https://www.congress.gov/bill/118th-congress/senate-bill/686/text?s=1&r=15
TAKE ACTION NOW! GET ACCESS TO YOUR FREE LETTERS TO YOUR LOCAL POLITICIANS!
118th CONGRESS
1st Session
S. 686
IN THE SENATE OF THE UNITED STATES
March 7, 2023
Mr. Warner (for himself, Mr. Thune, Ms. Baldwin, Mrs. Fischer, Mr. Manchin, Mr. Moran, Mr. Bennet, Mr. Sullivan, Mrs. Gillibrand, Ms. Collins, Mr. Heinrich, Mr. Romney, and Mrs. Capito) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation
A BILL
To authorize the Secretary of Commerce to review and prohibit certain transactions between persons in the United States and foreign adversaries, and for other purposes.
1.
Short title
This Act may be cited as the Restricting the Emergence of Security Threats that Risk Information and Communications Technology Act or the RESTRICT Act.
2.
Definitions
In this Act:
(1)
Classified national security information
The term classified national security information means information that has been determined pursuant to Executive Order 13526 (50 U.S.C. 3161 note; relating to classified national security information) or any predecessor or successor order, to require protection against unauthorized disclosure, and is marked to indicate such classified status if in documentary form.
(2)
Controlling holding
The term controlling holding means a holding with the power, whether direct or indirect and whether exercised or not exercised, to determine, direct, or decide important matters affecting an entity.
(3)
Covered holding
The term covered holding—
(A)
means, regardless of how or when such holding was or will be obtained or otherwise come to have been held, a controlling holding held, directly or indirectly, in an ICTS covered holding entity by—
(ii)
an entity subject to the jurisdiction of, or organized under the laws of, a foreign adversary; or
(iii)
an entity owned, directed, or controlled by an entity described in subparagraphs (i) or (ii); and
(B)
includes any other holding, the structure of which is designed or intended to evade or circumvent the application of this Act, subject to regulations prescribed by the Secretary.
(4)
Covered transaction
(A)
In general
The term covered transaction means a transaction in which an entity described in subparagraph (B) has any interest (including through an interest in a contract for the provision of the technology or service), or any class of such transactions.
(B)
Covered entities
The entities described in this subparagraph are:
(ii)
an entity subject to the jurisdiction of, or organized under the laws of, a foreign adversary; and
(iii)
an entity owned, directed, or controlled by a person described in subparagraph (A) or (B).
(C)
Non-evasion
The term covered transaction includes any other transaction, the structure of which is designed or intended to evade or circumvent the application of this Act, subject to regulations prescribed by the Secretary.
(D)
Timing
The term covered transaction includes a current, past, or potential future transaction.
(5)
Critical infrastructure
The term critical infrastructure has the meaning given the term in section 1016(e) of the USA PATRIOT Act (42 U.S.C. 5195c(e)).
(6)
Entity
The term entity means any of the following, whether established in the United States or outside of the United States:
(B)
A government, government agency, government department, or government commission.
(D)
A fraternal or social organization.
(I)
A group, subgroup, or other association or organization whether or not organized for profit.
(7)
Executive department and agency
The term executive department and agency has the meaning given the term Executive agency in section 105 of title 5, United States Code.
(8)
Foreign adversary
The term foreign adversary—
(A)
means any foreign government or regime, determined by the Secretary, pursuant to sections 3 and 5, to have engaged in a long-term pattern or serious instances of conduct significantly adverse to the national security of the United States or the security and safety of United States persons; and
(B)
includes, unless removed by the Secretary pursuant to section 6—
(i)
the People’s Republic of China, including the Hong Kong Special Administrative Region and Macao Special Administrative Region;
(ii)
the Republic of Cuba;
(iii)
the Islamic Republic of Iran;
(iv)
the Democratic People’s Republic of Korea;
(v)
the Russian Federation; and
(vi)
the Bolivarian Republic of Venezuela under the regime of Nicolás Maduro Moros.
(9)
Holding
The term holding—
(A)
means—
(v)
a partnership interest;
(vi)
an interest in a limited liability company;
(vii)
a membership interest; or
(viii)
any participation, right, or other equivalent, however designated and of any character; and
(B)
includes, without limitation, any security convertible into an ownership interest and right, warrant, or option to acquire ownership interests.
