§2279 Foreign Commercial Satellite Services and Foreign Launches

Summary

The Secretary of Defense must not sign a contract for satellite services with a foreign company if the Secretary reasonably believes the foreign government can influence the company’s satellite operations, the services will be provided from a covered foreign country, or the deal would create an unacceptable cybersecurity risk. The Secretary also must not buy services that use satellites designed or made in a covered foreign country or by an entity controlled by such a foreign government, or that are launched on a vehicle designed, made, or provided by a covered foreign country or its controlled entity, unless the launch happens in the United States. The launch limits do not apply to launches before December 31, 2022, or to launch contracts that were fully paid for or backed by a legal commitment by the contractor before the date that is 180 days after the date of the enactment of this subsection. The bans can be waived if the Secretary decides the contract is needed for U.S. national security and, at least 7 days before signing, sends the congressional defense committees a national security assessment done with the Director of National Intelligence. That assessment must list the contract period, money, and services; describe any covered-foreign-country ownership or services; explain why the contract is needed and how to avoid similar deals later; and give a risk assessment covering mission assurance, information security, and any fixes. Assessments should be unclassified but may include a classified annex. The Secretary may only give the waiver power to the Deputy Secretary of Defense, the Under Secretary of Defense for Policy, or the Under Secretary of Defense for Acquisition and Sustainment, and those officials may not delegate it further. A “covered foreign country” means the countries in section 1261(c)(2) of the National Defense Authorization Act for Fiscal Year 2013 and the Russian Federation. “Cybersecurity risk” means threats to information or information systems and harms from unauthorized access, use, disclosure, disruption, modification, or destruction, including acts of terrorism.