,i #aahth ,,congress #b;d ,session ,h4 ,r4 #hgda ,,in ,,the ,,house ,,of ,,representatives ,june #ac1 #bjbd,ms4 ,slotkin introduced the following bill2 which was referred to the ,committee on ,foreign ,affairs1 and in addition to the ,permanent ,select ,committee on ,intelligence1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to establish the ,office of ,information and ,communications ,technology and ,services within the ,bureau of ,industry and ,security of the ,department of ,commerce1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,connected ,vehicle ,national ,security ,review ,act4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,the ,office of ,information and ,communications ,technology and ,services4,sec4 #c4 ,transaction review process4,sec4 #d4 ,regulating person or jurisdiction of concern-connected covered ,,icts transactions4,sec4 #e4 ,risk assessment4,sec4 #f4 ,other authorities4,sec4 #g4 ,enforcement4,sec4 #h4 ,judicial review4,sec4 #i4 ,penalties4,sec4 #aj4 ,relationship to other laws4,sec4 #aa4 ,definitions4 #b4 ,the ,office of ,information and ,communications ,technology and ,services 7a7 ,establishment ,there is established within the ,bureau of ,industry and ,security of the ,department of ,commerce an ,office of ,information and ,communications ,technology and ,services 7in this section1 referred to as the ,office74 7b7 ,executive ,director ,the head of the ,office shall be an ,executive ,director who reports to the ,under ,secretary for ,industry and ,security and shall be designated by the ,secretary4 7c7 ,continuation in office of the executive director ,an individual serving as the ,executive ,director before the date of the enactment of this ,act may serve as the ,executive ,director on and after that date without the need for designation under subsection 7b74 7d7 ,duties ,the ,office shall-- 7#a7 identify and prevent through mitigation or prohibition the undue or unacceptable risk posed by certain ,,icts transactions2 and 7#b7 educate industry and other partners on relevant risks and communicate decisions4 7e7 ,special hiring authority ,the ,executive ,director may appoint1 without regard to the provisions of sections #ccji through #ccah of title #e1 ,united ,states ,code1 candidates directly to positions in the competitive service 7as defined in section #bajb of that title74 #c4 ,transaction review process 7a7 ,,icts transaction review process ,the ,secretary1 acting through the ,office of ,information and ,communications ,technology and ,services1 shall review ,,icts transactions according to the following procedures3 7#a7 ,review ,the ,secretary may review any ,,icts transaction that the ,secretary suspects poses an undue or unacceptable risk4 7#b7 ,investigative authority ,in reviewing an ,,icts transaction described in paragraph 7#a7 the ,secretary may do the following3 7,a7 ,require any person subject to the jurisdiction of the ,united ,states to furnish under oath1 in the form of a report or otherwise1 at any time as may be required by the ,secretary1 complete information relative to any such transaction4 7,b7 ,require that any such report take a particular form as directed in a request1 regulation1 or other guidance provided by the ,secretary1 which may be required before1 during1 or after any such transaction4 7,c7 ,through any agency1 conduct investigations1 hold hearings1 administer oaths1 examine witnesses1 receive evidence1 take depositions1 and require by subpoena the attendance and testimony of witnesses and the production of any book1 contract1 letter1 paper1 and other hard copy or document relating to any matter under investigation1 regardless of whether any such report has been required or filed4 7b7 ,mitigation of risk 7#a7 ,in general ,if the ,secretary finds that a covered ,,icts transaction poses an undue or unacceptable risk under subsection 7a71 the ,secretary shall mitigate the undue or unacceptable risk described in paragraph 7#b7 or prohibit such transaction4 7#b7 ,mitigation of risk authority ,the ,secretary may choose to mitigate any undue or unacceptable risk posed by a covered ,,icts transaction reviewed under subsection 7a74 ,to mitigate the undue or unacceptable risk1 the ,secretary may do any of the following with regard to any party to a covered ,,icts transaction3 7,a7 ,negotiate1 enter into or impose1 and enforce any agreement or condition with any such party4 7,b7 ,require adherence to certain cybersecurity standards and other mitigation requirements determined to be necessary by the ,secretary4 7,c7 ,require the exclusion 7in whole or in part7 of certain components1 including physical parts or hardware1 software1 digital services1 and digital components1 of any ,,icts or any sub-component of ,,icts from any such transaction4 7,d7 ,anything else the ,secretary