A bipartisan group says unfinished export control rules leave civilian intelligence services able to obtain U.S. cyber, surveillance and AI assistance. #
A bipartisan, bicameral group of lawmakers is pressing the Commerce Department to finalize rules restricting Americans and U.S. companies from providing technology or technical assistance to civilian intelligence agencies in China, Russia and other foreign adversaries.
Sens. Ron Wyden, D-Ore.; John Cornyn, R-Texas; and Peter Welch, D-Vt.; along with Reps. Pat Harrigan, R-N.C.; Sara Jacobs, D-Calif.; and Michael McCaul, R-Texas, made the request Tuesday in a letter to Commerce Secretary Howard Lutnick.
“Foreign intelligence agencies in many countries can still legally hire consultants in the United States and buy advanced U.S. surveillance, cyber, and artificial intelligence technology,” they wrote.
In 2019, a landmark Reuters investigation exposed Project Raven, a secret UAE operation that recruited more than a dozen former U.S. intelligence personnel to hack activists, journalists, foreign governments and American citizens. Two years later, three members of that same operation entered deferred prosecution agreements and agreed to pay a combined $1.68 million to resolve charges that they violated U.S. hacking and export control laws through their work for the UAE.
Earlier this year, federal authorities seized 13 websites that suspected Chinese agents allegedly used to recruit current and former U.S. security-clearance holders for bogus consulting jobs and pressure them to provide insider information.
The Trump administration imposed controls in 2021 on Americans supporting military and intelligence agencies in China, Russia and several other countries. But those restrictions did not clearly extend to civilian intelligence and security services.
Congress sought to close that gap in 2022 by expanding the government’s authority to regulate Americans’ work for foreign military, security and intelligence agencies. The controls can cover services and technical assistance even when no U.S.-made product is involved.
Nextgov/FCW has asked the Commerce Department for comment on the letter.
Commerce’s Bureau of Industry and Security proposed implementing rules in 2024, but they were never finalized. The proposal would require Americans and U.S. companies to obtain a license before providing certain support to civilian or military intelligence agencies in 45 countries. Applications involving China would generally face a presumption of denial, while those involving Russia would be denied under existing policy.
The administration currently projects the measure to have been made an interim final rule in July, though no such rule has been published.
The lawmakers are urging Commerce to finish the regulations and strengthen them beyond what was proposed in 2024, calling for a “trusted countries” list limited to governments with strong human rights records that do not spy on the United States. Americans would need a license to work with intelligence or security agencies in any country outside that group.
They also want foreign surveillance contractors to disclose whether they serve intelligence or security agencies in untrusted countries before receiving U.S. technology or assistance, arguing that spyware providers can otherwise avoid scrutiny by concealing their government clients.
A third recommendation would broaden proposed controls on facial recognition systems to cover other biometric surveillance technologies, including tools that identify people by their gait or cardiac signature or classify them by traits such as race, sex or ethnicity. Wyden raised those recommendations in comments on the proposed rules in 2024.