Cybersecurity capacity for civil society in Iran

(a) Training and tools Not later than 180 days after the date of the enactment of this Act, the Secretary of State shall establish programs— (1) to deliver remote or in-person cybersecurity training to journalists, defenders of internationally recognized human rights, and civil-society actors in Iran; (2) to furnish vetted open-source or commercially available digital-safety tools, including VPN services and end-to-end encrypted messaging applications; and (3) to provide multilingual educational materials that warn Iranian users about regime-controlled applications and phishing campaigns. (b) Reporting and evaluation (1) Quarterly metrics The Secretary of State shall track and, on a quarterly basis, make available to the Committee on Foreign Relations of the Senate and the Committee on Foreign Affairs of the House of Representatives aggregate metrics on the number of trainees, incident-response cases, and unique users of supported digital safety tools. (2) Independent evaluation Not later than 3 years after the date of the enactment of this Act, the Comptroller General of the United States shall submit to the appropriate congressional committees an evaluation of the effectiveness of the program carried out under this section. (c) Savings clause Nothing in this section may be construed to supersede or limit existing authority under section 404 of the Iran Threat Reduction and Syria Human Rights Act of 2012 (22 U.S.C. 8754) or any other provision of law related to internet freedom programming in Iran. (d) Authorization of appropriations There is hereby authorized to be appropriated such sums as may be necessary for each of fiscal years 2027 through 2030 to carry out the activities described in this section.