Sec. 4
Secure and Trusted Communications Networks Reimbursement Program
(a)
In general— The Commission shall establish a reimbursement program, to be known as the “Secure and Trusted Communications Networks Reimbursement Program”, to make reimbursements to providers of advanced communications service to replace covered communications equipment or services.
(b)
Eligibility— The Commission may not make a reimbursement under the Program to a provider of advanced communications service unless the provider—
(1)
has 2,000,000 or fewer customers; and
(2)
changed
makes all of the certifications required by subsection (d)(5).(d)(4).
(1)
In general— A recipient of a reimbursement under the Program shall use reimbursement funds solely for the purposes of—
(A)
permanently removing covered communications equipment or services purchased, rented, leased, or otherwise obtained before—
(i)
in the case of any covered communications equipment or services that are on the initial list published under section 2(a), August 14, 2018; or
(ii)
in the case of any covered communications equipment or services that are not on the initial list published under section 2(a), the date that is 60 days after the date on which the Commission places such equipment or services on the list required by such section;
(B)
replacing the covered communications equipment or services removed as described in subparagraph (A) with communications equipment or services that are not covered communications equipment or services; and
(C)
changed
disposing of the covered communications equipment or services removed as described in subparagraph (A) in accordance with the requirements under subsection (d)(8).(d)(7).
(2)
Limitations— A recipient of a reimbursement under the Program may not—
(A)
use reimbursement funds to remove, replace, or dispose of any covered communications equipment or service purchased, rented, leased, or otherwise obtained on or after—
(i)
in the case of any covered communications equipment or service that is on the initial list published under section 2(a), August 14, 2018; or
(ii)
in the case of any covered communications equipment or service that is not on the initial list published under section 2(a), the date that is 60 days after the date on which the Commission places such equipment or service on the list required by such section; or
(B)
purchase, rent, lease, or otherwise obtain any covered communications equipment or service, using reimbursement funds or any other funds (including funds derived from private sources).
(1)
added
Suggested replacements—
(A)
added
Development of list— The Commission shall develop a list of suggested replacements of both physical and virtual communications equipment, application and management software, and services or categories of replacements of both physical and virtual communications equipment, application and management software and services.
(1)
removed
Regulations— Not later than 270 days after the date of the enactment of this Act, the Commission shall promulgate regulations to implement the Program.
(2)
removed
Suggested replacements—
(A)
removed
Development of list— The Commission shall develop a list of suggested replacements of both physical and virtual communications equipment, application and management software, and services.
(B)
renumbered
was (5)(3)(3)
Neutrality— The list developed under subparagraph (A) shall be technology neutral and may not advantage the use of reimbursement funds for capital expenditures over operational expenditures, to the extent that the Commission determines that communications services can serve as an adequate substitute for the installation of communications equipment.
(2)
added
Application process—
(3)
removed
Application process—
(A)
renumbered
was (5)(4)(2)
In general— The Commission shall develop an application process and related forms and materials for the Program.
(B)
removed
Cost estimate—
(i)
renumbered
was (5)(4)(3)(2)
Initial estimate— The Commission shall require an applicant to provide an initial reimbursement cost estimate at the time of application, with supporting materials substantiating the costs.
(ii)
renumbered
was (5)(4)(3)(3)
Updates— During and after the application review process, the Commission may require an applicant to—
(I)
renumbered
was (5)(4)(3)(3)(3)
update the initial reimbursement cost estimate submitted under clause (i); and
(II)
renumbered
was (5)(4)(3)(3)(4)
submit additional supporting materials substantiating an updated cost estimate submitted under subclause (I).
(C)
renumbered
was (5)(4)(4)
Mitigation of burden— In developing the application process under this paragraph, the Commission shall take reasonable steps to mitigate the administrative burdens and costs associated with the application process, while taking into account the need to avoid waste, fraud, and abuse in the Program.
(3)
added
Application review process—
(4)
removed
Application review process—
(i)
renumbered
was (5)(5)(2)(2)
In general— Except as provided in clause (ii) and subparagraph (B), the Commission shall approve or deny an application for a reimbursement under the Program not later than 90 days after the date of the submission of the application.
