Tom Cotton
Senator for Arkansas · Republican · United States
“(2) Chip security mechanism.--The term ``chip security mechanism'' means, with respect to a covered integrated circuit product, a software-, firmware-, or hardware-enabled security mechanism or a physical security mechanism, including-- (A) periodic on-site audits or inventories at the end- user's approved destination for the covered inte…”
“(2) Chip security mechanism.--The term ``chip security mechanism'' means, with respect to a covered integrated circuit product, a software-, firmware-, or hardware-enabled security mechanism or a physical security mechanism, including-- (A) periodic on-site audits or inventories at the end- user's approved destination for the covered inte…”
“(2) Report to congress.-- (A) In general.--Not later than two years after the date of the enactment of this Act, and annually thereafter for three years, the Under Secretary shall submit to the appropriate congressional committees a report on the results of the assessment required by paragraph (1), including-- (i) an identification of the…”
“(2) Report to congress.-- (A) In general.--Not later than two years after the date of the enactment of this Act, and annually thereafter for three years, the Under Secretary shall submit to the appropriate congressional committees a report on the results of the assessment required by paragraph (1), including-- (i) an identification of the…”
“(B) Elements.--The assessment required by subparagraph (A) shall include-- (i) an examination of the feasibility, reliability, and effectiveness of-- (I) methods and strategies that prevent the tampering, disabling, or other manipulating of covered integrated circuit products; and (II) any other method the Under Secretary determines appro…”
“(B) Elements.--The assessment required by subparagraph (A) shall include-- (i) an examination of the feasibility, reliability, and effectiveness of-- (I) methods and strategies that prevent the tampering, disabling, or other manipulating of covered integrated circuit products; and (II) any other method the Under Secretary determines appro…”
The complete record
Every one of 299 lines we hold for Tom Cotton, in date order, each linked to its source. Free to read, in full, without an account. Page 1 of 6.
“(e) Enforcement.--A violation of any provision of this subtitle, or of any regulation, order, license, or other authorization issued pursuant to this subtitle shall be deemed a violation of the Export Control Reform Act of 2018 (50 U.S.C. 4801 et seq.). (f) Administrative Procedures and Confidentiality of Information.--The provisions of sections 1762 and 1761(h) of the Export Control Reform Act of 2018 (50 U.S.C. 4821 and 4820(h)) shall apply to this subtitle in the same manner and to the same extent as such provisions apply to the Export Control Reform Act of 2018. ______”
“4801 et seq.) insufficiently addressed issues arising from the presence of sufficient volume of foreign covered integrated circuit products not covered by the requirements of this subtitle. (3) Congressional notification.--At least 30 days prior to exercising the waiver described in paragraph (2), the Under Secretary shall provide a written notification to the appropriate congressional committees containing detailed quantitative analysis demonstrating the rationale for the waiver and that exercising any and all authorities under the Export Control Reform Act of 2018 (50 U.S.C. 4801 et seq.) insufficiently addressed issues arising from the presence of sufficient volume of foreign covered integrated circuit products not covered by the requirements of this subtitle.”
“(d) Foreign Competitiveness Assessment and Related Authorities.-- (1) In general.--The Under Secretary shall annually assess the competitiveness of foreign covered integrated circuit products in relation to United States covered integrated circuit products. (2) Waiver.--The Under Secretary, in consultation with the Secretary of State, the Secretary of Defense, and the Secretary of Energy, is authorized to waive any requirements of this subtitle if the Under Secretary, in consultation with such Secretaries, determines that the implementation of chip security mechanisms poses an undue burden on United States competitiveness, is inconsistent with the national security interests of the United States, and that exercising any and all authorities under the Export Control Reform Act of 2018 (50 U.S.C.”
“4801 et seq.) or otherwise provided by law, in carrying out this section, the Under Secretary may-- (1) verify, in a manner the Under Secretary determines appropriate, the ownership and location of a covered integrated circuit product that has been exported, reexported, or in-country transferred to or in a foreign country; (2) maintain a record of covered integrated circuit products and include in the record the location and current end-user of each such product; and (3) require any person involved in the design, manufacture, sale, physical security, oversight, distribution, export, or licensed transfer of a covered integrated circuit product being exported, re-exported, or in-country-transferred to a foreign country to provide the information needed to maintain the [[Page S3956]] record (such as essential information relating to the chip security mechanisms, or the end-user of covered integrated circuit products located outside of the United States).”
