Remote Access Security Act

Bill Number

S. 3519

Origin Chamber

Senate

Congress

119th Congress, Session 1

Policy Area

Foreign Trade and International Finance

Status

Introduced

Latest Action

2025-12-17: Read twice and referred to the Committee on Banking, Housing, and Urban Affairs.

Last Updated

2026-06-19T11:03:25Z

AI-Generated Summary

Purpose of the Legislation

The Remote Access Security Act (S. 3519) aims to strengthen U.S. national security and foreign policy by extending export controls to include "remote access" to certain sensitive technologies and items. It targets risks from foreign entities accessing these items through cloud services, such as those involving artificial intelligence (AI), cyber operations, or surveillance tools that could enable weapons development or human rights abuses.

Key Provisions

• Definitions:
• Remote access: Access by a "foreign person of concern" to U.S.-controlled items (listed on the Commerce Control List) via cloud infrastructure services from outside the U.S., if it poses a serious national security or foreign policy risk. Examples include using AI to design weapons of mass destruction, conduct offensive cyber attacks (excluding defensive uses), or enable deceptive surveillance with tools like spyware or biometric tech.
• Foreign person of concern: Includes governments of covered countries (e.g., those posing national security threats under U.S. law, like certain regions in China), entities headquartered there, or individuals under their jurisdiction.
• Cloud infrastructure service: Defined as "Infrastructure as a Service" per NIST standards (a framework for cloud computing where providers offer virtualized computing resources over the internet).

• Policy and Authority Updates:
• Inserts "provision of remote access to" throughout the Export Control Reform Act of 2018 (ECRA), treating it similarly to exports, reexports, or in-country transfers.
• Grants the President authority to regulate remote access to controlled items by foreign persons of concern.
• Expands enforcement tools, including licensing requirements, compliance assistance, penalties for violations (e.g., fines up to $1 million or imprisonment), and annual reporting on remote access activities.

• Oversight and Reporting:
• Requires the Secretary of Commerce to consult with Congress on new regulations, sharing details on risks, methods, and economic impacts (e.g., on U.S. cloud industry competitiveness) in classified settings if needed.
• Mandates a public report within one year of enactment, assessing implementation, recommending ways to reduce compliance costs and privacy risks for license applicants, improve review processes, enhance international cooperation, and update ECRA for clarity.
• The report includes public input via a roundtable with industry.

• Termination Clause:
• Controls on remote access expire 10 years after enactment, unless renewed.

Significant Changes to Existing Law

• Expands the ECRA (50 U.S.C. 4801 et seq.), which previously focused on physical exports and transfers, to explicitly cover digital remote access via cloud services— a gap in prior law due to evolving technology like AI and cloud computing.
• Adds remote access as a regulable activity alongside traditional export controls, updating licensing, penalties, and enforcement sections to include it (e.g., violations now encompass "remotely accessing" controlled items).
• Introduces time-limited authority (10 years) for these controls, unlike the ongoing nature of standard ECRA provisions.
• Enhances congressional involvement in rulemaking and requires economic impact assessments, promoting transparency not as emphasized in the original ECRA.

Potential Impacts

• Government Agencies: The Department of Commerce gains expanded regulatory duties, including license reviews and international coordination, potentially increasing workload but improving tools to counter security threats. Enforcement agencies (e.g., via penalties) will monitor cloud-based access more rigorously.
• Citizens and Businesses: U.S. companies in cloud services, AI, and tech sectors may face new licensing hurdles and compliance costs when serving foreign clients, possibly slowing innovation or raising prices. However, it could boost certainty for ethical businesses by clarifying rules. Citizens benefit indirectly through reduced risks from foreign misuse of U.S. tech.
• International Relations: Strengthens U.S. leverage against adversarial nations (e.g., by restricting access for entities in China or similar areas), but may strain trade ties or prompt retaliatory measures. Encourages cooperation with allies on export controls, potentially harmonizing global standards for remote access.

Main Stakeholders Affected

• U.S. Government: Department of Commerce (lead regulator), Congress (oversight role), and national security agencies (input on risks).
• U.S. Businesses: Tech firms providing cloud infrastructure, AI developers, and exporters of controlled items, who must navigate new licenses and compliance.
• Foreign Entities: "Persons of concern" (governments, companies, or individuals from specified countries), facing restricted access to U.S. tech.
• International Partners: Allied nations, benefiting from potential collaborations on controls but possibly affected if U.S. rules disrupt global cloud markets.
• Public and Civil Society: Advocacy groups on human rights and privacy, influencing the required report through public input.

Notable Legal, Constitutional, or Political Implications

• Legal: Broadens "export" interpretations under ECRA to include non-physical access, potentially tested in courts over jurisdiction (e.g., what constitutes U.S. "control" of cloud-based items). Aligns with existing penalties but adds specificity for digital violations, ensuring enforceability without new constitutional challenges.
• Constitutional: Supports national security powers under Article I (Congress's commerce clause) and the President's foreign affairs authority, but requires balancing with First Amendment concerns if regulations limit information flows—mitigated by targeted focus on security risks.
• Political: Bipartisan sponsorship (e.g., Senators from both parties) signals consensus on tech security amid U.S.-China tensions. The 10-year sunset and economic impact reviews address industry concerns, reducing politicization, while public reporting promotes accountability and could influence future tech policy debates.

This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.

Sponsor

Sen. McCormick, David [R-PA]

Cosponsors (4)

Sen. Wyden, Ron [D-OR], Sen. Cotton, Tom [R-AR], Sen. Coons, Christopher A. [D-DE], Sen. Scott, Rick [R-FL]

Recent Actions

• 2025-12-17: Read twice and referred to the Committee on Banking, Housing, and Urban Affairs.
• 2025-12-17: Introduced in Senate

Bill Versions

• Remote Access Security Act — issued 2025-12-17 — PDF (13 pages)