- The US Department of Commerce (Commerce) may now prohibit or otherwise restrict certain “transactions” related to Information and Communications Technology and Services (ICTS) that pose an undue or unacceptable risk to the national security of States -United or the safety of US nationals when these transactions involve “adversaries.”
- The expanded power of commerce covers the future and In progress ICTS of pre-existing contracts and gives wide latitude to the Secretary of Commerce to assess and address threats from six identified “foreign adversaries”: China (including Hong Kong), Russia, Iran, North Korea, Cuba and Venezuela.
- Preclearance procedures or a licensing process for entities seeking pre-approval before engaging or continuing to engage in ICTS transactions are under development and open to public comment until April 28, 2021.
In May 2019, the Trump administration released Executive Decree 13873, which aimed to control the use of certain information and communication technologies and services (ICTS) purchased from “foreign adversaries”. Then, the day before the Trump administration left in January 2021, the United States Department of Commerce (Commerce) issued interim regulations intended to secure ICTS supply chains (ICTS Interim Rule).
There was a lot of speculation as to whether the Biden administration would use this new tool or if it would simply be dismissed as yet another hijacking of Trump-era policies. However, with no adjustment from the Biden administration, the ICTS Interim Rule went into effect on March 22, 2021.1 In fact, the Biden administration embraced the concept even before the new regulations went into effect. On March 17, 2021, the Commerce Department issued subpoenas to several Chinese companies to obtain information about their ICTS activities in the United States.
Presentation of ICTS rules
Under the ICTS Interim Rule, Commerce may prohibit or otherwise restrict, on a case-by-case basis, certain acquisition and use transactions (including individual commercial sales) that 1) were initiated, pending or completed on or after January 19, 2021; 2) involve ICTS and 3) have been “designed, developed, manufactured or supplied” by a person under the control of a “foreign adversary” or under the jurisdiction of a “foreign adversary”. Currently, named “foreign adversaries” include China (including Hong Kong), Cuba, Iran, North Korea, Russia, and Venezuela. The list, however, is not static and may be reviewed and revised at the discretion of the US Secretary of Commerce (Secretary).
Changes from the proposed rule and persistent obstacles
Contrary to the proposed rule, the procedural flaws of which were corrected in a previous Holland & Knight alert (see “Proposed MTS Supply Chain Review Regime Raises Procedural Issues, “December 26, 2019), the ICTS Interim Rule has a more defined and limited scope – applying to transactions with six specific” foreign adversaries “, referred to as” foreign adversaries “, which involve ICTS hardware, software or technology product from one of the six sectors.It is important to note, the ICTS Interim Rule also:
- develops examination protocols
- defines key terms (for example, “undue or unacceptable” risk)
- develop a mechanism for parties to request a meeting with trade officials following an initial decision (which the trade secretary may decline, at his discretion)
- confirms that the secretary can take into account mitigating factors when assessing an ICTS transaction risk, and
- sets a date for Commerce’s review, typically requiring that the final determination be made within 180 days of the start of the review2
In some respects, however, the ICTS Interim Rule retains the overly inclusive nature of the proposed rule. By way of example, the Secretary continues to be able to closely examine Americans’ acquisition or use of ICTs, such as cloud and network management or data storage, in all sectors. .
Transactions subject to review
An “ICTS transaction” covers acquisitions, transfers, installations, importation and transactions or use of ICTS that took place on or after January 19, 2021, as well as ongoing activities such as transmissions , software updates, platform or data hosting for consumer downloads. and managed services. Therefore, even if the underlying contract was entered into before January 19, 2021, the installation of subsequent software updates may be revised as a new separate ICTS transaction.3
To trigger the review process, the ICTS transaction must meet certain criteria. First, ICTS must belong to one of the following six product and technology categories.
