H.R. 7121: Securing Federal Devices from Chinese Applications Act

HR7121 would create a government-wide rule: a "covered application" could not be downloaded or used on a "Federal Government device." The bill is targeted at the executive branch, including Executive departments, military departments, Government corporations, Government controlled corporations, the Executive Office of the President, and independent regulatory agencies. It specifically excludes the governments of the District of Columbia and the territories and possessions of the United States, along with their subdivisions.

The scope of what counts as a banned app is broad. A "covered application" includes an app developed, owned, or controlled by an entity headquartered in the People’s Republic of China; an entity in which the government of the People’s Republic of China, the Chinese Communist Party, or someone acting on their behalf holds a controlling interest; or a parent, subsidiary, or affiliate of such an entity. It also includes any application the Secretary of Defense determines poses an undue risk to U.S. national security because of ownership, control, or influence by the People’s Republic of China.

The bill is built around deadlines. Within 180 days after enactment, and every 180 days afterward, the Director of the Office of Management and Budget must issue guidance on creating and updating the covered applications list, in consultation with the Secretary of Homeland Security, the Secretary of Defense, and the Director of National Intelligence. Then, within 270 days after enactment, each agency head must issue guidance for exceptions, including cybersecurity safeguards and documentation showing how risk will be mitigated.

This is not an absolute ban with no escape valve. Agency heads may allow use of a covered app if they determine it is needed "for ensuring appropriate and controlled access to fulfill a research or intelligence function required by law." Even then, the bill pushes agencies toward formal controls. Once an application is identified as covered, agency heads must ensure it is removed from federal devices within 60 days. The bill does not include a dollar amount, grant program, or civil or criminal penalty; instead, it relies on agency implementation, OMB guidance, and internal executive branch compliance.