S. 3519

119 S3519 IS: Remote Access Security Act
 U.S. Senate
 2025-12-17
 text/xml
 EN
 Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
 II
 119th CONGRESS  1st Session
 S. 3519
 IN THE SENATE OF THE UNITED STATES
 December 17, 2025
  Mr. McCormick  (for himself,  Mr. Wyden ,  Mr. Cotton , and  Mr. Coons ) introduced the following bill; which was read twice and referred to the  Committee on Banking, Housing, and Urban Affairs
 A BILL
To amend the Export Control Reform Act of 2018 to provide for control of remote access to items, and for other purposes.
1.
Short title
This Act may be cited as the   Remote Access Security Act  .
2.
Control of remote access of items under the Export Control Reform Act of 2018
(a)
Definition of remote access
Section 1742 of the Export Control Reform Act of 2018 ( 50 U.S.C. 4801 ) is amended by adding at the end the following:
(15)
Remote access
(A)
In general
The term  remote access  means access to an item subject to the jurisdiction of the United States and included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations, by a foreign person of concern through a cloud infrastructure service from a location outside the United States and other than where the item is physically located, if the Secretary determines that the use of the item has demonstrated a serious risk to the national security or foreign policy of the United States through the use of software, such as by—
(i)
training an artificial intelligence dual-use model that—
(I)
substantially lowers the barrier of entry for experts or nonexperts to design, synthesize, acquire, or use chemical, biological, radiological, or nuclear weapons or other weapons of mass destruction;
(II)
conducts offensive cyber operations through automated vulnerability discovery and exploitation against a wide range of potential targets of cyber attacks (not including for defensive purposes such vulnerability reporting or mitigation); or
(III)
evades human control or oversight of automated systems through means of deception or obfuscation;
(ii)
accessing capabilities primarily designed for offensive cyberspace operations (not including accessing such capabilities for network defense activities); or
(iii)
conducting surveillance primarily designed to undermine human rights, such as by using spyware (as defined in section 1102A of the National Security Act of 1947 ( 50 U.S.C. 3232a(a) )), location tracking technology, or biometric identification technology primarily designed for such surveillance.
(B)
Cloud infrastructure service defined
For purposes of subparagraph (A), the term  cloud infrastructure service  has the meaning given the term  Infrastructure as a Service  by the National Institute of Standards and Technology in Special Publication 800–145 (or any successor publication).
(16)
Foreign person of concern
The term  foreign person of concern  means—
(A)
the government of—
(i)
a country specified in section 4872(f)(2) of title 10, United States Code; or
(ii)
any region within such a country, including the Macau Special Administrative Region and the Hong Kong Special Administrative Region of the People’s Republic of China;
(B)
an entity located or headquartered in, or the ultimate parent company of which is headquartered in, such a country or region; or
(C)
a person subject to the jurisdiction of a government described in subparagraph (A).
 .
(b)
Statement of policy
Section 1752 of the Export Control Reform Act of 2018 ( 50 U.S.C. 4811 ) is amended—
(1)
in paragraph (1)—
(A)
in subparagraph (A), by inserting  , and provision of remote access to,  after  export of ; and
(B)
in subparagraph (B), by inserting  , and provision of remote access to,  after  export of ; and
(2)
in paragraph (2)—
(A)
in the matter preceding subparagraph (A), by inserting  , and provision of remote access to,  after  transfer of ; and
(B)
in subparagraph (A), in the matter preceding clause (i), by inserting  , or provision of remote access to,  after  release of .
(c)
Authority of President
Section 1753 of the Export Control Reform Act of 2018 ( 50 U.S.C. 4812 ) is amended—
(1)
in subsection (a)—
(A)
in paragraph (1), by striking  and  at the end;
(B)
in paragraph (2)(F), by striking the period at the end and inserting  ; and ; and
(C)
by adding at the end the following:
(3)
the provision of remote access to items subject to the jurisdiction of the United States to foreign persons of concern.
 ;
(2)
in subsection (b)—
(A)
in paragraph (6), by striking  and  at the end;
(B)
in paragraph (7), by striking the period at the end and inserting  ; and ; and
(C)
by adding at the end the following:
(8)
regulate the provision of remote access to items described in subsection (a)(3).
 ; and
(3)
in subsection (c)—
(A)
by inserting  , or provision of remote access to,  after  in-country transfer of ;
(B)
by striking  subsections (b)(1) or (b)(2)  and inserting  paragraphs (1), (2), and (8) of subsection (b), as applicable, ; and
(C)
by striking  or in-country transfer occurs  and inserting  in-country transfer, or provision of remote access occurs .
(d)
Additional authorities
Section 1754 of the Export Control Reform Act of 2018 ( 50 U.S.C. 4813 ) is amended—
(1)
in subsection (a)—
(A)
in paragraph (3), by inserting  , and provision of remote access to,  after  transfers of ;
(B)
in paragraph (4), by inserting  , and provision of remote access to,  after  transfers of ;
(C)
in paragraph (5), in the matter preceding subparagraph (A), by inserting  , and provision of remote access to,  after  transfers of ;
(D)
in paragraph (6), by striking  United States export control  and inserting  United States control ;
(E)
in paragraph (7), by striking  export controls  and inserting  controls ;
(F)
in paragraph (10), by striking  or in-country transferred  and inserting  in-country transferred, or accessed remotely ;
(G)
in paragraph (11), by adding at the end before the semicolon the following:  or remote access ; and
(H)
in paragraph (15), by striking  to export  and inserting  for export, reexport, in-country transfer, or provision of remote access ;
(2)
in subsection (b), by inserting  , or provision of remote access to,  after  transfer of ; and
(3)
in subsection (d)(1)(A), by inserting  , or provision of remote access to,  after  in country-transfer of .
