Industrial Policy & Trade Monitor· 2666 actions· ✨ 90 recent

On 1 July 2025, the U.S. Treasury's Office of Foreign Assets Control (OFAC) designated Aeza Group, a St. Petersburg, Russia-based "bulletproof hosting" (BPH) provider, along with two affiliated companies and four Aeza Group leaders (Arsenii Penzev, Yuri Bozoyan, Vladimir Gast, Igor Knyazev), for supplying server infrastructure that shielded ransomware operators, infostealer groups, and darknet drug marketplaces from law-enforcement takedown. In coordination with the UK's National Crime Agency, OFAC also designated Aeza International Ltd., a UK front company Aeza used to lease IP addresses to cybercriminals. The action was taken under Executive Order 13694 (as amended by E.O. 14144 and E.O. 14306) and builds on OFAC's February 2025 designation of BPH provider ZServers.

On 8 December 2023 the Bureau of Industry and Security (BIS) published a direct final rule (88 FR 85479; FR Doc 2023-26532) making two export-liberalisation amendments to the Export Administration Regulations (EAR). First, BIS removes Chemical and Biological Weapons (CB) proliferation column controls from the Commerce Country Chart for exports of certain pathogens and toxins (ECCNs 1C351, 1C353, and 1C354) when destined to Australia Group (AG) member countries, on the basis that AG members operate equivalent domestic CBW-export controls. Second, the rule revises the Crime Control and Detection (CC) column entries for Austria, Finland, Ireland, Liechtenstein, South Korea, Sweden, and Switzerland, reflecting the updated US assessment of those countries' law-enforcement export-control standards. Both changes are effective on publication and reduce US export-licensing burdens for allied-country destinations without altering controls for non-allied markets.

The Bureau of Industry and Security (BIS) added eleven entities across Burma, China, Nicaragua, and Russia to the Entity List, effective March 28, 2023, under a human rights foreign policy rationale. Three Burmese trading companies and two Russian aviation-parts suppliers were designated for selling, procuring, and servicing military equipment enabling the Burmese military regime's attacks on civilians; five Xinjiang-based electronics manufacturers were added for activities contrary to U.S. foreign policy interests; and the Nicaraguan National Police was designated for serious human rights abuses. The rule simultaneously codified in the EAR that protection of human rights worldwide is an explicit basis for Entity List designations — a precedent-setting regulatory amendment extending the existing national-security and foreign-policy framework.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

The Bureau of Industry and Security (BIS) amended the Export Administration Regulations (EAR) to revise the licensing review policy for items controlled for Crime Control (CC) reasons, explicitly embedding human rights considerations into the review calculus. License applications for CC-controlled items — including stun guns, less-lethal ammunition, restraints, and biometric equipment such as fingerprint analyzers, polygraphs, and voice-stress devices — will be assessed case-by-case, with presumption of denial when the destination country or region exhibits civil disorder or when there is a risk items will be used to violate or abuse human rights (through censorship, surveillance, detention, or excessive force). The rule also extended human rights review as a factor to nearly all other EAR license applications, not only CC-flagged items.

The Bureau of Industry and Security (BIS) amended the Export Administration Regulations (EAR) to establish new Export Control Classification Numbers (ECCNs) 0A977, 0D977, and 0E977 for water cannon systems designed for riot or crowd control, their software, and related technology. A Commerce Control List licence is now required for exports and reexports to most destinations worldwide, with NATO members and certain other close military allies exempt from the new requirement. The rule furthers US foreign policy interests by enabling human rights-based review of crowd-control equipment transfers globally.