What changed between these versions
A complete substitute amendment. v2 fundamentally restructures the bill, replacing several sections, modifying key policy statements, and altering the scope and mechanisms for promoting internet freedom and human rights in Iran. The new version introduces additional safeguards for sensitive information and clarifies funding derivation, while removing specific mandates for a working group and reducing authorized appropriations for certain programs.
Overview
Extensive changes throughout the bill, constituting a complete substitute amendment. · v2 fundamentally restructures the approach, shifting some mandates to authorizations, refining policy statements, and introducing new safeguards and coordination requirements, while also removing some specific funding authorizations and reporting requirements.
v2 is a complete substitute amendment that fundamentally restructures the "Iran Human Rights, Internet Freedom, and Accountability Act of 2026." Key changes include shifting the primary legal authority for internet freedom strategy, modifying the scope of internet access technology development, and refining the policy statements on human rights and sanctions. The new version also adds provisions for protecting sensitive information and clarifies funding, while removing a section on identifying human rights violators and reducing specific funding authorizations.
Major additions
This new subsection amends Section 414 of the Iran Threat Reduction and Syria Human Rights Act of 2012 to include a requirement for relevant Federal departments and agencies to ensure that sanctions enforcement does not impede companies providing technology to Iranian civilians for open internet access.
This addition introduces a specific directive to mitigate potential unintended negative consequences of sanctions on legitimate technology providers, aiming to facilitate internet freedom for Iranian civilians.
This new objective for the development of internet access technologies requires that any supported technology be assessed for user safety, detectability by hostile governments, cybersecurity vulnerabilities, data protection, supply-chain risks, sanctions and export-control compliance, and risk of diversion to the Iranian regime or sanctioned entities.
This significantly enhances the security, privacy, and compliance considerations for technologies developed or supported under this program, aiming to protect users and prevent misuse by the Iranian regime. It introduces a robust framework for vetting technologies.
This new element for collaboration on acquisition strategies ensures that strategies account for the specific challenges presented by the country context, including logistical barriers to large-scale technology distribution and security risks to civilians using the technologies.
This addition introduces practical, on-the-ground considerations for the deployment of internet access technologies, aiming to improve their effectiveness and safety in the challenging Iranian environment.
This new provision requires the Comptroller General of the United States to ensure that the report on Near East Regional Democracy (NERD) expenditures does not publicly disclose sensitive information, such as personally identifiable information, implementing-partner identities, operational details, or cybersecurity methods, which could endanger individuals or compromise programs.
This aims to safeguard individuals, implementing partners, and the integrity of sensitive programs by preventing the public disclosure of information that could be exploited by hostile actors.
This new subsection requires the Secretary of State to coordinate with and build upon existing Iran internet freedom programs, including those established under section 5124 of the National Defense Authorization Act for Fiscal Year 2025, to avoid duplication and maximize effectiveness.
This promotes efficiency and synergy across related initiatives, ensuring that new cybersecurity capacity programs leverage existing efforts and resources, thereby optimizing impact and resource allocation.
This new section, titled 'Sanctions and Export Control Savings Clause,' clarifies that nothing in the Act may be construed to authorize any transaction prohibited by existing sanctions or export control authorities, except pursuant to a general or specific license or other authorization.
This provides legal clarity and reinforces adherence to existing regulatory frameworks, ensuring that the Act's provisions do not inadvertently undermine or conflict with established sanctions and export control laws.
This new section, titled 'Derivation of Funds,' specifies that amounts made available to carry out this Act shall be derived from amounts authorized to be appropriated or otherwise made available to the Department of State.
This clarifies the funding source for the Act's activities, providing transparency regarding how the programs authorized by the Act will be financed.
Deletions
This entire section, titled 'Identification of Individuals Supporting Human Rights Violations,' mandated that the President, upon written request from congressional committees, determine whether a foreign person engaged in providing material support for Iranian regime abuses (including censorship or repression) and submit a justification for imposing sanctions.
The deletion of this section removes a specific, direct mechanism for congressional oversight and presidential action regarding the identification and sanctioning of individuals supporting human rights violations by the Iranian regime. This changes the framework for accountability under this Act.
This subsection authorized the appropriation of 'such sums as may be necessary for each fiscal year 2027 through 2030' to carry out activities related to the development of internet access technologies.