“(B) Privacy and cybersecurity.--In assessing and developing requirements for enhanced chip security mechanisms under this subsection, the Under Secretary shall prioritize mitigation of confidentiality and cybersecurity risk. (c) Enforcement Authority.--In addition to the penalty and enforcement authorities granted to the Under Secretary under the Export Control Reform Act of 2018 (50 U.S.C.”
“(B) Form.--The report required by paragraph (1) shall be submitted in unclassified form, but may include a classified annex. (3) Implementation.-- (A) In general.--If any enhanced chip security mechanisms identified pursuant to paragraph (1)(A) are determined by the Under Secretary to be appropriate, the Under Secretary may, not later than two years after the date on which the Under Secretary completes the assessment required by paragraph (1), require any covered integrated circuit product to incorporate the enhanced chip security mechanisms, or for additional mechanisms to be otherwise implemented, at the time the product is exported, reexported, or in-country transferred to or in a foreign country.”
“(2) Report to congress.-- (A) In general.--Not later than two years after the date of the enactment of this Act, and annually thereafter for three years, the Under Secretary shall submit to the appropriate congressional committees a report on the results of the assessment required by paragraph (1), including-- (i) an identification of the chip security mechanisms, if any, to be included in the requirements for enhanced chip security mechanisms; (ii) an identification of research and development directions that could be used to improve the robustness of chip security mechanisms and incentives to promote such research and development directions; (iii) if applicable, a roadmap for the timely implementation of the enhanced chip security mechanisms; and (iv) any recommendations for modifications to relevant export controls to allow for more flexibility with respect to the countries to or in which covered integrated circuit products may be exported, reexported, or in-country transferred if the products include enhanced chip security mechanisms.”
“4801 et seq.); (bb) in detecting and deterring illegal diversion of the covered integrated circuit products; and (cc) in enhancing persons' global inventory management; and (III) the susceptibility of the methods examined under clause (i) to tampering, disabling, or other forms of manipulation; and (iii) an estimate of the expected costs to implement at- scale methods to tamper with, disable, or manipulate a covered integrated circuit product, or otherwise circumvent the methods examined under clause (i).”
“(B) Elements.--The assessment required by subparagraph (A) shall include-- (i) an examination of the feasibility, reliability, and effectiveness of-- (I) methods and strategies that prevent the tampering, disabling, or other manipulating of covered integrated circuit products; and (II) any other method the Under Secretary determines appropriate for the prevention of unauthorized use, access, or exploitation of covered integrated circuit products; (ii) an analysis of-- (I) the potential costs associated with implementing each method examined under clause (i), including an analysis of-- (aa) the potential impact of the method on the performance of covered integrated circuit products; and (bb) the potential for the introduction of new vulnerabilities into the products; (II) the potential benefits of implementing the methods examined under clause (i), including an analysis of the potential increase-- (aa) in compliance of covered integrated circuit products with the requirements of the Export Control Reform Act of 2018 (50 U.S.C.”
“4801 et seq.); (II) to detect the illegal diversion of covered integrated circuit products; (III) to identify and monitor smuggling intermediaries; (IV) to ensure United States technology leadership; (V) to ensure the orderly and effective implementation of the chip security mechanism; and (VI) to address industry feedback about the implementation of the chip security mechanism; (ii) if the Under Secretary identifies any such enhancements, develop incentives for facilitating industry- wide incorporation of such enhancements for covered integrated circuit products; and (iii) where necessary, to expedite the implementation of such enhancements and identify and support research activities, such as-- (I) updating and clarifying relevant vulnerability and threat models; (II) developing definitions, assets, and other practices to support traceability and provenance of materials and data across the product lifecycle; (III) developing updated databases of existing trust and assurance data practices; and (IV) developing practices for implementing chip security mechanisms and sharing relevant information across the product life cycle while protecting confidential intellectual property.”
