I 
118TH CONGRESS 
1ST SESSION H. R. 6106 
To create a risk framework to evaluate foreign mobile applications of concern, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 26, 2023 
Ms. SHERRILL (for herself, Mr. BERGMAN, Mr. KRISHNAMOORTHI, Mrs. 
HINSON, Mr. NEWHOUSE, Mr. GARAMENDI, Mr. CROW, Mr. FINSTAD, 
Mr. CARSON, and Ms. TOKUDA) introduced the following bill; which was 
referred to the Committee on Armed Services 
A BILL 
To create a risk framework to evaluate foreign mobile 
applications of concern, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Bolstering America’s 
Defenses Against Potentially Perilous Software Act’’ or 
the ‘‘BAD APPS Act’’. 
SEC. 2. RISK FRAMEWORK FOR FOREIGN MOBILE APPLICA-
TIONS OF CONCERN. 
(a) IN GENERAL.—The Secretary of Defense shall— 
VerDate Sep 11 2014 
20:19 Oct 28, 2023
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6106.IH
H6106
ssavage on DSKBC07HB2PROD with BILLS
(1) create categorical definitions of foreign mo-
bile applications of concern with respect to personnel 
or operations of the Department of Defense, distin-
guishing among categories such as applications for 
shopping, social media, entertainment, or health; 
and 
(2) create a risk framework with respect to De-
partment personnel or operations that assesses each 
foreign mobile application (or, if appropriate, group-
ing of similar such applications) that is from a coun-
try of concern for any potential impact on Depart-
mental personnel and Departmental operations, in-
corporating considerations of— 
(A) the manner and extent of data collec-
tion by the application; 
(B) the ability of the application to influ-
ence the user with the applications content to 
the detriment of the United States; 
(C) the manner and extent of foreign own-
ership or control of the application or data col-
lected by the application; 
(D) any foreign government interests asso-
ciated with the applications; 
(E) a software bill of materials with a 
focus on known or assessed malicious software 
VerDate Sep 11 2014 
20:19 Oct 28, 2023
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6106.IH
H6106
ssavage on DSKBC07HB2PROD with BILLS
embedded in the application, including in prior 
versions of the application or in other applica-
tions created by the owners of such application; 
(F) any known impact from prior use of 
the application to Department personnel or op-
erations; and 
(G) the foreign mobile application of con-
cern residing on a United States Government 
device or a personally owned device while in 
proximity to Department operations or activi-
ties or in the personal custody of personnel dur-
ing Department sanctioned activities. 
(b) CONSIDERATIONS.—In developing the categorical 
definitions and risk framework described in subsection (a), 
the Secretary of Defense— 
(1) shall include in the risk framework foreign 
mobile applications of concern— 
(A) from countries that the Secretary de-
termines to be engaged in consistent, unauthor-
ized conduct that is detrimental to the national 
security or foreign policy of the United States; 
(B) that are accessible to be downloaded 
from major mobile device application market-
places by Department personnel; and 
VerDate Sep 11 2014 
20:19 Oct 28, 2023
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6106.IH
H6106
ssavage on DSKBC07HB2PROD with BILLS
(C) originating from, authored in, owned 
by, or otherwise associated with countries or en-
tities that are designated on the list maintained 
and set forth in Supplement No. 4 to part 744 
of the Export Administration Regulations; 
(2) may include additional countries or indi-
vidual foreign mobile applications with malicious and 
banned capabilities from other countries to the ex-
tent the Secretary determines appropriate; and 
(3) shall consider distinguishing within the risk 
framework the particular interests of a country de-
scribed in paragraph (1) or (2) in the use of a for-
eign mobile application of concern of such country 
(regardless of device or owner) by— 
(A) users located at facilities of the De-
partment of Defense of varying levels of sensi-
tivity; 
(B) users conducting authorized operations 
or movements of Department of Defense mate-
riel; or 
(C) specific civilian employees of the De-
partment or contractors whom the Secretary 
determines likely to be a target of a foreign 
actor. 
VerDate Sep 11 2014 
20:19 Oct 28, 2023
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6106.IH
H6106
ssavage on DSKBC07HB2PROD with BILLS
(c) GUIDANCE AND UPDATES.—The Secretary of De-
fense shall— 
(1) issue guidance to all Department personnel 
incorporating the categories of foreign mobile appli-
cations of concern and advising how to mitigate the 
risks identified by the risk framework with respect 
to such applications; 
(2) routinely update the categorical definitions 
and risk framework promulgated pursuant to sub-
section (a), at least on an annual basis; and 
(3) prescribe, if feasible, regulations that appro-
priately mitigate risks from applications on devices 
provided by the Department of Defense or on any 
device used during an activity described in sub-
section (b)(3)(B) or at locations described under 
(b)(3)(A). 
Æ 
VerDate Sep 11 2014 
20:19 Oct 28, 2023
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H6106.IH
H6106
ssavage on DSKBC07HB2PROD with BILLS