Protecting Against Compromised Internet of Things Technology Act
Bill: H.R.7138 | Sponsor: Rep. Obernolte, Jay (R-CA)
Policy area: Science, Technology, Communications

Summary:
Protecting Against Compromised Internet of Things Technology Act
This bill requires the Bureau of Industry and Security within the Department of Commerce to identify foreign persons that pose a threat to supply chain security for Internet of Things devices (i.e., any object or device that is connected to the internet and is not a laptop, cell phone, or other conventional technology device) for inclusion on the Entity List. This list identifies entities reasonably believed to be involved in, or to pose a significant risk of being or becoming involved in, activities contrary to the national security or foreign policy interests of the United States.
The bureau must periodically submit a list of any foreign persons identified as threats to Internet of Things device supply chains to the interagency committee that makes decisions regarding additions to, removals from, or other modifications to the Entity List. After receiving the bureau's list, the committee must vote on whether to add such foreign persons to the Entity List.
A company added to the Entity List through this process may not receive any federal financial assistance, and the federal government may not contract with such a company for Internet of Things devices.

To establish procedures to include certain foreign persons that pose a 
 threat to the security of supply chains of Internet of Things devices 
  on the Department of Commerce's Entity List, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Protecting Against Compromised 
Internet of Things Technology Act''.

SEC. 2. RECOMMENDATIONS TO INCLUDE COVERED FOREIGN PERSONS ON THE 
              ENTITY LIST.

    (a) In General.--Not later than 90 days after the date of the 
enactment of this Act, the Secretary of Commerce, acting through the 
Bureau of Industry and Security, shall submit to the End-User Review 
Committee--
            (1) a list of covered foreign persons, if any, that the 
        Secretary determines pose a threat to the security of supply 
        chains of Internet of Things devices; and
            (2) a recommendation of whether or not to include each such 
        covered foreign person on the Entity List or make other 
        modifications to the Entity List as appropriate.
    (b) Updates of List.--The Secretary of Commerce shall submit to the 
End-User Review Committee an updated list and corresponding 
recommendations under paragraph (1)--
            (1) not later than 180 days after the date of the enactment 
        of this Act, and every 180 days thereafter; and
            (2) as new information becomes available.

SEC. 3. CONSIDERATION AND VOTE TO INCLUDE COVERED FOREIGN PERSONS ON 
              THE ENTITY LIST.

    Not later than 90 days after receiving a list of covered foreign 
persons and corresponding recommendations required by section 2, the 
End-User Review Committee shall convene a meeting--
            (1) to consider such list of covered foreign persons and 
        corresponding recommendations; and
            (2) to hold a vote with respect to including each such 
        covered foreign person on the Entity List or make other 
        modifications to the Entity List as appropriate.

SEC. 4. FEDERAL FINANCIAL ASSISTANCE PROHIBITION.

    In the event that any company is on the list described under 
section 3--
            (1) that company may not receive any Federal financial 
        assistance; and
            (2) the Federal Government may not enter into any contract 
        with such company for any Internet of Things device.

SEC. 5. DEFINITIONS.

    In this Act:
            (1) Covered foreign person.--The term ``covered foreign 
        person''--
                    (A) means a foreign person that produces an 
                Internet of Things device; and
                    (B) includes a parent company, subsidiary, or 
                relevant senior officer or other official of such 
                foreign person.
            (2) End-user review committee.--The term ``End-User Review 
        Committee'' means the End-User Review Committee described in 
        Supplement No. 9 to part 748 of the Export Administration 
        Regulations.
            (3) Entity list.--The term ``Entity List'' means the list 
        maintained by the Bureau of Industry and Security of the 
        Department of Commerce and set forth in Supplement No. 4 to 
        part 744 of title 15, Code of Federal Regulations.
            (4) Export administration regulations.--The term ``Export 
        Administration Regulations'' means subchapter C of chapter VII 
        of title 15, Code of Federal Regulations.
            (5) Federal financial assistance.--The term ``Federal 
        financial assistance'' means any form of loan, grant, 
        guarantee, insurance, payment, rebate, subsidy, or any other 
        form of direct or indirect Federal assistance (including 
        general or special revenue sharing or formula grants made to 
        States) approved by any Federal officer or agency.
            (6) Foreign person.--The term ``foreign person'' means a 
        person that is not a United States person.
            (7) Internet of things device.--The term ``Internet of 
        Things device'' means a device described in section 2(4) of the 
        Internet of Things Cybersecurity Improvement Act of 2020 (15 
        U.S.C. 278g-3a note).
            (8) United states person.--The term ``United States 
        person'' means--
                    (A) a United States citizen or an alien lawfully 
                admitted for permanent residence to the United States; 
                or
                    (B) an entity organized under the laws of the 
                United States or of any jurisdiction within the United 
                States, including a foreign branch of such an entity.
                                 <all>