IRAN Act

(a) Training and tools. Not later than 180 days after the date of the enactment of this Act, the Secretary of State shall seek to establish or expand existing programs to—

(1) deliver remote or in-person cybersecurity training to journalists, human rights defenders, and other civil society actors in Iran;

(2) furnish vetted open-source or commercially available digital safety tools to such actors, prioritizing VPN services and other software-based solutions that minimize physical detection risks, including end to-end encrypted messaging applications; and

(3) provide multilingual educational materials that warn Iranian users about regime-controlled applications and phishing campaigns.

(b) Reporting and evaluation

(1) Metrics. The Secretary of State shall make available to the appropriate congressional committees evaluations and assessments on the effectiveness of the programs established or expanded pursuant to subsection (a).

(2) Independent evaluation. Not later than 3 years after the date of the enactment of this Act, the Comptroller General of the United States shall submit to the appropriate congressional committees an evaluation of the effectiveness of the programs carried out pursuant to this section.