H.R. 3447 — Chip Security Act

This section expresses the sense of Congress that—(1) U.S.-developed technology should serve as the foundation for the global artificial intelligence ecosystem to advance U.S. foreign policy and national security objectives and those of U.S. allies and partners; (2) the United States can foster goodwill, strengthen relationships, and support innovative research worldwide by providing allies and partners with advanced computing capabilities; (3) advanced integrated circuits and computing hardware exported from the United States must be protected from diversion, theft, and other unauthorized use or exploitation to bolster U.S. competitiveness and protect national security; (4) implementing chip security mechanisms will improve compliance with U.S. export control laws, assist allies and partners with guarding computing hardware, and enhance protections from bad actors seeking to access, divert, or tamper with such hardware; and (5) implementing chip security mechanisms may help detect smuggling or exploitation of advanced integrated circuits and computing hardware, thereby allowing increased flexibility in export controls and enabling streamlined, larger shipments to more international partners.

This section establishes definitions for terms used in the Act, including (1) appropriate congressional committees as the Senate Committee on Banking, Housing, and Urban Affairs and the House Committee on Foreign Affairs; (2) chip security mechanism as a software-, firmware-, or hardware-enabled security mechanism or a physical security mechanism; (3) covered integrated circuit product as an integrated circuit, computer, or product containing such items classified under Export Control Classification Number (ECCN) 3A090 or 3A001.z, ECCN 4A090 or 4A003.z, or a successor or substantially similar ECCN; and (4) Secretary as the Secretary of Commerce. The section adopts the existing statutory definitions of export, in-country transfer, and reexport from the Export Control Reform Act of 2018 (50 U.S.C. 4801).

This section requires the Secretary of Commerce to mandate, not later than 180 days after enactment, that covered integrated circuit products incorporate primary chip security mechanisms for location verification—using feasible techniques—prior to export, reexport, or in-country transfer to a foreign country. It further requires, within the same timeframe, licensees under the Export Control Reform Act of 2018 to report credible information on product diversions from authorized locations or users or any tampering (including with security mechanisms). This section further directs the Secretary to (1) assess, not later than one year after enactment, additional secondary chip security mechanisms to enhance export control compliance, prevent unauthorized use, and support U.S. national security objectives—including evaluating feasibility, costs, benefits, and tampering risks—and report results to congressional committees with any implementation roadmap; and (2) if appropriate mechanisms are identified, require them on covered products not later than two years after completing the assessment (i.e., up to three years after enactment), prioritizing user privacy. This section authorizes the Secretary to verify product ownership and location post-export, maintain records of products and end-users, and compel licensees to provide related information. It also requires the Secretary to conduct annual assessments and reports on new chip security mechanisms, beginning two years after enactment and continuing for three years.