Title: SUPPLY CHAIN Act of 2019
Policy area: Science, Technology, Communications

Summary:
Sharing Urgent, Potentially Problematic Locations that Yield Communications Hazards in American Internet Networks Act of 2019 or the SUPPLY CHAIN Act of 2019
This bill requires the Department of Commerce to coordinate with various federal entities to conduct an ongoing review of risks to the communications-equipment-and-services marketplace and its supply chain.

[Congressional Bills 116th Congress]
[From the U.S. Government Publishing Office]
[S. 1457 Introduced in Senate (IS)]

<DOC>






116th CONGRESS
  1st Session
                                S. 1457

   To provide for interagency coordination on risk mitigation in the 
communications equipment and services marketplace and the supply chain 
                    thereof, and for other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                              May 14, 2019

 Mrs. Blackburn (for herself and Mr. Cornyn) introduced the following 
 bill; which was read twice and referred to the Committee on Commerce, 
                      Science, and Transportation

_______________________________________________________________________

                                 A BILL


 
   To provide for interagency coordination on risk mitigation in the 
communications equipment and services marketplace and the supply chain 
                    thereof, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Sharing Urgent, Potentially 
Problematic Locations that Yield Communications Hazards in American 
Internet Networks Act of 2019'' or the ``SUPPLY CHAIN Act of 2019''.

SEC. 2. INTERAGENCY COORDINATION ON RISK MITIGATION IN THE 
              COMMUNICATIONS EQUIPMENT AND SERVICES MARKETPLACE AND THE 
              SUPPLY CHAIN THEREOF.

