H.R. 1709 — Understanding Cybersecurity of Mobile Networks Act

This section requires the Assistant Secretary of Commerce for Communications and Information, in consultation with the Department of Homeland Security, to submit to the House Committee on Energy and Commerce and the Senate Committee on Commerce, Science, and Transportation, not later than one year after enactment, an unclassified report (with a possible classified annex) on the cybersecurity of mobile service networks and their vulnerability to cyberattacks and surveillance by adversaries. The report must include (1) an assessment of mobile service providers' responses to identified cybersecurity vulnerabilities; (2) customer considerations of cybersecurity in purchasing decisions and availability of evaluation tools; (3) providers' implementation of best practices; (4) prevalence and efficacy of encryption and authentication in mobile services, equipment, devices, operating systems, and apps; (5) barriers to adopting stronger encryption; (6) prevalence of technologies authenticating legitimate services and equipment; and (7) prevalence, costs, and adversary use of cell site simulators and similar surveillance tools. In preparing the report, the Assistant Secretary must consult, to the extent practicable, with the Federal Communications Commission, National Institute of Standards and Technology, intelligence community, Cybersecurity and Infrastructure Security Agency, academic researchers, standards organizations, mobile providers (including small and rural), equipment manufacturers, and other experts. The report is limited to mobile service networks (excluding 5G protocols), vulnerabilities exploited in non-laboratory settings or feasibly exploitable in real-world conditions, and must consider effectively mitigated vulnerabilities; a redacted public version omits potentially exploitable unclassified information, with the unredacted version provided to the committees. The section defines "adversary" to include unauthorized hackers and foreign actors engaged in conduct adverse to U.S. national security or the safety of U.S. persons.