- Critical infrastructure: ICTS transactions in one of the 16 identified critical infrastructure sectors and in any sub-sector or sector subsequently designated, which includes, but is not limited to, the information and communications technology sectors and which overlaps, but is not a direct replica of the investment critical infrastructure sectors covered identified by the Committee on foreign investment in the United States (CFIUS)
- Network infrastructure: ICTS which is an integral part of software, hardware or any other product or service integrated with wireless LANs, mobile networks, satellite payloads, satellite operations and control, cable access points, to wired access points, backbone network systems, or transport systems
- Data hosting or calculation of sensitive personal data: ICTS which is an integral part of data hosting or IT services that interact with sensitive personal data4 over 1 million U.S. people at any time in the 12 months leading up to an ICTS transaction (readers familiar with the CFIUS review process will note that the definition of personal data in the ICTS provisional rule generally follows that offered by the CFIUS)
- Popular surveillance and monitoring devices, home networking devices: If 1 million units of that item in question have been sold to U.S. nationals at any time during the 12 months prior to an ICTS transaction
- Popular communication software: Software designed primarily to connect and communicate over the Internet and used by over one million people in the United States at any time in the 12 months preceding an ICTS transaction, including desktop, mobile, web-based applications and play, or
- Emerging technology: ICTS which is an integral part of artificial intelligence and machine learning, quantum key distribution, quantum computing, drones, autonomous systems or advanced robotics
Second, the ICTS product must be purchased (i.e. supplied, developed, manufactured or designed) by a person controlled by, owned or subject to the direction or jurisdiction of a designated “foreign adversary” – currently. , China (including Hong Kong), Cuba, Iran, North Korea, Russia or Venezuela. To put into context, in determining whether a non-Chinese entity is controlled by China, the secretary may take into account factors such as whether the non-Chinese entity or its suppliers are carrying out key operations (e.g. research and development , manufacturing, testing and distribution) in China, or have key personnel, employees, consultants or contractors in China.
Transactions not covered by the ICTS provisional rule
Only two types of transactions are not covered by the ICTS provisional rule:
- acquisition operations of ICTS items authorized under a US government industrial security program
- transactions examined or under examination by the CFIUS
Proceed with caution, however, as the Commerce Department retains the authority to review an ICTS transaction if it is separate and subsequent to a transaction reviewed by CFIUS. Therefore, examining the CFIUS related to a particular ICTS does not in itself provide a safe haven for future transactions involving the same ICTS.
Further, although Commerce did not explicitly exclude them, it indicated that transactions involving ICTS hardware devices such as handsets would not be of particular interest to the agency.
Trade review mechanism and sanctions
The trade can initiate a review unilaterally (i.e. at the discretion of the secretary), or on the recommendation of an appropriate agency manager or private party (e.g. an industry competitor) . The Commerce Department’s review will typically last 180 days, from the day of acceptance to the final determination, and will begin with the assessment of a non-exhaustive list of 10 criteria to answer an introductory question: The ICTS transaction likely pose an “undue or unacceptable risk” to US national security?
- If it probably isn’tThe Department of Commerce will terminate the examination without prejudice, which means that the agency may review the transaction if additional information is revealed.
- If it’s probable, The Department of Commerce, in interagency consultation with other appropriate agencies (including, but not limited to, the United States Department of the Treasury, the Office of the United States Trade Representative, and the United States Department of State), will determine whether the ICTS transaction actually poses an unacceptable or unacceptable risk, by looking at the same 10 non-exhaustive criteria, and serve as its initial determination.5 Interestingly, Commerce has a choice of how it serves the parties – either through publication Federal Register or through more traditional routes such as US registered mail, email, etc.
Trade initial determination will 1) explain the agency’s basis for prohibiting the transaction or imposing mitigation measures on it and 2) giving the parties 30 days to provide comments. If the parties respond, Commerce must begin another round of inter-agency consultations to consider any new evidence or arguments. If the parties do not respond, Commerce may proceed without further inter-agency consultation. Commerce will then publish its final determination, either by allowing, prohibiting or imposing mitigating measures on the transaction, in the Federal Register. No other administrative appeal process is available, and violations of Commerce’s final rulings or imposed mitigation measures can result in serious criminal and civil liability (up to $ 307,922 or twice the value of a transaction. by violation).
Conclusion and next steps
Given bipartisan support for decreasing reliance on China in critical supply chains and the secretary’s own statements that ICTS from China warrant further scrutiny, it is expected that a fair number of Commerce exams will have a link with China.6 For advice on the impact of the ICTS Interim Rule on your operations or for assistance in commenting on the preclearance and licensing procedures before April 28, 2021, please contact the experienced lawyers at Holland & Knight’s International Trade Group.