Blocking Foreign Cellular Modules in Defense Systems Act of 2026
- Sponsor
- Sen. Banks, Jim [R-IN]
- Committees
- Armed Services Committee (primary)
- Last action
- Sep 29, 2026
Bottom line
The bill requires the DoD to identify and remove cellular components from its systems that pose a national security risk due to their origin in adversarial countries, particularly China.
What it actually does
This bill mandates the Department of Defense (DoD) to conduct a comprehensive audit within 180 days to identify all 'covered cellular modules' in its systems and infrastructure. These modules are defined as cellular connectivity devices produced by entities linked to the People's Republic of China or deemed a supply-chain risk. Following the audit, the Secretary of Defense must submit biennial reports for six years detailing mitigation efforts, including 'rip-and-replace' programs, network isolation, and supply-chain substitutions, along with cost estimates and identified barriers. The Comptroller General is also required to report on the effectiveness of these activities.
Proponents argue
Proponents argue that this bill is a critical step to enhance national security by eliminating vulnerabilities in the Department of Defense's vast network infrastructure. They contend that cellular modules from foreign adversaries, especially those controlled by the People's Republic of China, present significant cybersecurity risks, including potential for data exfiltration, remote access, and disruption of critical military operations. Identifying and mitigating these risks proactively is essential to safeguard sensitive military information and operational capabilities against state-sponsored espionage and sabotage.
Opponents contend
Opponents might argue that while the intent is sound, the bill could impose substantial financial and logistical burdens on the Department of Defense, potentially diverting resources from other critical defense priorities. They may also raise concerns about the feasibility and timeline of a comprehensive 'rip-and-replace' program across all military departments and contractor-operated systems, suggesting it could disrupt existing operations or create new, unforeseen vulnerabilities during the transition. Some might also argue that the definition of 'covered cellular module' is overly broad or could lead to supply chain disruptions if trusted alternatives are not readily available or cost-effective.
The bill is concise and can be read quickly, allowing ample time for detailed consideration of its implications.
Section 2(a)
Department of Defense Audit of Covered Cellular Modules
This provision mandates the Secretary of Defense to initiate a Department-wide audit within 180 days of the bill's enactment. The audit's purpose is to identify the presence of 'covered cellular modules' within all Department of Defense (DoD) systems and infrastructure. It specifically requires prioritization of systems critical to military mobility, logistics, and installation security, and includes both government-owned and contractor-operated systems connected to DoD networks. The audit must also identify manufacturers, models, firmware versions, and assess the cybersecurity risk of each identified module, including data flows and potential for remote access. This ensures a comprehensive understanding of the scope of the potential vulnerability.
Supporters argue
Supporters argue that a thorough audit is the essential first step to understanding the full extent of foreign cellular module penetration within DoD systems. Without a clear picture of where these modules exist and the risks they pose, effective mitigation strategies cannot be developed. Prioritizing critical systems ensures that the most vulnerable and impactful areas are addressed first, safeguarding core military functions.
Critics contend
Critics might contend that while an audit is necessary, the 180-day timeline for a 'Department-wide' audit, including contractor systems, is overly ambitious and could lead to rushed, incomplete results. They may also argue that the scope, while comprehensive, could strain existing cybersecurity and IT resources, potentially delaying other critical security initiatives.
Tradeoffs
The provision balances the urgent need to identify security vulnerabilities against the practical challenges and resource demands of conducting a massive, rapid audit across a complex global organization like the DoD.
Section 2(b)
Mitigation and Reporting Requirements
This provision requires the Secretary of Defense to submit an initial report within one year of enactment, and then biennially for six years, to the congressional defense committees. These reports must detail the audit findings and describe ongoing and planned mitigation measures. Mitigation measures include 'rip-and-replace' programs, accelerated divestiture of legacy assets, network segmentation, firmware remediation, and supply-chain substitution with trusted alternatives. The reports must also include cost estimates, timelines, resource requirements, and identify any statutory, regulatory, or acquisition barriers to mitigation, along with recommendations for additional legislative authorities. This ensures transparency and accountability in the remediation process.
Section 2(d)
Definitions of Key Terms
This subsection defines critical terms used throughout the bill, ensuring clarity and scope. Key definitions include 'cellular module' (a modular transmitter providing cellular connectivity), 'covered cellular module' (any cellular module produced by entities identified under Section 889 of the FY19 NDAA, entities owned/controlled by China, or any entity deemed an unacceptable supply-chain risk by the Secretary of Defense), and 'covered system' (any DoD-owned, leased, operated, or controlled infrastructure). It also defines 'Internet of things device' by referencing NIST Special Publication 1800-16. These definitions are crucial for determining which devices and entities fall under the audit and mitigation requirements.
The definition of 'covered cellular module' includes any module produced by an entity identified under section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019, or an entity owned by, controlled by, or subject to the jurisdiction or direction of the People's Republic of China.
Section 2(d)(3)(A) and (B)
Why it matters:This is standard legislative practice to define terms precisely in a dedicated section. However, the reference to Section 889 of a previous NDAA requires external knowledge to fully understand the scope of entities already identified, making it less immediately transparent.
Case for: Supporters argue that explicitly linking to Section 889 and directly targeting entities connected to the People's Republic of China provides clear, legally robust grounds for identifying and mitigating high-risk components. This leverages existing legislative frameworks and focuses on known adversarial threats, streamlining the DoD's efforts.
Case against: Some might argue that relying on external references like Section 889 requires continuous awareness of updates to that list, potentially complicating implementation. Additionally, the broad phrasing 'owned by, controlled by, or subject to the jurisdiction or direction of the People's Republic of China' could be subject to interpretation challenges, potentially leading to disputes over specific entities.
Estimated impact: This provision significantly narrows the scope of the audit and mitigation to specific, high-risk manufacturers and their products, potentially affecting a large but targeted segment of the defense supply chain.
The definition of 'covered cellular module' also includes 'any other entity determined by the Secretary of Defense to present an unacceptable supply-chain risk.'
Section 2(d)(3)(C)
Why it matters:This clause provides the Secretary of Defense with broad discretionary authority, which is often placed in definitions or general authority sections. It's standard for flexibility but can be seen as less transparent than explicit listings.
Case for: Proponents argue this grants essential flexibility to the Secretary of Defense to adapt to evolving threats and identify new supply-chain risks that may not be explicitly covered by existing legislation or direct links to China. This ensures the DoD can respond dynamically to emerging national security challenges without needing new legislation for every new threat.
Case against: Critics might express concern that this clause provides overly broad and potentially unchecked authority to the Secretary of Defense. They may argue it could lead to arbitrary designations, lack of transparency in decision-making, or unintended economic consequences for companies not directly linked to adversarial governments but deemed a 'risk' for other reasons, potentially without clear recourse.
Estimated impact: This provision could significantly expand the scope of the bill beyond explicitly named entities, depending on the Secretary's discretion, potentially impacting a wider range of suppliers and technologies.