“(b) Enhancements to Chip Security Mechanisms.-- (1) Assessment.-- (A) In general.--Not later than two years after the date of the enactment of this Act, and annually thereafter for three years, the Under Secretary, in consultation with the Secretary of State, the Secretary of Defense, and the Secretary of Energy, shall-- (i) conduct an assessment, in robust consultation with the public in a manner determined appropriate by the Under Secretary and in consultation with the heads of other relevant Federal departments and agencies, to identify what enhancements, if any, should be used to improve the chip security mechanisms implemented under subsection (a)(1)-- (I) to enhance compliance with the requirements of the Export Control Reform Act of 2018 (50 U.S.C.”
“(5) Stakeholder engagement.--In carrying out this subsection, the Under Secretary shall undertake a robust stakeholder engagement process to inform the development and implementation of chip security mechanisms, which shall include-- (A) soliciting input from relevant stakeholders, including-- (i) private sector entities involved in the covered integrated circuit product supply chain; (ii) experts in software, firmware, and hardware security, cybersecurity, privacy, export compliance, national security, and advanced artificial intelligence; and (iii) individuals from academic institutions, federally funded research and development centers, Federal departments and agencies, and other research organizations with relevant expertise; and (B) incorporating stakeholder feedback to ensure that required chip security mechanisms are operationally effective, scalable, and aligned with best practices in security, privacy, and export compliance.”
“(4) Rule promulgation.--Not later than one year after the date of the enactment of this Act, the Under Secretary, in robust consultation with the public in a manner determined appropriate by the Under Secretary and in consultation with the heads of other relevant Federal departments and agencies, shall promulgate a rule that includes a reporting requirement to inform the Bureau of Industry and Security of the Department of Commerce whenever chip security mechanisms fail to confirm that any covered integrated circuit product has not been illegally diverted to a destination of concern, taking into account reasonable time for persons to verify or repair the chip security mechanism, identified in the rule, including instances in which there is evidence that a product has been subjected to tampering or an attempt at tampering, including efforts to disable, spoof, falsify, manipulate, mislead, or circumvent chip security mechanisms.”
“(B) Requirements.--In promulgating the proposed regulations under subparagraph (A), the Under Secretary shall-- (i) solicit public feedback on potential guidance to clarify the categories of persons subject to this requirement, how information should be securely shared between entities, and the procedures for submission of such notifications, in order to ensure clarity regarding compliance obligations and implementation; and (ii) issue guidance to clarify how the regulations can be applied in nations with data localization laws or data privacy laws, providing flexibility if such laws require novel or flexible approaches.”
“(2) Adaptation of requirement for geographical differences.--In implement the requirements of paragraph (1), the Under Secretary may select chip security mechanisms that vary by geographical region and by party, as the Under Secretary deems appropriate to support national security and foreign policy. (3) Proposed regulations.-- (A) In general.--Not later than 270 days after the date of the enactment of this Act, the Under Secretary shall promulgate proposed regulations implementing the requirements of paragraph (1).”
“(a) Primary Requirements.-- (1) In general.--Not later than one year after the date of the enactment of this Act, [[Page S3955]] the Under Secretary, in consultation with the Secretary of State, the Secretary of Defense, and the Secretary of Energy, shall require any covered integrated circuit product that is exported, reexported, or in-country transferred to or within a foreign country to be secured by a chip security mechanism that enables reliable verification of whether the product has been illegally diverted to destinations of concern, to the extent consistent with the recommendations transmitted pursuant to section 1098, using techniques that are feasible and appropriate on such date of enactment.”
“(2) Form.--The report required in this subsection shall be submitted in unclassified form but may include a classified annex. SEC. 1099. REQUIREMENTS FOR CHIP SECURITY MECHANISMS FOR EXPORT, RE-EXPORT, OR IN-COUNTRY TRANSFER OF COVERED INTEGRATED CIRCUIT PRODUCTS.”
