,i  #aah? ,,congress  #a/ ,session  ,h4 
,r4 #fajf  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,octob] #bf1 #bjbc,ms4
 ,%]rill 7= h]self1 ,mr4 ,b]gman1 ,mr4  
,kri%namoor?i1 ,mrs4 ,h9son1 ,mr4       
,ne:\se1 ,mr4 ,g>am5di1 ,mr4 ,cr[1 ,mr4 
,f9/ad1 ,mr4 ,c>son1 & ,ms4 ,tokuda7    
introduc$ ! foll[+ bill2 :i* 0 ref]r$ to
 ! ,committee on ,arm$ ,s]vices  ,a     
,,bill  ,to create a risk framework to  
evaluate =eign mobile applications (    
conc]n1 & = o!r purposes4  #a4 ,%ort    
title ,?is ,act may be cit$ z ! ,bol/]+ 
,am]ica's ,def5ses ,aga9/ ,pot5tially   
,p]il\s ,s(tw>e ,act or ! ,,bad ,,apps  
,act4  #b4 ,risk framework = =eign      
mobile applications ( conc]n  7a7 ,9    
g5]al ,! ,secret>y ( ,def5se %all--     
7#a7 create categorical def9itions (    
=eign mobile applications ( conc]n )    
respect to p]sonnel or op]ations ( !    
,dep>tm5t ( ,def5se1 di/+ui%+ among     
categories su* z applications = %opp+1  
social m$ia1 ent]ta9m5t1 or heal?2 &    
7#b7 create a risk framework ) respect  

to ,dep>tm5t p]sonnel or op]ations t    
assesses ea* =eign mobile application   
7or1 if appropriate1 gr\p+ ( simil> su* 
applications7 t is f a c\ntry ( conc]n =
 any pot5tial impact on ,dep>tm5tal     
p]sonnel & ,dep>tm5tal op]ations1       
incorporat+ consid]ations (--  7,a7 !   
mann] & ext5t ( data collection by !    
application2  7,b7 ! ability ( !        
application to influ5ce ! us] ) !       
applications cont5t to ! detrim5t ( !   
,unit$ ,/ates2  7,c7 ! mann] & ext5t (  
=eign own]%ip or control ( ! application
 or data collect$ by ! application2     
7,d7 any =eign gov]nm5t int]e/s         
associat$ ) ! applications2  7,e7 a     
s(tw>e bill ( mat]ials ) a focus on kn[n
 or assess$ malici\s s(tw>e emb$d$ 9 !  
application1 includ+ 9 prior v]sions ( !
 application or 9 o!r applications      
creat$ by ! own]s ( su* application2    
7,f7 any kn[n impact f prior use ( !    
application to ,dep>tm5t p]sonnel or    
op]ations2 &  7,g7 ! =eign mobile       
application ( conc]n resid+ on a ,unit$ 

,/ates ,gov]nm5t device or a p]sonally  
own$ device :ile 9 proximity to         
,dep>tm5t op]ations or activities or 9 !
 p]sonal cu/ody ( p]sonnel dur+         
,dep>tm5t sanction$ activities4  7b7    
,consid]ations ,9 develop+ ! categorical
 def9itions & risk framework describ$ 9 
subsection 7a71 ! ,secret>y ( ,def5se-- 
7#a7 %all include 9 ! risk framework    
=eign mobile applications ( conc]n--    
7,a7 f c\ntries t ! ,secret>y det]m9es  
to be engag$ 9 consi/5t1 unau?oriz$     
conduct t is detrim5tal to ! national   
security or =eign policy ( ! ,unit$     
,/ates2  7,b7 t are accessible to be    
d[nload$ f major mobile device          
application m>ketplaces by ,dep>tm5t    
p]sonnel2 &  7,c7 orig9at+ f1 au?or$ 91 
own$ by1 or o!rwise associat$ ) c\ntries
 or entities t are designat$ on ! li/   
ma9ta9$ & set =? 9 ,supplem5t ,no4 #d to
 "p #gdd ( ! ,export ,adm9i/ration      
,regulations2  7#b7 may include         
additional c\ntries or individual =eign 
mobile applications ) malici\s & bann$  

capabilities f o!r c\ntries to ! ext5t !
 ,secret>y det]m9es appropriate2 &  7#c7
 %all consid] di/+ui%+ )9 ! risk        
framework ! p>ticul> int]e/s ( a c\ntry 
describ$ 9 p>agraph 7#a7 or 7#b7 9 ! use
 ( a =eign mobile application ( conc]n (
 su* c\ntry 7reg>dless ( device or own]7
 by--  7,a7 us]s locat$ at facilities ( 
! ,dep>tm5t ( ,def5se ( v>y+ levels (   
s5sitivity2  7,b7 us]s conduct+ au?oriz$
 op]ations or movem5ts ( ,dep>tm5t (    
,def5se mat]iel2 or  7,c7 specific      
civilian employees ( ! ,dep>tm5t or     
contractors :om ! ,secret>y det]m9es    
likely to be a t>get ( a =eign actor4   
7c7 ,guidance & updates ,! ,secret>y (  
,def5se %all--  7#a7 issue guidance to  
all ,dep>tm5t p]sonnel incorporat+ !    
categories ( =eign mobile applications (
 conc]n & advis+ h[ to mitigate ! risks 
id5tifi$ by ! risk framework ) respect  
to su* applications2  7#b7 r\t9ely      
update ! categorical def9itions & risk  
framework promulgat$ pursuant to        
subsection 7a71 at lea/ on an annual    

basis2 &  7#c7 prescribe1 if feasible1  
regulations t appropriately mitigate    
risks f applications on devices provid$ 
by ! ,dep>tm5t ( ,def5se or on any      
device us$ dur+ an activity describ$ 9  
subsection 7b77#c77;,b7 or at locations 
describ$ "u 7b77#c77;,a74