(ii)
renumbered
was (5)(5)(2)(3)
Additional time needed by Commission— If the Commission determines that, because an excessive number of applications have been filed at one time, the Commission needs additional time for employees of the Commission to process the applications, the Commission may extend the deadline described in clause (i) for not more than 45 days.
(B)
renumbered
was (5)(5)(3)
Opportunity for applicant to cure deficiency— If the Commission determines that an application is materially deficient (including by lacking an adequate cost estimate or adequate supporting materials), the Commission shall provide the applicant a 15-day period to cure the defect before denying the application. If such period would extend beyond the deadline under subparagraph (A) for approving or denying the application, such deadline shall be extended through the end of such period.
(C)
renumbered
was (5)(5)(4)
Effect of denial— Denial of an application for a reimbursement under the Program shall not preclude the applicant from resubmitting the application or submitting a new application for a reimbursement under the Program at a later date.
(4)
renumbered
was (5)(6)
Certifications— An applicant for a reimbursement under the Program shall, in the application of the applicant, certify to the Commission that—
(A)
renumbered
was (5)(6)(3)
as of the date of the submission of the application, the applicant—
(i)
renumbered
was (5)(6)(3)(2)
has developed a plan for—
(I)
renumbered
was (5)(6)(3)(2)(2)
the permanent removal and replacement of any covered communications equipment or services that are in the communications network of the applicant as of such date; and
(II)
added
the disposal of the equipment or services removed as described in subclause (I) in accordance with the requirements under paragraph (7); and
(ii)
added
has developed a specific timeline (subject to paragraph (6)) for the permanent removal, replacement, and disposal of the covered communications equipment or services identified under clause (i), which timeline shall be submitted to the Commission as part of the application; and
(II)
removed
the disposal of the equipment or services removed as described in subclause (I) in accordance with the requirements under paragraph (8); and
(ii)
removed
has developed a specific timeline (subject to paragraph (7)) for the permanent removal, replacement, and disposal of the covered communications equipment or services identified under clause (i), which timeline shall be submitted to the Commission as part of the application; and
(B)
renumbered
was (5)(6)(4)
beginning on the date of the approval of the application, the applicant—
(i)
renumbered
was (5)(6)(4)(2)
will not purchase, rent, lease, or otherwise obtain covered communications equipment or services, using reimbursement funds or any other funds (including funds derived from private sources); and
(ii)
renumbered
was (5)(6)(4)(3)
in developing and tailoring the risk management practices of the applicant, will consult and consider the standards, guidelines, and best practices set forth in the cybersecurity framework developed by the National Institute of Standards and Technology.
(5)
added
Distribution of reimbursement funds—
(6)
removed
Distribution of reimbursement funds—
(A)
renumbered
was (5)(7)(2)
In general— The Commission shall make reasonable efforts to ensure that reimbursement funds are distributed equitably among all applicants for reimbursements under the Program according to the needs of the applicants, as identified by the applications of the applicants.
(B)
added
Notification— If, at any time during the implementation of the Program, the Commission determines that $1,000,000,000 will not be sufficient to fully fund all approved applications for reimbursements under the Program, the Commission shall immediately notify—
(B)
removed
Notification— If, at any time during the implementation of the Program, the Commission determines that the funds made available to the Commission to carry out the Program will not be sufficient to fully fund all approved applications for reimbursements under the Program, the Commission shall immediately notify—
(i)
renumbered
was (5)(7)(3)(3)
the Committee on Energy and Commerce and the Committee on Appropriations of the House of Representatives; and
(ii)
renumbered
was (5)(7)(3)(4)
the Committee on Commerce, Science, and Transportation and the Committee on Appropriations of the Senate.
(6)
added
Removal, replacement, and disposal term—
(A)
added
Deadline— Except as provided in subparagraphs (B) and (C), the permanent removal, replacement, and disposal of any covered communications equipment or services identified under paragraph (4)(A)(i) shall be completed not later than 1 year after the date on which the Commission distributes reimbursement funds to the recipient.
