; or (3) is an unmanned aircraft system that, as procured or as modified after procurement but before operational use, can no longer transfer to, or download data from, a covered foreign entity and otherwise poses no national security cybersecurity risks as determined by the exempting official. (c) Waiver The head of an agency may waive the prohibition under subsection (a) on a case-by-case basis for a year, which may be renewed— (1) with the approval of the Secretary of Homeland Security or the Secretary of Defense