,,ii #aaith ,,congress #b;d ,session ,s4 #dhhb ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #bd1 #bjbf,mr4 ,scott of ,south ,carolina 7for himself and ,mr4 ,hagerty7 introduced the following bill2 which was read twice and referred to the ,committee on ,banking1 ,housing1 and ,urban ,affairs ,a ,,bill ,to amend the ,export ,control ,reform ,act of #bjah to provide for the security of information and communications technology and services supply chains1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,,icts ,supply ,chain ,security ,act of #bjbf4 #b4 ,assistant ,secretary of ,commerce for ,information and ,communications ,technology ,supply ,chains ,part ,,iii of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhea et seq47 is amended-- 7#a7 in the part heading1 by striking administrative authorities and inserting ,organization of ,bureau of ,industry and ,security2 and 7#b7 by adding at the end the following3 #aghc4 ,assistant ,secretary of ,commerce for ,information and ,communications ,technology ,supply ,chains 7a7 ,in general ,the ,president shall appoint1 by and with the advice and consent of the ,senate1 and in addition to the ,assistant ,secretaries of ,commerce appointed under section #aghb1 an ,assistant ,secretary of ,commerce for ,information and ,communications ,technology ,supply ,chains 7in this section referred to as the ,assistant ,secretary71 who shall report to the ,under ,secretary of ,commerce for ,industry and ,security4 7b7 ,responsibilities ,the ,assistant ,secretary shall be responsible for overseeing the ,office of ,information and ,communications ,technology and ,services established by section #aghd4 4 #c4 ,office of ,information and ,communications ,technology and ,services ,part ,,iii of the ,export ,control ,reform ,act of #bjah1 as amended by section #b1 is further amended by adding at the end the following3 #aghd4 ,office of ,information and ,communications ,technology and ,services 7a7 ,establishment ,the ,secretary shall establish an ,office of ,information and ,communications ,technology and ,services 7in this section referred to as the ,office7 within the ,bureau of ,industry and ,security4 7b7 ,organizational structure ,the head of the ,office shall report directly to the ,assistant ,secretary of ,commerce for ,information and ,communications ,technology ,supply ,chains4 7c7 ,duties ,the ,office shall-- 7#a7 administer part ,,iv2 and 7#b7 carry out such other duties as the ,secretary or the ,assistant ,secretary of ,commerce for ,information and ,communications ,technology ,supply ,chains may assign4 7d7 ,availability of information to ,congress 7#a7 ,in general ,any information obtained at any time by the ,office in carrying out the duties of the ,office under subsection 7c71 including in administering part ,,iv1 shall be made available to a committee or subcommittee of ,congress of appropriate jurisdiction1 upon the request of the chairman or ranking minority member of the committee or subcommittee4 7#b7 ,prohibition on further disclosure ,no committee or subcommittee referred to in paragraph 7#a71 or any member thereof1 may disclose any information made available under paragraph 7#a7 that is submitted on a confidential basis unless the full committee determines that the withholding of that information is contrary to the national interest4 4 #d4 ,security of information and communications technology and services supply chains 7a7 ,in general ,the ,export ,control ,reform ,act of #bjah1 as amended by sections #b and #c1 is further amended by adding at the end the following3 ,,iv ,security of information and communications technology and services supply chains #aghe4 ,definitions ,in this part3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means the ,committee on ,banking1 ,housing1 and ,urban ,affairs of the ,senate and the ,committee on ,foreign ,affairs of the ,house of ,representatives4 7#b7 ,country of concern ,the term country of concern means-- 7,a7 the ,people's ,republic of ,china1 including the ,hong ,kong and ,macau ,special ,administrative ,regions2 7,b7 the ,republic of ,cuba2 7,c7 the ,islamic ,republic of ,iran2 7,d7 the ,democratic ,people's ,republic of ,korea2 and 7,e7 the ,russian ,federation4 7#c7 ,covered ,,icts transaction ,the term covered ,,icts transaction means any transaction described in section #aghe;,a7b7 or a class of such transactions4 7#d7 ,information and communications technology or services2 ,,icts ,the terms information and