(10)
ICTS covered holding entity
The term ICTS covered holding entity means any entity that—
(A)
owns, controls, or manages information and communications technology products or services; and
(B)(i)
has not less than 1,000,000 United States-based annual active users at any point during the year period preceding the date on which the covered holding is referred to the President; or
(ii)
for which more than 1,000,000 units have been sold to persons in the United States before the date on which the covered holding is referred to the President.
(11)
Information and communications technology products or services
The term information and communications technology products or services means any hardware, software, or other product or service primarily intended to fulfill or enable the function of information or data processing, storage, retrieval, or communication by electronic means, including transmission, storage, and display.
(12)
Mitigation measure
The term mitigation measure means a measure agreed to in an agreement between any relevant party and the Federal Government, or ordered by the Federal Government and of which any relevant party has been notified, in any matter addressed under this Act to address any risk arising from a covered transaction or associated with a covered holding.
(13)
Person
The term person means a natural person, including a citizen or national of the United States or of any foreign country.
(14)
Relevant executive department and agency heads
The term relevant executive department and agency heads means—
(A)
the Secretary of Treasury;
(B)
the Secretary of State;
(C)
the Secretary of Defense;
(D)
the Attorney General;
(E)
the Secretary of Homeland Security;
(F)
the United States Trade Representative;
(G)
the Director of National Intelligence;
(H)
the Administrator of General Services;
(I)
the Chairman of the Federal Communications Commission; and
(J)
the heads of other executive departments and agencies, as appropriate.
(15)
Relevant committees of congress
The term relevant committees of Congress means—
(A)
the Committee on Commerce, Science, and Transportation, the Committee on the Judiciary, the Committee on Homeland Security and Governmental Affairs, the Committee on Foreign Relations, the Committee on Banking, Housing, and Urban Affairs, the Committee on Armed Services, the Committee on Rules and Administration, and the Select Committee on Intelligence of the Senate; and
(B)
the Committee on Energy and Commerce, the Committee on the Judiciary, the Committee on Homeland Security, the Committee on Oversight and Accountability, the Committee on Foreign Affairs, the Committee on Armed Services, the Committee on House Administration, and the Permanent Select Committee on Intelligence of the House of Representatives.
(16)
Secretary
The term Secretary means the Secretary of Commerce.
(17)
Transaction
The term transaction means any acquisition, importation, transfer, installation, dealing in, or use of any information and communications technology product or service, including ongoing activities such as managed services, data transmission, software updates, repairs, or the provision of data hosting services, or a class of such transactions.
3.
Addressing information and communication technology products and services that pose undue or unacceptable risk
(a)
In general
The Secretary, in consultation with the relevant executive department and agency heads, is authorized to and shall take action to identify, deter, disrupt, prevent, prohibit, investigate, or otherwise mitigate, including by negotiating, entering into, or imposing, and enforcing any mitigation measure to address any risk arising from any covered transaction by any person, or with respect to any property, subject to the jurisdiction of the United States that the Secretary determines—
(1)
poses an undue or unacceptable risk of—
(A)
sabotage or subversion of the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of information and communications technology products and services in the United States;
(B)
catastrophic effects on the security or resilience of the critical infrastructure or digital economy of the United States;
(C)
interfering in, or altering the result or reported result of a Federal election, as determined in coordination with the Attorney General, the Director of National Intelligence, the Secretary of Treasury, and the Federal Election Commission; or
(D)
coercive or criminal activities by a foreign adversary that are designed to undermine democratic processes and institutions or steer policy and regulatory decisions in favor of the strategic objectives of a foreign adversary to the detriment of the national security of the United States, as determined in coordination with the Attorney General, the Director of National Intelligence, the Secretary of Treasury, and the Federal Election Commission; or
(2)
otherwise poses an undue or unacceptable risk to the national security of the United States or the safety of United States persons.
(b)
Procedure
(1)
In general
Not later than 180 days after the date of enactment of this Act, the Secretary, in consultation with the relevant executive department and agency heads, shall review any transaction described in subsection (a) to—
(A)
determine, not later than 180 days after the date on which the Secretary initiates such review, if such transaction poses an undue or unacceptable risk under subsection (a)(2) and qualifies as a covered transaction; and
(B)
with respect to a transaction found to pose an undue or unacceptable risk and qualify as a covered transaction, determine whether—
(i)
the covered transaction should be prohibited; or
(ii)
any other action should be taken to mitigate the effects of the covered transaction.
(2)
Published explanations
If practicable, and consistent with the national security and law enforcement interests of the United States, in coordination and in cooperation with the Director of National Intelligence, the Secretary shall publish information in a declassified form to explain how a covered transaction that the Secretary denied or otherwise mitigated under paragraph (1) meets the criteria established under subsection (a) or section 4(a).
