,,ii #aafth ,,congress #ast ,session ,s4 #bcaf ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #cj1 #bjai ,mr4 ,crapo 7for himself and ,mr4 ,warner7 introduced the following bill2 which was read twice and referred to the ,select ,committee on ,intelligence ,a ,,bill ,to require a plan for strengthening the supply chain intelligence function1 to establish a ,national ,supply ,chain ,intelligence ,center1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,manufacturing1 ,investment1 and ,controls ,review for ,computer ,hardware1 ,intellectual ,property1 and ,supply ,act of #bjai or the ,,microchips ,act of #bjai4 #b4 ,findings and sense of ,congress 7a7 ,findings ,congress makes the following findings3 7#a7 ,fifth generation telecommunications technology 7commonly referred to as #e;,g71 as well as other emerging technologies1 will revolutionize the technology industry1 becoming a vital part of day-to-day business and life1 and requires secure supply chains for the national security of the ,united ,states4 7#b7 ,an insecure supply chain for products supplied to the ,united ,states ,government can lead to a degradation of critical infrastructure and technology items that are essential to the defense of the ,united ,states4 7#c7 ,the ,united ,states ,government confronts adversaries who seek to offset the military strength of the ,united ,states through asymmetric1 nonkinetic actions that compromise and neutralize the decision-making systems1 processes1 and warfighting capabilities of the ,united ,states4 7#d7 ,these adversaries take advantage of the open and democratic system of the ,united ,states that prioritizes governmental transparency to connect citizens with the actions of the ,government4 7#e7 ,the ,national ,defense ,strategy identified ,russia and ,china as primary strategic competitors of the ,united ,states4 7#f7 ,russia and ,china seek to steal sensitive defense information from the ,united ,states through the use of blended espionage operations in the supply chain1 supply chain activities1 and cyberspace1 and through insider threat human actors4 7#g7 ,the actions of ,russia and ,china go well beyond theft of critical military technology1 threatening the integrity and readiness of information and weapons systems and potentially enabling key elements of the strategies of an adversary to defeat the ,armed ,forces of the ,united ,states across the spectrum of conflict4 7#h7 ,according to some estimates1 cybersecurity spending in the ,united ,states from #bjag to #bjba will exceed #a1jjj1jjj1jjj1jjj among the public and private sectors4 7#i7 ,even with these large investments in cybersecurity1 the ,united ,states remains vulnerable to advanced cyber actors like ,russia and ,china4 7#aj7 ,since #bjac1 more than #f1jjj1jjj individual data records have been compromised every day through data breaches1 with nearly half of these losses occurring in the ,government sector4 7#aa7 ,large expenditures of resources and a protective strategy that relies on firewalls and boundaries that can be breached by a persistent actor are clearly insufficient and completely ignore the supply chain vector4 7#ab7 ,military weapons systems are not immune to cyber vulnerabilities4 7#ac7 ,an ,october #bjah ,government ,accountability ,office report found that nearly all weapons systems of the ,united ,states have cyber vulnerabilities the scale of which the ,department of ,defense is just beginning to grapple with4 7#ad7 ,furthermore1 the report stated that despite multiple warnings since the early #aiijs1 cybersecurity has not been a focus of weapon systems acquisitions4 7#ae7 ,there have been numerous press stories about data breaches and theft of ,united ,states sensitive technology that prove that cyber vulnerabilities are real and not theoretical4 7#af7 ,the ,department of ,defense will spend more than #a1fjj1jjj1jjj1jjj to develop and field its current portfolio of weapons systems4 7#ag7 ,conducting acquisitions without making security resiliency a key discriminator in capability development and contract award decisions could potentially lead to additional losses of technological advantages of the ,armed ,forces and negate efforts to improve the capabilities of the ,armed ,forces to meet the ,national ,defense ,strategy4 7#ah7 ,software1 hardware1 and services supply chains have proven to be major means through which adversaries seek to gain access to weapons systems and information and communications technology platforms and systems of the ,united ,states4 7#ai7 ,vulnerabilities in these critical areas introduce unacceptable risks to human life and the ability of the ,armed ,forces to execute the missions the public of the ,united ,states expects of them4 7#bj7 ,the establishment of the ,protecting ,critical ,technology ,task ,force of the ,department of ,defense and the ,information and ,communication ,technology ,supply ,chain ,risk ,management ,task ,force of the ,department of ,homeland ,security is a welcome first step1 but the ,united ,states ,government requires a fundamental security culture change4 7#ba7 ,the innovative