HR1709-119

What This Bill Does

The Understanding Cybersecurity of Mobile Networks Act directs the Assistant Secretary of Commerce for Communications and Information, who leads NTIA, to submit a report within one year to the House Energy and Commerce Committee and the Senate Commerce, Science, and Transportation Committee. The report must examine the cybersecurity of mobile service networks and the vulnerability of mobile devices to cyberattacks and adversary surveillance. It must assess whether mobile service providers have addressed vulnerabilities identified by academic researchers, independent researchers, standards organizations, industry experts, NTIA, NIST, DHS, CISA, and the DHS Science and Technology Directorate. It must also discuss whether consumers, companies, and government agencies consider cybersecurity when buying mobile service or devices; whether tools and frameworks exist to evaluate cybersecurity risk and price tradeoffs; adoption of best practices and risk frameworks; encryption and authentication used in mobile service, equipment, phones, operating systems, software, and apps; barriers to stronger algorithms; authentication of legitimate network equipment; and prevalence, cost, availability, and adversary use of cell-site simulators. The report must consult FCC, NIST, the intelligence community, CISA, DHS Science and Technology Directorate, researchers, 3GPP, IETF, international stakeholders, the State Department, small and rural providers, equipment manufacturers, device makers, mobile operating-system developers, and other experts. It excludes 5G protocols and networks and focuses on real-world exploitable vulnerabilities or mitigated vulnerabilities.

Who Benefits and How

Mobile service customers, consumer device buyers, companies buying mobile service, government agency mobile users, congressional commerce committees, cybersecurity researchers, NIST, CISA, FCC, and standards bodies benefit from a consolidated federal assessment of legacy mobile-network risk, surveillance threats, encryption gaps, authentication tools, and provider practices. The report can help users and policymakers understand where mobile-network security is weak without waiting for a breach-specific investigation.

Who Bears the Burden and How

NTIA, the Department of Homeland Security, CISA, DHS Science and Technology Directorate, FCC, NIST, intelligence-community analysts, mobile service providers, rural mobile providers, small mobile providers, telecommunications equipment manufacturers, mobile device manufacturers, mobile operating-system developers, and communications software developers must provide technical input, document mitigation status, discuss barriers to stronger encryption and authentication, and respond to federal scrutiny of surveillance and interception risks.

Key Provisions

• Requires NTIA and DHS to report within one year on mobile-service network cybersecurity and adversary surveillance risks.
• Requires assessment of provider responses to vulnerabilities identified by researchers, standards bodies, industry experts, and federal agencies.
• Requires discussion of customer cybersecurity decision-making, risk tools, best practices, encryption, authentication, and cell-site simulators.
• Requires consultation with FCC, NIST, CISA, DHS Science and Technology Directorate, researchers, 3GPP, IETF, international stakeholders, providers, manufacturers, and software developers.
• Limits the report to mobile service networks, excludes 5G protocols and networks, and focuses on real-world exploitable or mitigated vulnerabilities.