Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Understanding Cyber-
security of Mobile Networks Act’’. 
SEC. 2. REPORT ON CYBERSECURITY OF MOBILE SERVICE 
NETWORKS. 
(a) IN GENERAL.—Not later than 1 year after the 
date of the enactment of this Act, the Assistant Secretary, 
in consultation with the Department of Homeland Secu-
rity, shall submit to the Committee on Energy and Com-
merce of the House of Representatives and the Committee 
on Commerce, Science, and Transportation of the Senate 
a report examining the cybersecurity of mobile service net-
works and the vulnerability of such networks and mobile 
devices to cyberattacks and surveillance conducted by ad-
versaries. 
(b) MATTERS TO BE INCLUDED.—The report re-
quired by subsection (a) shall include the following: 
(1) An assessment of the degree to which pro-
viders of mobile service have addressed, are address-
ing, 
or 
have 
not 
addressed 
cybersecurity 
vulnerabilities (including vulnerabilities the exploi-
tation of which could lead to surveillance conducted 
by adversaries) identified by academic and inde-
VerDate Sep 11 2014 
21:06 Jun 30, 2025
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1709.RH
H1709
kjohnson on DSK7ZCZBW3PROD with $$_JOB
pendent researchers, multistakeholder standards and 
technical organizations, industry experts, and Fed-
eral agencies, including in relevant reports of— 
(A) the National Telecommunications and 
Information Administration; 
(B) the National Institute of Standards 
and Technology; and 
(C) the Department of Homeland Security, 
including— 
(i) the Cybersecurity and Infrastruc-
ture Security Agency; and 
(ii) the Science and Technology Direc-
torate. 
(2) A discussion of— 
(A) the degree to which customers (includ-
ing consumers, companies, and government 
agencies) consider cybersecurity as a factor 
when considering the purchase of mobile service 
and mobile devices; and 
(B) the commercial availability of tools, 
frameworks, best practices, and other resources 
for enabling such customers to evaluate cyber-
security risk and price tradeoffs. 
VerDate Sep 11 2014 
21:06 Jun 30, 2025
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1709.RH
H1709
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(3) A discussion of the degree to which pro-
viders of mobile service have implemented cybersecu-
rity best practices and risk assessment frameworks. 
(4) An estimate and discussion of the preva-
lence and efficacy of encryption and authentication 
algorithms and techniques used in each of the fol-
lowing: 
(A) Mobile service. 
(B) Mobile communications equipment or 
services. 
(C) Commonly used mobile phones and 
other mobile devices. 
(D) Commonly used mobile operating sys-
tems and communications software and applica-
tions. 
(5) A discussion of the barriers for providers of 
mobile service to adopt more efficacious encryption 
and authentication algorithms and techniques and to 
prohibit the use of older encryption and authentica-
tion algorithms and techniques with established 
vulnerabilities in mobile service, mobile communica-
tions equipment or services, and mobile phones and 
other mobile devices. 
(6) An estimate and discussion of the preva-
lence, usage, and availability of technologies that au-
VerDate Sep 11 2014 
21:06 Jun 30, 2025
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1709.RH
H1709
kjohnson on DSK7ZCZBW3PROD with $$_JOB
thenticate legitimate mobile service and mobile com-
munications equipment or services to which mobile 
phones and other mobile devices are connected. 
(7) An estimate and discussion of the preva-
lence, costs, commercial availability, and usage by 
adversaries in the United States of cell site simula-
tors (often known as international mobile subscriber 
identity catchers) and other mobile service surveil-
lance and interception technologies. 
(c) CONSULTATION.—In preparing the report re-
quired by subsection (a), the Assistant Secretary shall, to 
the degree practicable, consult with— 
(1) the Federal Communications Commission; 
(2) the National Institute of Standards and 
Technology; 
(3) the intelligence community; 
(4) the Cybersecurity and Infrastructure Secu-
rity Agency of the Department of Homeland Secu-
rity; 
(5) the Science and Technology Directorate of 
the Department of Homeland Security; 
(6) academic and independent researchers with 
expertise in privacy, encryption, cybersecurity, and 
network threats; 
VerDate Sep 11 2014 
21:06 Jun 30, 2025
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1709.RH
H1709
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(7) participants in multistakeholder standards 
and technical organizations (including the 3rd Gen-
eration Partnership Project and the Internet Engi-
neering Task Force); 
(8) international stakeholders, in coordination 
with the Department of State as appropriate; 
(9) providers of mobile service, including small 
providers (or the representatives of such providers) 
and rural providers (or the representatives of such 
providers); 
(10) manufacturers, operators, and providers of 
mobile communications equipment or services and 
mobile phones and other mobile devices; 
(11) developers of mobile operating systems and 
communications software and applications; and 
(12) other experts that the Assistant Secretary 
considers appropriate. 