determines to be appropriate or necessary to mitigate the undue or unacceptable risks4 7#c7 ,prohibition of transaction ,if the ,secretary determines that the undue or unacceptable risk posed by a covered ,,icts transaction cannot be effectively mitigated for any reason as determined by the ,secretary1 the ,secretary-- 7,a7 may prohibit the covered ,,icts transaction2 7,b7 shall notify any party subject to the covered ,,icts transaction review of the prohibition2 and 7,c7 may publish any such prohibition in the ,federal ,register4 #d4 ,regulating person or jurisdiction of concern-connected covered ,,icts transactions 7a7 ,authorization ,to issue rules for certain classes of covered ,,icts transactions ,the ,secretary may determine that1 for certain classes of covered ,,icts transactions1 an ,,icts transaction review described under section #c may not effectively address undue or unacceptable risks and may promulgate regulations that do the following3 7#a7 ,identify particular covered ,,icts transactions and person or jurisdiction of concern which warrant particular scrutiny for undue or unacceptable risk4 7#b7 ,establish mitigation measures to address undue or unacceptable risk1 to include prohibitions related to entities of concern or for classes of covered ,,icts transactions4 7#c7 ,establish criteria by which particular covered ,,icts transactions or particular classes of participants in the covered ,,icts transaction supply chain may be recognized as categorically included in or as categorically excluded from mitigation measures or prohibitions4 7#d7 ,establish particular classes of covered ,,icts transactions or parties to transactions that must abide by certain prohibitions or mitigation measures4 7#e7 ,establish procedures to authorize or license transactions otherwise prohibited pursuant to a regulation promulgated under this section4 7#f7 ,any other rule the ,secretary determines to be appropriate4 7b7 ,other review by ,secretary permitted ,the promulgation of any regulation under subsection 7a7 does not preclude the ,secretary from initiating a review of any covered ,,icts transaction1 including a covered ,,icts transaction that belongs to an identified category under this section4 #e4 ,risk assessment 7a7 ,,dni risk assessment ,not later than #ahj days after the date of the enactment of this ,act1 and annually thereafter1 the ,director of ,national ,intelligence shall submit to the ,secretary a risk assessment that relates to threats posed by persons or jurisdictions of concern to the ,united ,states by the supply chain of covered ,,icts transactions that-- 7#a7 includes specific criteria to evaluate any undue or unacceptable risk to the national security of the ,united ,states2 and 7#b7 identifies any person or jurisdiction of concern1 participants in such supply chain1 and covered ,,icts transactions or classes of covered ,,icts transactions posing the highest risks to the national security of the ,united ,states4 7b7 ,submission of risk assessment ,not later than #ij days after the date on which the risk assessment is submitted to the ,secretary1 the ,director of ,national ,intelligence shall submit the risk assessment to the relevant congressional committees in unclassified format4 7c7 ,classified annex ,the risk assessment submitted under subsection 7b7-- 7#a7 may include a classified annex2 and 7#b7 shall only include specific participants in such supply chain that pose risk to the national security of the ,united ,states in the classified annex4 #f4 ,other authorities 7a7 ,regulations ,any regulation the ,secretary promulgated under ,executive ,order #achgc 7#hd ,fed4 ,reg4 #bbfhi2 relating to securing the information and communications technology and services supply chain7 and ,executive ,order #adjcd 7#hf ,fed4 ,reg4 #cadbc2 relating to protecting ,americans' sensitive data from foreign adversaries7 before the date of the enactment of this ,act shall continue in effect on and after the date of the enactment of this ,act4 ,in carrying out the requirements of this ,act1 the ,secretary may amend regulations or promulgate new regulations and procedures as the ,secretary considers appropriate4 7b7 ,guidance ,the ,secretary may issue guidance and establish procedures to carry out this ,act4 7c7 ,technical advisory committee ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary shall establish an ,,icts technical advisory committee to report to the ,executive ,director of the ,office of ,information and ,communications ,technology and ,services4 7d7 ,membership ,the ,,icts advisory committee shall include the following3 7#a7 ,industry academic experts on covered ,,icts transaction supply chains4 7#b7 ,representatives of private sector companies1 industry associations1 and academia4 7#c7 ,a designated ,federal officer to