communications technology or services and ,,icts mean any hardware1 software1 connected software applications1 or other product or service primarily intended to fulfill or enable the function of information or data processing1 storage1 retrieval1 or communication by electronic means1 including through transmission1 storage1 or display4 7#e7 ,open-source software ,the term open-source software means software for which the human-readable source code is available in its entirety for use1 study1 reuse1 modification1 enhancement1 and redistribution by the users of the software4 #aghe;,a4 ,prohibition on transactions that threaten security of information and communications technology and services supply chains 7a7 ,in general ,except as otherwise specifically provided in this part1 a transaction described in subsection 7b7 is prohibited4 7b7 ,transactions described ,a transaction described in this subsection is any acquisition1 importation1 transfer1 installation1 dealing in1 or use of any information and communications technology or service by any person1 or with respect to any property1 subject to the jurisdiction of the ,united ,states1 if the ,secretary1 in consultation with the heads of the relevant ,federal agencies1 has determined that the transaction-- 7#a7 involves information and communications technology or services designed1 developed1 manufactured1 or supplied by persons owned by1 controlled by1 or subject to the jurisdiction or direction of a country of concern2 and 7#b7 7,a7 poses an undue risk of sabotage to or subversion of the design1 integrity1 manufacturing1 production1 distribution1 installation1 operation1 or maintenance of information and communications technology or services in the ,united ,states2 7,b7 poses an undue risk of catastrophic effects on the security or resiliency of ,united ,states critical infrastructure or the digital economy of the ,united ,states2 or 7,c7 otherwise poses an unacceptable risk to the national security of the ,united ,states or the security and safety of ,united ,states persons4 7c7 ,exception for information and informational materials ,the prohibition under subsection 7a7 shall not include a prohibition intended to prevent the importation from any country1 or the exportation to any country1 whether commercial or otherwise1 of any expressive materials1 including-- 7#a7 publications1 films1 posters1 photographs1 artworks1 news wire feeds1 digital streaming content1 podcasts1 social media posts1 blogs1 online news articles1 and other electronically distributed media2 and 7#b7 items and transactions described in section #bjc7;b7 of the ,international ,emergency ,economic ,powers ,act 7#ej ,u4,s4,c4 #agjb7;b774 7d7 ,exception for open-,source software ,the prohibition under subsection 7a7 does not include a prohibition on transactions specifically intended to provide the public with access to open-source software4 7e7 ,effect on contracts and permits ,the prohibition under subsection 7a7 applies notwithstanding any contract entered into or license or permit granted before the date of the enactment of this part4 #aghe;,b4 ,authorization to prescribe regulations with respect to covered ,,icts transactions and persons and jurisdictions of concern ,if ,secretary determines that1 for certain classes of covered ,,icts transactions1 the prohibition under subsection 7a7 of section #aghe;,a may not effectively address the undue or unacceptable risks described in subsection 7b77#b7 of that section1 the ,secretary may-- 7#a7 prescribe regulations that-- 7,a7 identify particular covered ,,icts transactions or persons or jurisdictions of concern that pose such a risk2 7,b7 impose mitigation measures and prohibitions to address the risk posed by such transactions1 persons1 or jurisdictions2 7,c7 establish criteria by which particular covered ,,icts transactions or particular classes of participants in the covered ,,icts transaction supply chain may be recognized as categorically included in or as categorically excluded from mitigation measures or prohibitions imposed under subparagraph 7,b72 7,d7 establish particular classes of covered ,,icts transactions or parties to such transactions that are required to abide by such mitigation measures and prohibitions2 and 7,e7 establish procedures to authorize or license transactions otherwise prohibited pursuant to a regulation prescribed under this section2 and 7#b7 prescribe such other regulations as the ,secretary determines to be necessary