Key Takeaways from the First Unilateral Controls Issued Pursuant to the Export Control Reform Act

On January 6, 2020, the Bureau of Industry and Security (“BIS”) within the U.S. Department of Commerce published an interim final rule (the “Rule”) amending the Export Administration Regulations (“EAR”) to impose new export controls on software specially designed to automate the analysis of geospatial imagery. Publication of the Rule marks the first step by BIS to establish new export controls pursuant to the Export Control Reform Act of 2018 (“ECRA”), which BIS is expected to implement through rolling publication of similar rules in the coming months.

In addition to introducing new (immediately applicable) licensing requirements for exports of geospatial imagery software, the Rule expands the jurisdiction of the Committee on Foreign Investment in the United States (“CFIUS”) to review foreign investments in U.S. businesses that deal in geospatial imagery software.

Background

The EAR regulate the export, reexport, and transfer of certain commodities, technology, and services. Items subject to the EAR include items physically located within the United States, U.S.-origin items (wherever located), and certain foreign-origin items. Each item controlled under the EAR is assigned an Export Control Classification Number (“ECCN”), which is used to determine the reason for control—such as national security, regional stability, or anti-terrorism—and whether a license is required to export the item to a specific country. Controlled items are not subject to identical restrictions. For example, a controlled item may require a license to be exported to Russia, but not require a license to be exported to Canada.

ECRA, signed into law in 2018, will lead to a wide range of new products and technologies becoming subject to export restrictions. ECRA requires BIS to lead an interagency process to identify and add to the EAR controls on “emerging” and “foundational” technologies that are “essential to the national security of the United States” (but which previously have not been subject to export restrictions).

The Interim Final Rule

The Rule sets forth new export restrictions applicable to geospatial imagery “software” that is “specially designed” for training a Deep Convolutional Neural Network to automate the analysis of geospatial imagery and point clouds (i.e., collections of data points defined by a given coordinate system, also known as digital surface models). To be within the scope of the new restrictions, the software must:

1. Provide a graphical user interface that enables the user to identify objects (e.g., vehicles, houses, etc.) from within geospatial imagery and point clouds in order to extract positive and negative samples of an object of interest;
2. Reduce pixel variation by performing scale, color, and rotational normalization on the positive samples;
3. Train a Deep Convolutional Neural Network to detect the object of interest from the positive and negative samples; and
4. Identify objects in geospatial imagery using the trained Deep Convolutional Neural Network by matching the rotational pattern from the positive samples with the rotational pattern of objects in the geospatial imagery.

Software meeting the above criteria is now properly classified as ECCN 0D251 in the 0Y251 series, and an export license from BIS is required for the export, reexport, transfer, or release of such software to any country (with the exception of Canada). Pursuant to License Exception GOV – the only available license exception – a license is not required for the consignment of items classified as ECCN 0D251 to a department or agency of the U.S. government, and for the purpose of conducting official government business.

Implications

The New Controls Apply Immediately

Although BIS has invited public comments on the Rule through March 6, 2020—and plans to work with other countries to propose additional, multilateral controls—the new, unilateral controls became effective when the Rule was published on January 6, 2020. Accordingly, parties seeking to export, reexport, transfer, or release software controlled under ECCN 0D251 must obtain an export license for every jurisdiction other than Canada. (The Rule does not apply retroactively to transactions that occurred prior to January 6.)

The penalties for exporting controlled products without a required license can be severe, with civil penalties of up to $300,000 per violation, or twice the value of the impermissible transaction (whichever is greater). Accordingly, companies that may deal in software controlled under ECCN 0D251 would be well-advised to pause current export activity while they determine whether the new controls apply. This determination may be made in-house (i.e., through the process of self-classification), with the assistance of legal counsel and/or a third-party export consultant, or through the submission of a formal classification request to BIS.

Controls Will Be Targeted, but Focused on Key Areas Like Artificial Intelligence

In November 2018, BIS published an advance notice of proposed rule making (“ANPRM”) that preliminarily identified expected categories of “emerging technology” that will be subject to new controls under ECRA. Representative categories of technology identified in the ANPRM included biotechnology, artificial intelligence and machine learning, advanced computing technology, robotics, and other key categories of cutting-edge technology. Because it described these categories at only a very high level, publication of the ANPRM created some concern that BIS was contemplating broad-based controls across entire categories of technology.

Although it represents only the first step in implementing ECRA, the Rule suggests that these concerns may have been unfounded. Specifically, the Rule sets forth new controls applicable to a specific iteration of artificial intelligence technology (as opposed to all artificial intelligence technologies more broadly). The Rule thus suggests that BIS is seeking to tailor the new export controls to restrict access to technology that the U.S. government believes has national security implications, without needlessly stifling technological development and economic activity. However, the Rule also suggests that the categories of technology set forth in the ANPRM remain the areas of focus for new restrictions.

The New Rules Affect the CFIUS Process

The Foreign Investment Risk Review Modernization Act (“FIRRMA”), passed alongside ECRA, provides CFIUS significant, additional authority to review foreign investments in sensitive U.S. businesses. In October 2018, CFIUS announced a “pilot program” that implemented certain aspects of FIRRMA, on a temporary/provisional basis. The pilot program introduced, for the first time, a mandatory CFIUS notification requirement for certain non-passive investments in U.S. businesses that produce, design, test, manufacture, fabricate, or develop “critical technology” and that afford the foreign investor at least one of several key rights.

The term “critical technology” is defined in the pilot program regulations to include defense articles and defense services controlled under the International Traffic in Arms Regulations, most items controlled under the EAR, certain nuclear equipment, select agents and toxins, and emerging and foundational technologies controlled under ECRA. The Rule—and future, similar export controls implemented pursuant to ECRA—are therefore significant from a CFIUS perspective, because every technology that becomes subject to controls pursuant to ECRA will be considered “critical technology” from a CFIUS perspective. Companies that develop such technology then must ensure that any foreign investment does not trigger a mandatory CFIUS filing requirement under the pilot program, or bear the risk of significant, failure-to-file penalties (up to the value of the transaction/investment).

Accordingly, companies that deal—or may deal—in the geospatial software covered by the Rule should consider not only whether export controls restrict the unlicensed transfer of such software, but also whether new, proposed investments by non-U.S. parties may now trigger CFIUS filing obligations.

Next Steps

Interested parties have until March 6, 2020 to submit comments to BIS. Foreseeably, commenters may (1) request additional clarification from BIS regarding the scope of technology covered by the Rule, or (2) advocate for the publication of additional license exceptions. Comments, which will be public, may be submitted through the Federal eRulemaking Portal or by mail.

Importantly, the Rule represents the first, rather than the last, word from BIS on “emerging and foundational technology.” The Rule confirms that BIS intends to introduce new export restrictions pursuant to ECRA on a rolling basis, rather than through issuance of a single, comprehensive rule. In the coming months, it is likely that similar, interim final rules will be issued, and that such rules will also have immediate effect. The rolling implementation of ECRA will therefore require companies that deal in technologies identified in the November 2018 ANPRM, as well as prospective investors in such companies, to continue to closely monitor ever-evolving export and foreign investment restrictions.