Explainer: From undercover employment to corporate data breaches: the "Combating Foreign Threats to Main Street Act"

The U.S. House of Representatives deliberates on a bipartisan bill to protect U.S. small business owners from cyber intrusion, technology theft, and supply chain threats from North Korea and other sources.

Editor's note: this story was translated from the original VOA Korean article.

A bipartisan bill that could help U.S. small businesses recognize threats from foreign adversaries, including the risk posed by North Korean workers posing as job candidates, was debated and passed in the House of Representatives on Wednesday. It now moves on to the Senate.

The core provision requires the Small Business Administration to develop and distribute educational materials so that businesses can recognize the risks identified by the U.S. government and learn how to respond.

What is this bill?

Its official title is the “Combating Foreign Threats to Main Street Act of 2026." It requires the Small Business Administration to guide businesses on how to identify, prevent, and respond to threats. The bill requires the SBA to develop materials in collaboration with relevant agencies and distribute them through regional offices and existing support programs. The SBA would be expected to use its existing budget to produce new materials.

Who is spearheading this effort?

Rep. Roger Williams, a Republican from Texas’s 25th Congressional District and chairman of the House Small Business Committee, is leading the effort. Williams has specifically identified China, Russia and North Korea as foreign threats the legislation seeks to address. Explaining the need for the bill, he said that “while many small businesses are exposed to foreign threats, they lack the resources and expertise to respond.”

Rep. Derek Tran, a Democrat representing California’s 45th Congressional District, is also involved in the effort. He serves on the House Small Business and Armed Services committees.

Why Is This Important for Small and Medium-Sized Enterprises?

“Even small companies have technology and information that needs to be protected”, according to the proposed bill.

For example, even a small software company may have programs it developed in-house. “If a manufacturer’s blueprints or customer and business partner information are leaked, it could harm the business”.

Chairman Williams’ office explained that “many small businesses lack the resources or expertise to identify and respond to increasingly sophisticated threats”.

The bill goes beyond simply alerting businesses to risk; it also provides guidance on prevention methods and where to seek assistance.

It includes guidelines to ensure that while risks are assessed when conducting business or receiving investments overseas, legitimate commercial activities are not unnecessarily restricted.

How is North Korea included?

The bill relies on the Commerce Department’s definition of “foreign adversary,” which includes North Korea. While it does not specifically address North Korea’s use of covert IT workers in U.S. companies, its coverage of cyber intrusions and its catch-all provision for emerging threats could allow the SBA to include such schemes.

During hiring: North Korean IT workers misrepresent their identities and actual work locations to secure remote work positions.

Once hired: They gain access to the company’s computer networks and the data necessary to perform their duties.

If that access is abused: It can lead to the theft of corporate information or extortion.

Last January, the FBI warned of a case in which North Korean IT personnel stole sensitive corporate data and program source code from a company and, after being discovered, used this as leverage to demand money.

In July of the same year, the FBI stated that companies that outsource IT work to third-party vendors may face additional vulnerabilities because they cannot directly manage the hiring process.

This alert is directed at U.S. companies in general. It does not mean that all affected companies are small and medium-sized enterprises.

What kind of assistance will companies receive?

The bill requires the SBA to guide companies on how to protect intellectual property, trade secrets, sensitive corporate information, and supply chains.

The proposed bill covers not only cybersecurity but also the import of goods produced through forced labor, counterfeit goods and illicit trade, and predatory investment practices.

What remains before it becomes law?

The bill now moves to the Senate. There is currently no Senate version of the bill, and this session of Congress ends in early January.

Here is the bill's history.

- September 10: The bill was introduced by Rep. Roger Williams (R-Texas), with Rep. Derek Tran (D-Calif.) as the Democratic co-sponsor.

- September 16: The House Small Business Committee voted 22–0 to recommend the bill to the full House.

- October 9: The committee’s official report was submitted.

- November 11: Passed by a voice vote. The Senate must approve it with the same wording, and the President must sign it.