administer the advisory committee and report to the ,executive ,director4 7e7 ,confidentiality and disclosure of information ,any information or document not otherwise publicly or commercially available that has been submitted to the ,secretary under this ,act shall not be released publicly excepted to the extent required by ,federal law4 #g4 ,enforcement 7a7 ,investigations 7#a7 ,in general ,the ,secretary may conduct an investigation of any violation of an authorization1 order1 mitigation measure1 regulation1 or prohibition issued under this ,act4 7#b7 ,actions by designees ,in conducting an investigation described in paragraph 7#a71 designated officers or employees of the ,secretary may1 to the extent necessary or appropriate to enforce this ,act1 exercise such authority as is conferred upon them by any other ,federal law1 subject to policies and procedures approved by the ,attorney ,general4 7b7 ,permitted activities ,an officer or employee authorized to conduct investigations under subsection 7a7 by the ,secretary may do any of the following3 7#a7 ,inspect1 search1 detain1 seize1 or impose a temporary denial order with respect to any item1 in any form1 or conveyance on which it is believed that there are items that have been1 are being1 or are about to be imported into the ,united ,states in violation of this ,act or any other applicable ,federal law4 7#b7 ,require1 inspect1 and obtain any book1 record1 and any other information from any person subject to the provisions of this ,act or other applicable ,federal law4 7#c7 ,administer an oath or affirmation and1 by subpoena1 require any person to appear and testify or to appear and produce books1 records1 and other writings4 7#d7 ,obtain a court order and issue legal process to the extent authorized under chapters #aai1 #aba1 and #bjf of title #ah1 ,united ,states ,code1 or any other applicable ,federal law4 7c7 ,enforcement of subpoenas ,in the case of contumacy by1 or refusal to obey a subpoena issued to1 any person under subsection 7b77#c71 a district court of the ,united ,states1 after notice to such person and a hearing1 shall have jurisdiction to issue an order requiring such person to appear and give testimony or to appear and produce books1 records1 and other writings1 regardless of format1 that are the subject of the subpoena4 ,any failure to obey such order of the court may be punished by such court as a contempt thereof4 7d7 ,actions by the ,attorney ,general ,the ,attorney ,general may bring an action in an appropriate district court of the ,united ,states for appropriate relief1 including declaratory and injunctive1 or divestment relief1 against any person who violates this ,act or any regulation1 order1 direction1 mitigation measure1 prohibition1 or other authorization or directive issued under this ,act4 #h4 ,judicial review 7a7 ,right of action ,a claim or petition challenging this ,act or any action1 finding1 or determination under this ,act may be filed only in the ,united ,states ,court of ,appeals for the ,district of ,columbia ,circuit4 7b7 ,exclusive jurisdiction ,the ,united ,states ,court of ,appeals for the ,district of ,columbia ,circuit shall have exclusive jurisdiction over claims or petitions arising under this ,act against the ,united ,states1 any agency1 or any component or official of an agency1 subject to review by the ,supreme ,court of the ,united ,states under section #abed of title #bh1 ,united ,states ,code4 7c7 ,in camera and ex parte review ,the following information may be included in the administrative record and shall be submitted only to the court ex parte and in camera3 7#a7 ,sensitive security information1 as defined in section #aebj4e of title #di1 ,code of ,federal ,regulations4 7#b7 ,records or information compiled for law enforcement purposes1 as described in section #eeb7;b77#g7 of title #e1 ,united ,states ,code4 7#c7 ,classified information1 meaning any information or material that has been determined by the ,united ,states ,government pursuant to an ,executive order1 statute1 or regulation1 to require protection against unauthorized disclosure for reasons of national security and any restricted data1 as defined in section #aa of the ,atomic ,energy ,act of #aied 7#db ,u4,s4,c4 #bjad74 7#d7 ,information subject to privilege or protections under any other provision of law1 including subchapter ,,ii of title #ca1 ,united ,states ,code4 7d7 ,information under seal ,any information that is part of the administrative record filed ex parte and in camera under subsection 7b71 or cited by the court in any decision1 shall be treated by the court consistent with the provisions of this section4 ,in no event shall such information be released to the claimant or petitioner or as part of the public record4 7e7 ,return ,after the expiration of the time to