“(c) Report to Congress.-- (1) In general.--Not later than 210 days after the date of the enactment of this Act, the Under Secretary shall submit to the appropriate congressional committees a report on the results of the assessment required by subsection (a), including-- (A) an identification of the chip security mechanisms the Under Secretary plans to propose pursuant to implementing section 1099; (B) an identification of future research and development directions that could be used to enhance robustness of chip security mechanisms and incentives to promote such research and development directions; (C) a roadmap for the timely implementation of the chip security mechanisms; and (D) any recommendations for potential modifications to relevant export controls to allow for more flexibility with respect to the countries to or in which covered integrated circuit products may be exported, reexported, or in-country- transferred if the products include chip security mechanisms.”
“(b) Stakeholder Engagement.--In carrying out the requirements under subsection (a), the Under Secretary shall undertake a robust stakeholder engagement process to inform the development and implementation of chip security mechanisms, which shall include-- (1) soliciting input from relevant stakeholders, including-- (A) private sector entities involved in the covered integrated circuit product supply chain; (B) experts in software, firmware, hardware security, cybersecurity, privacy, export compliance, national security, and advanced artificial intelligence; and (C) individuals from academic institutions, federally funded research and development centers, Federal departments and agencies, and other research organizations with relevant expertise; and (2) incorporating stakeholder feedback to ensure that required chip security mechanisms are operationally effective, scalable, and aligned with best practices in security, privacy, and export compliance.”
“(a) Assessment.--On the date of the enactment of this Act, the Under Secretary, in consultation with the Secretary of State, the Secretary of Defense, and the Secretary of Energy and in robust consultation with the public in a manner determined appropriate by the Under Secretary and in consultation with the heads of other relevant Federal departments and agencies, shall initiate an assessment-- (1) to identify potential chip security mechanisms to enable reliable verification of whether a covered integrated circuit product has been illegally diverted or accessed; (2) to develop incentives for facilitating industry-wide incorporation of such chip security mechanisms; (3) to conduct an analysis of the potential costs associated with implementing such chip security mechanisms; and (4) to recommend a set of chip security mechanisms that would effectively detect diversion and smuggling and is technically feasible, cost-effective, and ensures the technology leadership of the United States.”
“4801 et seq.) or any other provision of law; or (6) to apply any requirements or regulations under this subtitle to any covered integrated circuit products in the United States. SEC. 1098. INITIAL REPORT TO CONGRESS ON CHIP SECURITY MECHANISMS.”
“Nothing in this subtitle may be construed to direct the Under Secretary-- (1) to require any chip security mechanisms that-- (A) may hinder the capability or functionality of a covered integrated circuit product, such as a kill switch or geofencing mechanism; or (B) meaningfully undermine the cybersecurity of the covered integrated circuit product; (2) to mandate the incorporation of a location verification mechanism on a covered integrated circuit product that requires physical changes to hardware; (3) to consider any chip security mechanism requirements of this subtitle as applicable to a person that fabricates covered integrated circuit products, unless the person also designs the respective covered integrated circuit products; (4) to require chip security mechanisms for exports of integrated circuits, computers, electronic assemblies, or components that are not designed or marketed for artificial intelligence datacenter use; (5) to limit any other enforcement authority of the Under Secretary or the head of any other Federal department or agency under the Export Control Reform Act of 2018 (50 U.S.C.”
“(5) Export, in-country transfer, and reexport.--The terms ``export'', ``in-country transfer'', and ``reexport'' have the meanings given those terms in section 1742 of the Export Control Reform Act of 2018 (50 U.S.C. 4801). (6) Under secretary.--The term ``Under Secretary'' means the Under Secretary of Commerce for Industry and Security. SEC. 1097. RULES OF CONSTRUCTION.”
“(C) Exclusion.--The term ``covered integrated circuit'' does not include-- (i) covered integrated circuits or products containing a covered integrated circuit that are not designed or marketed for use in a data center; (ii) microprocessor microcircuits, such as central processing units, that are not graphics processing units or similar products; or (iii) network switch integrated circuits whose dominant function is routing traffic over a computing network. (4) Destination of concern.--The term ``destination of concern'' means-- (A) a country subject to a United States arms embargo as described in section 126.1 of title 22, Code of Federal Regulations; or (B) any other country determined by the Under Secretary.”