The removal of this subsection eliminates a dedicated funding authorization for the program focused on developing internet access technologies. While other funding mechanisms might exist, this specific authorization is no longer present, potentially impacting the program's dedicated resources for those fiscal years.
This subsection provided a definition for 'appropriate congressional committees' specifically for the purposes of Section 4(c) related to the development of internet access technologies.
The removal of this specific definition streamlines the bill by relying on broader definitions of 'appropriate congressional committees' elsewhere, but it removes a tailored list of committees for this particular program.
This subsection authorized the appropriation of 'such sums as may be necessary for each of fiscal years 2027 through 2030' to carry out activities related to cybersecurity capacity for civil society in Iran.
The removal of this subsection eliminates a dedicated funding authorization for the cybersecurity capacity program for civil society in Iran. Similar to Section 4(c)(5), this could impact the program's dedicated resources for those fiscal years.
Modifications
This is a stylistic change and does not appear to have a significant operative impact on the meaning or policy.
Before
v1 stated that 'Access to free expression, open information, and uncensored communication are fundamental human rights'.
After
v2 states that 'Free expression, open information, and uncensored communication are fundamental human rights'.
This change removes the explicit mention of 'free and fair elections' and 'future leadership,' making the policy statement on self-determination more general and less prescriptive about the specific means of achieving it.
Before
v1 stated the policy was 'to recognize the right of the Iranian people to freely determine, through free and fair elections, the future leadership of their country'.
After
v2 states the policy is 'to recognize the Iranian people's right to self-determination'.
This modification clarifies the desired nature of internet access ('open, uncensored') and explicitly states the goal of enabling communication both within Iran and internationally, providing a more detailed policy objective.
Before
v1 stated the policy was 'to facilitate the immediate expansion of unrestricted internet access and civilian lines of communication across Iran'.
After
v2 states the policy is 'to facilitate the immediate expansion of open, uncensored internet access and civilian lines of communication for the people of Iran to communicate domestically and with the outside world'.
This narrows the explicit scope of individuals targeted by sanctions enforcement under this policy statement, removing a specific category of individuals (family members/associates in the U.S. providing support) from direct mention.
Before
v1 stated the policy was 'to fully enforce sanctions against regime violators of internationally recognized human rights and their family members, including any family members and associates in the United States that continue to directly or indirectly provide support to the regime'.
After
v2 states the policy is 'to fully enforce sanctions against regime violators of internationally recognized human rights and their family members'.
This expands the scope of violence to be deterred to cover all regime violence against the Iranian people, not just lethal violence against protesters, and broadens the network of collaborators to include 'partners' in addition to 'allies'.
Before
v1 stated the policy was 'to work in coordination with its allies to consider appropriate measures to deter further lethal violence against protesters'.
After
v2 states the policy is 'to work in coordination with its allies and partners to deter the regime's violence against the Iranian people'.
This changes the Secretary's role from a mandatory to an authorized one, providing more discretion. The shift in legal authority for the strategy means that future updates and implementation will be governed by a different legislative framework. The clarification of information access emphasizes quality and impartiality.
Before
v1 mandated that the Secretary of State 'shall be' the Federal official with primary responsibility for promoting internet freedom and coordinating efforts, and for updating the strategy required under section 414 of the Iran Threat Reduction and Syria Human Rights Act of 2012.
After
v2 states that the Secretary of State 'is authorized to be' the Federal official with primary responsibility for promoting widespread internet freedom and expanding open access to independent and impartial information, and for updating the strategy required under section 5124(a) of the National Defense Authorization Act for Fiscal Year 2025.
This fundamentally changes the scope and focus of the internet freedom strategy. It introduces more detailed and nuanced considerations for circumvention tools, including user security and detectability, and mandates assessments of USG efforts and limitations, providing a more comprehensive but potentially more complex strategic framework.
Before
v1 amended Section 414 of the Iran Threat Reduction and Syria Human Rights Act of 2012 by inserting new paragraphs (11), (12), and (13) which evaluated VPNs and direct-to-cell satellite technologies, ensured sanctions don't impede internet access, and assessed the regime's ability to cut off internet access.
After
v2 completely rewrites subparagraphs (A) through (G) of Section 5124(a)(2) of the National Defense Authorization Act for Fiscal Year 2025, replacing them with new subparagraphs (A) through (D). These new subparagraphs expand evaluation criteria for circumvention tools (including centralized networks, peer-to-peer, and prioritization criteria), add assessments of USG alternatives and limitations, and rephrase the assessment of internet blackouts.