(7)
removed
Removal, replacement, and disposal term—
(A)
removed
Deadline— The permanent removal, replacement, and disposal of any covered communications equipment or services identified under paragraph (5)(A)(i) shall be completed not later than 1 year after the date on which the Commission distributes reimbursement funds to the recipient.
(B)
renumbered
was (5)(8)(3)
General extension— The Commission may grant an extension of the deadline described in subparagraph (A) for 6 months to all recipients of reimbursements under the Program if the Commission—
(i)
renumbered
was (5)(8)(3)(3)
finds that the supply of replacement communications equipment or services needed by the recipients to achieve the purposes of the Program is inadequate to meet the needs of the recipients; and
(ii)
renumbered
was (5)(8)(3)(4)
provides notice and a detailed justification for granting the extension to—
(I)
renumbered
was (5)(8)(3)(4)(2)
the Committee on Energy and Commerce of the House of Representatives; and
(II)
renumbered
was (5)(8)(3)(4)(3)
the Committee on Commerce, Science, and Transportation of the Senate.
(C)
added
Individual extension—
(C)
removed
Individual extension—
(i)
renumbered
was (5)(8)(4)(2)
Petition— A recipient of a reimbursement under the Program may petition the Commission for an extension for such recipient of the deadline described in subparagraph (A) or, if the Commission has granted an extension of such deadline under subparagraph (B), such deadline as so extended.
(ii)
renumbered
was (5)(8)(4)(3)
Grant— The Commission may grant a petition filed under clause (i) by extending, for the recipient that filed the petition, the deadline described in subparagraph (A) or, if the Commission has granted an extension of such deadline under subparagraph (B), such deadline as so extended, for a period of not more than 6 months if the Commission finds that, due to no fault of such recipient, such recipient is unable to complete the permanent removal, replacement, and disposal described in subparagraph (A).
(7)
added
Disposal of covered communications equipment or services— The Commission shall include in the regulations promulgated under subsection (g) requirements for the disposal by a recipient of a reimbursement under the Program of covered communications equipment or services identified under paragraph (4)(A)(i) and removed from the network of the recipient in order to prevent such equipment or services from being used in the networks of providers of advanced communications service.
(8)
added
Status updates—
(A)
added
In general— Not less frequently than once every 90 days beginning on the date on which the Commission approves an application for a reimbursement under the Program, the recipient of the reimbursement shall submit to the Commission a status update on the work of the recipient to permanently remove, replace, and dispose of the covered communications equipment or services identified under paragraph (4)(A)(i).
(8)
removed
Disposal of covered communications equipment or services— The Commission shall include in the regulations promulgated under paragraph (1) requirements for the disposal by a recipient of a reimbursement under the Program of covered communications equipment or services identified under paragraph (5)(A)(i) and removed from the network of the recipient in order to prevent such equipment or services from being used in the networks of providers of advanced communications service.
(9)
removed
Status updates—
(A)
removed
In general— Not less frequently than once every 90 days beginning on the date on which the Commission approves an application for a reimbursement under the Program, the recipient of the reimbursement shall submit to the Commission a status update on the work of the recipient to permanently remove, replace, and dispose of the covered communications equipment or services identified under paragraph (5)(A)(i).
(B)
renumbered
was (5)(10)(3)
Public posting— Not earlier than 30 days after the date on which the Commission receives a status update under subparagraph (A), the Commission shall make such status update public on the website of the Commission.
(C)
renumbered
was (5)(10)(4)
Reports to Congress— Not less frequently than once every 180 days beginning on the date on which the Commission first makes funds available to a recipient of a reimbursement under the Program, the Commission shall prepare and submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report on—
(i)
renumbered
was (5)(10)(4)(3)
the implementation of the Program by the Commission; and
(ii)
added
the work by recipients of reimbursements under the Program to permanently remove, replace, and dispose of covered communications equipment or services identified under paragraph (4)(A)(i).
