H.R. 1709: Understanding Cybersecurity of Mobile Networks Act

This bill, known as the Understanding Cybersecurity of Mobile Networks Act, aims to improve the understanding of cybersecurity issues related to mobile service networks in the United States. Here’s a more detailed summary of what the bill entails:

Report Requirement

Within one year of the bill becoming law, the Assistant Secretary of Commerce for Communications and Information must prepare and submit a report to specific congressional committees that examines:

• The overall cybersecurity of mobile service networks.
• The vulnerabilities of these networks and associated mobile devices to cyberattacks and surveillance by adversaries.

Key Contents of the Report

The report is required to include several specific items:

1. An assessment of how well mobile service providers have addressed cybersecurity vulnerabilities identified by various entities, including:
   • Academic and independent researchers.
   • Industry standards organizations.
   • Relevant federal agencies like the National Telecommunications and Information Administration.
   • The National Institute of Standards and Technology.
   • The Department of Homeland Security.
2. A discussion on how much customers, including individuals and businesses, consider cybersecurity when choosing mobile services and devices, as well as the resources available to assist them in understanding cybersecurity risks.
3. An evaluation of how mobile service providers implement cybersecurity best practices and risk assessment frameworks.
4. An estimate of the prevalence and effectiveness of encryption and authentication techniques in mobile services, devices, operating systems, and applications.
5. Barriers that mobile service providers face in adopting effective encryption and authentication methods and eliminating the use of outdated technologies.
6. An estimate of technologies available that authenticate legitimate mobile services and equipment.
7. A discussion of technologies used by adversaries for mobile service surveillance, such as cell site simulators.

Consultation Process

In preparing the report, the Assistant Secretary is encouraged to consult with a range of stakeholders, including:

• The Federal Communications Commission.
• The National Institute of Standards and Technology.
• The intelligence community.
• The Cybersecurity and Infrastructure Security Agency.
• Industry representatives, including those from smaller or rural mobile service providers.
• Experts in various technological and cybersecurity fields.

Scope Limitations

The report will focus solely on mobile service networks and will explicitly exclude 5G protocols from consideration. It will assess vulnerabilities that have demonstrated real-world exploitation or have the potential for practical exploitation.

Report Format

The report will be published in a generally unclassified format but may contain a classified annex for sensitive information. Certain unclassified details that could expose vulnerabilities will be redacted from the public report.

Definitions

Definitions provided in the bill clarify terms used throughout, such as:

• Adversary: Refers to unauthorized hackers and foreign entities posing risks to national security.
• Mobile service: Encompasses commercial mobile services provided to customers in the United States.

Responsibilities

The Assistant Secretary is tasked with ensuring the report adheres to the above guidelines and sufficiently covers the essential areas of concern regarding mobile network cybersecurity.

Relevant Companies

• VZ (Verizon Communications Inc.): As a major mobile service provider, Verizon would need to address the vulnerabilities identified and report findings to comply with the bill’s research requirements.
• T (AT&T Inc.): Similar to Verizon, AT&T may be impacted by the need to enhance its cybersecurity measures in response to findings from the report.
• S (Sprint Corporation): Although Sprint is now part of T-Mobile, previous corporate practices might still be under scrutiny regarding mobile network security vulnerabilities.