“(3) Covered integrated circuit product.-- (A) In general.--The term ``covered integrated circuit product'' means a certain integrated circuit, computer, or other product classified under Export Control Classification Number 3A090, 4A090, 5A002.z, related .z Export Control Classification Numbers, or other functionally equivalent or substantially similar items. (B) Modification.--The Under Secretary shall routinely modify the definition of the term ``covered integrated circuit product'' under subparagraph (A) for the purposes of this subtitle to ensure only integrated circuits, computers, electronic assembly, or components designed or marketed for datacenter use are subject to the requirements of this subtitle.”
“(2) Chip security mechanism.--The term ``chip security mechanism'' means, with respect to a covered integrated circuit product, a software-, firmware-, or hardware-enabled security mechanism or a physical security mechanism, including-- (A) periodic on-site audits or inventories at the end- user's approved destination for the covered integrated circuit product; (B) periodic attestations by a U.S.-headquartered entity, or its subsidiaries, confirming that all covered integrated circuit products are accounted for, provided the Under Secretary approves the attestations; (C) except in the case of a covered integrated circuit product whose sole or principal function is memory or storage, ping-based location verification through a trusted landmark server utilizing secure software- or firmware- enabled mechanisms; or (D) various other mechanisms, or combinations of mechanisms, that the Under Secretary determines can verifiably demonstrate with significant confidence that the covered integrated circuit product has not been illegally diverted to a destination of concern.”
“SEC. 1096. DEFINITIONS. In this subtitle: (1) Appropriate congressional committees.--The term ``appropriate congressional committees'' means-- (A) the Committee on Banking, Housing, and Urban Affairs of the Senate; and (B) the Committee on Foreign Affairs of the House of Representatives.”
“SEC. 1095. SENSE OF CONGRESS. It is the sense of Congress that-- (1) technology developed in the United States should serve as the foundation for the global ecosystem of artificial intelligence to advance the foreign policy and national security objectives of the United States and allies and partners of the United States; (2) the United States can foster goodwill, strengthen relationships, and support innovative research around the world by providing allies and partners of the United States with advanced computing capabilities; (3) advanced integrated circuits and computing hardware that are exported from the United States must be protected from diversion, theft, and other unauthorized use or exploitation in order to bolster the competitiveness of the United States and protect the national security of the United States; (4) illegal diversion of advanced integrated circuits and computing hardware, particularly illegal diversion to the People's Republic of China and the Russian Federation, is a significant and growing issue that undermines the United States' export controls and threatens the United States' national security; (5) implementing chip security mechanisms will improve enforcement of export control laws of the United States, assist allies and partners with guarding computing hardware, and enhance protections from bad actors looking to access, divert, or tamper with advanced integrated circuits and computing hardware; and (6) implementing chip security mechanisms may help with the detection of smuggling or exploitation of advanced integrated circuits and computing hardware, thereby allowing for increased flexibility in export controls and opening the door for more international partners to receive streamlined and larger shipments of advanced computing hardware.”
“Congressional Record, Volume 172 Issue 114 (Tuesday, July 14, 2026) [Congressional Record Volume 172, Number 114 (Tuesday, July 14, 2026)] [Senate] [Pages S3953-S3956] From the Congressional Record Online through the Government Publishing Office [ www.gpo.gov ] SA 6683. Mr. COTTON submitted an amendment intended to be proposed by him to the bill S. 4784, to authorize appropriations for fiscal year 2027 for military activities of the Department of Defense, for military construction, [[Page S3954]] and for defense activities of the Department of Energy, to prescribe military personnel strengths for such fiscal year, and for other purposes; which was ordered to lie on the table; as follows: At the end of title X, add the following: Subtitle H--Chip Security Act SEC. 1094. SHORT TITLE. This subtitle may be cited as the ``Chip Security Act''.”
“America and this Senate will forever be grateful to Senator Lindsey Graham for his lifetime of service, patriotism, and courageous leadership. I yield the floor. The PRESIDING OFFICER. The Senator from Iowa.”
