Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Partners provide annually updated U.S. chapter on asset recovery

Webinar explores impacts of SECURE 2.0 on employer retirement plans

Nominees not likely to support some current FTC priorities

BakerHostetler team contributes U.S. chapter to Asset Tracing and Recovery Review

<p>The U.S. Department of Commerce’s Bureau of Industry and Security (BIS) appears to be increasing the rate at which it imposes new export controls on various technologies, software and commodities (items). In October alone, BIS published four separate notices that either impose new export controls or propose to do so. We believe BIS is likely to continue to impose export controls on new items, including emerging technologies, at an increased rate. This alert summarizes the export classification changes, final and proposed, that BIS published in October.</p>  <p>To ensure compliance with the U.S. export control laws, companies should verify the export control classification numbers (ECCNs) of the items that they export, including technologies and source code transferred to foreign persons in the United States. Items that may have been eligible for export without a license from BIS may now or soon require an export license.</p>  <h5>New Controls on Cybersecurity Items</h5>  <p>In a move intended to crack down on the export of computer software that can be used to further malicious monitoring and hacking attempts, BIS recently released an <a href="https://bis.doc.gov/index.php/documents/regulations-docs/federal-register-notices/federal-register-2021/2861-86-fr-58205-cybersecurity-items-10-21-21/file">interim final rule</a> that imposes new export controls on intrusion and surveillance tools. The new controls, which will take effect on January 19, 2022, are implemented in part through the introduction of two new ECCNs to the Commerce Control List (CCL): ECCNs 4A005 and 4D004. Both ECCNs relate to “intrusion software.” ECCN 4A005 will control ‘“systems,’ ‘equipment,’ and ‘components’ therefor, ‘specially designed’ or modified for the generation, command and control, or delivery of ‘intrusion software.’” ECCN 4D004 will control ‘“software’ ‘specially designed’ or modified for the generation, command and control, or delivery of ‘intrusion software.’” The interim final rule will also add paragraph “.c” to ECCN 4E001 to control ‘“technology’ for the ‘development’ of ‘intrusion software.’”</p>  <p>The EAR defines “intrusion software” as follows:</p>  <p style="margin-left:40px"> “‘Software” specially designed or modified to avoid detection by ‘monitoring tools,’ or to defeat ‘protective countermeasures,’ of a computer or network-capable device, and performing any of the following:</p>  <ol style="margin-left:80px"> 	<li>The extraction of data or information, from a computer or network-capable device, or the modification of system or user data; or</li> 	<li>The modification of the standard execution path of a program or process in order to allow the execution of externally provided instructions.<a href="#_ftn1" name="_ftnref1" title="">[1]</a></li> </ol>  <p>In addition, the interim final rule will add paragraph “.j” to ECCN 5A001 to control certain “IP network communications surveillance systems or equipment”  that perform particular functions on carrier class IP networks.</p>  <p>The interim final rule has been under development since 2013. A previous version of the rule was criticized by the software development community in 2015 as overly broad and likely to stymie technological research and development. To address those concerns, BIS revised the language to be more specific, including by adding “command and control” as a control criterion. These revisions were intended to narrow the scope to control only malicious hardware and software tools. “Vulnerability disclosure” and “cyber incident response” software, as well as products designed and limited to provide basic software updates and upgrades, are not covered by the new controls.</p>  <p>Further, the interim final rule will create a new license exception – Authorized Cybersecurity Exports (ACE). This License Exception is intended to ensure that “legitimate cybersecurity research and incident response activities” are authorized. Certain items to be controlled under new ECCNs 4A005 and 4D004, and new paragraphs 4E001.c and 5A001.j, in addition to certain items controlled under preexisting ECCNs in Category 5—Part 2 (“Information Security”), may be eligible for export under License Exception ACE. While License Exception ACE will apply broadly, it may not be used if the exporter, reexporter, or transferor “knows or has reason to know at the time of export, reexport, or transfer (in-country) ... that the ‘cybersecurity item’ will be used to affect the confidentiality, integrity or availability of information or information systems without authorization by the owner, operator, or administrator of the information system (including the information and processes within such systems).” Further, the use of License Exception ACE for exports to government end-users is limited.