technologies that will help the ,armed ,forces1 economy1 and industry of the ,united ,states maintain competitive advantages over the competitors of the ,united ,states are developed in private industry and in academia4 7#bb7 ,engagement to find solutions with industry stakeholders and allied countries to mitigate the clear1 present1 and rapidly evolving threats to the national security of the ,united ,states is necessary4 7#bc7 ,a national center to unify efforts across the whole of government to strategically warn of and support the mitigation of threats to supply chains and supply chain activities is vital to the cybersecurity1 critical infrastructure1 and national security of the ,united ,states4 7b7 ,sense of ,congress ,it is the sense of ,congress that-- 7#a7 the ,united ,states ,government should endeavor to deliver warfighting capabilities to operational forces without having critical information or technology wittingly or unwittingly lost1 stolen1 or modified2 7#b7 the ,department of ,defense and the whole of the ,united ,states ,government should adapt to the challenges presented by adversaries while maintaining as much transparency with the people of the ,united ,states as possible2 7#c7 stronger effort should be placed on securing the vast supply chains of the contractors responsible for developing and producing the defense related capabilities of the ,united ,states2 7#d7 the efforts of the ,department of ,defense1 the ,department of ,homeland ,security1 and the ,federal ,acquisition ,security ,council to protect critical technologies should be action oriented with clear outcome expectations and chains of accountability2 7#e7 technology protection should begin long before a contract is signed between a contractor and the ,united ,states ,government2 7#f7 the ,united ,states ,government should improve its ability to collaborate to protect both the open research environment and emerging military technologies2 and 7#g7 the ,united ,states ,government should focus on supply chain security to ensure that military systems and systems required for sensitive activities are not acquired or operated in a compromised state4 #c4 ,plan for strengthening the supply chain intelligence function 7a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of the ,national ,counterintelligence and ,security ,center1 in coordination with the ,director of the ,defense ,counterintelligence and ,security ,agency and other interagency partners1 shall submit to ,congress a plan for strengthening the supply chain intelligence function4 7b7 ,elements ,the plan submitted under subsection 7a7 shall address the following3 7#a7 ,such recommendations as the ,director of the ,national ,counterintelligence and ,security ,center may have with respect to-- 7,a7 the appropriate workforce model1 including size1 mix1 and seniority1 from the elements of the intelligence community and other interagency partners2 and 7,b7 the appropriate governance structure within the intelligence community and with interagency partners4 7#b7 ,the budgetary resources necessary to implement the plan4 7#c7 ,the authorities necessary to implement the plan4 7c7 ,definition of intelligence community ,in this section1 the term intelligence community has the meaning given such term in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc74 #d4 ,establishment of ,national ,supply ,chain ,intelligence ,center 7a7 ,establishment of ,center ,title ,,ix of the ,intelligence ,authorization ,act for ,fiscal ,year #bjjc 7#ej ,u4,s4,c4 #cchb et seq47 is amended by adding at the end the following3 #ije4 ,national ,supply ,chain ,intelligence ,center 7a7 ,establishment of ,center ,there is within the ,national ,counterintelligence and ,security ,center in the ,office of the ,director of ,national ,intelligence a ,national ,supply ,chain ,intelligence ,center4 7b7 ,director of ,national ,supply ,chain ,intelligence ,center ,there is a ,director of the ,national ,supply ,chain ,intelligence ,center1 who shall be appointed by the ,president1 in consultation with the ,director of ,national ,intelligence and other interagency partners as the ,president considers appropriate4 7c7 ,center personnel 7#a7 ,senior management ,the ,director of the ,national ,supply ,chain ,intelligence ,center shall ensure that the senior management of the ,center includes one or more detailees from each of the following3 7,a7 ,the ,department of ,defense4 7,b7 ,the ,department of ,justice4 7,c7 ,the ,department of ,homeland ,security4 7,d7 ,the ,department of ,commerce4 7#b7 ,detail or assignment of personnel 7,a7 ,in general ,with the approval of the ,director of the ,office of ,management and ,budget1 and in consultation with the congressional committees of jurisdiction1 the ,director of the ,national ,supply ,chain ,intelligence ,center may request of the head of any department1 agency1 or element of the ,federal ,government the detail or assignment of personnel from such department1 agency1 or element to the ,national ,supply ,chain ,intelligence ,center4 7,b7 ,duties ,personnel detailed or assigned under