(e)
Administration of controls
Section 1755 of the Export Control Reform Act of 2018 ( 50 U.S.C. 4814 ) is amended—
(1)
in subsection (b)(2)—
(A)
in subparagraph (C), by inserting  , and provision of remote access to,  after  in-country transfers of ; and
(B)
in subparagraph (E), by inserting  , and remote access to,  after  in-country transfers of ; and
(2)
in subsection (c), by striking  export controls  and inserting  controls .
(f)
Licensing
Section 1756 of the Export Control Reform Act of 2018 ( 50 U.S.C. 4815 ) is amended—
(1)
in subsection (a), in the matter preceding paragraph (1), by inserting  , and provision of remote access to,  after  in-country transfer of ; and
(2)
in subsection (b), by inserting  , or provide remote access to,  after  in-country transfer .
(g)
Compliance assistance
Section 1757 of the Export Control Reform Act of 2018 ( 50 U.S.C. 4816 ) is amended—
(1)
in subsection (a), by inserting  , or provision of remote access to,  after  in-country transfer of ; and
(2)
in subsection (c)(2), by striking  export controls  and inserting  controls .
(h)
Penalties
Section 1760 of the Export Control Reform Act of 2018 ( 50 U.S.C. 4819 ) is amended—
(1)
in subsection (a)(2)(F)—
(A)
in clause (ii), by striking  any export control document or any report  and inserting  any document or report ; and
(B)
in clause (iii), by inserting  , or provision of remote access to,  after  in-country transfer of ;
(2)
in subsection (c)(1)(C), by striking  or in-country transfer  and inserting  in-country transfer, or remotely access ; and
(3)
in subsection (e)(1)(A)—
(A)
in clause (i), by inserting  , or remotely access or provide remote access to,  after  United States ; and
(B)
in clause (ii), by striking  or in-country transfer  and inserting  in-country transfer, or remotely access, or provide remote access to, .
(i)
Enforcement
Section 1761 of the Export Control Reform Act of 2018 ( 50 U.S.C. 4820 ) is amended—
(1)
in subsection (a)(5), by striking  or in-country transferred  and inserting  in-country transferred, or remotely accessed ; and
(2)
in subsection (h)(1)(B), by inserting  , or provide remote access to,  after  in-country transfer .
(j)
Annual report
Section 1765(a)(1) of the Export Control Reform Act of 2018 ( 50 U.S.C. 4824(a)(1) ) is amended by inserting  , and provision of remote access to,  after  in-country transfers of .
(k)
Effect on other Acts
Section 1767 of the Export Control Reform Act of 2018 ( 50 U.S.C. 4825 ) is amended—
(1)
in subsection (a), by inserting  , or remote access to,  after  reexport of ; and
(2)
in subsection (b)(2)—
(A)
in subparagraph (A), by inserting  , and remote access by and provision of remote access to such persons to,  after  persons of ; and
(B)
in subparagraph (C), by striking  or in-country transferred  and inserting  in-country transferred, or remotely accessed .
(l)
Termination
The authority under part I of the Export Control Reform Act of 2018, as amended by this section, to impose controls on remote access to items terminates on the date that is 10 years after the date of the enactment of this Act.
3.
Consultations with Congress
The Secretary of Commerce shall ensure Congress is kept fully and currently informed of any anticipated promulgation of regulations to control remote access to items under the Export Control Reform Act of 2018, as amended by section 2, including ensuring that Congress is informed, in a classified setting as necessary, on—
(1)
the national security or foreign policy risk that would be addressed by the regulations;
(2)
how the method of the regulations addresses that risk; and
(3)
how the regulations may impact the economy of the United States, including the impact on the competitiveness of United States industry in cloud services and related industries as a result of the regulations.
4.
Report and recommendations
(a)
In general
Not later than 1 year after the date of the enactment of this Act, the Secretary of Commerce shall submit to Congress and make available to the public a report assessing and making recommendations with respect to—
(1)
the implementation of this Act and the amendments made by this Act;
(2)
maximizing the level of privacy, and minimizing compliance costs, for entities seeking licenses relating to remote access to items under the Export Control Reform Act of 2018, as amended by section 2;
(3)
improving the speed at which and consistency with which applications for such licenses are reviewed;
(4)
identifying relevant national security and foreign policy concerns related to remote access to items in the interest of improving certainty for United States businesses;
(5)
increasing cooperation with international partners with respect to remote access to items;
(6)
ensuring export controls relating to remote access to items are consistent, clear, and up to date; and
(7)
recommending amendments to the Export Control Reform Act of 2018 to strengthen the provisions of that Act relating to remote access.
(b)
Consultations
In developing the report required by subsection (a), the Secretary shall seek input from the public, including holding a public roundtable with industry participants.