§2279 Foreign commercial satellite services and foreign launches

Summary

The Secretary of Defense cannot sign a contract for satellite services with a foreign company if the Secretary reasonably believes any of these are true: the foreign government owns enough of the company to influence satellite operations; the services will be provided from a listed foreign country; or the deal would create an unacceptable cybersecurity risk. The Secretary also cannot contract for services that use satellites built or designed in a covered foreign country or by companies tied to that government, or that use a launch vehicle built or provided by a covered foreign country or its agents, no matter where the launch happens unless the launch is in the United States. The rule about launches does not apply to launches before December 31, 2022, or to contracts or launch agreements that were fully paid for or had a binding payment commitment by the contractor before the date that is 180 days after the date of the enactment of this subsection. A “launch vehicle” means a fully integrated space launch vehicle. The Secretary can override these bans if the Secretary decides the contract is needed for U.S. national security and, after talking with the Director of National Intelligence, sends a national security assessment to the congressional defense committees at least 7 days before signing. That assessment must describe the time and cost, the services, any foreign ownership and where services will be done, why the contract is needed and how to avoid such contracts later, and a risk review with steps to reduce risks. Only the Deputy Secretary of Defense, the Under Secretary of Defense for Policy, or the Under Secretary of Defense for Acquisition and Sustainment may be given the power to approve such exceptions, and they cannot pass that power on to others. Assessments must be unclassified but can include a classified annex. A “covered foreign country” means the countries listed in section 1261(c)(2) of the National Defense Authorization Act for Fiscal Year 2013 and the Russian Federation. “Cybersecurity risk” means threats to information or information systems from unauthorized access, use, or damage, including acts of terrorism.