Chip Security Act
- Sponsor
- Sen. Cotton, Tom [R-AR]
- Committees
- Banking, Housing, and Urban Affairs Committee (primary)
- Last action
- May 8, 2025
Bottom line
This bill aims to enhance U.S. national security and export control compliance by embedding mandatory security features into advanced microchips to prevent unauthorized use and diversion.
What it actually does
This bill mandates the Secretary of Commerce to establish standards requiring advanced integrated circuit products to be outfitted with chip security mechanisms, including location verification, before export. It also requires license holders to report unauthorized use or tampering and directs the Secretary to assess and potentially implement additional security measures, with ongoing review of new technologies.
Proponents argue
Proponents argue that this bill is crucial for protecting U.S. technological leadership and national security by preventing advanced computing hardware from falling into the wrong hands. They believe it will strengthen export controls, foster goodwill with allies by providing secure technology, and potentially allow for more flexible export policies by improving detection of illicit activities.
Opponents contend
No specific opposition arguments are detailed within the provided bill text. Potential concerns, if raised, might include increased costs for manufacturers, technical feasibility challenges, or potential impacts on product performance.
The bill is concise and its core provisions are understandable, making it accessible for a quick review.
Section 4(a)(1)
Mandatory Location Verification for Exported Chips
This provision requires the Secretary of Commerce to mandate that all covered advanced integrated circuit products include chip security mechanisms capable of location verification. This must be implemented within 180 days of the Act's enactment, applying to products exported, reexported, or transferred within a foreign country.
Supporters argue
Supporters argue this is a critical first step to secure advanced U.S. technology, ensuring that chips exported to allies and partners are not diverted or exploited by adversaries, thereby bolstering national security and foreign policy objectives.
Critics contend
No specific opposition is typically raised against the concept of securing sensitive technology, but concerns could arise regarding the technical feasibility, cost burden on manufacturers, or potential impact on product performance.
Tradeoffs
Balances national security interests with potential impacts on manufacturing costs and product design flexibility.
Section 4(a)(2)
Mandatory Reporting of Unauthorized Chip Activity
This provision requires any person authorized to export, reexport, or transfer a covered integrated circuit product to promptly report to the Under Secretary of Industry and Security if they obtain credible information that the product is in an unauthorized location, used by an unauthorized user, or has been tampered with, including attempts to circumvent security mechanisms.
Section 4(b)
Assessment and Implementation of Advanced Chip Security
This section mandates the Secretary of Commerce, in coordination with the Secretary of Defense, to conduct an assessment within one year to identify additional chip security mechanisms beyond location verification. This assessment will examine methods to prevent tampering, verify workloads, modify illicitly acquired products, and monitor smuggling. If deemed appropriate, these secondary mechanisms will be required for covered products within two years after the assessment's completion, with a priority on confidentiality.
Section 4(d)
Ongoing Review of Emerging Chip Security Technologies
Beginning two years after enactment and annually for three years thereafter, the Secretary of Commerce, in coordination with the Secretary of Defense, must assess new chip security mechanisms developed in the preceding year. A report summarizing these findings, evaluating whether new mechanisms should replace or supplement existing requirements, and recommending modifications to export controls for products with enhanced security, must be submitted to Congress.
Defines the specific types of integrated circuits and computing products subject to the Act's security requirements, primarily referencing Export Control Classification Numbers (ECCNs) 3A090, 3A001.z, 4A090, and 4A003.z, or their successors.
Section 3(3)
Why it matters:Standard legislative practice to define terms upfront, but the technical nature of ECCNs makes its full implications less immediately obvious.
Case for: Supporters argue that using established ECCNs provides clarity and aligns the Act with existing export control frameworks, ensuring that the most sensitive and advanced technologies are targeted.
Case against: Critics might argue that relying on specific ECCNs could lead to a narrow interpretation that might not adapt quickly enough to new technological developments or could inadvertently exclude critical emerging technologies.
Estimated impact: This definition determines the entire scope of the bill's application, affecting potentially billions of dollars in advanced chip exports annually.
States that in implementing requirements for secondary chip security mechanisms, the Secretary 'shall prioritize confidentiality.'
Section 4(b)(3)(B)
Why it matters:Could be seen as standard legislative language to address privacy concerns, but its placement might suggest it's a secondary consideration rather than a primary one.
Case for: Proponents would argue this demonstrates a commitment to protecting user data and intellectual property while implementing security measures, addressing potential concerns about surveillance or data leakage.
Case against: Critics might argue that 'prioritize confidentiality' is vague and lacks specific enforcement mechanisms, potentially leaving room for interpretations that could compromise privacy or make security less effective.
Estimated impact: Could significantly influence the design and data handling protocols of future advanced chip security systems, affecting privacy for potentially millions of users globally.