    (a) Definitions.--In this section:
            (1) Appropriate committees of congress.--The term 
        ``appropriate committees of Congress'' means--
                    (A) the Committee on Commerce, Science, and 
                Transportation, the Committee on Foreign Relations, the 
                Committee on Armed Services, the Committee on the 
                Judiciary, the Committee on Homeland Security and 
                Governmental Affairs, and the Select Committee on 
                Intelligence of the Senate; and
                    (B) the Committee on Energy and Commerce, the 
                Committee on Foreign Affairs, the Committee on Armed 
                Services, the Committee on the Judiciary, the Committee 
                on Homeland Security, and the Permanent Select 
                Committee on Intelligence of the House of 
                Representatives.
            (2) Appropriate federal entity.--The term ``appropriate 
        Federal entity'' means--
                    (A) the Department of Defense;
                    (B) the Department of Energy;
                    (C) the Department of Homeland Security;
                    (D) the Department of Justice;
                    (E) the Department of Transportation;
                    (F) the Department of the Treasury; and
                    (G) the Office of the Director of National 
                Intelligence.
            (3) Classified information.--The term ``classified 
        information'' means any information or material that has been 
        determined by the Federal Government pursuant to an Executive 
        order, statute, or regulation, to require protection against 
        unauthorized disclosure for reasons of national security.
            (4) Communications equipment and services.--The term 
        ``communications equipment and services'' includes any 
        hardware, software, or other product or service primarily 
        intended to fulfill or enable the function of information 
        processing and communications by electronic means, including 
        transmission and display, including over the internet.
            (5) Risk.--The term ``risk'' means any aspect or property 
        of the components of communications equipment and services or 
        the associated supply chain that may be used to gain 
        unauthorized access to a communications network, disrupt a 
        communications network, disrupt the manufacture of 
        communications equipment, disrupt consensus-driven industry 
        standards for communications equipment and services, or 
        otherwise harm a communications network or the users of the 
        network, including gaining unauthorized access to data or 
        redirecting data.
            (6) Secretary.--The term ``Secretary'' means the Secretary 
        of Commerce.
            (7) Supply chain.--The term ``supply chain'', with respect 
        to communications equipment and services--
                    (A) means the network of persons and activities 
                from source to delivery of the equipment and services; 
                and
                    (B) includes--
                            (i) vendors, suppliers, and providers of 
                        the equipment and services; and
                            (ii) persons who manufacture, assemble, 
                        develop, or test the equipment and services.
    (b) Ongoing Review.--Consistent with the protection of classified 
information, the Secretary shall, in coordination with the head of each 
appropriate Federal entity, conduct an ongoing review of risks to the 
communications equipment and services marketplace and the supply chain 
thereof.
    (c) Long-Term Scenario and Strategic Planning.--
            (1) Development, issuance, and implementation of 
        procedures.--Not later than 180 days after the date of 
        enactment of this section, consistent with the protection of 
        classified information, the Secretary, in coordination with the 
        head of each appropriate Federal entity, shall--
                    (A) develop and issue procedures to regularly 
                facilitate--
                            (i) long-term scenario and strategic 
                        planning with private entities that have 
                        appropriate security clearances to review 
                        classified information about risks, including 
                        by--
                                    (I) assessing the severity of risks 
                                posed to the marketplace of individual 
                                components of communications equipment 
                                and services and the supply chain 
                                thereof;
                                    (II) identifying counterfeit 
                                communications equipment and services 
                                in the marketplace;
                                    (III) assessing the ability of 
                                foreign governments or third parties to 
                                exploit the marketplace in a manner 
                                that raises risks;
                                    (IV) identifying--
                                            (aa) emerging risks and 
                                        long-term trends in the 
                                        marketplace of individual 
                                        components or standards of 
                                        communications equipment and 
                                        services and the supply chain 
                                        thereof; and
                                            (bb) strategies to mitigate 
                                        risks described in item (aa); 
                                        and
                                    (V) analyzing opportunities for 
                                asymmetric advantage;
                            (ii) the--
                                    (I) preparation of unclassified 
                                information that raises awareness of 
                                risks, including, as appropriate, 
                                unclassified versions of any 
                                information shared under clause (i); 
                                and
                                    (II) dissemination by the Secretary 
                                of the unclassified information 
                                described in subclause (I) to private 
                                entities that do not have appropriate 
                                security clearances; and
                            (iii) the voluntary sharing from private 
                        entities to the Secretary of information about 
                        risks to the marketplace; and
                    (B) carry out the procedures developed and issued 
                under subparagraph (A).
            (2) Manner of presentation.--The information shared with 
        private entities under paragraph (1)(A)(i) shall be presented 
        in a manner that identifies, assesses, and prioritizes risks, 
        the mitigation of risks, and opportunities for asymmetric 
        advantage.
            (3) Information shared with or provided to the federal 
        government.--
                    (A) No waiver of privilege or protection.--The 
                provision of information to the Federal Government by a 
                private entity under clause (i) or (iii) of paragraph 
                (1)(A) shall not constitute a waiver of any applicable 
                privilege or protection provided by law, including 
                trade secret protection.
                    (B) Proprietary information.--Information provided 
                to the Federal Government by a private entity under 
                clause (i) or (iii) of paragraph (1)(A) shall be 
                considered the commercial, financial, and proprietary 
                information of the private entity.
                    (C) Exemption from disclosure under foia.--
                Information provided to the Federal Government by a 
                private entity under clause (i) or (iii) of paragraph 
                (1)(A) shall be exempt from disclosure under section 
                552(b)(3) of title 5, United States Code.
                    (D) Exemption from federal regulatory authority.--
                Information provided to the Federal Government by a 
                private entity under clause (i) or (iii) of paragraph 
                (1)(A) shall not be used by any Federal entity to 
                regulate, including through an enforcement action, the 
                lawful activities of the private entity.
                    (E) Protection from liability.--No cause of action 
                shall lie or be maintained in any court against a 
                private entity, and such action shall be promptly 
                dismissed, if the action is related to or arises out of 
                the provision of information to the Federal Government 
                by the private entity under clause (i) or (iii) of 
                paragraph (1)(A).
    (d) Report to Congress.--
            (1) In general.--Not later than 1 year after the date of 
        enactment of this section, and biennially thereafter, the 
        Secretary, in coordination with the head of each appropriate 
        Federal entity, shall submit to the appropriate committees of 
        Congress a report on the implementation of this section.
            (2) Contents.--The report required under paragraph (1) 
        shall--
                    (A) include any recommendations that the Secretary, 
                in collaboration with the heads of the appropriate 
                Federal entities, may have for improvements or 
                modifications to the procedures developed and issued 
                under this section;
                    (B) evaluate the effectiveness of the procedures 
                developed and issued under subsection (c)(1)(A);
                    (C) identify processes and procedures that improve 
                the ability of private entities and the Federal 
                Government to adapt to emerging risks to the 
                marketplace;
                    (D) provide technical guidance on procurement of 
                communications equipment and services offered by 
                private entities in order to mitigate vulnerabilities;
                    (E) include recommendations to streamline the 
                provision of security clearances for relevant private 
                sector actors; and
                    (F) assess coordination between the heads of the 
                appropriate Federal entities, including by identifying 
                distinct competencies and jurisdictions of each 
                appropriate Federal entity.
            (3) Form of reports.--Each report submitted under paragraph 
        (1) shall be in unclassified form, but may include a classified 
        annex.
    (e) Rule of Construction.--Nothing in this section shall be 
construed to authorize the Secretary or the head of any other Federal 
agency to issue new regulations.
                                 <all>