Pentagon forced to audit and purge foreign cellular modules from military networks

What it does

This bill requires the Department of Defense to audit all military systems and infrastructure within 180 days to identify cellular modules made by Chinese entities or other foreign suppliers deemed a supply-chain risk, then report back to Congress within one year on what was found and how the Pentagon plans to remove or isolate those modules. The bill benefits military cybersecurity by forcing transparency about foreign-origin components in defense networks; it costs the Pentagon time and money to conduct the audit and execute mitigation (rip-and-replace, network isolation, or substitution with trusted suppliers).

Why we flagged it

The bill's core mechanism is a mandatory audit and mitigation program targeting foreign-origin cellular modules in DoD systems. It is a straightforward cybersecurity and supply-chain risk-management measure, not a deregulation, subsidy, or commemorative act.

What the text implies

• The audit may expose the extent to which Chinese and other foreign suppliers have penetrated DoD supply chains, potentially revealing years of undetected vulnerabilities in critical military systems.
• Mitigation timelines and costs could be substantial; 'rip-and-replace' of legacy assets across all military departments may require significant appropriations and operational disruption.
• The bill's definition of 'covered cellular module' is broad and includes any module from entities 'determined by the Secretary of Defense to present an unacceptable supply-chain risk,' giving DoD discretion to expand the scope beyond named Chinese entities.
• Requiring unclassified reports with optional classified annexes may limit public transparency on the full scope of vulnerabilities, though it balances operational security concerns.
• The Comptroller General's independent review (due 180 days after DoD's report) creates a second layer of oversight, potentially surfacing implementation gaps or cost overruns.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

The bill strengthens national security by forcing the Pentagon to identify and mitigate foreign-origin cellular modules in military systems, reducing the risk of remote access or data exfiltration by hostile actors. The primary cost—DoD audit and remediation effort—is a legitimate public investment in defense infrastructure integrity, not a burden on ordinary citizens.

Who stands to gain

• U.S. defense contractors and suppliers (as replacements for foreign modules under supply-chain subst
• Cybersecurity and network-isolation service providers (for compensating controls and remediation)

Named in the bill

Department of Defense, Secretary of Defense, Congressional Defense Committees, Comptroller General of the United States, People's Republic of China, NIST (National Institute of Standards and Technology), John S. McCain National Defense Authorization Act for Fiscal Year 2019

Where it stands

• Sep 29, 2026 — Introduced · Congress.gov: “Introduced in Senate”
• Sep 29, 2026 — Referred to Senate Committee on Armed Services · Congress.gov: “Read twice and referred to the Committee on Armed Services”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.