1. Short title This Act may be cited as the Bolstering America’s Defenses Against Potentially Perilous Software Act or the BAD APPS Act . 2. Risk framework for foreign mobile applications of concern (a) In general The Secretary of Defense shall— (1) create categorical definitions of foreign mobile applications of concern with respect to personnel or operations of the Department of Defense, distinguishing among categories such as applications for shopping, social media, entertainment, or health; and (2) create a risk framework with respect to Department personnel or operations that assesses each foreign mobile application (or, if appropriate, grouping of similar such applications) that is from a country of concern for any potential impact on Departmental personnel and Departmental operations, incorporating considerations of— (A) the manner and extent of data collection by the application; (B) the ability of the application to influence the user with the applications content to the detriment of the United States; (C) the manner and extent of foreign ownership or control of the application or data collected by the application; (D) any foreign government interests associated with the applications; (E) a software bill of materials with a focus on known or assessed malicious software embedded in the application, including in prior versions of the application or in other applications created by the owners of such application; (F) any known impact from prior use of the application to Department personnel or operations