Congress demands broader spy-agency controls as Commerce misses deadline

A bipartisan, bicameral group of six lawmakers sent a letter to Commerce Secretary Howard Lutnick on Tuesday demanding the department finalize rules that would restrict Americans and U.S. companies from providing technical assistance to civilian intelligence agencies in adversary nations including China and Russia. The rules were proposed in 2024 and projected as an interim final rule by July 2025. That deadline came and went with no rule published, and Commerce hasn't offered a new one.

The gap that won't close

The loophole these rules target has been open for seven years. In 2019, Reuters revealed Project Raven, a UAE operation that hired more than a dozen former U.S. intelligence personnel to hack journalists, activists, foreign governments, and American citizens. Three Raven operatives later entered deferred prosecution agreements and paid $1.68 million for violating U.S. hacking and export control laws. The first Trump administration imposed controls in 2021 on Americans supporting foreign military and intelligence agencies, but those restrictions didn't clearly reach civilian intelligence and security services. Congress expanded the underlying authority in 2022. Commerce proposed implementing rules in 2024. August 2026: nothing finalized.

Beyond Commerce's proposal

What the lawmakers want now goes substantially further than Commerce's 2024 draft. That proposal would require licenses for support to intelligence agencies in 45 countries, with a presumption of denial for China. The letter calls instead for a "trusted countries" approach. Only governments with strong human rights records that don't spy on the United States would qualify; Americans would need a license to work with intelligence or security agencies in any country outside that group. It also demands that foreign surveillance contractors disclose whether they serve intelligence agencies in untrusted countries before receiving U.S. technology, and it seeks to expand biometric surveillance controls beyond facial recognition to cover gait recognition, cardiac signatures, and systems that classify people by race or ethnicity.

The uncertainty is the cost

For contractors and consulting firms, the stakes are immediate even before any rule is finalized. The ambiguity about what is legal now, and what will become legal once Commerce acts, hangs over any U.S. firm hiring security-cleared personnel or technology experts for foreign government clients. A licensing requirement could block high-margin advisory work in some markets entirely. The letter signals that Congress has lost patience with narrow export-control framing and wants a regime with teeth. Whether Commerce agrees is the open question, and the clock is still running.