Sec. 1513. Update to cyber security requirements for telecommunications contracts
453 words·~2 min read·
/bill/119/hr/3838/eh/section-1513·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 180 days after the date of enactment of this Act, the Secretary of the Navy shall implement regulations requiring that each covered telecommunications contract includes updated cyber security requirements for Department wireless telecommunication devices to protect against domestic and international cybersecurity attacks, including SS7 signaling attacks, diameter signaling attacks, SIM hacking, and simulated cellular sites. The cyber security requirements required to be included in covered telecommunication contracts under subsection
(a)shall include the following: Disabling the use of 2G and 3G telecommunication networks by Department wireless telecommunication devices, and security vulnerabilities in inbound and outbound Signaling System 7 traffic from foreign countries and operators of foreign telecommunications networks. Providing protection against all categories of Diameter protocol exploitation, including Category 0 non-application information, Category 1 application ID and command codes, Category 2 application-specific values, and Category 3 location and time. Enabling and facilitating rotation of traditionally persistent alphanumeric identifiers used to authentic users, including the international mobile subscriber identity for users, including the international mobile subscriber identity. Real-time monitoring and blocking of suspicious connections and requests that pose a high risk to cybersecurity, including any connection or request that would force a Department wireless telecommunication device to use a 3G telecommunication network, improperly filtered signaling traffic, and connections or requests that do not match the location of the subscriber, as well as real-time alerting when a user of Department wireless telecommunication device is targeted by a high-risk connection or request. Encrypting data and call sessions, encrypting call data records in storage, and storing call data records not longer than 60 days. Apply modern cryptographic protections to prevent the ability to transfer phone numbers between devices and disabling user requests to transfer phone numbers between devices. Hosting the software infrastructure for the mobile network in a commercial cloud computing environment and making publicly available quarterly cybersecurity audits conducted by independent auditors on behalf of the Department of Defense. Not later than 180 days after the date of enactment of this Act, the Secretary of the Navy shall certify to the congressional defense committees that the Secretary of the Navy has implemented the regulations required by subsection (a). In this section: The term covered telecommunications contract means a contract— that is entered into under the multiple award contract (as defined in section 3302(a) of title 41, United States Code) described in the memorandum of the Department of Defense entitled DoD UNCLASSIFIED Wireless Mobile Services and Devices Spiral 4 and dated May 23, 2024; or under which the Navy acquires wireless telecommunication services or devices. The term Department wireless telecommunication device means a wireless telecommunication device— acquired under a covered telecommunications contract; or that is using wireless telecommunication services under a covered telecommunications contract.