On January 19, 2021, the US Commerce Department published an interim final rule to implement President Trump’s 2019 Executive Order 13873 on “Securing the Information and Communications Technology and Services Supply Chain” (“Interim Rule”). The Interim Rule was issued following the closure of the public comment period on January 10, 2021 on the proposed rules issued on November 27, 2019 (“Proposed Rules”) to implement Executive Order 13873. For more information on Executive Order 13873 and the Proposed Rules, please see our blog post here. The Interim Rule is being issued in part to allow for a second round of public comment, which will close on March 22, 2021.
The Interim Rule has narrowed somewhat the implementation of Executive Order 13873 in response to comments the Commerce Department received on the Proposed Rules. In particular, the Interim Rule limits the scope of covered transactions (“ICTS Transactions”) and establishes the following process for the Commerce Department’s review of ICTS Transactions.
- Scope. The Interim Rule identifies the ICTS Transactions within its scope. Covered ICTS Transactions include those that are
- Conducted by any person subject to the jurisdiction of the United States or involves property subject to the jurisdiction of the United States;
- Involve any property in which any foreign country or a national thereof has an interest (including through an interest in a contract for the provision of the technology or service);
- Initiated, pending, or completed on or after January 19, 2021; and
- Involve one of the following categories of ICTS:
- ICTS that will be used by a party to a transaction in a sector designated as critical infrastructure by Presidential Policy Directive 21 – Critical Infrastructure Security and Resilience, including any subsectors or subsequently designated sectors;
- software, hardware, or any other product or service integral to wireless local area networks, mobile networks, satellite payloads, satellite operations and control, cable access points, wireline access points, core networking systems, or long- and short-haul systems;
- software, hardware, or any other product or service integral to data hosting or computing services that uses, processes, or retains, or is expected to use, process, or retain, sensitive personal data on greater than one million US persons at any point over the 12 months preceding an ICTS Transaction (including internet hosting services, cloud-based distributed computing and data storage, managed services, and content delivery services);
- certain ICTS products of which greater than one million units have been sold to US persons at any point over the 12 months prior to an ICTS Transaction;
- software designed primarily for connecting with and communicating via the Internet that is in use by greater than one million US persons at any point over the 12 months preceding an ICTS Transaction; and
- ICTS integral to artificial intelligence and machine learning, quantum key distribution, quantum computing, drones, autonomous systems, or advanced robotics.
- Identification of “foreign adversaries.” The Interim Rule identifies six foreign governments or foreign non-government persons as “foreign adversaries:” China (including Hong Kong), Cuba, Iran, North Korea, Russia, and Venezuela’s President Nicolás Maduro. This list of foreign adversaries will be revised and modified as determined necessary.
- Steps in the Review Process. The Interim Rule establishes procedures for the Secretary of Commerce to determine whether to prohibit or restrict ICTS Transactions. The steps in this process include the following:
- Initial Determination. The Secretary of Commerce will make an initial determination regarding whether a particular transaction is a covered ICTS Transaction based on either information made available to the Federal Government, at the request of an appropriate agency head, or the Secretary’s own discretion. The initial determination will no longer be based on information submitted to the Secretary by credible private parties, as suggested under the Proposed Rules. The initial written determination will specify whether the transaction is prohibited or will propose mitigation measures by which the ICTS Transaction will be permitted.
- Response. Parties may respond to the initial determination within 30 days and seek to have the initial determination rescinded or mitigated. If no response is received, the initial determination becomes final.
- Second Interagency Review. The Secretary of Commerce will review the response and seek interagency consensus on a final determination. If interagency consensus is not reached, the President will make the final determination based on the Commerce Secretary’s recommendation.
- Final Determination. Within 180 days of commencing the review process, the Secretary of Commerce will issue a final determination indicating whether an ICTS Transaction is permitted, prohibited, or permitted with mitigation measures.
Interim Rule Clarifications and Departures from the Proposed Rules
In addition to clarifying the scope of covered ICTS Transactions, identifying the foreign adversaries, and laying out the steps in the review process, the Interim Rule contains the following important clarifications in response to comments received to the Proposed Rules:
- Definition of “Transaction.” The Proposed Rules defined “transaction” as “any acquisition, importation, transfer, installation, dealing in, or use of any information and communications technology or service.” The Interim Rule defines “ICTS Transaction” as “any acquisition, importation, transfer, installation, dealing in, or use of any information and communications technology or service, including ongoing activities, such as managed services, data transmission, software updates, repairs, or the platforming or data hosting of applications for consumer download.” These additions are intended to clarify that the Commerce Secretary may review ICTS Transactions that include the provision of services by a foreign adversary.
- Process to Seek Pre-Approval for Covered ICTS Transactions. The Interim Rule indicates that, by May 19, 2021, the Commerce Department will publish procedures to allow parties to ICTS Transactions to seek pre-approval via a license to engage in the transaction. Such license applications will be considered within a 120-day timeline; if no license is issued within 120 days, the application will be deemed granted.
- CFIUS Exclusion. Commerce clarified that the Interim Rule excludes transactions that the Committee on Foreign Investment in the United States (“CFIUS”) is actively reviewing, or has reviewed. However, an ICTS Transaction separate from, and subsequent to, a transaction for which CFIUS has concluded action may still be subject to review.
- Penalties. The Interim Rule makes clear that any person who commits a violation of any final determination, direction, or mitigation agreement in connection with an ICTS Transaction may be liable to the United States for civil or criminal penalties under the International Economic Emergency Powers Act (“IEEPA”). Current IEEPA penalties are summarized in our blog post here.
Finally, the Interim Rule pushed back the effective date announced in the Proposed Rules and becomes effective on March 22, 2021. The Commerce Department has indicated that it will review comments to the Interim Rule and expects to publish a final rule by May 19, 2021, which will also establish the licensing process for pre-approval of ICTS Transactions.
* * *
If you wish to submit a comment on the Interim Rule or have any questions, please contact any member of our Outbound Trade Compliance team.