subparagraph 7,a7 shall assist the ,national ,supply ,chain ,intelligence ,center in carrying out the primary missions of the ,center4 7,c7 ,terms ,personnel detailed or assigned under subparagraph 7,a7 shall be assigned or detailed to the ,national ,supply ,chain ,intelligence ,center for a period of not more than #b years4 7,d7 ,regular employment ,any ,federal ,government employee detailed or assigned under subparagraph 7,a7 shall retain the rights1 status1 and privileges of his or her regular employment without interruption4 7d7 ,primary missions ,the primary missions of the ,national ,supply ,chain ,intelligence ,center shall be as follows3 7#a7 ,to aggregate all-source intelligence relating to supply chains1 including-- 7,a7 classified and unclassified information2 7,b7 threat information2 and 7,c7 proprietary and sensitive information1 including risk and vulnerability information1 voluntarily provided by private entities4 7#b7 ,to share strategic warnings relating to supply chains or supply chain activities1 as the ,director of the ,national ,supply ,chain ,intelligence ,center considers appropriate and consistent with security standards for classified information and sensitive proprietary information1 among-- 7,a7 the elements of the intelligence community 7as defined in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc771 components of the ,department of ,justice and the ,department of ,defense1 the ,federal ,acquisition ,security ,council1 and other ,federal agencies2 7,b7 at-risk industry partners2 and 7,c7 governments of countries that are allies of the ,united ,states4 7#c7 ,to serve as the central and shared knowledge resource for-- 7,a7 known and suspected threats to supply chain activities or supply chain integrity from international groups1 companies1 countries1 or other entities2 and 7,b7 the goals1 strategies1 capabilities1 and networks of contacts and support of such groups1 companies1 countries1 and other entities4 7#d7 ,to perform tasks assigned to the ,national ,supply ,chain ,intelligence ,center by relevant ,government supply chain task forces1 councils1 including the ,federal ,acquisition ,security ,council1 and other entities4 7e7 ,annual reports required ,the ,director of the ,national ,supply ,chain ,intelligence ,center shall annually submit to ,congress a report1 with classified annexes as appropriate1 on the state of threats to the security of supply chains and supply chain activities for ,united ,states ,government acquisitions and replenishment as of the date of the submittal of the report4 7f7 ,funding ,amounts used to carry out this section shall be derived from amounts appropriated or otherwise made available for the ,national ,intelligence ,program 7as defined in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc774 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of such ,act is amended by inserting after the item relating to section #ijd the following new item3 ,sec4 #ije4 ,national ,supply ,chain ,intelligence ,center4 4 7c7 ,sense of ,congress ,it is the sense of ,congress that the ,director of the ,national ,supply ,chain ,intelligence ,center should implement the recommendations submitted under section #c7;b77#a74 #e4 ,investment in supply chain security under ,defense ,production ,act of #aiej 7a7 ,in general ,section #cjc of the ,defense ,production ,act of #aiej 7#ej ,u4,s4,c4 #decc7 is amended by adding at the end the following3 7h7 ,investment in supply chain security 7#a7 ,in general ,the ,president may make available to an eligible entity described in paragraph 7#b7 payments to increase the security of supply chains and supply chain activities1 if the ,president certifies to ,congress not less than #cj days before making such a payment that the payment is in the national security interests of the ,united ,states4 7#b7 ,eligible entity ,an eligible entity described in this paragraph is an entity that-- 7,a7 is organized under the laws of the ,united ,states or any jurisdiction within the ,united ,states2 and 7,b7 produces-- 7i7 one or more critical components2 7ii7 critical technology2 or 7iii7 one or more products for the increased security of supply chains or supply chain activities4 7#c7 ,regulations 7,a7 ,in general ,not later than #ij days after the date of the enactment of the ,manufacturing1 ,investment1 and ,controls ,review for ,computer ,hardware1 ,intellectual ,property1 and ,supply ,act of #bjai1 the ,president shall prescribe regulations setting forth definitions for the terms supply chain and supply chain activities for the purposes of this subsection4 7,b7 ,scope of definitions ,the definitions required by subparagraph 7,a7-- 7i7 shall encompass-- 7,i7 the organization1 people1 activities1 information1 and resources involved in the delivery and operation of a product or service used by the ,government2 or 7,,ii7 critical infrastructure as defined in ,presidential ,policy ,directive #ba 7,february #ab1 #bjac2 relating to critical infrastructure security and resilience72 and 7ii7 may include variations for specific sectors or ,government functions4 4