STIFLE Act of 2023

To require the Secretary of the Treasury to study the threat of digital location obfuscation as it relates to national security and financial technology, and for other purposes. 1. Short title; findings (a) Short title This Act may be cited as the Stop Terrorism and Illicit Finance Location Exploitation Act of 2023 STIFLE Act of 2023 (b) Findings The Congress finds the following: (1) Financial sanctions are a primary national security tool for the United States. (2) Financial technology has created both new beneficial financial innovations and emerging illicit finance risks, including the evasion of sanctions. (3) A financial technology platform must be able to determine the precise location of an active user of the platform to effectively implement location-based access controls for compliance with— (A) sanctions programs administered by the Office of Foreign Assets Control; (B) obligations imposed by the Anti-Money Laundering Act of 2020, the Bank Secrecy Act, and regulations associated with such Acts; and (C) any other regulatory obligation. (4) Financial technology platforms generally use an Internet Protocol (in this Act referred to as IP (5) IP addresses were first created in 1974 and standardized in 1983 as unique identification numbers attributed to devices on an interconnected computer network and are the foundation of the modern internet. (6) IP addresses are assigned by Internet Service Providers (in this Act referred to as ISPs (7) IP addresses can be manipulated through the use of Virtual Private Networks (in this Act referred to as VPNs (A) illicit finance; (B) evading detection under existing sanctions; and (C) evading requirements set forth in the Anti-Money Laundering Act of 2020 and the Bank Secrecy Act. (8) Global System for Mobiles triangulation, Wi-Fi triangulation, and GPS data provide substantially more accurate location information than IP addresses, but are individually susceptible to similar manipulation through device tampering, freely available downloadable software, and other obfuscation techniques. (9) Technology that combines enhanced data analytics with aggregated authentic sources of location data is widely used to effectively ensure compliance with United States sanctions, the Anti-Money Laundering Act of 2020, the Bank Secrecy Act, and other statutory and regulatory requirements. 2. Report on the threat of digital location obfuscation to national security and financial technology compliance obligations (a) Study The Secretary of the Treasury, acting through the Undersecretary of the Treasury for Terrorism and Financial Intelligence, and in consultation with technology experts, national security experts, and law enforcement, shall conduct a study to assess the following: (1) The role that location obfuscation techniques, including VPNs, proxy servers, GPS location manipulation applications, and device tampering plays in money laundering, sanctions evasion, and other forms of illicit finance. (2) The ease with which an illicit actor can manipulate and falsify location data relevant to compliance with sanctions, the Anti-Money Laundering Act of 2020, the Bank Secrecy Act, and any other statutory and regulatory obligation. (3) The degree to which a financial technology platform relies upon an IP address as the primary or sole indicator of the precise location of a user of the platform. (4) The ability of a financial technology platform to use multiple aggregated points of location data to indicate the precise location of a user of such platform if an illicit actor manipulates one or more of such data points. (b) Report Not later than 1 year after the date of the enactment of this Act, the Secretary of the Treasury, acting through the Undersecretary of the Treasury for Terrorism and Financial Intelligence, and in consultation with technology experts, national security experts, and law enforcement, shall submit to the Congress a report that contains the following: (1) Each finding and determination made in the study required under subsection (a). (2) Any insufficiency in or lack of available data inhibiting any finding and determination made in the study required under subsection (a). (3) A comprehensive analysis of any cost, benefit, and potential risk associated with the modernization of precise location standards used by a financial technology platform that relies on an IP address as the primary or sole indicator of the precise location of a user of the platform. (4) A comprehensive analysis of the ways in which technology that combines enhanced data analytics with multiple aggregated and authenticated sources of location data may be used to reduce evasion of United States sanctions, requirements under the Anti-Money Laundering Act of 2020, the Bank Secrecy Act, and any other statutory and regulatory obligation. (c) Definitions In this Act: (1) Anti-Money Laundering Act of 2020 The term Anti-Money Laundering Act of 2020 (2) Bank Secrecy Act The term Bank Secrecy Act 31 U.S.C. 5301

Summary: Stop Terrorism and Illicit Finance Location Exploitation Act of 2023 or the STIFLE Act of 2023This bill requires the Department of the Treasury to report on the role location obfuscation technology (IP address manipulation that includes the use of virtual private networks [VPNs] and proxy servers) plays in U.S. sanctions evasions, money laundering, and other illicit finance activity. Treasury must also assess the degree to which a financial technology platform relies upon a user’s IP address to indicate a user’s location and a platform’s ability to use aggregated location data to indicate a user’s location in the event one or more data points have been manipulated. The report must also contain an analysis of techniques to reduce evasion of U.S. sanctions and money laundering laws and regulations.