# Understanding Cybersecurity of Mobile Networks Act

This bill asks the federal government to study how secure your cell phone service actually is. Specifically, it directs the Commerce Department's Assistant Secretary for Communications and Information to spend about a year examining whether mobile networks and devices are protected against hacking and spying by criminals and foreign governments. The government will then report back to Congress with their findings.

The report needs to cover several important areas. It will assess whether cell phone companies have fixed known security problems that researchers and government agencies have identified. It will look at whether people actually care about cybersecurity when choosing their phone service, and whether tools exist to help customers understand the risks. The report will also examine what encryption and security methods are currently being used in phones, networks, and apps, and whether there are barriers preventing companies from using stronger security technology. Additionally, it will investigate how common surveillance devices like cell site simulators (sometimes called IMSI-catchers) are in the United States and how much they cost.

To prepare this report, the government will talk to a wide range of people including phone companies, phone manufacturers, security researchers, international partners, and technology standards organizations. The report will be made public, though it may include some classified information that stays secret for national security reasons. The bill sets aside $500,000 to fund this study through 2022. Importantly, the report will focus on current mobile networks but will exclude newer 5G technology, and it will only look at security problems that have actually been exploited in the real world or could realistically be exploited—not just theoretical vulnerabilities found in laboratories.

Understanding Cybersecurity of Mobile Networks Act

Eshoo, Anna G.

Understanding Cybersecurity of Mobile Networks Act This bill requires the National Telecommunications and Information Administration to examine and report on the cybersecurity of mobile service networks and the vulnerability of these networks and mobile devices to cyberattacks and surveillance conducted by adversaries. The report shall include (1) an assessment of the degree to which providers of mobile service have addressed certain cybersecurity vulnerabilities; (2) a discussion of the degree to which these providers have implemented cybersecurity best practices and risk assessment frameworks; and (3) an estimate of the prevalence and efficacy of encryption and authentication algorithms and techniques used in mobile service and communications equipment, mobile devices, and mobile operating systems and software.