“If you loved America, Lindsey loved you. If you fought for freedom, Lindsey would fight for you. Only in America could a man like Lindsey Graham leave such a mark on our history and our future. That above all is a testament to his strength of character. Lindsey's unwavering love for our Lord, devotion to our country, and commitment to his family defined his entire life. He was an example of what makes America exceptional. Though we lost a dedicated public servant, a workhorse of a colleague, and an irreplaceable friend, his memory and his legacy will never be forgotten. I extend my deepest prayers, thoughts, and condolences to Darline, Lindsey's family, Lindsey's staff, his friends, and his loved ones.”
“Needless to say, South Carolinians loved him, and it is not hard to see why. Throughout my time working with Lindsey in the Senate, he fought for South Carolinians, he defended America's founding principles, and he supported the men and women of our military. [[Page S3917]] While he served as chairman of the Judiciary Committee, he oversaw the confirmation of a Supreme Court Justice and more than 200 Federal judges committed to upholding the rule of law as our Founders intended. Further, Lindsey knew that strength produces peace and prosperity, and he believed that the United States is the greatest force for freedom that mankind has ever known. Through every bill he introduced, every speech he gave, every statement he made, Lindsey ensured our allies knew our word was good and our enemies feared our resolve.”
“After suddenly and unexpectedly losing both parents while attending the University of South Carolina, he stepped in to raise his beloved younger sister Darline. But even in the face of tragedy, Lindsey's grit, determination, and faith enabled him to finish college, earn a law degree, serve in the Air Force, and eventually make his way here to the U.S. Congress. When Lindsey arrived in the House in 1995 as the first Republican Congressman from South Carolina's Third Congressional District since 1877, he brought with him a sense of duty and responsibility, a love for liberty, and a resolute commitment to America's national security. He carried this with him to the Senate, where he served for more than two decades and became the first person in South Carolina history to earn more than 1 million votes in a general election.”
“He told me I was great; I needed to run for the Senate; we had to win the Senate seat in Arkansas. The next morning, we had a 08 briefing with General Breedlove, then the commander of our forces in Europe, and Lindsey stumbled in at about 8:55. Senator McCain hailed the arrival of his illegitimate son, and then we had a coffee break 5 minutes later, when Lindsey came over, slapped me on the back, and said: You were great. We have got to have you run for Senate. Now, what was your name again? That was Lindsey, self-described rascal that he was. I often joked about it--and with him. You never knew quite what Lindsey was up to, but it probably wasn't nothing. He became the first member of his family to attend college.”
“Mr. President, Lindsey Graham was a self-made American original. Born in Central, SC, Lindsey grew up in a room behind his parents' bar and pool hall, where he worked to help the family make ends meet and earned the nickname ``Stinkball'' from its patrons because of his sense of humor and his irrepressible nature and his rascal streak, as he called it. I saw that in my first experience with Lindsey Graham. I traveled with him and Senator McCain to the Munich Security Conference in 2013 as a brandnew Congressman. That evening, as I was meeting some of the other Senators on the delegation--Senator Ayotte and Senator Corker-- Lindsey came up to me and slapped me on the back and asked me who the hell I was. I introduced myself, and I told him a little bit about my story, my service in the Army before I was elected to the House.”
“Mr. President, I ask unanimous consent that the order for the quorum call be rescinded. The PRESIDING OFFICER. Without objection, it is so ordered.”
“(e) Enforcement.--A violation of any provision of this subtitle, or of any regulation, order, license, or other authorization issued pursuant to this subtitle shall be deemed a violation of the Export Control Reform Act of 2018 (50 U.S.C. 4801 et seq.). (f) Administrative Procedures and Confidentiality of Information.--The provisions of sections 1762 and 1761(h) of the Export Control Reform Act of 2018 (50 U.S.C. 4821 and 4820(h)) shall apply to this subtitle in the same manner and to the same extent as such provisions apply to the Export Control Reform Act of 2018. ______”
“4801 et seq.) insufficiently addressed issues arising from the presence of sufficient volume of foreign covered integrated circuit products not covered by the requirements of this subtitle. (3) Congressional notification.--At least 30 days prior to exercising the waiver described in paragraph (2), the Under Secretary shall provide a written notification to the appropriate congressional committees containing detailed quantitative analysis demonstrating the rationale for the waiver and that exercising any and all authorities under the Export Control Reform Act of 2018 (50 U.S.C. 4801 et seq.) insufficiently addressed issues arising from the presence of sufficient volume of foreign covered integrated circuit products not covered by the requirements of this subtitle.”