This modification effectively reduces the authorized funding for the Iran Internet Freedom Grant Program for fiscal years 2027-2030 from 'not less than $20,000,000' to the original 'not less than $15,000,000' (assuming the original base amount for 2025-2026 was $15M), potentially impacting the scale of the program in those later years.
Before
v1 amended the authorization for the Iran Internet Freedom Grant Program to provide '$15,000,000 for each of fiscal years 2025 and 2026' and 'not less than $20,000,000 for each of fiscal years 2027 through 2030'.
After
v2 amends the authorization by striking 'each of fiscal years 2025 and 2026' and inserting 'each fiscal year through fiscal year 2030'.
This shifts from creating a new dedicated entity to leveraging existing structures, potentially streamlining efforts but also removing a specific mandate for a new, focused group. The removal of USAGM from explicit coordination may alter the scope of media-related technology development.
Before
v1 mandated the Department of State, in coordination with the Department of Defense and the United States Agency for Global Media, to 'form a joint working group' to support the development of internet access technologies.
After
v2 authorizes the Department of State, in coordination with the Department of Defense and other relevant Federal departments and agencies, to 'utilize existing interagency coordination mechanisms to the maximum extent practicable' to support technology development, and removes the United States Agency for Global Media from the explicit coordination list.
This narrows the focus of technology development to the specific context of Iran, rather than a general 'adversary country.' The removal of LEO satellites as an explicit example might reflect a shift in technological priorities or feasibility assessments.
Before
v1's objectives included identifying technologies to overcome disruptions imposed by 'an adversary country' and listed 'low-earth orbit satellite internet infrastructure' as an example.
After
v2's objectives specify overcoming disruptions imposed by 'the Government of the Islamic Republic of Iran' and removes 'low-earth orbit satellite internet infrastructure' from the explicit examples.
This broadens the pool of expertise for acquisition processes and refines the objectives to be more comprehensive, including specific training, dialogue, and country-context considerations for rapid technology deployment. This aims to make acquisition more effective and responsive to on-the-ground realities.
Before
v1 specified collaboration with the 'Federal Acquisition Institute' and detailed five objectives (A-E) for integrating best practices in defense acquisition and ensuring alignment with DoD/State strategies.
After
v2 changes this to collaboration with 'relevant Federal agencies' and rewrites objectives (A-D) while adding a new (E). The rewritten objectives focus on integrating acquisition best practices, providing training, fostering dialogue, and developing rapid acquisition strategies, with new considerations for country context.
This streamlines the reporting responsibility, making the Secretary of State solely responsible for submitting the annual report, potentially reducing interagency coordination burdens for this specific report.
Before
v1 required the Secretary of State to submit an annual report in coordination with the Secretary of Defense and the United States Agency for Global Media.
After
v2 requires the Secretary of State to submit an annual report, removing the explicit coordination with the Secretary of Defense and the United States Agency for Global Media.
This streamlines the responsibility for developing and submitting the strategy, making the Secretary of State solely responsible, and potentially reducing the direct involvement of USAGM in the strategic planning process for human rights assistance.
Before
v1 required the Secretary of State, 'in coordination with the Chief Executive Officer of the United States Agency for Global Media,' to submit a strategy on Iran broadcasting and human rights assistance.
After
v2 requires the Secretary of State to submit a strategy on human rights assistance, removing the explicit coordination with the Chief Executive Officer of the United States Agency for Global Media.
This narrows the scope of the required strategy elements by removing the specific focus on reviewing and assessing broadcasting efforts, shifting the emphasis more directly to human rights and civil society support programs.
Before
v1's strategy elements included 'a comprehensive review and assessment of current United States Government and international broadcasting efforts targeted at Iran, including Voice of America Persian Service, Radio Farda, and other relevant programs'.
After
v2's strategy elements focus on 'United States Government efforts to support internationally recognized human rights and democratic civil society, including efforts to assist in the credible documentation of abuses of internationally recognized human rights'.
This removes a particular technology from the explicitly mandated methods for providing news access, potentially reflecting a shift in strategic priorities or perceived effectiveness of satellite broadcasting.
