H.R. 10861: Blocking Foreign Cellular Modules in Defense Systems Act of 2026

This bill would require the Department of Defense to look for certain cellular communication modules in its systems and then take steps to reduce any security risk they pose.

What the bill covers

The bill focuses on covered cellular modules, meaning cellular components used in devices or equipment that provide cellular connectivity, including internet-connected devices. A module is considered “covered” if it is made or supplied by:

• an entity already covered by Section 889 restrictions,
• an entity owned by, controlled by, or subject to the jurisdiction or direction of the People’s Republic of China, or
• any other entity the Secretary of Defense decides poses an unacceptable supply-chain risk.

The bill applies to any covered system, which means DoD-owned, leased, operated, or controlled infrastructure.

Required audit

Within 180 days after enactment, the Secretary of Defense would have to start a department-wide audit to find where these covered cellular modules are used. The audit would cover:

• all military departments, combatant commands, defense agencies, and other DoD programs or activities;
• systems important to military mobility, logistics, and installation security first; and
• both government-owned and contractor-operated systems that connect to DoD networks or access DoD information.

The audit would also try to identify, where possible, the manufacturer, model, firmware version, and host product for each module, and evaluate the cybersecurity risk, including data exposure, network exposure, and possible remote access.

Mitigation and reporting

Within 1 year after enactment, and then every 2 years for up to 6 years, the Secretary of Defense would have to submit a report to the congressional defense committees. That report would include:

• the audit findings;
• steps being taken or planned to reduce risk;
• cost estimates, timelines, and resource needs;
• any legal, regulatory, or procurement barriers to fixing the problem; and
• any additional authority Congress may need to provide.

The report would generally be unclassified, though it could include a classified annex.

Types of mitigation the bill contemplates

The bill specifically mentions several possible ways the Defense Department could address any problematic modules, including:

• removing and replacing the hardware;
• retiring older equipment sooner;
• segregating or isolating networks and using other cybersecurity controls;
• fixing firmware or software; and
• substituting trusted suppliers in the supply chain.

Oversight

The Government Accountability Office would have to review how the Defense Department carries out these efforts and how effective they are. That report would be due within 180 days after the Defense Department submits its own report.

Relevant Companies

• HON - Honeywell International could be affected if Defense Department systems using Honeywell-supplied connected hardware or modules need to be audited, replaced, or redesigned.
• BA - Boeing may be affected if DoD platforms or infrastructure using connected components in Boeing products require replacement or mitigation.
• LMT - Lockheed Martin could be impacted if DoD systems in its supply chain or integrated platforms need approved alternative cellular modules or remediation.
• NOC - Northrop Grumman may be affected through DoD contracts involving networked defense systems that need component audits or substitutions.
• RTX - RTX could be impacted if any connected defense hardware or embedded communications components in its products fall under the audit and mitigation process.
• ERIC - Ericsson could be affected if its cellular modules or related connectivity hardware used in defense systems are identified as covered modules.
• NOK - Nokia could be impacted if DoD systems use its cellular connectivity modules or related components that need to be reviewed or replaced.