“(d) Foreign Competitiveness Assessment and Related Authorities.-- (1) In general.--The Under Secretary shall annually assess the competitiveness of foreign covered integrated circuit products in relation to United States covered integrated circuit products. (2) Waiver.--The Under Secretary, in consultation with the Secretary of State, the Secretary of Defense, and the Secretary of Energy, is authorized to waive any requirements of this subtitle if the Under Secretary, in consultation with such Secretaries, determines that the implementation of chip security mechanisms poses an undue burden on United States competitiveness, is inconsistent with the national security interests of the United States, and that exercising any and all authorities under the Export Control Reform Act of 2018 (50 U.S.C.”
“4801 et seq.) or otherwise provided by law, in carrying out this section, the Under Secretary may-- (1) verify, in a manner the Under Secretary determines appropriate, the ownership and location of a covered integrated circuit product that has been exported, reexported, or in-country transferred to or in a foreign country; (2) maintain a record of covered integrated circuit products and include in the record the location and current end-user of each such product; and (3) require any person involved in the design, manufacture, sale, physical security, oversight, distribution, export, or licensed transfer of a covered integrated circuit product being exported, re-exported, or in-country-transferred to a foreign country to provide the information needed to maintain the [[Page S3956]] record (such as essential information relating to the chip security mechanisms, or the end-user of covered integrated circuit products located outside of the United States).”
“(B) Privacy and cybersecurity.--In assessing and developing requirements for enhanced chip security mechanisms under this subsection, the Under Secretary shall prioritize mitigation of confidentiality and cybersecurity risk. (c) Enforcement Authority.--In addition to the penalty and enforcement authorities granted to the Under Secretary under the Export Control Reform Act of 2018 (50 U.S.C.”
“(B) Form.--The report required by paragraph (1) shall be submitted in unclassified form, but may include a classified annex. (3) Implementation.-- (A) In general.--If any enhanced chip security mechanisms identified pursuant to paragraph (1)(A) are determined by the Under Secretary to be appropriate, the Under Secretary may, not later than two years after the date on which the Under Secretary completes the assessment required by paragraph (1), require any covered integrated circuit product to incorporate the enhanced chip security mechanisms, or for additional mechanisms to be otherwise implemented, at the time the product is exported, reexported, or in-country transferred to or in a foreign country.”
“(2) Report to congress.-- (A) In general.--Not later than two years after the date of the enactment of this Act, and annually thereafter for three years, the Under Secretary shall submit to the appropriate congressional committees a report on the results of the assessment required by paragraph (1), including-- (i) an identification of the chip security mechanisms, if any, to be included in the requirements for enhanced chip security mechanisms; (ii) an identification of research and development directions that could be used to improve the robustness of chip security mechanisms and incentives to promote such research and development directions; (iii) if applicable, a roadmap for the timely implementation of the enhanced chip security mechanisms; and (iv) any recommendations for modifications to relevant export controls to allow for more flexibility with respect to the countries to or in which covered integrated circuit products may be exported, reexported, or in-country transferred if the products include enhanced chip security mechanisms.”
“4801 et seq.); (bb) in detecting and deterring illegal diversion of the covered integrated circuit products; and (cc) in enhancing persons' global inventory management; and (III) the susceptibility of the methods examined under clause (i) to tampering, disabling, or other forms of manipulation; and (iii) an estimate of the expected costs to implement at- scale methods to tamper with, disable, or manipulate a covered integrated circuit product, or otherwise circumvent the methods examined under clause (i).”
