Mobile device force protection against commercial surveillance threats

(a) Pilot program (1) Establishment Not later than 180 days after the date of the enactment of this Act, the Secretary shall establish a pilot program to evaluate mobile device force protection technologies intended to reduce the operational exposure of covered personnel arising from application-generated signals. (2) Participation The Secretary shall make participation in the pilot program available to the military departments, the combatant commands, and other covered organizations seeking to participate. (3) Acquisition authorities The Secretary shall, to the maximum extent practicable, use existing rapid acquisition authorities and other transaction authorities to minimize administrative barriers to participation in the pilot program. (4) Measures of effectiveness The Secretary shall establish objective, outcome-based measures of effectiveness before the initiation of the pilot program. (b) Minimum operational requirements A technology evaluated under the pilot program shall demonstrate the ability to— (1) identify applications generating signals relevant to force protection; (2) determine the destinations receiving such signals; (3) characterize the categories of information transmitted in sufficient detail to assess operational exposure; (4) distinguish legitimate application functionality from analytics, diagnostics, advertising, profiling, and related exploitation activities; (5) maintain auditable records and generate commander-level reporting sufficient to support force protection decisions; (6) actively control application-generated transmissions, including the ability to block, throttle, or otherwise govern which signals leave the device and the destinations to which they may be sent, and not merely to observe, characterize, or report them; (7) enable the Department of Defense, and not solely a vendor, to independently verify the matters described in paragraphs (1) through (6) and to confirm measured reductions in operational exposure; and (8) adapt as commercial surveillance techniques evolve. (c) Transition and operational adoption (1) Determination Not later than 90 days after the evaluation of a technology is completed under the pilot program, the Secretary shall determine whether the evaluated technology demonstrated measurable reductions in operational exposure associated with commercial mobile surveillance. (2) Adoption If the Secretary determines that the effectiveness of a technology evaluated under the pilot program has been adequately demonstrated, the Secretary may authorize operational deployment of the technology without initiating a duplicative requirements process. (3) Transition pathways The Secretary shall identify potential transition pathways for a technology before evaluating the technology under the pilot program. (d) Continuous assessment (1) Framework The Secretary shall establish a continuous assessment framework applicable to deployed mobile device force protection technologies, under which each such technology is reviewed not less frequently than annually to evaluate whether it continues to reduce operational exposure arising from commercial mobile surveillance. (2) Annual report Not less frequently than annually, the Secretary shall submit to the congressional defense committees a report that summarizes the findings of the assessments conducted under paragraph (1), identifies emerging commercial surveillance techniques, documents the effectiveness of deployed technologies, and recommends modifications to standards and procurement approaches. (e) Degradation and reassessment If the Secretary determines that a deployed mobile device force protection technology no longer provides meaningful protection against identified threats, the Secretary shall initiate a review of alternative capabilities using the authorities established under this section. (f) Rule of construction Nothing in this section shall be construed to require the use of a particular technical architecture, implementation methodology, or commercial vendor. The requirements established under this section are intended to define the operational outcomes necessary to support force protection and not to prescribe the means by which those outcomes are achieved. (g) Definitions In this section: (1) The term application-generated signal means any data transmitted from a mobile device by, or on behalf of, a software application, including data derived from device sensors, network and environmental observations, diagnostic and behavioral telemetry, and embedded software development kits, whether or not the data includes a persistent identifier. (2) The term covered personnel means— (A) members of the Armed Forces; (B) civilian employees of the Department of Defense; (C) contractors supporting the Department of Defense; (D) employees of entities engaged in the development or manufacture of weapons systems or other defense articles; and (E) any other category of personnel designated by the Secretary of Defense whose duties involve heightened operational security considerations. (3) The term mobile device force protection technology means a technology or capability intended to identify, observe, characterize, audit, report upon, restrict, suppress, or otherwise manage application-generated signals that may contribute to operational surveillance or pattern-of-life reconstruction affecting covered personnel. (4) The term Secretary means the Secretary of Defense.