seek further review1 or the conclusion of further proceedings1 the court shall return the administrative record1 including any and all copies1 to the ,united ,states4 7f7 ,exclusive remedy ,a determination by the court under this section shall be the exclusive judicial remedy for any claim or petition for review challenging this ,act or any action1 finding1 or determination under this ,act against the ,united ,states1 any agency1 or any component or official of any such agency4 7g7 ,rule of construction ,nothing in this section shall be construed as limiting1 superseding1 or preventing the invocation of1 any privileges or defenses that are otherwise available at law or in equity to protect against the disclosure of information4 7h7 ,statute of limitations ,a challenge to any determination under this ,act may only be brought not later than #ahj days after the date of such a determination4 #i4 ,penalties 7a7 ,unlawful acts ,it shall be unlawful for a person to violate1 attempt to violate1 conspire to violate1 or cause a violation of any regulation1 order1 direction1 prohibition1 or other authorization or directive issued under this ,act4 7b7 ,criminal penalties ,a person who willfully commits1 willfully attempts to commit1 or willfully conspires to commit1 or aids and abets in the commission of a violation of subsection 7a7 shall be fined not more than #a1jjj1jjj for each violation1 imprisoned for not more than #bj years1 or both4 7c7 ,civil penalties ,the ,secretary may impose the following civil penalties on a person for each violation by that person of a rule promulgated under this section3 7#a7 ,a fine that is the greater of-- 7,a7 #cjj1jjj2 or 7,b7 an amount that is twice the value of the action that is the basis of the violation with respect to which the penalty is imposed4 7#b7 ,revocation of any mitigation measure or authorization issued under this ,act to the person4 7#c7 ,a prohibition or other restriction on the ability of the person to engage in any transaction or class of transactions covered by this ,act4 7d7 ,procedures ,any civil penalty imposed under subsection 7c7 may be imposed only pursuant to a rule promulgated under this section4 7e7 ,standards for levels of civil penalty ,the ,secretary may1 by rule1 provide standards for establishing levels of civil penalty under subsection 7c7 based upon factors1 including-- 7#a7 the seriousness of the violation2 7#b7 the culpability of the violator1 including any pattern of reckless behavior2 and 7#c7 any mitigating factors1 such as the record of cooperation of the violator with the ,federal ,government in disclosing the violation4 #aj4 ,relationship to other laws 7a7 ,rule of construction relating to other law ,nothing in this ,act shall be construed to alter or affect any other authority1 process1 regulation1 investigation1 enforcement measure1 or review provided by or established under any other provision of ,federal law4 7b7 ,administrative procedure exceptions ,except with respect to a civil penalty imposed pursuant to section #i7;c71 any function exercised under this ,act is not subject to sections #eea1 #eec through #eei1 and #gja through #gjf of title #e1 ,united ,states ,code4 7c7 ,paperwork reduction act exception ,the requirements of chapter #ce of title #dd1 ,united ,states ,code 7commonly referred to as the ,paperwork ,reduction ,act71 shall not apply to any action by the ,secretary to implement this ,act4 7d7 ,defense production act ,nothing in this ,act shall prevent or preclude the ,president or the ,committee on ,foreign ,investment in the ,united ,states from exercising any authority under section #gba of the ,defense ,production ,act of #aiej 7#ej ,u4,s4,c4 #defe et seq47 as would be available in the absence of this ,act4 7e7 ,rule of construction for the ,,oicts ,nothing in this ,act may be construed as altering any of the authority of the ,office of ,information and ,communications ,technology and ,services under ,executive ,order #achgc 7#hd ,fed4 ,reg4 #bbfhi2 relating to securing the information and communications technology and services supply chain7 and ,executive ,order #adjcd 7#hf ,fed4 ,reg4 #cadbc2 relating to protecting ,americans' sensitive data from foreign adversaries74 #aa4 ,definitions ,in this ,act3 7#a7 ,agency ,the term agency has the meaning given that term in section #eea of title #e1 ,united ,states ,code4 7#b7 ,covered ,,icts transaction ,the term covered ,,icts transaction means an ,,icts transaction that meets each of the following requirements3 7,a7 ,is conducted by any person subject to the jurisdiction of the ,united ,states or involves property subject to the jurisdiction of the ,united ,states4 7,b7 ,involves ,,icts designed1 developed1 manufactured1 or supplied by a person owned by1 controlled by1 or subject to the jurisdiction or