Bipartisan Senate bill targets supply chain threats from foreign adversaries

The bill would strengthen oversight powers for the body charged with investigating IT products from China and other foes.

An interagency federal council charged with securing the government’s IT supply chain would get stronger oversight powers under new legislation from a bipartisan pair of Senate lawmakers.

The Federal Acquisition Security Council Improvement Act from Sens. Gary Peters, D-Mich., and Mike Rounds, R-S.D., is aimed at better combatting security threats posed by technology products made by companies with ties to foreign adversaries, most notably China. 

“Our foreign adversaries will take every opportunity to exploit the vulnerabilities in our supply chain for their own advantage, and that includes through the communications and cybersecurity technologies our federal government purchases,” Peters said in a press release Tuesday. “This bipartisan bill will help improve the security of our supply chain and ensure our nation’s critical information technology is better protected against potential threats.”

Said Rounds: “Protecting our federal supply chain is a matter of national security. This legislation equips the Federal Acquisition Security Council with the tools it needs to eliminate the risk posed by foreign adversaries like China who seek to infiltrate our critical infrastructure.”

The legislation would shift leadership authorities of the Federal Acquisition Security Council from the Office of Management and Budget to the Office of the National Cyber Director, which Peters and Rounds said made sense given ONCD’s capabilities in addressing security threats to the U.S. IT and communications supply chain. ONCD and the State Department would also be added to the FASC membership roster under the legislation, a companion to a bipartisan House bill introduced in September.

Since its creation six years ago, the FASC hasn’t yet delivered an order blocking the use of a technology that could threaten national security. The new bill aims to change that, laying out a process in the bill for how Congress can require the revamped council to probe potential areas of concern that lawmakers believe may pose threats to national security. 

If the FASC discovers security concerns in investigations initiated by Congress, the council would then be able to order a ban on government purchases of that product or a ban on products from the company in question. Due to what Peters and Rounds characterized as inaction on the part of the FASC, Congress has previously issued bans on Huawei telecom equipment and Chinese-made semiconductors, and is currently working to prohibit connected vehicles manufactured in China from military bases and other places of concern. 

“This provision will create stronger congressional oversight over the FASC’s work to ensure it is tackling its mission of limiting foreign influence and addressing the threats posed by foreign-owned or controlled products or sources in the American supply chain,” the press release stated.  

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Election official says Tina Peters would be consultant, won’t have access to election systems