Risk Framework for Foreign Mobile Applications of Concern

Statutory Text

(a) In General.—Not later than 180 days after the date of the enactment of this Act, the Chief Information Officer of the Department of Defense, in coordination with the Under Secretary of Defense for Intelligence and Security, shall submit to Congress a report on—

(1) the feasibility and advisability of developing comprehensive guidance on personal mobile devices and mobile applications for personnel of the Department of Defense;

(2) the feasibility and advisability of developing categorical definitions of mobile applications of concern with respect to personnel or operations of the Department of Defense;

(3) the feasibility and advisability of creating, and updating not less than annually, a risk framework with respect to Department personnel or operations that assesses mobile applications or groupings thereof for potential risks to the personnel or operations of the Department, including—

(A) the collection, retention, sale, and potential misuse of data;

(B) exposure to misinformation and disinformation;

(C) software bill of materials; and

(D) ownership, origination, authorship, or other relationship of an application with the governments of the Russian Federation, the People’s Republic of China, the Islamic Republic of Iran, or the Democratic People’s Republic of Korea;

(4) a description of any statutory or policy restrictions affecting ability of the Department to provide guidance to personnel of the Department regarding personal mobile devices and applications, including any variations of such guidance based on location, status, visibility, or work role; and

(5) such other information as the Chief Information Officer of the Department of Defense determines appropriate.

Verbatim from the enrolled law as published by GovInfo; margin notes and page markers omitted. Pub. L. 118-159 on GovInfo · PDF · text fetched Oct. 17, 2026

How the Date Is Worked Out

1. Enacted Dec. 23, 2024 (Pub. L. 118-159).
2. Text: “Not later than 180 days after the date of the enactment of this Act.” Dec. 23, 2024 + 180 days = June 21, 2025.
3. As of Nov. 11, 2026: one-time deadline passed on June 21, 2025.

Delivery Status

Not publicly verifiable

Public Evidence

• No public document located that shows delivery.

Evidence Searched

• GovInfo Congressionally Mandated Reports collection: 1,209 packages listed; titles searched for Middle East terms; 55 State, Defense, Treasury and executive-office summaries checked for citations to Pub. L. 118-159 (0 found) (Oct. 17, 2026)
• MEF hand review: evidence.json, items with a link and a note on what the document shows (Oct. 17, 2026)

A status of “Reported late by GAO, committee or agency” appears only with a linked GAO, committee or agency statement. Reports sent only to committees, or in classified form, leave no public trace; their absence here is not evidence of a missed deadline.

Review

• Machine-extracted by rule from the public law text; awaiting named human review.