direction of a person or jurisdiction of concern4 7,c7 ,is used in a covered motor vehicle4 7#c7 ,covered motor vehicle 7,a7 ,in general ,the term covered motor vehicle means a motor vehicle that has one or more integrated systems capable of communicating wirelessly with any other network or device4 7,b7 ,motor vehicle ,the term motor vehicle-- 7i7 means a vehicle driven or drawn by mechanical power and manufactured primarily for use on public streets1 roads1 and highways2 and 7ii7 does not include a vehicle operated only on a rail line4 7#d7 ,critical infrastructure ,the term critical infrastructure means systems and assets1 whether physical or virtual1 so vital to the ,united ,states that the incapacity or destruction of such systems and assets would have a debilitating impact on national security1 national economic security1 national public health or safety1 or any combination of those matters4 7#e7 ,,icts transaction ,the term ,,icts transaction means any acquisition1 importation1 transfer1 installation1 dealing in1 or use of ,,icts1 including any ongoing activity1 such as a managed service1 data transmission1 software update1 repair1 or the platforming or data hosting of an application for consumer download1 and any class of ,,icts transactions 7including the acquisition1 importation1 transfer1 installation1 dealing in1 or use1 including any ongoing activity1 of any category of technology product or services1 or group of technology products or services as identified by the ,secretary74 7#f7 ,information and communications technology and services2 ,,icts ,the terms information and communications technology or services and ,,icts mean any hardware1 software1 or other product or service1 including cloud-computing services1 primarily intended to fulfill or enable the function of information or data processing1 storage1 retrieval1 or communication by electronic means 7including electromagnetic1 magnetic1 and photonic71 including transmission1 storage1 or display4 7#g7 ,office ,the term ,office means the ,office of ,information and ,communications ,technology and ,services established under section #b4 7#h7 ,person or jurisdiction of concern 7,a7 ,in general ,except as provided in subparagraph 7,b71 the term person or jurisdiction of concern means any foreign person or any foreign region1 country1 or government that is engaged in any long-term pattern or serious instances of activity adverse to the national security of the ,united ,states1 the security of critical infrastructure of the ,united ,states1 or the safety and security of ,united ,states persons and includes the following3 7i7 ,the ,russian ,federation4 7ii7 ,the ,people's ,republic of ,china1 including the ,hong ,kong ,special ,administrative ,region and the ,macau ,special ,administrative ,region4 7iii7 ,the ,republic of ,cuba4 7iv7 ,the ,islamic ,republic of ,iran4 7v7 ,the ,democratic ,people's ,republic of ,korea4 7vi7 ,venezuelan politician ,nicols ,maduro4 7,b7 ,updates to the list ,the ,secretary1 in consultation with the ,director of ,national ,intelligence1 shall periodically review the list under subparagraph 7,a7 and may update by adding to1 subtracting from1 supplementing1 or otherwise amending the list through publication of a notice in the ,federal ,register and any such update shall apply with respect to any ,,icts transaction that is initiated1 pending1 or completed on or after the date of the notice4 7#i7 ,relevant committees of congress ,the term relevant committees of ,congress means-- 7,a7 the ,committee on ,commerce1 ,science1 and ,transportation1 the ,committee on ,banking1 ,housing1 and ,urban ,affairs1 the ,committee on ,armed ,services1 and the ,select ,committee on ,intelligence of the ,senate2 and 7,b7 the ,committee on ,energy and ,commerce1 the ,committee on ,foreign ,affairs1 the ,committee on ,armed ,services1 and the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives4 7#aj7 ,secretary ,the term ,secretary means the ,secretary of ,commerce4 7#aa7 ,undue or unacceptable risk ,the term undue or unacceptable risk means any of the following3 7,a7 ,the undue risk of sabotage to or subversion of the design1 integrity1 manufacturing1 production1 distribution1 installation1 operation1 or maintenance of ,,icts in the ,united ,states4 7,b7 ,the undue risk of catastrophic effects on the security or resiliency of ,united ,states critical infrastructure or the digital economy of the ,united ,states4 7,c7 ,the unacceptable risk to the national security of the ,united ,states or the security and safety of ,united ,states persons4 7#ab7 ,united ,states person ,the term ,united ,states person any ,united ,states citizen1 national1 or lawful permanent resident1 and any corporation1 partnership1 or other organization organized under the laws of the ,united ,states4