```

[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[H.R. 6605 Introduced in House (IH)]

<DOC>

118th CONGRESS
  1st Session
                                H. R. 6605

To require the Secretary of the Treasury to study the threat of digital 
 location obfuscation as it relates to national security and financial 
                  technology, and for other purposes.

_______________________________________________________________________

                    IN THE HOUSE OF REPRESENTATIVES

                            December 5, 2023

Mr. Nunn of Iowa (for himself and Mrs. Beatty) introduced the following 
    bill; which was referred to the Committee on Financial Services

_______________________________________________________________________

                                 A BILL

 
To require the Secretary of the Treasury to study the threat of digital 
 location obfuscation as it relates to national security and financial 
                  technology, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE; FINDINGS.

    (a) Short Title.--This Act may be cited as the ``Stop Terrorism and 
Illicit Finance Location Exploitation Act of 2023'' or the ``STIFLE Act 
of 2023''.
    (b) Findings.--The Congress finds the following:
            (1) Financial sanctions are a primary national security 
        tool for the United States.
            (2) Financial technology has created both new beneficial 
        financial innovations and emerging illicit finance risks, 
        including the evasion of sanctions.
            (3) A financial technology platform must be able to 
        determine the precise location of an active user of the 
        platform to effectively implement location-based access 
        controls for compliance with--
                    (A) sanctions programs administered by the Office 
                of Foreign Assets Control;
                    (B) obligations imposed by the Anti-Money 
                Laundering Act of 2020, the Bank Secrecy Act, and 
                regulations associated with such Acts; and
                    (C) any other regulatory obligation.
            (4) Financial technology platforms generally use an 
        Internet Protocol (in this Act referred to as ``IP'') address 
        as the primary or sole indicator of their users' precise 
        location.
            (5) IP addresses were first created in 1974 and 
        standardized in 1983 as unique identification numbers 
        attributed to devices on an interconnected computer network and 
        are the foundation of the modern internet.
            (6) IP addresses are assigned by Internet Service Providers 
        (in this Act referred to as ``ISPs'') and have become a less 
        accurate determinant of precise location as a result of the 
        proliferation of mobile devices, dynamic IP addresses, 
        globalized content delivery networks, and other innovations.
            (7) IP addresses can be manipulated through the use of 
        Virtual Private Networks (in this Act referred to as ``VPNs''), 
        proxy servers, anonymizing darknet website browsers, and other 
        location obfuscation techniques for the purpose of--
                    (A) illicit finance;
                    (B) evading detection under existing sanctions; and
                    (C) evading requirements set forth in the Anti-
                Money Laundering Act of 2020 and the Bank Secrecy Act.
            (8) Global System for Mobiles triangulation, Wi-Fi 
        triangulation, and GPS data provide substantially more accurate 
        location information than IP addresses, but are individually 
        susceptible to similar manipulation through device tampering, 
        freely available downloadable software, and other obfuscation 
        techniques.
            (9) Technology that combines enhanced data analytics with 
        aggregated authentic sources of location data is widely used to 
        effectively ensure compliance with United States sanctions, the 
        Anti-Money Laundering Act of 2020, the Bank Secrecy Act, and 
        other statutory and regulatory requirements.

SEC. 2. REPORT ON THE THREAT OF DIGITAL LOCATION OBFUSCATION TO 
              NATIONAL SECURITY AND FINANCIAL TECHNOLOGY COMPLIANCE 
              OBLIGATIONS.

    (a) Study.--The Secretary of the Treasury, acting through the 
Undersecretary of the Treasury for Terrorism and Financial 
Intelligence, and in consultation with technology experts, national 
security experts, and law enforcement, shall conduct a study to assess 
the following:
            (1) The role that location obfuscation techniques, 
        including VPNs, proxy servers, GPS location manipulation 
        applications, and device tampering plays in money laundering, 
        sanctions evasion, and other forms of illicit finance.
            (2) The ease with which an illicit actor can manipulate and 
        falsify location data relevant to compliance with sanctions, 
        the Anti-Money Laundering Act of 2020, the Bank Secrecy Act, 
        and any other statutory and regulatory obligation.
            (3) The degree to which a financial technology platform 
        relies upon an IP address as the primary or sole indicator of 
        the precise location of a user of the platform.
            (4) The ability of a financial technology platform to use 
        multiple aggregated points of location data to indicate the 
        precise location of a user of such platform if an illicit actor 
        manipulates one or more of such data points.
    (b) Report.--Not later than 1 year after the date of the enactment 
of this Act, the Secretary of the Treasury, acting through the 
Undersecretary of the Treasury for Terrorism and Financial 
Intelligence, and in consultation with technology experts, national 
security experts, and law enforcement, shall submit to the Congress a 
report that contains the following:
            (1) Each finding and determination made in the study 
        required under subsection (a).
            (2) Any insufficiency in or lack of available data 
        inhibiting any finding and determination made in the study 
        required under subsection (a).
            (3) A comprehensive analysis of any cost, benefit, and 
        potential risk associated with the modernization of precise 
        location standards used by a financial technology platform that 
        relies on an IP address as the primary or sole indicator of the 
        precise location of a user of the platform.
            (4) A comprehensive analysis of the ways in which 
        technology that combines enhanced data analytics with multiple 
        aggregated and authenticated sources of location data may be 
        used to reduce evasion of United States sanctions, requirements 
        under the Anti-Money Laundering Act of 2020, the Bank Secrecy 
        Act, and any other statutory and regulatory obligation.
    (c) Definitions.--In this Act:
            (1) Anti-money laundering act of 2020.--The term ``Anti-
        Money Laundering Act of 2020'' means Division F of the National 
        Defense Authorization Act for Fiscal Year 2021.
            (2) Bank secrecy act.--The term ``Bank Secrecy Act'' has 
        the meaning given the term under section 6303 of the Anti-Money 
        Laundering Act of 2020 (31 U.S.C. 5301 note).
                                 <all>
```