“(B) Elements.--The assessment required by subparagraph (A) shall include-- (i) an examination of the feasibility, reliability, and effectiveness of-- (I) methods and strategies that prevent the tampering, disabling, or other manipulating of covered integrated circuit products; and (II) any other method the Under Secretary determines appropriate for the prevention of unauthorized use, access, or exploitation of covered integrated circuit products; (ii) an analysis of-- (I) the potential costs associated with implementing each method examined under clause (i), including an analysis of-- (aa) the potential impact of the method on the performance of covered integrated circuit products; and (bb) the potential for the introduction of new vulnerabilities into the products; (II) the potential benefits of implementing the methods examined under clause (i), including an analysis of the potential increase-- (aa) in compliance of covered integrated circuit products with the requirements of the Export Control Reform Act of 2018 (50 U.S.C.”
“4801 et seq.); (II) to detect the illegal diversion of covered integrated circuit products; (III) to identify and monitor smuggling intermediaries; (IV) to ensure United States technology leadership; (V) to ensure the orderly and effective implementation of the chip security mechanism; and (VI) to address industry feedback about the implementation of the chip security mechanism; (ii) if the Under Secretary identifies any such enhancements, develop incentives for facilitating industry- wide incorporation of such enhancements for covered integrated circuit products; and (iii) where necessary, to expedite the implementation of such enhancements and identify and support research activities, such as-- (I) updating and clarifying relevant vulnerability and threat models; (II) developing definitions, assets, and other practices to support traceability and provenance of materials and data across the product lifecycle; (III) developing updated databases of existing trust and assurance data practices; and (IV) developing practices for implementing chip security mechanisms and sharing relevant information across the product life cycle while protecting confidential intellectual property.”
“(b) Enhancements to Chip Security Mechanisms.-- (1) Assessment.-- (A) In general.--Not later than two years after the date of the enactment of this Act, and annually thereafter for three years, the Under Secretary, in consultation with the Secretary of State, the Secretary of Defense, and the Secretary of Energy, shall-- (i) conduct an assessment, in robust consultation with the public in a manner determined appropriate by the Under Secretary and in consultation with the heads of other relevant Federal departments and agencies, to identify what enhancements, if any, should be used to improve the chip security mechanisms implemented under subsection (a)(1)-- (I) to enhance compliance with the requirements of the Export Control Reform Act of 2018 (50 U.S.C.”
“(5) Stakeholder engagement.--In carrying out this subsection, the Under Secretary shall undertake a robust stakeholder engagement process to inform the development and implementation of chip security mechanisms, which shall include-- (A) soliciting input from relevant stakeholders, including-- (i) private sector entities involved in the covered integrated circuit product supply chain; (ii) experts in software, firmware, and hardware security, cybersecurity, privacy, export compliance, national security, and advanced artificial intelligence; and (iii) individuals from academic institutions, federally funded research and development centers, Federal departments and agencies, and other research organizations with relevant expertise; and (B) incorporating stakeholder feedback to ensure that required chip security mechanisms are operationally effective, scalable, and aligned with best practices in security, privacy, and export compliance.”
“(4) Rule promulgation.--Not later than one year after the date of the enactment of this Act, the Under Secretary, in robust consultation with the public in a manner determined appropriate by the Under Secretary and in consultation with the heads of other relevant Federal departments and agencies, shall promulgate a rule that includes a reporting requirement to inform the Bureau of Industry and Security of the Department of Commerce whenever chip security mechanisms fail to confirm that any covered integrated circuit product has not been illegally diverted to a destination of concern, taking into account reasonable time for persons to verify or repair the chip security mechanism, identified in the rule, including instances in which there is evidence that a product has been subjected to tampering or an attempt at tampering, including efforts to disable, spoof, falsify, manipulate, mislead, or circumvent chip security mechanisms.”
“(B) Requirements.--In promulgating the proposed regulations under subparagraph (A), the Under Secretary shall-- (i) solicit public feedback on potential guidance to clarify the categories of persons subject to this requirement, how information should be securely shared between entities, and the procedures for submission of such notifications, in order to ensure clarity regarding compliance obligations and implementation; and (ii) issue guidance to clarify how the regulations can be applied in nations with data localization laws or data privacy laws, providing flexibility if such laws require novel or flexible approaches.”