47 U.S.C. § 1601 — Determination of communications equipment or services posing national security risks

(a) Publication of covered communications equipment or services list.—Not later than 1 year after March 12, 2020, the Commission must publish on its website a list of covered communications equipment or services. (b) Publication by Commission.—The Commission must put a communications equipment or service on the list published under subsection (a) if and only if both of the following conditions are met: (1) The equipment or service is produced or provided by an entity, and, based exclusively on the determinations described in paragraphs (1) through (4) of subsection (c), the equipment or service produced or provided by that entity poses an unacceptable risk to the national security of the United States or to the security and safety of people in the United States; and (2) The equipment or service is capable of doing at least one of the following: (A) Routing or redirecting users’ data traffic, or allowing someone to see user data or packets that the equipment or service transmits or otherwise handles; (B) Remotely disrupting the network of a provider of advanced communications service; or (C) Otherwise posing an unacceptable risk to the national security of the United States or to the security and safety of people in the United States. (c) Reliance on certain determinations.—When acting under subsection (b)(1), the Commission must put on the list any communications equipment or service that poses an unacceptable risk to the national security of the United States or to the security and safety of people in the United States based only on one or more of these determinations: (1) A specific determination by an executive-branch interagency body with appropriate national-security expertise, including the Federal Acquisition Security Council established under section 1322(a) of title 41. (2) A specific determination by the Department of Commerce under Executive Order No. 13873, which concerns securing the information and communications technology and services supply chain. (3) The equipment or service is covered telecommunications equipment or services as defined in section 889(f)(3) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019. (4) A specific determination by an appropriate national-security agency. (d) Updating of list.— (1) In general.—The Commission must periodically update the list published under subsection (a) to address changes in the determinations described in paragraphs (1) through (4) of subsection (c). (2) Monitoring of determinations.—The Commission must monitor when the determinations described in paragraphs (1) through (4) of subsection (c) are made or reversed. The purpose is to put additional communications equipment or services on the list published under subsection (a), or to remove communications equipment or services from that list. If a determination described in any of those paragraphs provided the basis for the Commission’s determination under subsection (b)(1) concerning a communications equipment or service, and that determination is reversed, the Commission must remove the equipment or service from the list. However, the Commission may not remove it if another determination described in any of those paragraphs provides a basis for including it on the list under subsection (b)(1). (3) Public notification.—For each 12-month period in which the list published under subsection (a) is not updated, the Commission must notify the public that no updates were necessary during that period to protect national security or to address changes in the determinations described in paragraphs (1) through (4) of subsection (c).