(3)
Certain administrative procedure requirements inapplicable
Section 553 of title 5, United State Code, shall not apply to any regulation promulgated pursuant to paragraph (1).
4.
Addressing information and communications technology products and services holdings that pose undue or unacceptable risk
(a)
In general
The Secretary shall identify and refer to the President any covered holding that the Secretary determines, in consultation with the relevant executive department and agency heads, poses an undue or unacceptable risk to the national security of the United States or the security and safety of United States persons.
(b)
Procedure
(1)
Review and referral
The Secretary shall, by regulation, establish procedures by which the Secretary, in consultation with the relevant executive department and agency heads, shall—
(A)
conduct reviews of holdings to determine if such holdings constitute covered holdings that pose an undue or unacceptable risk under subsection (a); and
(B)
refer to the President covered holdings that are determined under subsection (a) to pose an undue or unacceptable risk.
(2)
Referrals prior to establishment of regulations
At any time preceding the issuance of regulations or establishment of procedures under subparagraph (1), the Secretary may identify and refer to the President a holding determined to be a covered holding under subsection (a) for action by the President pursuant to subsection (c) if the Secretary, in the sole and unreviewable discretion of the Secretary, determines that such referral would be in the interest of national security.
(3)
Administrative procedure requirements inapplicable
Subchapter II of chapter 5, and chapter 7, of title 5, United States Code (commonly known as the Administrative Procedure Act) shall not apply to any referral by the Secretary to the President of a covered holding.
(c)
Action by the President
(1)
In general
Subject to section 13, with respect to any covered holding referred to the President under subsection (a), if the President determines that the covered holding poses an undue or unacceptable risk to the national security of the United States or the security and safety of United States persons, the President may take such action as the President considers appropriate to compel divestment of, or otherwise mitigate the risk associated with, such covered holding to the full extent the covered holding is subject to the jurisdiction of the United States, with respect to—
(A)
the United States operations, assets, or property of the entity in which the covered holding is held, or of any products or services owned, controlled, designed, developed, manufactured, or supplied by the entity are used in the United States;
(B)
any tangible or intangible assets, wherever located, are used to support or enable use of the product or software of the entity in the United States; and
(C)
any data obtained or derived from use of the product or software of the entity in the United States.
(2)
Non-delegable authority
The authority to compel divestment of a covered holding under paragraph (1) may only be exercised by the President and may not be delegated to any other individual, except as described in paragraph (4).
(3)
Announcement
If the President determines that action is required pursuant to paragraph (1), the President shall announce the decision not later than 30 days after the date on which the Secretary refers the covered holding to the President pursuant to subsection (a).
(4)
Enforcement of divestment
The President may direct the Attorney General to seek appropriate relief, including divestment relief, in the district courts of the United States in order to implement and enforce this subsection.
5.
Considerations
(a)
Priority information and communications technology areas
In carrying out sections 3 and 4, the Secretary shall prioritize evaluation of—
(1)
information and communications technology products or services used by a party to a covered transaction in a sector designated as critical infrastructure in Policy Directive 21 (February 12, 2013; relating to critical infrastructure security and resilience);
(2)
software, hardware, or any other product or service integral to telecommunications products and services, including—
(A)
wireless local area networks;
(D)
satellite operations and control;
(F)
wireline access points;
(G)
core networking systems;
(H)
long-, short-, and back-haul networks; or
(I)
edge computer platforms;
(3)
any software, hardware, or any other product or service integral to data hosting or computing service that uses, processes, or retains, or is expected to use, process, or retain, sensitive personal data with respect to greater than 1,000,000 persons in the United States at any point during the year period preceding the date on which the covered transaction is referred to the Secretary for review or the Secretary initiates review of the covered transaction, including—
(A)
internet hosting services;
(B)
cloud-based or distributed computing and data storage;
(C)
machine learning, predictive analytics, and data science products and services, including those involving the provision of services to assist a party utilize, manage, or maintain open-source software;
(E)
content delivery services;
(4)
internet- or network-enabled sensors, webcams, end-point surveillance or monitoring devices, modems and home networking devices if greater than 1,000,000 units have been sold to persons in the United States at any point during the year period preceding the date on which the covered transaction is referred to the Secretary for review or the Secretary initiates review of the covered transaction;
(5)
unmanned vehicles, including drones and other aerials systems, autonomous or semi-autonomous vehicles, or any other product or service integral to the provision, maintenance, or management of such products or services;
(6)
software designed or used primarily for connecting with and communicating via the internet that is in use by greater than 1,000,000 persons in the United States at any point during the year period preceding the date on which the covered transaction is referred to the Secretary for review or the Secretary initiates review of the covered transaction, including—
(D)
payment applications; or
(E)
web-based applications; or
(7)
information and communications technology products and services integral to—
(A)
artificial intelligence and machine learning;
(B)
quantum key distribution;
(C)
quantum communications;
(E)
post-quantum cryptography;
(J)
computational biology; and
(K)
e-commerce technology and services, including any electronic techniques for accomplishing business transactions, online retail, internet-enabled logistics, internet-enabled payment technology, and online marketplaces.
