S3900-119

What This Bill Does

The reported Iran Human Rights, Internet Freedom, and Accountability Act authorizes State to lead federal Iran internet-freedom coordination and requires a 120-day update to the existing fiscal year 2025 defense authorization strategy. The update evaluates VPNs, centralized and peer-to-peer networks, alternatives, deployment limitations, blackout capabilities, and sanctions implementation that does not block lawful civilian access tools. A second 120-day report evaluates direct-to-cell service, drones, jamming, service-provider ownership, and communications risks. Existing internet-freedom funding is extended through fiscal year 2030. State may use existing interagency mechanisms to develop and rapidly acquire scalable anti-shutdown tools, with required attention to user detectability, cybersecurity, data, supply chains, sanctions, export controls, and diversion to Iran or sanctioned entities; State reports annually. A 120-day human-rights strategy covers civil society, uncensored news, independent journalists, training, partners, metrics, and budgets. GAO must audit fiscal years 2024-2025 Near East Regional Democracy spending within 180 days while protecting identities and operational details. State should establish cybersecurity training and vetted digital tools, report protected aggregate metrics twice yearly, coordinate with existing programs, and receive a GAO evaluation after three years. The reported bill omits the introduced congressional-request sanctions-determination process, omits the new interagency working group, removes the bill-specific authorizations of such sums for fiscal years 2027-2030, narrows the anti-shutdown program to Iran, and relies on State funds. It adds sanctions and export-control savings, user-safety safeguards, and protected reporting.

Who Benefits and How

Iranian journalists, human-rights defenders, civil-society organizations, protesters, and ordinary internet users may gain circumvention tools, cybersecurity training, secure communications, independent news, grants, and safer technology deployment. Companies providing licensed internet-access tools gain clearer sanctions coordination and potential procurement opportunities. Congress gains strategy updates, annual implementation reports, protected metrics, and GAO audits. U.S. agencies and implementing partners gain explicit authority to use existing coordination and acquisition systems while protecting partner identities and sensitive methods.

Who Bears the Burden and How

State, Treasury, Commerce, the Federal Communications Commission, Defense, other agencies, and GAO must update strategies, assess technologies, coordinate sanctions and procurement, vet risks, administer programs, protect sensitive information, and report on short deadlines. Grant and technology partners must meet cybersecurity, safety, supply-chain, sanctions, export-control, and diversion safeguards. The Iranian government, censorship operators, sanctioned persons, and suppliers of surveillance or shutdown capabilities face higher circumvention, exposure, and enforcement risk. The final bill reduces federal fiscal and organizational burdens by removing the new working group and separate open-ended appropriations, but cybersecurity program creation becomes discretionary rather than mandatory.

Key Provisions

• Requires a 120-day update to the Iran internet-freedom strategy and ongoing reviews.
• Requires direct-to-cell, jamming, drone, ownership, and telecommunications-risk reporting.
• Extends existing internet-freedom funding through fiscal year 2030.
• Authorizes existing interagency mechanisms to develop and acquire anti-shutdown technology with user-safety safeguards.
• Requires a human-rights assistance strategy and protected GAO audit of Iran-related democracy spending.
• Provides cybersecurity training, vetted digital tools, protected biannual metrics, and a three-year GAO review.
• Restricts implementation through sanctions, export-control, no-force, and State-funding savings clauses.