(ii)
removed
the work by recipients of reimbursements under the Program to permanently remove, replace, and dispose of covered communications equipment or services identified under paragraph (5)(A)(i).
(e)
changed
Measures to To avoid waste, fraud, and abuse—
(1)
In general— The Commission shall take all necessary steps to avoid waste, fraud, and abuse with respect to the Program.
(2)
Spending reports— The Commission shall require recipients of reimbursements under the Program to submit to the Commission on a regular basis reports regarding how reimbursement funds have been spent, including detailed accounting of the covered communications equipment or services permanently removed and disposed of, and the replacement equipment or services purchased, rented, leased, or otherwise obtained, using reimbursement funds.
(3)
Audits, reviews, and field investigations— The Commission shall conduct—
(A)
regular audits and reviews of reimbursements under the Program to confirm that recipients of such reimbursements are complying with this Act; and
(B)
changed
random field investigations to ensure that recipients of reimbursements under the Program are performing the work such recipients are required to perform under the commitments made in the applications of such recipients for reimbursements under the Program, including the permanent removal, replacement, and disposal of the covered communications equipment or services identified under subsection (d)(5)(A)(i).(d)(4)(A)(i).
(A)
In general— The Commission shall require a recipient of a reimbursement under the Program to submit to the Commission, in a form and at an appropriate time to be determined by the Commission, a certification stating that the recipient—
(i)
has fully complied with (or is in the process of complying with) all terms and conditions of the Program;
(ii)
has fully complied with (or is in the process of complying with) the commitments made in the application of the recipient for the reimbursement;
(iii)
has permanently removed from the communications network of the recipient, replaced, and disposed of (or is in the process of permanently removing, replacing, and disposing of) all covered communications equipment or services that were in the network of the recipient as of the date of the submission of the application of the recipient for the reimbursement; and
(iv)
changed
has fully complied with (or is in the process of complying with) the timeline submitted by the recipient under subparagraph (A)(ii) of paragraph (5) (4) of subsection (d) and the other requirements of such paragraph.
(B)
Updated certification— If, at the time when a recipient of a reimbursement under the Program submits a certification under subparagraph (A), the recipient has not fully complied as described in clause (i), (ii), or (iv) of such subparagraph or has not completed the permanent removal, replacement, and disposal described in clause (iii) of such subparagraph, the Commission shall require the recipient to file an updated certification when the recipient has fully complied as described in such clause (i), (ii), or (iv) or completed such permanent removal, replacement, and disposal.
(f)
Effect of removal of equipment or service from list—
(1)
In general— If, after the date on which a recipient of a reimbursement under the Program submits the application for the reimbursement, any covered communications equipment or service that is in the network of the recipient as of such date is removed from the list published under section 2(a), the recipient may—
(A)
return to the Commission any reimbursement funds received for the removal, replacement, and disposal of such equipment or service and be released from any requirement under this section to remove, replace, or dispose of such equipment or service; or
(B)
retain any reimbursement funds received for the removal, replacement, and disposal of such equipment or service and remain subject to the requirements of this section to remove, replace, and dispose of such equipment or service as if such equipment or service continued to be on the list published under section 2(a).
(2)
Assurances— In the case of an assurance relating to the removal, replacement, or disposal of any equipment or service with respect to which the recipient returns to the Commission reimbursement funds under paragraph (1)(A), such assurance may be satisfied by making an assurance that such funds have been returned.
(1)
added
Commencement— Not later than 90 days after the date of the enactment of this Act, the Commission shall commence a rulemaking to implement this section.
(2)
added
Completion— The Commission shall complete the rulemaking under paragraph (1) not later than 1 year after the date of the enactment of this Act.
(h)
renumbered
was (8)
Rule of construction regarding timing of reimbursement— Nothing in this section shall be construed to prohibit the Commission from making a reimbursement under the Program to a provider of advanced communications service before the provider incurs the cost of the permanent removal, replacement, and disposal of the covered communications equipment or service for which the application of the provider has been approved under this section.
