Securing Federal Devices from Chinese Applications Act

A covered application may not be downloaded or used on a Federal Government device, unless the head of an agency determines that such use is for ensuring appropriate and controlled access to fulfill a research or intelligence function required by law.

Not later than 270 days after the date of the enactment of this section, the head of each agency shall issue guidance with respect to an exception made under subsection (a)—

(1) that ensures safeguards for cybersecurity; and

(2) that includes requirements for the development and documentation of risk mitigation actions for such exception.

Not later than 180 days after the date of the enactment of this section, and every 180 days thereafter, the Director of the Office of Management and Budget, in consultation with the Secretary of Homeland Security, the Secretary of Defense, and the Director of National Intelligence, shall issue guidance on how the list of covered applications will be created and periodically updated.

The head of each agency shall ensure that a covered application is removed from a Federal device within 60 days after the date on which the application is identified as a covered application pursuant to subsection (c).

In this section:

The term agency —

(A) means any Executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Federal Government (including the Executive Office of the President), or any independent regulatory agency; and

(B) does not include the governments of the District of Columbia and of the territories and possessions of the United States, and their various subdivisions.

The term covered application includes an application that is—

(A) developed, owned, or controlled by—

(i) an entity headquartered in the People’s Republic of China;

(ii) an entity in which the government of the People’s Republic of China, the Chinese Communist Party, or a person acting on their behalf, holds a controlling interest; or

(iii) a parent, subsidiary, or affiliate of such an entity; or

(B) determined by the Secretary of Defense to pose an undue risk to the national security of the United States due to ownership, control, or influence by the People’s Republic of China.

The term cybersecurity means the prevention of damage to, unauthorized use of, exploitation of, and, if needed, the restoration of electronic information and communications systems, and the information the systems contain, in order to strengthen the confidentiality, integrity, and availability of the systems.