(b)
Considerations relating to undue and unacceptable risks
In determining whether a covered transaction poses an undue or unacceptable risk under section 3(a) or 4(a), the Secretary—
(1)
shall, as the Secretary determines appropriate and in consultation with appropriate agency heads, consider, where available—
(A)
any removal or exclusion order issued by the Secretary of Homeland Security, the Secretary of Defense, or the Director of National Intelligence pursuant to recommendations of the Federal Acquisition Security Council pursuant to section 1323 of title 41, United States Code;
(B)
any order or license revocation issued by the Federal Communications Commission with respect to a transacting party, or any consent decree imposed by the Federal Trade Commission with respect to a transacting party;
(C)
any relevant provision of the Defense Federal Acquisition Regulation and the Federal Acquisition Regulation, and the respective supplements to those regulations;
(D)
any actual or potential threats to the execution of a national critical function identified by the Director of the Cybersecurity and Infrastructure Security Agency;
(E)
the nature, degree, and likelihood of consequence to the public and private sectors of the United States that would occur if vulnerabilities of the information and communications technologies services supply chain were to be exploited; and
(F)
any other source of information that the Secretary determines appropriate; and
(2)
may consider, where available, any relevant threat assessment or report prepared by the Director of National Intelligence completed or conducted at the request of the Secretary.
6.
Designation of foreign adversaries
(a)
In general
(1)
Designation
The Secretary may, in consultation with the Director of National Intelligence, designate any foreign government or regime as a foreign adversary if the Secretary finds that the foreign government or regime is engaged in a long-term pattern or serious instances of conduct significantly adverse to the national security of the United States or security and safety of United States persons.
(2)
Removal of designation
The Secretary may, in consultation with the Director of National Intelligence, remove the designation of any foreign government or regime as a foreign adversary, including any foreign government or regime identified in section 2(8), if the Secretary finds that the foreign government or regime is no longer engaged in a long-term pattern or serious instances of conduct significantly adverse to the national or economic security of the United States or security and safety of United States persons in a manner that would warrant designation as a foreign adversary.
(b)
Notice
Not later than 15 days before the date on which the Secretary makes or removes a designation under subsection (a), the Secretary shall, by classified communication, notify the President pro tempore, Majority Leader, and Minority Leader of the Senate, the Speaker and Minority Leader of the House of Representatives, and the relevant committees of Congress, in writing, of the intent to designate a foreign government or regime as a foreign adversary under this section, together with the findings made under subsection (a) with respect to the foreign government or regime and the factual basis therefor.
7.
Resolution of disapproval of designation or removal of designation of a foreign adversary
(a)
Definition
In this section—
(1)
the term covered joint resolution means a joint resolution of disapproval of designation or a joint resolution of disapproval of removal of designation;
(2)
the term joint resolution of disapproval of designation means a joint resolution the matter after the resolving clause of which is as follows: That Congress disapproves the designation by the Secretary of Commerce of ___ as a foreign adversary for purposes of the Securing the Information and Communications Technology and Services Supply Chain Act of 2023, and such designation shall have no force or effect until the Secretary of Commerce provides specific evidence to the relevant committees of Congress regarding the removal of designation under section 6(a) of that Act. (The blank space being appropriately filled in with the name of the foreign person of which the Secretary has designated as a foreign adversary of for purposes of this Act); and
(3)
the term joint resolution of disapproval of removal of designation means a joint resolution the matter after the resolving clause of which is as follows: That Congress disapproves the removal of designation by the Secretary of Commerce of ___ as a foreign adversary for purposes of the Securing the Information and Communications Technology and Services Supply Chain Act of 2023, and such removal shall have no force or effect until the Secretary of Commerce provides specific evidence to the relevant committees of Congress regarding the removal of designation under section 6(a) of that Act. (The blank space being appropriately filled in with the name of the foreign government or regime of which the Secretary has removed the designation as a foreign adversary of for purposes of this Act).
