Cloud Security Act
- Sponsor
- Rep. Gottheimer, Josh [D-NJ-5]
- Committees
- Judiciary Committee (primary)
- Last action
- Jun 30, 2026
Bottom line
The bill facilitates the sharing of certain customer data by cloud providers with the Department of Commerce for export control enforcement related to advanced AI and specified foreign entities.
What it actually does
This bill amends Title 18 of the U.S. Code to create new exceptions that allow providers of electronic communication services and remote computing services to disclose customer communications and records to the Secretary of Commerce. These disclosures are permitted when the provider, in good faith, believes the information relates to the use of a 'covered cloud product' by a 'specified foreign entity' and is necessary to comply with regulations issued under the Export Control Reform Act of 2018.
Proponents argue
Proponents argue this bill is crucial for national security, enabling the U.S. government to monitor and prevent hostile foreign entities from illicitly acquiring or utilizing advanced AI capabilities developed with U.S. technology. It closes a potential loophole in existing export control regulations by allowing cloud providers to proactively report suspicious activities without violating privacy laws.
Opponents contend
Opponents might raise concerns about privacy implications, arguing that expanding exceptions to privacy protections, even for national security, could lead to overreach or unintended surveillance. They might also question the scope of 'specified foreign entities' and 'covered cloud products,' fearing it could inadvertently impact legitimate international business or research.
The bill is short and relatively straightforward for those familiar with legal text, allowing sufficient time for evaluation.
Section 2(a) of the bill, amending 18 U.S.C. 2702(b)
Disclosure of Communications to Secretary of Commerce
This provision amends federal law to allow providers of electronic communication services to disclose the contents of communications to the Secretary of Commerce. This is permitted if the disclosure is for complying with Export Control Reform Act regulations, the provider believes the communication relates to a 'specified foreign entity' using a 'covered cloud product,' and the disclosure is limited to what's reasonably necessary for verification or reporting.
Supporters argue
Supporters would argue this provision is essential for national security, allowing the government to track and prevent the misuse of advanced AI technologies by adversarial foreign entities. It provides a necessary legal pathway for cloud providers to cooperate with export control enforcement without fear of violating privacy laws.
Critics contend
Critics might contend that this provision broadens government surveillance capabilities, potentially eroding privacy protections for individuals and legitimate businesses. They may argue it creates a precedent for further expansion of data sharing without judicial oversight.
Tradeoffs
Balances national security interests in preventing technology transfer to adversaries against individual and corporate privacy rights.
Section 2(b) of the bill, amending 18 U.S.C. 2702(c)
Disclosure of Customer Records to Secretary of Commerce
This section allows providers of remote computing services to disclose customer records (non-content information) to the Secretary of Commerce. This is permissible under the same conditions: for Export Control Reform Act compliance, belief of use by a 'specified foreign entity' with a 'covered cloud product,' and limited to the record or other information reasonably necessary for verification or reporting.
Section 2(c) of the bill, amending 18 U.S.C. 2711
Key Definitions for Cloud Security
This section adds several critical definitions to Title 18, including 'AI model,' 'covered cloud product,' and 'covered integrated circuit.' These definitions are highly technical, specifying parameters for AI models (e.g., 1 billion parameters), types of cloud services (IaaS, PaaS, SaaS for AI development), and integrated circuits (based on Export Control Classification Numbers or specific performance metrics). It also defines 'specified foreign entity' by referencing the Internal Revenue Code.
Defines 'specified foreign entity' by referencing section 7701(a)(51)(B) of the Internal Revenue Code of 1986.
Section 2(c)(8), amending 18 U.S.C. 2711(8)
Why it matters:Standard legislative practice to define terms by reference to existing law to avoid redundancy and ensure consistency. However, using the Internal Revenue Code for a national security bill might be considered less intuitive.
Case for: Using an existing, established definition from the IRS code provides legal clarity and consistency, avoiding the need to craft a new definition that might introduce ambiguities or conflicts with existing federal policy.
Case against: The definition in the IRS code might not perfectly align with the national security objectives of this bill, potentially leading to an overly broad or narrow application. It also requires legal professionals to consult a separate, complex body of law.
Estimated impact: This definition is foundational to the entire bill, determining which foreign entities trigger the reporting requirements. Its scope directly impacts the effectiveness and reach of the new exceptions.
States that the definition of 'covered integrated circuit' (as given in subparagraph (A)) can be modified by the Secretary of Commerce beginning 24 months after the date of enactment.
Section 2(c)(7)(B), amending 18 U.S.C. 2711(7)(B)
Why it matters:Could be seen as standard practice to allow agencies flexibility to adapt to evolving technology without requiring new legislation. However, granting such broad authority within a definition can obscure its significance.
Case for: Proponents would argue this flexibility is crucial given the rapid pace of technological advancement in AI and integrated circuits. It allows the government to adapt export controls to new threats and innovations without constant legislative updates.
Case against: Critics might argue this grants excessive power to the executive branch, allowing significant changes to the scope of the law without congressional review. It could lead to uncertainty for industry if definitions are frequently altered.
Estimated impact: This provision could fundamentally alter the scope of the bill's application to hardware over time, potentially expanding or narrowing the types of integrated circuits that trigger reporting requirements.