as appropriate; 
(9) providers of mobile service, including small 
providers (or the representatives of such providers) 
VerDate Sep 11 2014 
03:11 Dec 02, 2021
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H2685.RH
H2685
pbinns on DSKJLVW7X2PROD with BILLS
and rural providers (or the representatives of such 
providers); 
(10) manufacturers, operators, and providers of 
mobile communications equipment or services and 
mobile phones and other mobile devices; 
(11) developers of mobile operating systems and 
communications software and applications; and 
(12) other experts that the Assistant Secretary 
considers appropriate. 
(d) SCOPE
OF REPORT.—The Assistant Secretary 
shall— 
(1) limit the report required by subsection (a) to 
mobile service networks; 
(2) exclude consideration of 5G protocols and 
networks in the report required by subsection (a); 
(3) limit the assessment required by subsection 
(b)(1) to vulnerabilities that have been shown to be— 
(A) exploited in non-laboratory settings; or 
(B) feasibly and practicably exploitable in 
real-world conditions; and 
(4) consider in the report required by subsection 
(a) vulnerabilities that have been effectively mitigated 
by manufacturers of mobile phones and other mobile 
devices. 
(e) FORM OF REPORT.— 
VerDate Sep 11 2014 
03:11 Dec 02, 2021
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H2685.RH
H2685
pbinns on DSKJLVW7X2PROD with BILLS
(1) CLASSIFIED INFORMATION.—The report re-
quired by subsection (a) shall be produced in unclas-
sified form but may contain a classified annex. 
(2) POTENTIALLY
EXPLOITABLE
UNCLASSIFIED 
INFORMATION.—The Assistant Secretary shall redact 
potentially exploitable unclassified information from 
the report required by subsection (a) but shall provide 
an unredacted form of the report to the committees 
described in such subsection. 
(f) AUTHORIZATION OF APPROPRIATIONS.—There is 
authorized to be appropriated to carry out this section 
$500,000 for fiscal year 2022. Such amount is authorized 
to remain available through fiscal year 2023. 
(g) DEFINITIONS.—In this section: 
(1) ADVERSARY.—The term ‘‘adversary’’ in-
cludes— 
(A) any unauthorized hacker or other in-
truder into a mobile service network; and 
(B) any foreign government or foreign non-
government person engaged in a long-term pat-
tern or serious instances of conduct significantly 
adverse to the national security of the United 
States or security and safety of United States 
persons. 
VerDate Sep 11 2014 
03:11 Dec 02, 2021
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H2685.RH
H2685
pbinns on DSKJLVW7X2PROD with BILLS
(7) PERSON.—The term ‘‘person’’ means an in-
dividual or entity. 
(8) UNITED STATES PERSON.—The term ‘‘United 
States person’’ means— 
(A) an individual who is a United States 
citizen or an alien lawfully admitted for perma-
nent residence to the United States; 
(B) an entity organized under the laws of 
the United States or any jurisdiction within the 
United States, including a foreign branch of 
such an entity; or 
(C) any person in the United States. 
VerDate Sep 11 2014 
03:11 Dec 02, 2021
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H2685.RH
H2685
pbinns on DSKJLVW7X2PROD with BILLS
VerDate Sep 11 2014 
03:11 Dec 02, 2021
Jkt 029200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H2685.RH
H2685
pbinns on DSKJLVW7X2PROD with BILLS
Union Calendar No. 136 
117TH CONGRESS 
1ST SESSION 
H. R. 2685 
[Report No. 117–186] 
A BILL 
To direct the Assistant Secretary of Commerce for 
Communications and Information to submit to 
Congress a report examining the cybersecurity of 
mobile service networks, and for other purposes. 
NOVEMBER 30, 2021 
Reported with an amendment; committed to the Com-
mittee of the Whole House on the State of the Union 
and ordered to be printed 
VerDate Sep 11 2014 
03:11 Dec 02, 2021
Jkt 029200
PO 00000
Frm 00012
Fmt 6651
Sfmt 6651
E:\BILLS\H2685.RH
H2685
pbinns on DSKJLVW7X2PROD with BILLS