Industrial Policy & Trade Monitor· 2667 actions· ✨ 89 recent

BIS published an interim final rule on October 21, 2021 establishing new Export Control Classification Numbers (ECCNs 4A005, 4D004, 4E001.c, and 5A001.j) for intrusion software systems, command-and-control platforms, and IP network surveillance tools, implementing the Wassenaar Arrangement 2017 cybersecurity decisions into the Export Administration Regulations (EAR). The rule simultaneously created License Exception ACE (Authorized Cybersecurity Exports), codified at § 740.22, to authorize exports to most destinations while imposing licence requirements — or outright prohibitions — for sales to Country Groups E:1/E:2 governments and certain D-group government end-users. Carve-outs for vulnerability disclosure and cyber-incident-response activities were included to protect legitimate security research. The effective date was subsequently delayed from January 19, 2022 to March 7, 2022 by a separate interim rule (FR 2022-00448), and the rule was finalized with revisions on May 26, 2022 (FR 2022-11282).

BIS amends the Export Administration Regulations (EAR) to implement the decision adopted at the Australia Group (AG) Virtual Implementation Meeting of May 2021, creating new ECCN 2D352 to control software designed for nucleic acid assemblers and synthesizers (ECCN 2B352.j) that is capable of designing and building functional genetic elements from digital sequence data. The rule also amends ECCN 2E001 to capture technology for the development of 2D352-controlled software. Exports to most non-allied destinations require a BIS licence under CB Column 2 and AT Column 1, and the classification of 2D352 software as a critical technology triggers mandatory CFIUS filing requirements for qualifying foreign investment.

On June 1, 2021, the Bureau of Industry and Security (BIS) published FR Doc 2021-11585 (86 FR 29189) notifying the public that, effective May 26, 2021, BIS had assumed jurisdiction over certain firearms-related "technology" and "software" — specifically digital files (CAD/AMF/G-code) for 3D-printed firearms and CNC milling instruction files — under ECCNs 0D501 and 0E501 of the Export Administration Regulations (EAR). The transfer was triggered by the Ninth Circuit's April 27, 2021 vacatur of a March 6, 2020 district-court preliminary injunction that had blocked the technology/software prong of the broader January 23, 2020 USML-to-CCL transfer rule. Internet posting of such files now requires a BIS license (review policy: denial), completing the full implementation of the January 2020 rule transferring USML Categories I–III (firearms, guns, and ammunition) from ITAR/State Department to EAR/Commerce jurisdiction.

The Bureau of Industry and Security (BIS) extended for one year the temporary unilateral export control on software classified as ECCN 0D521 — "software specially designed for training a Deep Convolutional Neural Network to automate the analysis of geospatial imagery and point clouds" — adding a second year of control through January 6, 2022. The extension was required because COVID-19 prevented the Wassenaar Arrangement from formally convening in 2020 to consider the US multilateral control proposal submitted that year. Only License Exception GOV (§ 740.11(b)(2)(ii)) is available; all other exports require a specific licence from BIS.