WASHINGTON, October 7 — In a move that could significantly impact internet privacy and access, a bipartisan bill aimed at blocking foreign adversary-controlled applications advanced through the U.S. House Judiciary Committee this week. Known as the Protecting Americans from Foreign Adversary Controlled Applications Act (PAFACAA), the legislation targets apps like TikTok and requires virtual private network (VPN) providers operating in the United States to retain user connection logs and disclose them to authorities upon request.
The bill, introduced by Representatives Mike Gallagher (R-WI) and Raja Krishnamoorthi (D-IL) in May 2024, seeks to prevent evasion of national security-based app bans by mandating internet service providers and intermediary services, including VPNs, to implement blocking capabilities at the network level. Under the proposed language, VPN providers would be required to maintain records of user IP addresses, connection timestamps, and bandwidth usage for a minimum of two years, aligning with data retention standards already applied to telecommunications carriers under the Communications Assistance for Law Enforcement Act (CALEA).
The legislation does not explicitly name VPNs but defines ‘covered entities’ broadly to include any service that enables users to circumvent geographic or governmental restrictions on online content. Supporters argue the measure is necessary to protect national security, citing concerns that foreign adversaries could exploit anonymizing tools to maintain access to prohibited platforms.
Critics, including digital rights groups such as the Electronic Frontier Foundation (EFF) and the American Civil Liberties Union (ACLU), warn that mandatory logging undermines the core privacy function of VPNs and could deter legitimate uses by journalists, activists, and ordinary citizens seeking protection from surveillance or censorship.
The bill passed the House Energy and Commerce Committee by a vote of 34-22 on June 5, 2024, and was ordered reported favorably by the Judiciary Committee on June 10, 2024, setting the stage for a potential floor vote in the House of Representatives later in June. If enacted, the law would take effect 180 days after signing, requiring affected companies to comply with data retention and disclosure mandates or face civil penalties of up to $10,000 per violation per day.
No similar federal law currently exists that directly regulates VPN data retention, though existing authorities under Section 702 of the FISA Amendments Act and Executive Order 12333 already permit certain forms of foreign intelligence collection involving overseas communications. The debate over the bill reflects broader tensions between national security objectives and digital privacy rights, particularly as Congress considers multiple bills aimed at restricting foreign-influenced applications while balancing First Amendment protections and user autonomy online.
The calculus is complex, with strategic implications for the broader geopolitical chessboard, as the United States navigates the interconnected dynamics of technology, security, and individual liberties.
