Twelve US senators introduced bipartisan legislation on Tuesday to address what they see as an ongoing sabotage and privacy threat posed by technology from foreign adversaries such as China and Russia over apps such as the wildly popular video-sharing app TikTok and others.
The RESTRICT (Restricting the Emergence of Security Threats that Risk Information and Communications Technology) Act would give the Department of Commerce the power to review, prevent and mitigate information communications and technology transactions, including imports, purchases and software updates, that pose “undue risk” in order to protect the US supply chain.
Undue risk is defined in the 55-page bill as posing an unacceptable risk of “sabotage or subversion of the design, integrity, manufacturing, production, distribution, installation, operation or maintenance of information and communications technology and services in the US.” Such subversion could disrupt critical infrastructure or federal elections or steer policies in favor of the strategic objectives of foreign adversaries, the bill adds.
Primary sponsors of the act are US Senators Mark Warner, D-Virginia, chair of the Senate Select Committee on Intelligence, and John Thune, R-South Dakota, ranking member of the Commerce Committee’s Subcommittee on Communications, Media and Broadband.
The senators noted that similar to prior concerns over networking products from Huawei and ZTE, the US government is now concerned with ByteDance’s TikTok, Tencent’s WeChat and Alibaba’s Alipay as well as other software and hardware from companies and operators inside adversary countries. The legislation seeks to create consistency in how the US identifies threats and takes action on them. The White House on Feb. 27 already set a 30-day deadline for federal agencies to purge TikTok from federal devices and systems, following the shooting down of a suspected spy balloon from China.
Immediately on introduction of the act, the White House issued a statement of support from National Security Advisory Jake Sullivan.
In the past, efforts to address identified risks have been disjointed and have failed to comprehensively address the risks or have been slow to meet the fast-paced demands of the interconnections in the tech supply chain, the senators said. In recent years, China-based Huawei faced US sanctions under the Trump administration preventing sales of its networking products in the US partly based on concerns that the Chinese Communist Party could gather data from its servers installed in companies and government sites, a charge Huawei has denied.
The RESTRICT Act would require the Commerce Secretary to establish procedures to identify, deter, disrupt, prevent, prohibit and mitigate transactions involving information and communications tech products in which any foreign adversary has an interest and poses undue or unacceptable risk to national security. Foreign adversaries listed in the 55-page bill include the People’s Republic of China, the Republic of Cuba, the Islamic Republic of Iran, the Democratic People’s Republic of Korea, the Russian Federation, and the Bolivarian Republic of Venezuela under the regime of Nocolas Maduro Moros.
The act would also education the public and businesses about threats by requiring the Commerce Secretary to coordinate with the Director of National Intelligence to provide declassified information on how transactions denied or otherwise mitigated had posed undue or unacceptable risk.
Warner said in a press briefing carried over Youtube that the coordination with the intelligence community is essential. "It's incumbent on the US government to show its cards as to how [an application] is a threat," he said. In the case of Huawei, equipment was ripped and replaced after the security threat became known and the intelligence community wasn't "forthcoming enough early on."
Senators said TikTok reaches 100 million Americans and is widely popular among young people but potentially exposes personal data to misuse and attack. "We;re not decrying everything on TikTok is somehow bad. It's not, but there's potential for that data ending up in China," Warner added.
The act would create a rules-based approach for establishing which apps, software and hardware pose undue risks, taking a broader approach than has been possible with reviews by the FCC or CFIUS (the Committee on Foreign Investment in the US), The current federal approach has been ad hoc and more "Whac-A-Mole," several senators said.
In one example the act is designed to address, the FCC was able to ban China Mobile from offering telcomm services in the US but the company could still offer cloud and business data services in the US.
Thune told reporters that the act offers a more systematic approach than what both Presidents Trump and Biden have employed.
Thune and other Republicans backing the measure said the issues of technology privacy are more urgent with China. "Congress recognizes the Chinese Community Party is not our friend," said co-sponsor Sen. Mitt Romney, R-Utah. "We face geopolitical adversaries that threaten the security and prosperity and freedoms we enjoy."
Several of the Senators noted that Beijing has banned TikTok in China and that other countries are considering bans. In addition to the potential for personal data on TikTok to be stolen or misused, the platform can be used as a propaganda tool, they said.