Before
v1's strategy elements included ensuring access to news coverage 'through satellite broadcasting, digital circumvention tools, shortwave radio, and emerging technologies'.
After
v2's strategy elements include ensuring access to news coverage 'through digital circumvention tools, shortwave radio, and emerging technologies'.
This changes the nature of the directive from a requirement to a recommendation, providing the Secretary of State with more discretion in establishing these cybersecurity programs.
Before
v1 mandated that the Secretary of State 'shall establish programs' for cybersecurity capacity.
After
v2 states that the Secretary of State 'should establish programs' for cybersecurity capacity.
This adds a new directive to prioritize VPN services and other software-based solutions that minimize physical detection risks, aiming to enhance the safety and effectiveness of these tools for users in Iran.
Before
v1 stated programs would 'furnish vetted open-source or commercially available digital-safety tools, including VPN services and end-to-end encrypted messaging applications'.
After
v2 states programs would 'furnish vetted open-source or commercially available digital-safety tools, including prioritizing VPN services and other software-based solutions that minimize physical detection risks, including end-to-end encrypted messaging applications'.
This changes the frequency of reporting and introduces significant new requirements for protecting sensitive information related to cybersecurity programs, aiming to enhance security and operational integrity while reducing the frequency of public reporting.
Before
v1 required the Secretary of State to track and, 'on a quarterly basis,' make available aggregate metrics on trainees, incident-response cases, and unique users of supported digital safety tools.
After
v2 requires the Secretary of State to track and make available aggregate metrics 'in classified form or otherwise protected form as appropriate,' and specifies that 'Such metrics shall be aggregated and reported biannually in a manner that protects user safety, operational security, implementing partners and the integrity of supported tools and platforms'.
Scope
Complete substitute — Changes are scattered throughout the bill, affecting policy statements, coordination mechanisms, strategy requirements, funding authorizations, and specific program objectives across multiple sections. — v2 represents a meaningful shift in policy implementation, moving from mandatory directives to authorized actions in some areas, refining the scope of internet freedom and human rights support, and introducing more robust security and compliance considerations for technology deployment. It also streamlines agency coordination and removes specific oversight mechanisms. — The changes interact significantly with existing provisions by amending specific sections of the Iran Threat Reduction and Syria Human Rights Act of 2012 and the National Defense Authorization Act for Fiscal Year 2025, altering their requirements and scope.
Impact analysis
Secretary of State
Procedural change, increased discretion.
The Secretary's role in promoting internet freedom in Iran shifts from a mandatory 'shall be' the primary official to an 'is authorized to be' the primary official. The legal authority for the internet freedom strategy also changes from the Iran Threat Reduction Act to the NDAA FY25. The Secretary also gains more discretion in establishing cybersecurity programs ('should' instead of 'shall').
Iranian people (protestors, civil society, journalists)
Mixed. Clarified policy intent and enhanced security are positive, but reduced explicit funding authorizations and removal of specific technology examples could be seen as a narrowing of direct support mechanisms.
Policy statements on self-determination are broadened, and internet access is explicitly defined as 'open, uncensored.' New assessment criteria for internet access technologies are added to ensure user safety and security. However, specific funding authorizations for internet access and cybersecurity programs are removed, and satellite broadcasting is removed from the strategy for news access.
Companies providing technology to Iranian civilians
Positive. Reduced regulatory hurdles.
A new provision (Section 3(b)(3)) is added requiring Federal departments and agencies to ensure sanctions do not impede these companies from providing open internet access tools.
Foreign persons supporting Iranian regime abuses (human rights violators, censors)
Reduced direct accountability mechanism under this specific Act.
The entire section (v1 Section 5) mandating presidential determination and justification for sanctions against such individuals is removed.
Grant programs for internet freedom and cybersecurity
Reduced funding.
The authorized appropriation for the Iran Internet Freedom Grant Program for fiscal years 2027-2030 is reduced from 'not less than $20,000,000' to an extension of the prior $15,000,000. Dedicated authorization of appropriations for internet access technologies (v1 Section 4(c)(5)) and cybersecurity capacity (v1 Section 7(d)) are removed.
GAO (Comptroller General of the United States)
Procedural change, increased responsibility for data protection.
A new requirement (Section 5(b)(3)) is added to protect sensitive information in the GAO report on Near East Regional Democracy (NERD) expenditures.