(d) SCOPE OF REPORT.—The Assistant Secretary 
shall— 
(1) limit the report required by subsection (a) 
to mobile service networks; 
(2) exclude consideration of 5G protocols and 
networks in the report required by subsection (a); 
VerDate Sep 11 2014 
21:06 Jun 30, 2025
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1709.RH
H1709
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(3) limit the assessment required by subsection 
(b)(1) to vulnerabilities that have been shown to 
be— 
(A) exploited in non-laboratory settings; or 
(B) feasibly and practicably exploitable in 
real-world conditions; and 
(4) consider in the report required by sub-
section (a) vulnerabilities that have been effectively 
mitigated by manufacturers of mobile phones and 
other mobile devices. 
(e) FORM OF REPORT.— 
(1) CLASSIFIED INFORMATION.—The report re-
quired by subsection (a) shall be produced in unclas-
sified form but may contain a classified annex. 
(2) POTENTIALLY EXPLOITABLE UNCLASSIFIED 
INFORMATION.—The Assistant Secretary shall re-
dact potentially exploitable unclassified information 
from the report required by subsection (a) but shall 
provide an unredacted form of the report to the 
committees described in such subsection. 
(f) DEFINITIONS.—In this section: 
(1) ADVERSARY.—The term ‘‘adversary’’ in-
cludes— 
(A) any unauthorized hacker or other in-
truder into a mobile service network; and 
VerDate Sep 11 2014 
21:06 Jun 30, 2025
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1709.RH
H1709
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(B) any foreign government or foreign 
nongovernment person engaged in a long-term 
pattern or serious instances of conduct signifi-
cantly adverse to the national security of the 
United States or security and safety of United 
States persons. 
(2) ASSISTANT SECRETARY.—The term ‘‘Assist-
ant Secretary’’ means the Assistant Secretary of 
Commerce for Communications and Information. 
(3) ENTITY.—The term ‘‘entity’’ means a part-
nership, association, trust, joint venture, corpora-
tion, group, subgroup, or other organization. 
(4) INTELLIGENCE
COMMUNITY.—The term 
‘‘intelligence community’’ has the meaning given 
that term in section 3 of the National Security Act 
of 1947 (50 U.S.C. 3003). 
(5) MOBILE COMMUNICATIONS EQUIPMENT OR 
SERVICE.—The term ‘‘mobile communications equip-
ment or service’’ means any equipment or service 
that is essential to the provision of mobile service. 
(6) MOBILE SERVICE.—The term ‘‘mobile serv-
ice’’ means, to the extent provided to United States 
customers, either or both of the following services: 
VerDate Sep 11 2014 
21:06 Jun 30, 2025
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1709.RH
H1709
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(A) Commercial mobile service (as defined 
in section 332(d) of the Communications Act of 
1934 (47 U.S.C. 332(d))). 
(B) Commercial mobile data service (as de-
fined in section 6001 of the Middle Class Tax 
Relief and Job Creation Act of 2012 (47 U.S.C. 
1401)). 
(7) PERSON.—The term ‘‘person’’ means an in-
dividual or entity. 
(8) 
UNITED
STATES
PERSON.—The 
term 
‘‘United States person’’ means— 
(A) an individual who is a United States 
citizen or an alien lawfully admitted for perma-
nent residence to the United States; 
(B) an entity organized under the laws of 
the United States or any jurisdiction within the 
United States, including a foreign branch of 
such an entity; or 
(C) any person in the United States. 
VerDate Sep 11 2014 
21:06 Jun 30, 2025
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1709.RH
H1709
kjohnson on DSK7ZCZBW3PROD with $$_JOB
VerDate Sep 11 2014 
21:06 Jun 30, 2025
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1709.RH
H1709
kjohnson on DSK7ZCZBW3PROD with $$_JOB
Union Calendar No. 143 
119TH CONGRESS 
1ST SESSION 
H. R. 1709 
[Report No. 119–177] 
A BILL 
To direct the Assistant Secretary of Commerce for 
Communications and Information to submit to 
Congress a report examining the cybersecurity of 
mobile service networks, and for other purposes. 
JUNE 30, 2025 
Committed to the Committee of the Whole House on the 
State of the Union and ordered to be printed 
VerDate Sep 11 2014 
21:06 Jun 30, 2025
Jkt 059200
PO 00000
Frm 00012
Fmt 6651
Sfmt 6651
E:\BILLS\H1709.RH
H1709
kjohnson on DSK7ZCZBW3PROD with $$_JOB