Sec. 1858. Risk framework for foreign phone applications of concern
462 words·~2 min read·
/bill/118/hr/2670/rds/section-1858·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
The Secretary of Defense shall— create categorical definitions of foreign phone applications of concern with respect to personnel or operations of the Department of Defense, distinguishing among categories such as applications for shopping, social media, entertainment, or health; and create a risk framework with respect to Department personnel or operations that assesses each foreign phone application (or, if appropriate, grouping of similar such applications) that is from a country of concern for any potential impact on Departmental personnel and Departmental operations, incorporating considerations of— the manner and extent of data collection by the application; the ability of the application to influence users; the manner and extent of foreign ownership or control of the application or data collected by the application; any foreign government interests associated with the applications; known or assessed malicious software embedded in the application, including in prior versions of the application or in other applications created by the owners of such application; and any known impact from prior use of the application to Department personnel or operations.
In developing the categorical definitions and risk framework described in subsection (a), the Secretary of Defense— shall include in the risk framework foreign phone applications of concern— from countries that the Secretary determines to be engaged in consistent, unauthorized conduct that is detrimental to the national security or foreign policy of the United States; that are accessible to be downloaded from major mobile device application marketplaces by Department personnel; and originating from, authored in, owned by, or otherwise associated with countries or entities that are designated on the list maintained and set forth in Supplement No. 4 to part 744 of the Export Administration Regulations; may include additional countries or individual foreign phone applications from other countries to the extent the Secretary determines appropriate; and shall consider distinguishing within the risk framework the particular interests of a country described in paragraph
(1)or
(2)in the use of a foreign phone application of concern of such country (regardless of device or owner) by— users located at facilities of the Department of Defense of varying levels of sensitivity; users conducting authorized operations or movements of Department of Defense materiel; or specific civilian employees of the Department or contractors whom the Secretary determines likely to be a target of a foreign actor. The Secretary of Defense shall— issue guidance to all Department personnel incorporating the categories of foreign phone applications of concern and advising how to mitigate the risks identified by the risk framework with respect to such applications; routinely update the categorical definitions and risk framework promulgated pursuant to subsection (a), at least on an annual basis; and prescribe regulations that prohibit applications on phones provided by the Department of Defense or on any device used during an activity described in subsection (b)(3)(B).