PROTECT the Grid Act
- Sponsor
- Rep. Crenshaw, Dan [R-TX-2]
- Committees
- Homeland Security Committee (primary)
- Last action
- Jan 23, 2026
Bottom line
The PROTECT the Grid Act aims to safeguard the U.S. electric grid from potential manipulation by foreign adversaries through smart home devices and applications by mandating a risk assessment and solidifying existing executive authority.
What it actually does
This bill directs the Secretary of Commerce to submit a report assessing national security risks to the U.S. electric grid from Internet-connected devices and applications controlled by foreign adversaries. It also codifies Executive Order 13873, which grants the Commerce Secretary authority to prohibit or mitigate transactions involving information and communications technology and services (ICTS) that pose undue risks to national security or critical infrastructure.
Proponents argue
Proponents argue that the rapid proliferation of high-wattage IoT devices, coupled with foreign adversary control over associated applications and data, creates a significant vulnerability for large-scale, coordinated manipulation of power demand, potentially leading to grid instability and blackouts. They contend that codifying Executive Order 13873 provides a necessary and permanent legal framework to address these critical national security threats.
Opponents contend
No explicit opposition is stated within the bill text. However, potential opponents might argue that the measures could lead to unnecessary trade restrictions, limit consumer choice, or impose undue burdens on manufacturers and importers without clear evidence of imminent threats. Concerns could also be raised about the broad authority granted to the Commerce Secretary under the codified Executive Order.
The bill is concise and relatively straightforward, allowing for a quick and informed read to understand its core provisions and implications.
Section 1
Short Title
This section establishes the official short title of the Act as the 'Preventing Remote Operations by Threatening Entities on Critical Technology for the Grid Act,' or the 'PROTECT the Grid Act.' This provides a common, easily referencable name for the legislation.
Supporters argue
Supporters argue that a clear and memorable short title helps communicate the bill's purpose and facilitates public and legislative discussion.
Critics contend
No specific opposition is typically raised against this provision as it is standard legislative practice.
Tradeoffs
None inherent in establishing a short title.
Section 2
Congressional Findings and Purposes
This section outlines Congress's findings regarding the national security risks posed by high-wattage Internet of Things (IoT) devices and applications controlled by foreign adversaries, particularly the People's Republic of China. It highlights the potential for these devices to be leveraged for coordinated manipulation of power demand, threatening electric grid stability. The section also states the bill's purposes: to harmonize existing national security initiatives and direct the Secretary of Commerce to report on these vulnerabilities.
Section 3
Key Definitions
This section defines critical terms used throughout the Act, such as 'consumer product,' 'covered entity' (an entity subject to or operating on behalf of a foreign adversary), 'critical infrastructure,' 'foreign adversary' (referencing 10 U.S.C. 4872(f) for 'covered nation'), 'foreign adversary-controlled application,' 'high-wattage IoT device' (exceeding 500 watts), 'IoT,' and 'relevant Federal official.' These definitions establish the precise scope and targets of the bill's provisions.
Section 4
Report on National Security Risks Posed by Foreign Adversary-Controlled Applications
This section directs the Secretary of Commerce, in coordination with other relevant Federal officials, to submit a report to Congress within 270 days. The report must assess national security risks associated with foreign adversary-controlled applications that can control high-wattage IoT devices and undermine U.S. critical infrastructure. It requires consideration of IoT device deployment, risks to the electric grid, national security impacts, and public input. The report must also include recommendations for mitigation measures, such as applying Executive Order 13873 to IoT devices, restricting Federal procurement of consumer products with such applications, and implementing certification or labeling requirements.
Section 5
Codification of Executive Order 13873
This section enacts Executive Order 13873, titled 'Securing the Information and Communications Technology and Services Supply Chain,' into law. This Executive Order grants the Secretary of Commerce broad authority to review, prohibit, or mitigate transactions involving ICTS that pose an undue risk to U.S. national security, critical infrastructure, or the digital economy. Codifying it makes these authorities permanent statutory law, rather than relying on executive action. The Archivist of the United States is directed to include the text of the Executive Order as an appendix to the Act.
The definition of 'foreign adversary' is not self-contained but refers to 'any covered nation (as defined in section 4872(f) of title 10, United States Code)'.
Section 3(4)
Why it matters:This is standard legislative practice to avoid redundancy and ensure consistency with existing legal definitions across different statutes.
Case for: Using an existing, established definition ensures legal consistency and avoids creating conflicting interpretations of 'foreign adversary' across different federal laws.
Case against: For a casual reader, this requires an additional step to fully grasp the scope of the bill, potentially obscuring the specific nations being targeted.
Estimated impact: The referenced statute (10 U.S.C. 4872(f)) currently defines 'covered nation' to include the People's Republic of China, the Russian Federation, the Islamic Republic of Iran, and the Democratic People's Republic of Korea (North Korea). This directly determines the geopolitical scope of the bill's concerns.
The definition of 'foreign adversary-controlled application' includes control 'directly or indirectly (including through a parent, subsidiary, or affiliate (as those terms are defined in section 230.405 of title 17, Code of Federal Regulations (as in effect on the date of enactment of this Act))).'
Section 3(5)
Why it matters:This is likely intended to provide a comprehensive and legally robust definition of control that captures various corporate structures, preventing evasion through indirect ownership or influence. It leverages an existing, well-understood legal definition from a different regulatory domain.
Case for: This broad definition of 'control' is crucial for preventing foreign adversaries from circumventing restrictions through complex corporate structures or indirect influence, ensuring the bill's intent is not easily undermined.
Case against: The reliance on a securities regulation definition for national security purposes might be seen as overly broad or potentially confusing for entities not typically engaged in securities markets, leading to compliance challenges.
Estimated impact: This provision significantly expands the scope of entities considered 'foreign adversary-controlled,' potentially including a wider range of companies and applications than a simpler definition of direct ownership would capture.
The findings explicitly mention 'several academic studies from researchers at Princeton University, the Georgia Institute of Technology, and the University of California, Santa Cruz, point to significant risks of manipulation of demand via IoT (commonly referred to as 'MaDIoT') attacks to manipulate power demand on the electric grid that could result in large-scale blackouts and potential damage to the electric grid.'
Section 2(a)(9)
Why it matters:It serves to provide a strong, evidence-based foundation for the bill's premise, demonstrating that the concerns are not merely speculative but are supported by scientific research. It's placed in findings to establish legislative intent and justification.
Case for: Citing specific academic research lends significant credibility to the bill's underlying concerns about grid vulnerabilities and the potential for MaDIoT attacks, strengthening the argument for legislative action.
Case against: No direct case against citing academic research, but some might argue that the specific studies or their interpretations could be debated, or that the findings section is not the place for such detailed technical references.
Estimated impact: This reference provides the core technical rationale for the bill's focus on high-wattage IoT devices and their potential for grid manipulation, influencing the direction of the mandated Commerce report.