American consultants can still legally work for foreign intelligence agencies, while U.S. companies can sell them advanced surveillance, cyber, and artificial intelligence technology, a bipartisan group of lawmakers says.
The lawmakers noted China’s Ministry of State Security, the Chinese regime’s civilian intelligence agency, as a prime example of what current U.S. export controls fail to fully cover.
“Foreign intelligence agencies in many countries can still legally hire consultants in the United States and buy advanced U.S. surveillance, cyber, and artificial intelligence technology,” they wrote.
The letter says U.S. companies can also export otherwise uncontrolled commercial products to Chinese intelligence agencies while knowing they will be used for intelligence collection.
It says companies can provide certain technology, consulting, and other support to Chinese military, security, and intelligence entities that the broader controls proposed by Commerce would subject to licensing requirements.
Related Stories
Congress expanded the government’s authority to restrict such activity in 2022. The implementing regulations have still not taken effect.
Congress Expanded Controls, Commerce Has Not Finished Them
The gap stems from a mismatch between an amendment Congress enacted and the preceding regulations that are still in force.
The Export Control Reform Act of 2018 authorized controls on certain activities by Americans and U.S. companies involving foreign “military intelligence services.”
On Jan. 15, 2021, the Commerce Department’s Bureau of Industry and Security issued an interim final rule establishing new controls on military-intelligence end uses and end users.
The rule took effect March 16, 2021. It required licenses for exports, reexports, or transfers of items subject to U.S. export rules when destined for specified military-intelligence uses or users in China and several other countries. It also restricted certain services and other support provided by Americans and U.S. companies to those military-intelligence users.
Current Commerce Department export rules still apply those particular support restrictions to military-intelligence organizations rather than the broader categories Congress later authorized.
Congress amended the law to broaden its application in December 2022.
Section 5589 of the fiscal 2023 National Defense Authorization Act changed the statutory language from foreign “military intelligence services” to foreign “military, security, or intelligence services.”
That expanded the government’s authority beyond military intelligence to civilian intelligence and security agencies.
The Bureau of Industry and Security proposed regulations in July 2024 that would broaden controls to foreign government intelligence, surveillance, and reconnaissance organizations.
A companion proposal covered foreign security agencies, including government bodies with authority to arrest, detain, monitor, search, or use force.
Neither proposal took effect.
Federal regulatory records show that the foreign-security proceeding was merged into the military-and-intelligence rulemaking in April 2025.
The combined proceeding later moved to the final rule stage. The federal regulatory agenda projected an interim final rule for July 2026, but no such rule has been issued.
The lawmakers blamed administrations of both parties.
“The executive branch, under both Democratic and Republican administrations, has, however, failed to fully implement these new authorities,” they wrote.
US Technology Helped Build China’s Surveillance Systems
The lawmakers’ push follows a decades-long history of U.S. technology entering Chinese police, intelligence, censorship, and surveillance systems.
An Associated Press investigation published in 2025 found that Chinese defense contractor Huadi worked with IBM in 2009 to develop national intelligence systems, including a counterterrorism system used by the Ministry of State Security and the Chinese military.
AP said the finding was based on classified Chinese government documents. It also reported that leaked emails and marketing materials showed Chinese agents selling IBM’s i2 police-analysis software to the Ministry of State Security and Chinese police during the 2010s.
IBM told AP that it ended its relationship with Huadi in 2019.
Cisco technology had entered China’s policing and internet control infrastructure years earlier.
The U.S.-China Economic and Security Review Commission said in its 2008 report to Congress that Cisco sold routers and switches to the Chinese government that became “cornerstones” of Golden Shield.
Golden Shield was a Ministry of Public Security project designed to expand police information networks, internet monitoring, censorship, and surveillance across China.
The presentation also cited a Chinese regime goal of using the system to target Falun Gong and other groups authorities regarded as threats to communist rule.
Fearing that Falun Gong’s popularity threatened the regime’s power, the Chinese Communist Party launched a nationwide persecution campaign against the practice in 1999. Since then, untold numbers of practitioners have suffered arbitrary detention, forced labor, torture, and forced organ harvesting.
Cisco marketing material touted its video and image analyzers as the “only product capable of recognizing over 90 percent of Falun Gong pictorial information.”
A display for facial recognition and artificial intelligence is seen on monitors at Huawei’s Bantian campus on April 26, 2019 in Shenzhen, China. Kevin Frayer/Getty Images
Lawmakers Want Stronger Final Rules
The lawmakers want Commerce to strengthen the regulations before putting them into effect.
One change would replace the proposed country lists with a “trusted countries” approach. Americans and U.S. companies would need licenses to do business with intelligence or security agencies outside that group.
Wyden made the same recommendation during the Biden administration’s public comment period in 2024.
The lawmakers said Commerce’s original approach would leave out governments that have engaged in repression or espionage against the United States.
They also want tighter controls on private spyware and cyber surveillance companies that may conceal their government clients from U.S. suppliers.
Their proposal would require those companies to provide sworn assurances that their customers do not include intelligence or security agencies outside the trusted country group.
The lawmakers also want broader biometric controls.
The 2024 proposal covered certain facial recognition systems. The lawmakers want the final regulations to include technologies that identify people through gait or cardiac signatures, as well as systems that classify people using characteristics such as race, sex, or ethnicity.
The Commerce Department did not respond by time of publication to questions about what activities involving Chinese civilian intelligence agencies remain outside current controls, why the broader regulations have not been issued, and when Commerce expects to act.
The rules remain unfinished nearly four years after Congress expanded the underlying authority.
