This bill mandates the Assistant Secretary of Commerce for Communications and Information to submit a comprehensive report to Congress within one year of its enactment. The report will examine the cybersecurity of mobile service networks and their vulnerability to cyberattacks and surveillance conducted by adversaries. It specifically focuses on mobile service networks, excluding 5G protocols and networks, and limits its assessment of vulnerabilities to those exploited in non-laboratory settings or feasibly exploitable in real-world conditions.

The report must assess the degree to which mobile service providers have addressed cybersecurity vulnerabilities identified by various experts and federal agencies. It will also discuss how customers consider cybersecurity in purchasing decisions and the commercial availability of tools for evaluating cybersecurity risks. Additionally, the report will detail the implementation of cybersecurity best practices and risk assessment frameworks by providers.

Key technical aspects to be covered include an estimate and discussion of the prevalence and efficacy of encryption and authentication algorithms used across mobile service, equipment, devices, operating systems, and applications. The Assistant Secretary must also discuss barriers preventing providers from adopting more effective encryption and prohibiting older, vulnerable techniques. A significant component involves estimating the prevalence, costs, and usage by adversaries in the United States of cell site simulators and other mobile service surveillance technologies.

In preparing this report, the Assistant Secretary is required to consult with a wide range of stakeholders. These include the Department of Homeland Security, the Federal Communications Commission, the intelligence community, academic researchers, industry experts, and mobile service providers. The final report will be produced in an unclassified form, but may contain a classified annex, with potentially exploitable unclassified information redacted from the public version while still being provided to the relevant committees.