Commerce Dept. gets $100M to build export-control AI—with no privacy guardrails

What it does

This bill authorizes $25 million per year through 2029 for the Commerce Department's Bureau of Industry and Security to modernize its aging IT systems, replacing them with unified case-management and data-analytics platforms. The modernization is intended to speed up export license reviews, better track military end-users and dual-use technology flows to adversaries (especially China, Russia, Iran), and share data more efficiently with federal agencies and international partners.

Why we flagged it

The bill's primary stated purpose is routine IT infrastructure modernization for a federal agency. However, the operative language explicitly expands data collection, fusion, and sharing authorities—particularly with the intelligence community and international partners—without corresponding privacy or transparency guardrails, making it functionally a surveillance-capability upgrade wrapped in modernization framing.

What the text implies

• The bill authorizes 'data fusion' and 'additional commercial data sets' without defining what commercial data may be collected, how long it is retained, or what privacy notice companies receive. This may enable warrantless aggregation of U.S. business supply-chain and trade data.
• Explicit authorization to share 'appropriate data elements' with the 'intelligence community' lacks statutory definition of 'appropriate' and creates no audit trail or congressional reporting requirement, potentially enabling bulk data transfers to CIA, NSA, or other agencies without public disclosure.

The full analysis lists 5 implications of this text.

Who stands to gain

IT systems integrators and contractors (likely large defense/IT firms such as Booz Allen Hamilton, L; Commercial data brokers and analytics firms providing 'data fusion' and 'supply chain illumination'