(i)
renumbered
was (9)
Education efforts— The Commission shall engage in education efforts with providers of advanced communications service to—
(1)
renumbered
was (9)(3)
encourage such providers to participate in the Program; and
(2)
renumbered
was (9)(4)
assist such providers in submitting applications for the Program.
(j)
renumbered
was (10)
Separate from Federal universal service programs— The Program shall be separate from any Federal universal service program established under section 254 of the Communications Act of 1934 (47 U.S.C. 254).
(j)
removed
Authorization of Appropriations— There is authorized to be appropriated to the Commission $1,000,000,000 for fiscal year 2020 to carry out the Program. Such amount is authorized to remain available through fiscal year 2029. Not more than $5,000,000 of the amounts appropriated under this subsection may be used for the administrative costs of carrying out the Program.
Sec. 8
NTIA program for preventing future vulnerabilities
added
(a)
added
Future vulnerability program—
(1)
added
Establishment— Not later than 120 days after the date of the enactment of this Act, including an opportunity for notice and comment, the Assistant Secretary, in cooperation with the Director of National Intelligence, the Director of the Federal Bureau of Investigation, the Secretary of Homeland Security, and the Commission, shall establish a program to share information regarding supply chain security risks with trusted providers of advanced communications service and trusted suppliers of communications equipment or services.
(2)
added
Activities— In carrying out the program established under paragraph (1), the Assistant Secretary shall—
(A)
added
conduct regular briefings and other events to share information with trusted providers of advanced communications service and trusted suppliers of communications equipment or services;
(B)
added
engage with trusted providers of advanced communications service and trusted suppliers of communications equipment or services, in particular such providers and suppliers that—
(i)
added
are small businesses; or
(ii)
added
primarily serve rural areas;
(C)
added
not later than 180 days after the date of the enactment of this Act, submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a plan for—
(i)
added
declassifying material, when feasible, to help share information regarding supply chain security risks with trusted providers of advanced communications service and trusted suppliers of communications equipment or services; and
(ii)
added
expediting and expanding the provision of security clearances to facilitate information sharing regarding supply chain security risks with trusted providers of advanced communications service and trusted suppliers of communications equipment or services; and
(D)
added
ensure that the activities carried out through the program are consistent with and, to the extent practicable, integrated with, ongoing activities of the Department of Homeland Security and the Department of Commerce.
(3)
added
Scope of program— The program established under paragraph (1) shall involve only the sharing of information regarding supply chain security risks by the Federal Government to trusted providers of advanced communications service and trusted suppliers of communications equipment or services, and not the sharing of such information by such providers and suppliers to the Federal Government.
(b)
added
Representation on CSRIC of interests of public and consumers—
(1)
added
In general— The Commission shall appoint to the Communications Security, Reliability, and Interoperability Council (or any successor thereof), and to each subcommittee, workgroup, or other subdivision of the Council (or any such successor), at least one member to represent the interests of the public and consumers.
(2)
added
Initial appointments— The Commission shall make the initial appointments required by paragraph (1) not later than 180 days after the date of the enactment of this Act. Any member so appointed shall be in addition to the members of the Council, or the members of the subdivision of the Council to which the appointment is being made, as the case may be, as of the date of the enactment of this Act.
(c)
added
Definitions— In this section:
(1)
added
Assistant Secretary— The term Assistant Secretary means the Assistant Secretary of Commerce for Communications and Information.
(2)
added
Foreign adversary— The term foreign adversary means any foreign government or foreign nongovernment person engaged in a long-term pattern or serious instances of conduct significantly adverse to the national security of the United States or security and safety of United States persons.
(3)
added
Supply chain security risk— The term supply chain security risk includes specific risk and vulnerability information related to equipment and software.
(4)
added
Trusted— The term trusted means, with respect to a provider of advanced communications service or a supplier of communications equipment or service, that the Assistant Secretary has determined that such provider or supplier is not owned by, controlled by, or subject to the influence of a foreign adversary.