</p>  <p>The interim final rule remains open for public comment from now through December 6, 2021. Companies that design, produce or develop intrusion software or other items subject to these new controls should analyze how these new controls may impact their business, including whether items will be subject to stricter license requirements and, if so, whether License Exception ACE will be available. If appropriate, companies should prepare comments for submission before the December 6 deadline.</p>  <h5>Expanded Controls on Software and Technology Related to Nucleic Acid Assemblers and Synthesizers and Addition of Controls on Deuterium</h5>  <p>On October 5, BIS issued a <a href="https://www.govinfo.gov/content/pkg/FR-2021-10-05/pdf/2021-21493.pdf">final rule</a> imposing controls on software and technology related to nucleic acid assemblers and synthesizers. The rule became effective October 5 and added ECCN 2D532 to the CCL to control ‘“software’ designed for nuclear acid assemblers and synthesizers controlled by ECCN 2B352.j that is capable of designing and building functional genetic elements from digital sequence data.” In addition, technology for the “development” of software capable of designing and building functional genetic elements from digital sequence data is now controlled under ECCN 2E001. According to BIS, the new controls, which are part of BIS’s effort to control emerging technologies, were necessary because “the prior absence of controls on this ‘software’ could be exploited for biological weapons purposes.”</p>  <p>The following day, on October 6, BIS issued a <a href="https://bis.doc.gov/index.php/documents/regulations-docs/federal-register-notices/federal-register-2021/2852-86-fr-55492/file">final rule</a> to add ECCN 1C298 to the CCL to control deuterium “intended for use other than in a nuclear reactor.” Prior to this amendment, all deuterium, regardless of whether it was for non-nuclear end-use, was regulated by the Nuclear Regulatory Commission (“NRC”). Effective December 6, BIS will have export licensing control authority over deuterium that is not for nuclear end use; deuterium for nuclear end-uses will continue to be controlled by the NRC. Also, on October 6, the NRC issued a companion <a href="https://bis.doc.gov/index.php/documents/regulations-docs/federal-register-notices/federal-register-2021/2851-86-fr-55476/file">final rule</a> that will become effective December 6.</p>  <h5>Proposed Controls on Brain-Computer Interface Emerging Technology</h5>  <p>On October 26, as part of its continued initiative to identify emerging technologies that are not yet listed on the CCL, BIS issued an <a href="https://www.govinfo.gov/content/pkg/FR-2021-10-26/pdf/2021-23256.pdf">advanced notice of proposed rulemaking</a> (ANPRM) requesting public comment on the potential uses of Brain-Computer Interface (BCI) technology. The ANPRM stated that comments regarding BCI technology’s “impact on U.S. national security (e.g., whether such technology could provide the United States, or any of its adversaries, with a qualitative military or intelligence advantage),” and comments on whether effective export controls could be implemented on BCI technology are of particular interest. While the ANPRM does not specifically define BCI technology, it states that BCI technologies frequently involve a process in which brain signals are acquired, analyzed and then translated into commands that are: “(1) used to control machines; (2) potentially transferred to other humans; or (3) used for human assessment or enhancement.” BIS named “neural-controlled interfaces, mind machine interfaces, direct neural interfaces, and brain-machine interfaces” as examples of BCIs.</p>  <p>The ANPRM remains open for public comment through December 10. To help ensure that BCI export controls are properly tailored, companies that design, produce or develop BCI technologies or related technologies are encouraged to submit comments.</p>  <p>******</p>  <p><em>Author credit: Melissa Mannino, Ragan Updegraff, and Sarah-Jane Lorenzo</em></p>  <p>As always, please do not hesitate to contact BakerHostetler’s International Trade and National Security team to discuss these new and proposed changes to U.S. export controls or submission of comments in response to the ANPRM.</p>  <div> <hr /> <div id="ftn1"> <p><a href="#_ftnref1" name="_ftn1" title="">[1]</a> See 15 C.F.R. § 772.1.</p> </div> </div>




core/freeform

Houston

Partner

Lana Muranovic

Washington, D.C.

Barbara D. Linney

Senior Trade and Security Advisor

Kevin J. Miller

Associate

Orga Cadet

Melissa B. Mannino

Enterprise Issues

Digital Assets and Data Management

International Trade and National Security

Are Your Export Classifications Up to Date? New Export Controls, Including on Cybersecurity Software and Technologies, May Impact International Business Opportunities

Related Services

Featured Insights