(b)
Expedited consideration of legislation
(1)
Initiation
In the event the Secretary designates a foreign government or regime as a foreign adversary or removes such designation as a foreign adversary, a joint resolution of disapproval of designation or a joint resolution of disapproval of removal of designation, as applicable, that is introduced during the 60-calendar day period thereafter shall be entitled to expedited consideration pursuant to this subsection.
(2)
Introduction
During the 60-calendar day period provided for in paragraph (1), a covered joint resolution may be introduced—
(A)
in the Senate, by the Majority Leader (or the designee of the Majority Leader) or the Minority Leader (or the designee of the Minority Leader); and
(B)
in the House of Representatives, by the Speaker or the Minority Leader.
(3)
Floor consideration in house of representatives
(A)
Reporting and discharge
If a relevant committee of the House to which a covered joint resolution has been referred has not reported such covered joint resolution within 10 legislative days after the date of referral, that committee shall be discharged from further consideration thereof.
(B)
Proceeding to consideration
Beginning on the third legislative day after each committee to which covered joint resolution has been referred reports the covered joint resolution to the House or has been discharged from further consideration thereof, it shall be in order to move to proceed to consider the covered joint resolution in the House. All points of order against the motion are waived. Such a motion shall not be in order after the House has disposed of a motion to proceed on the covered joint resolution with regard to the same agreement. The previous question shall be considered as ordered on the motion to its adoption without intervening motion. The motion shall not be debatable. A motion to reconsider the vote by which the motion is disposed of shall not be in order.
(C)
Consideration
The covered joint resolution shall be considered as read. All points of order against the covered joint resolution and against its consideration are waived. The previous question shall be considered as ordered on the covered joint resolution to final passage without intervening motion except 2 hours of debate equally divided and controlled by the sponsor of the covered joint resolution (or a designee) and an opponent. A motion to reconsider the vote on passage of the covered joint resolution shall not be in order.
(4)
Consideration in the senate
(A)
Committee referral
A covered joint resolution introduced in the Senate shall be referred to the relevant committees of the Senate.
(B)
Reporting and discharge
If a relevant committee of the Senate has not reported such covered joint resolution within 10 session days after the date of referral of such legislation, that committee shall be discharged from further consideration of such legislation and the covered joint resolution shall be placed on the appropriate calendar.
(C)
Proceeding to consideration
Notwithstanding Rule XXII of the Standing Rules of the Senate, it is in order at any time after each committee authorized to consider covered joint resolution reports it to the Senate or has been discharged from its consideration (even though a previous motion to the same effect has been disagreed to) to move to proceed to the consideration of the covered joint resolution, and all points of order against covered joint resolution (and against consideration of the covered joint resolution) are waived. The motion to proceed is not debatable. The motion is not subject to a motion to postpone. A motion to reconsider the vote by which the motion is agreed to or disagreed to shall not be in order. If a motion to proceed to the consideration of the covered joint resolution is agreed to, the covered joint resolution shall remain the unfinished business until disposed of.
(D)
Debate
Debate on covered joint resolution, and on all debatable motions and appeals in connection therewith, shall be limited to not more than 10 hours, which shall be divided equally between the majority and minority leaders or their designees. A motion to further limit debate is in order and not debatable. An amendment to, or a motion to postpone, or a motion to proceed to the consideration of other business, or a motion to recommit the covered joint resolution is not in order.
(E)
Vote on passage
The vote on passage shall occur immediately following the conclusion of the debate on the covered joint resolution and a single quorum call at the conclusion of the debate, if requested in accordance with the rules of the Senate.
(F)
Rulings of the chair on procedure
Appeals from the decisions of the Chair relating to the application of the rules of the Senate, as the case may be, to the procedure relating to a covered joint resolution shall be decided without debate.
(G)
Consideration of veto messages
Debate in the Senate of any veto message with respect to a covered joint resolution, including all debatable motions and appeals in connection with such covered joint resolution, shall be limited to 10 hours, to be equally divided between, and controlled by, the Majority Leader and the Minority Leader or their designees.
(5)
Rules relating to senate and house of representatives
(A)
Coordination with action by other house
If, before the passage by one House of a covered joint resolution of that Ho