HR7121-119

What This Bill Does

The Securing Federal Devices from Chinese Applications Act prohibits covered applications from being downloaded or used on federal government devices unless an agency head determines controlled access is needed for a legally required research or intelligence function. Agency exception guidance is due within 270 days and must include cybersecurity safeguards and documentation of risk-mitigation actions. OMB, in consultation with Homeland Security, Defense, and the Director of National Intelligence, must issue guidance within 180 days and every 180 days afterward on how the covered-application list will be created and updated. Agencies must remove a covered application from federal devices within 60 days after it is identified. Covered applications include applications developed, owned, or controlled by entities headquartered in China, entities controlled by the Chinese government, the Chinese Communist Party, or their representatives, parents, subsidiaries, or affiliates of such entities, and applications the Defense Secretary determines pose an undue national-security risk due to Chinese ownership, control, or influence.

Who Benefits and How

Federal cybersecurity teams, national-security officials, agency chief information officers, OMB, DHS, Defense, intelligence agencies, and federal employees using secure devices benefit from a clear device ban, list-update process, and removal deadline for China-linked applications. Research and intelligence offices benefit from a narrow exception that permits controlled access when required by law.

Who Bears the Burden and How

Federal agencies, agency CIO offices, device-management teams, employees using federal devices, researchers, intelligence personnel, Chinese application developers, and vendors with China-linked ownership must identify covered apps, remove them within 60 days, document exceptions, apply cybersecurity safeguards, and comply with repeated OMB guidance updates.

Key Provisions

• Prohibits covered China-linked applications from being downloaded or used on federal government devices.
• Provides a narrow exception for controlled research or intelligence access required by law.
• Requires agency exception guidance with cybersecurity safeguards and risk-mitigation documentation within 270 days.
• Requires OMB, with DHS, Defense, and DNI consultation, to issue covered-application list guidance within 180 days and every 180 days thereafter.
• Requires agencies to remove covered applications from federal devices within 60 days after identification.