IRAN Act

(a) Training and tools. The Secretary of State, acting through the Bureau of Democracy, Human Rights, and Labor, shall, not later than 180 days after the date of the enactment of this Act, establish programs to—

(1) deliver remote or in‑person cybersecurity training to journalists, human‑rights defenders, and civil‑society actors in Iran;

(2) furnish vetted open‑source or commercially available digital‑safety tools, including VPN services and end‑to‑end encrypted messaging applications; and

(3) provide multilingual educational materials that warn Iranian users about regime‑controlled applications and phishing campaigns.

(b) Reporting and evaluation

(1) Quarterly metrics. The Secretary of State shall track and, on a quarterly basis, make available to the appropriate congressional committees aggregate metrics on the number of trainees, incident‑response cases, and unique users of supported digital‑safety tools.

(2) Independent evaluation. Not later than 3 years after the date of the enactment of this Act, the Comptroller General of the United States shall submit to the appropriate congressional committees an evaluation of the effectiveness of the programs carried out under this section.

(c) Savings clause. Nothing in this section may be construed to supersede or limit existing authority under section 404 of the Iran Threat Reduction and Syria Human Rights Act of 2012 (22 U.S.C. 8754) or any other provision of law related to internet freedom programming in Iran.