or appropriate to address the undue or unacceptable risks described in section #aghe;,a7b77#b74 #aghe;,c4 ,administration 7a7 ,in general ,the head of the ,office of ,information and ,communications ,technology and ,services established under section #aghd 7in this section referred to as the head of the ,office7 shall administer this part4 7b7 ,mitigation and approval of covered ,,icts transactions ,the head of the ,office1 in consultation with the heads of the relevant ,federal agencies1 may-- 7#a7 design1 negotiate1 and impose mitigation measures with respect to a covered ,,icts transaction2 and 7#b7 approve the transaction if those measures are implemented4 7c7 ,regulations ,the ,secretary1 acting through the head of the ,office1 may prescribe regulations to carry out this part4 #aghe;,d4 ,judicial review 7a7 ,exclusive jurisdiction ,a claim or petition challenging this part or any final action or determination under this part may be filed only in the ,united ,states ,court of ,appeals for the ,district of ,columbia ,circuit4 ,notwithstanding the preceding sentence1 the ,united ,states ,district ,court for the ,district of ,columbia ,circuit shall have the jurisdiction and power to order and require compliance with any subpoena issued under this part4 7b7 ,in camera and ex parte review 7#a7 ,in general ,the following information may be included in the administrative record and shall be submitted only to the court ex parte and in camera3 7,a7 ,sensitive security information1 as defined in section #aebj4e of title #di1 ,code of ,federal ,regulations4 7,b7 ,records or information compiled for law enforcement purposes1 as described in section #eeb7;b77#g7 of title #e1 ,united ,states ,code4 7,c7 ,classified information1 as defined in section #a7;a7 of the ,classified ,information ,procedures ,act 7#ah ,u4,s4,c4 ,app474 7#b7 ,treatment of information filed in camera and ex parte ,any information that is part of the administrative record filed ex parte and in camera under paragraph 7#a71 or cited by the court in any decision1 shall be treated by the court consistent with the provisions of this section4 ,in no event shall such information be released to the claimant or petitioner or as part of the public record1 or shall the petitioner be permitted to review information submitted to the court ex parte and in camera4 7c7 ,exclusive remedy ,a determination by the court under this section shall be the exclusive judicial remedy for any claim or petition for review challenging this part or any final action or determination under this part against the ,united ,states1 any agency1 or any component or official of any such agency4 7d7 ,rule of construction ,nothing in this section may be construed as limiting1 superseding1 or preventing the invocation of any privileges or defenses that are otherwise available at law or in equity to protect against the disclosure of information4 7e7 ,statute of limitations ,a challenge to any final action or determination under this part may only be brought not later than #ahj days after the date of such an action or determination4 #aghe;,e4 ,penalties 7a7 ,unlawful acts ,it shall be unlawful for a person to violate1 attempt to violate1 conspire to violate1 or cause a violation of any regulation1 order1 direction1 prohibition1 or other authorization or directive issued under this part4 7b7 ,criminal penalties ,a person who willfully commits1 willfully attempts to commit1 or willfully conspires to commit1 or aids and abets in the commission of an unlawful act described in subsection 7a7-- 7#a7 shall be fined not more than #a1jjj1jjj2 and 7#b7 in the case of the individual1 shall be imprisoned for not more than #bj years1 or both4 7c7 ,civil penalties 7#a7 ,in general ,the ,secretary may impose the following civil penalties on a person for each violation by that person of this part or any regulation1 order1 or license issued under this part3 7,a7 ,a fine that is the greater of #a1ejj1jjj or an amount that is #e times the value of the transaction that is the basis of the violation with respect to which the penalty is imposed4 7,b7 ,revocation of any mitigation measure or authorization issued under this part to the person4 7,c7 ,a prohibition or other restriction on the ability of the person to engage in any covered ,,icts transaction4 7#b7 ,inflation ,the fine under paragraph 7#a77;,a7 is subject to adjustment pursuant to the ,federal ,civil ,penalties ,inflation ,adjustment ,act of #aiij 7,public ,law #aja-daj2 #bh ,u4,s4,c4 #bdfa note74 7#c7 ,standards for levels of civil penalty ,the ,secretary may by regulation provide standards for establishing levels of civil penalty under paragraph 7#a7 based upon factors that include-- 7,a7 the seriousness of the violation to the national security of the ,united ,states2 7,b7 the intent or actions of the violator1 including any pattern of reckless behavior2 and 7,c7 any mitigating factors1 such as a record of cooperation of the violator with the ,federal ,government in disclosing the violation4 #aghe;,f4 ,relationship to other laws 7a7 ,rule of construction relating to other law ,nothing in this part shall be construed to alter or affect any other authority1 process1 regulation1 investigation1 enforcement measure1 or review provided by or established under any other provision of ,federal law4 7b7 ,administrative procedure exceptions ,except with respect to a civil penalty imposed pursuant to section #aghe;,e7c71 any function exercised under this part is not subject to sections #eea1 #eec through #eei1 and #gja through #gjf of title #e1 ,united ,states ,code4 7c7 ,paperwork ,reduction ,act exception ,the requirements of chapter #ce of title #dd1 ,united ,states ,code 7commonly referred to as the ,paperwork ,reduction ,act71 shall not apply to any action to implement this part4 7d7 ,defense ,production ,act of #aiej 7#a7 ,rule of construction ,nothing in this part shall prevent or preclude the ,president or the ,committee on ,foreign ,investment in the ,united ,states from exercising any authority under section #gba of the ,defense ,production ,act of #aiej 7#ej ,u4,s4,c4 #defe7 that would be available in the absence of this part4 7#b7 ,coordination of reviews ,the ,secretary shall terminate the review of a covered ,,icts transaction under this part if-- 7,a7 the transaction involves the acquisition of ,,icts items by a ,united ,states person as a party to a transaction authorized under the ,defense ,production ,act of #aiej 7#ej ,u4,s4,c4 #deja et seq472 or 7,b7 the ,committee on ,foreign ,investment in the ,united ,states is conducting a review or investigation of the transaction under section #gba of the ,defense ,production ,act of #aiej 7#ej ,u4,s4,c4 #defe74 7e7 ,executive ,orders #achgc and #adjcd 7#a7 ,rule of construction ,nothing in this part may be construed as altering any of the authority of the ,secretary under ,executive ,order #achgc 7#ej ,u4,s4,c4 #agja note2 relating to securing the information and communications technology and services supply chain7 or ,executive ,order #adjcd 7#ej ,u4,s4,c4 #agja note2 relating to protecting ,americans' sensitive data from foreign adversaries74 7#b7 ,continuation in effect ,any regulation the ,secretary prescribed under ,executive ,order #achgc 7#ej ,u4,s4,c4 #agja note2 relating to securing the information and communications technology and services supply chain7 or ,executive ,order #adjcd 7#ej ,u4,s4,c4 #agja note2 relating to protecting ,americans' sensitive data from foreign adversaries7 before the date of the enactment of this part shall continue in effect on and after such date of enactment4 #aghe;,g4 ,authorization of other actions ,in carrying out the requirements of this part1 the ,secretary may take any other actions that the ,secretary determines to be necessary or appropriate1 including prescribing new regulations1 amending regulations1 publishing any notices in the ,federal ,register 7including with respect to mitigation measures and prohibitions imposed under section #aghe;,b71 issuing guidance1 establishing procedures1 revoking or amending authorizations1 and terminating or amending any determination4 #aghe;,h4 ,annual reports ,not later than #ahj days after the date of the enactment of this part1 and annually thereafter1 the head of the ,office of ,information and ,communications ,technology and ,services shall submit to the appropriate congressional committees a report on actions taken to carry out this part during the one-year period preceding submission of the report4 #aghe;,i4 ,termination ,the prohibition under section #aghe;,a7a7 and the requirements of and authorities provided by this part terminate on the date that is #e years after the date of the enactment of this part4 4 7b7 ,conforming amendment ,section #agdb7ac77;,a7 of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhja7ac77;,a77 is amended1 in the matter preceding clause 7i71 by striking part ,i and inserting parts ,i and ,,iv4