US BIS Cybersecurity Items Export Controls: Interim Final Rule (FR 2021-22774)

Mechanism

The rule operationalises the 2017 Wassenaar Arrangement plenary decisions on cybersecurity tools. Prior to 2021, intrusion software and surveillance platforms occupied a regulatory grey zone in the EAR: many were not captured by existing ECCNs (EAR99 or misclassified) and could be exported without a licence even to authoritarian end-users.

New ECCN structure:

• 4A005 — Systems and equipment for generation, command-and-control, or delivery of

intrusion software (hardware layer)

• 4D004 — Software for the same functions (software layer)
• 4E001.c — Technology for development of intrusion software
• 5A001.j — IP network communications surveillance systems capable of monitoring

full-packet capture at the backbone level

License Exception ACE (§ 740.22): Authorises exports/reexports to most destinations without a licence, except:

• Country Groups E:1 and E:2 (arms-embargoed nations: CN, RU, IR, KP, CU, SY, BY, MM)

are completely prohibited

• Government end-users in Country Groups D:1, D:2, D:3, D:4, D:5 require a licence,

unless the end-user is in the allied A:6 subgroup (Cyprus, Israel, Taiwan as of 2021)

• Any end-use that would affect "confidentiality, integrity, or availability of information

systems without authorization" is prohibited regardless of destination

The rule was the first comprehensive US codification of dual-use cybersecurity tool controls at the ECCN level, shifting enforcement from reactive entity-listing toward a classification-based preventive regime.

Downstream implications

• Major offensive-security vendors (Crowdstrike, Palo Alto Networks, smaller boutiques)

had to reassess product-line classifications; tool features affecting payload delivery may now require review for ECCN 4D004 or 4E001.c status

• Red-team / penetration-testing toolkits (Cobalt Strike, Metasploit-commercial variants)

fall within 4D004 scope; exports to D-group government customers require licences

• Backbone surveillance platforms (deep-packet inspection at national ISP level) now

captured under 5A001.j — restricts sales of telecom surveillance gear to authoritarian telecom authorities

• Creates licence-requirement overlap with Entity List controls: entities already on

the list would trigger both mechanisms; ACE provides no exception for listed parties

• Effective date delayed by 45 days (Jan 19 → Mar 7, 2022) after industry comments

highlighted compliance complexity; BIS noted it would issue supplemental guidance

• May 2022 finalization (FR 2022-11282) revised ACE conditions and clarified ECCN scope

following the public-comment period

Open questions

• Whether 4A005/4D004 coverage extends to AI-driven cyberattack automation tooling

(LLM-assisted red-teaming); BIS has not yet issued interpretive guidance

• Interplay with OFAC cyber-related sanctions (EO 13694/13984) — dual-track risk for

exports to Russian or Iranian security-sector entities

• EU counterpart: the EU Dual-Use Regulation (2021/821) covers similar intrusion-

software categories; transatlantic divergence in ACE vs. EU general authorisations remains a compliance friction point for multinational vendors