Blocking Foreign Cellular Modules in Defense Systems Act of 2026
- Sponsor
- Rep. Biggs, Sheri [R-SC-3]
- Committees
- Armed Services Committee (primary)
- Last action
- Oct 22, 2026
Bottom line
This bill aims to enhance national security by systematically removing potentially compromised cellular communication hardware from critical Department of Defense systems and supply chains.
What it actually does
This bill mandates the Department of Defense to conduct a comprehensive audit within 180 days to identify all "covered cellular modules" (those from entities linked to the People's Republic of China or deemed high-risk) present in its systems and infrastructure. Following the audit, it requires the Secretary of Defense to develop and implement mitigation measures, such as replacing or isolating these modules, and to report biennially to Congress on progress, costs, and any barriers encountered for a period not to exceed six years.
Proponents argue
Supporters argue that this bill is a critical step to safeguard national security by eliminating vulnerabilities posed by foreign-made cellular modules in sensitive defense systems. They contend that these modules could be exploited for espionage, sabotage, or data exfiltration, and proactive mitigation is essential to protect military operations, logistics, and intelligence. The bill provides a structured approach to identify and address these risks, ensuring the integrity of defense infrastructure.
Opponents contend
Critics might argue that while the intent is valid, the bill could impose significant financial and logistical burdens on the Department of Defense, potentially diverting resources from other critical defense priorities. They might also raise concerns about the feasibility and timeline of a comprehensive "rip-and-replace" program across a vast and complex defense ecosystem, suggesting that less disruptive cybersecurity controls might be more practical in some instances.
The bill is short and relatively straightforward, allowing an informed reader to understand its core directives within a short timeframe.
Section 2(a)(1)
Department-Wide Audit of Covered Cellular Modules
This provision directs the Secretary of Defense to initiate a comprehensive, Department-wide audit within 180 days of the bill's enactment. The purpose of this audit is to identify the presence of "covered cellular modules" within any infrastructure or system owned, leased, operated, or controlled by the Department of Defense. This ensures a systematic approach to uncovering potential vulnerabilities across the entire defense ecosystem.
Supporters argue
Supporters argue this audit is essential for identifying the full scope of the problem and understanding the national security risk before effective mitigation can begin. It ensures a comprehensive approach rather than piecemeal efforts.
Critics contend
Critics might contend that the audit itself could be resource-intensive and potentially disruptive to ongoing operations, possibly diverting personnel from other critical cybersecurity tasks. The broad scope might lead to identifying low-risk modules alongside high-risk ones, creating unnecessary work.
Tradeoffs
This provision balances the need for comprehensive risk identification against the immediate operational and resource costs of conducting a large-scale audit across a vast and complex organization.
Section 2(a)(2)
Scope and Prioritization of Audit
This section specifies the detailed requirements for the audit. It mandates coverage of all military departments, combatant commands, and defense agencies, while prioritizing systems critical to military mobility, logistics, and installation security. The audit must include both government-owned and contractor-operated systems, identify specific module details (manufacturer, model, firmware), and assess the cybersecurity risk, including data flows and potential for remote access.
Section 2(b)
Mitigation Measures and Biennial Reporting to Congress
This section requires the Secretary of Defense to submit an initial report within one year of enactment, and then biennially for six years, to the congressional defense committees. The report must detail audit findings and describe ongoing and planned mitigation strategies, which include "rip-and-replace" programs, accelerated divestiture of legacy assets, network segmentation, firmware remediation, and supply-chain substitution with trusted alternatives. The report must also include cost estimates, timelines, resource requirements, and identify any statutory or acquisition barriers to completing mitigation, along with recommendations for additional legislative authorities.
Section 2(d)(3)
Definition of Covered Cellular Module
This provision defines a "covered cellular module" as any cellular module produced, manufactured, or provided by entities identified under Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (which includes specific Chinese telecommunications companies), any entity owned by, controlled by, or subject to the jurisdiction or direction of the People's Republic of China, or any other entity the Secretary of Defense determines to present an unacceptable supply-chain risk. This definition is central to determining which modules are subject to the audit and mitigation.
The definition of "covered cellular module" relies on Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115-232; 41 U.S.C. 3901 note prec.).
Section 2(d)(3)(A)
Why it matters:This is standard legislative practice to avoid re-listing extensive details already codified elsewhere, ensuring consistency with existing law and reducing redundancy in the bill text.
Case for: Referencing Section 889 ensures the bill leverages existing, established legal frameworks for identifying high-risk foreign technology, providing continuity and avoiding redundant definitions. This streamlines the legislative process and reinforces existing national security measures.
Case against: Requiring external research for full comprehension makes the bill less self-contained and potentially harder for a casual reader or non-legal expert to fully grasp its implications without consulting additional legal texts.
Estimated impact: This reference significantly narrows the scope of "covered cellular modules" to specific, already-identified high-risk vendors, primarily from China, impacting their ability to supply the Department of Defense.
The definition of "Internet of things device" refers to NIST Special Publication 1800-16.
Section 2(d)(5)
Why it matters:This is standard practice to rely on established technical definitions from expert bodies, ensuring the bill's scope aligns with industry and cybersecurity best practices and avoids creating new, potentially conflicting definitions.
Case for: Provides a clear, technically sound, and widely accepted definition for IoT devices, avoiding ambiguity and ensuring the audit covers the intended range of connected systems as understood by cybersecurity professionals.
Case against: Requires external technical knowledge to fully understand the precise scope of "Internet of things device" as it pertains to the audit, potentially making the bill less accessible to a general audience.
Estimated impact: Clarifies the broad range of devices that might contain cellular modules and fall under the audit's purview, from various sensors to vehicles and other connected infrastructure within the DoD.