US BIS: Wassenaar Arrangement 2019 Plenary — Six Emerging Technology Controls (EUV Lithography, Digital Forensics, Sub-orbital Craft)

Mechanism

BIS published this interim final rule on 5 October 2020 (85 FR 62583, FR Doc 2020-18334), effective immediately upon publication. It implements decisions agreed at the December 2019 Wassenaar Arrangement Plenary meeting and is the first of two US implementing actions for the 2019 Plenary. The second, covering the broader CCL harmonisation (22 ECCNs across nine categories), followed on 29 March 2021 (2021-03-29-us-bis-wassenaar-2019-plenary-ear-ccl-update).

This rule specifically addresses six recently developed or developing technologies identified by the Wassenaar Arrangement as warranting multilateral control, pursuant to the Export Control Reform Act of 2018 (ECRA) mandate to identify emerging technologies essential to US national security. Unlike the 0Y521 temporary ECCN series used for unilateral emerging- technology controls pending multilateral adoption, these controls enter the permanent CCL under standard classification numbers.

Six controlled technology categories and revised ECCNs:

1. Hybrid AM/CNC Machine Tools — ECCN 2B001 (Note 4) A new Note 4 was added to ECCN 2B001 to catch machines that combine additive manufacturing (3D printing) with subtractive computer numerically controlled machining in a single platform. Such hybrid systems can produce high-precision metal parts — including munitions components and aerospace parts — without the discrete steps that traditionally create observable supply- chain checkpoints. The concern is undetected production of controlled-dimension parts at non-partner end-users.

2. EUV Mask Computational Lithography Software — ECCN 3D003 New ECCN 3D003 controls electronic design automation (EDA) or computational lithography software "designed or modified" for the fabrication of extreme ultraviolet (EUV) lithographic masks. EUV lithography is the enabling process for sub-5 nm IC nodes; the mask-making computational software is a critical bottleneck that very few firms supply globally (notably Synopsys SNPS, Cadence CDNS). Controlling this EDA layer complements equipment-level controls on EUV scanners (ASML).

3. 5 nm Wafer-Finishing Technology — ECCN 3E004 New ECCN 3E004 controls technology for the production (polishing, planarisation, finishing) of substrates used in high-end integrated circuits at the 5 nm node and below. This targets process know-how rather than the equipment itself, closing a gap where the EDA and fab equipment were controlled but the downstream substrate-preparation process knowledge was not.

4. Digital Forensics / Device Authentication Bypass — ECCN 5A004.b ECCN 5A004.b now specifically controls items "designed to perform extraction of raw data from a computer or communications device" by circumventing authentication or authorization controls. This targets commercial device-unlocking and forensics tools (used by law enforcement to access locked smartphones and computers) that, in non-allied-government hands, become offensive intrusion tools. The control addresses the dual-use nature of commercial mobile-device forensics products.

5. Communications Interception Monitoring Software — ECCN 5D001.e New paragraph (e) under ECCN 5D001 controls software "specially designed or modified for use by law enforcement to analyze the content of communications and associated metadata acquired from a handover interface." A handover interface is the lawful-interception tap point provided by telecoms carriers to national authorities. The concern: governments supplying mass-surveillance software to authoritarian states via this ostensibly "law enforcement" channel — a pattern documented in multiple high-profile cases involving Middle Eastern and African security services.

6. Sub-orbital Craft — ECCN 9A004.h A new paragraph (h) was added to ECCN 9A004 to explicitly include "sub-orbital craft" in the controlled spacecraft/launch-vehicle category. Sub-orbital vehicles (commercial spaceplanes, hypersonic glide vehicles, and certain long-range missiles occupying the zone between conventional aircraft and orbital spacecraft) were previously in a regulatory grey zone. The control does not cover "spacecraft" (defined as satellites and space probes).

Downstream implications

• EDA/lithography software perimeter: ECCN 3D003 created an early EDA-level control

layer for the semiconductor supply chain. The March 2021 BIS advanced chip controls (2022-10-07-us-bis-advanced-ai-chip-controls-china) and the subsequent FDPR expansions built on this foundation. Synopsys and Cadence face licensing requirements for EUV mask software exports to Country Group D destinations.

• Digital forensics sector: The 5A004.b control directly affects commercial vendors

(Cellebrite, Grayshift, MSAB) selling mobile-device extraction tools to foreign government customers. Non-US vendors operating outside EAR remain uncontrolled absent Wassenaar implementation by partner states.

• Sub-orbital proliferation: The 9A004.h addition pre-emptively addresses the commercial

spaceflight boom; hypersonic vehicles produced or sold by Country Group D end-users now require a licence.

• Surveillance software: 5D001.e is the predecessor of the more targeted 2021 surveillance

software-specific controls; it established legal authority to restrict handover-interface monitoring tools before the subsequent dedicated rulemaking narrowed the scope further.

Open questions

• Whether partner Wassenaar states implemented equivalent controls on EUV mask EDA software

and the 5D001.e surveillance-software category at comparable pace (implementation delays among partners create competitive disadvantage for US-licensed exporters).

• How the 3D003/3E004 controls interact with ASML's EUV scanner export-control status and

the Netherlands' subsequent national-level export restrictions (2023 onward).

• Whether the digital forensics controls (5A004.b) have been enforced against any commercial

vendor supply chain — no enforcement actions publicly attributed to this ECCN as of mid-2026.