Remote Access Security Act

Section 1742 of the Export Control Reform Act of 2018 (50 U.S.C. 4801) is amended by adding at the end the following:

The term remote access means access to an item subject to the jurisdiction of the United States and included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations, by a foreign person of concern through a cloud infrastructure service from a location outside the United States and other than where the item is physically located, if the Secretary determines that the use of the item has demonstrated a serious risk to the national security or foreign policy of the United States through the use of software, such as by—

(i) training an artificial intelligence dual-use model that—

(I) substantially lowers the barrier of entry for experts or nonexperts to design, synthesize, acquire, or use chemical, biological, radiological, or nuclear weapons or other weapons of mass destruction;

(II) conducts offensive cyber operations through automated vulnerability discovery and exploitation against a wide range of potential targets of cyber attacks (not including for defensive purposes such vulnerability reporting or mitigation); or

(III) evades human control or oversight of automated systems through means of deception or obfuscation;

(ii) accessing capabilities primarily designed for offensive cyberspace operations (not including accessing such capabilities for network defense activities); or

(iii) conducting surveillance primarily designed to undermine human rights, such as by using spyware (as defined in section 1102A of the National Security Act of 1947 (50 U.S.C. 3232a(a))), location tracking technology, or biometric identification technology primarily designed for such surveillance.

For purposes of subparagraph (A), the term cloud infrastructure service has the meaning given the term Infrastructure as a Service by the National Institute of Standards and Technology in Special Publication 800–145 (or any successor publication).

The term foreign person of concern means—

(A) the government of—

(i) a country specified in section 4872(f)(2) of title 10, United States Code; or

(ii) any region within such a country, including the Macau Special Administrative Region and the Hong Kong Special Administrative Region of the People’s Republic of China;

(B) an entity located or headquartered in, or the ultimate parent company of which is headquartered in, such a country or region; or

(C) a person subject to the jurisdiction of a government described in subparagraph (A).

Section 1752 of the Export Control Reform Act of 2018 (50 U.S.C. 4811) is amended—

(1) in paragraph (1)—

(A) in subparagraph (A), by inserting, and provision of remote access to, after export of; and

(B) in subparagraph (B), by inserting, and provision of remote access to, after export of; and

(2) in paragraph (2)—

(A) in the matter preceding subparagraph (A), by inserting, and provision of remote access to, after transfer of; and

(B) in subparagraph (A), in the matter preceding clause (i), by inserting, or provision of remote access to, after release of.

Section 1753 of the Export Control Reform Act of 2018 (50 U.S.C. 4812) is amended—

(1) in subsection (a)—

(A) in paragraph (1), by striking and at the end;

(B) in paragraph (2)(F), by striking the period at the end and inserting; and; and

(C) by adding at the end the following:

(3) the provision of remote access to items subject to the jurisdiction of the United States to foreign persons of concern.

(2) in subsection (b)—

(A) in paragraph (6), by striking and at the end;

(B) in paragraph (7), by striking the period at the end and inserting; and; and

(C) by adding at the end the following:

(8) regulate the provision of remote access to items described in subsection (a)(3).

(C) ; and

(3) in subsection (c)—

(A) by inserting, or provision of remote access to, after in-country transfer of;

(B) by striking subsections (b)(1) or (b)(2) and inserting paragraphs (1), (2), and (8) of subsection (b), as applicable,; and

(C) by striking or in-country transfer occurs and inserting in-country transfer, or provision of remote access occurs.

Section 1754 of the Export Control Reform Act of 2018 (50 U.S.C. 4813) is amended—

(1) in subsection (a)—

(A) in paragraph (3), by inserting, and provision of remote access to, after transfers of;

(B) in paragraph (4), by inserting, and provision of remote access to, after transfers of;

(C) in paragraph (5), in the matter preceding subparagraph (A), by inserting, and provision of remote access to, after transfers of;

(D) in paragraph (6), by striking United States export control and inserting United States control;

(E) in paragraph (7), by striking export controls and inserting controls;

(F) in paragraph (10), by striking or in-country transferred and inserting in-country transferred, or accessed remotely;

(G) in paragraph (11), by adding at the end before the semicolon the following: or remote access; and

(H) in paragraph (15), by striking to export and inserting for export, reexport, in-country transfer, or provision of remote access;

(2) in subsection (b), by inserting, or provision of remote access to, after transfer of; and

(3) in subsection (d)(1)(A), by inserting, or provision of remote access to, after in country-transfer of.

Section 1755 of the Export Control Reform Act of 2018 (50 U.S.C. 4814) is amended—

(1) in subsection (b)(2)—

(A) in subparagraph (C), by inserting, and provision of remote access to, after in-country transfers of; and

(B) in subparagraph (E), by inserting, and remote access to, after in-country transfers of; and

(2) in subsection (c), by striking export controls and inserting controls.

Section 1756 of the Export Control Reform Act of 2018 (50 U.S.C. 4815) is amended—

(1) in subsection (a), in the matter preceding paragraph (1), by inserting, and provision of remote access to, after in-country transfer of; and

(2) in subsection (b), by inserting, or provide remote access to, after in-country transfer.

Section 1757 of the Export Control Reform Act of 2018 (50 U.S.C. 4816) is amended—

(1) in subsection (a), by inserting, or provision of remote access to, after in-country transfer of; and

(2) in subsection (c)(2), by striking export controls and inserting controls.

Section 1760 of the Export Control Reform Act of 2018 (50 U.S.C. 4819) is amended—

(1) in subsection (a)(2)(F)—

(A) in clause (ii), by striking any export control document or any report and inserting any document or report; and

(B) in clause (iii), by inserting, or provision of remote access to, after in-country transfer of;

(2) in subsection (c)(1)(C), by striking or in-country transfer and inserting in-country transfer, or remotely access; and

(3) in subsection (e)(1)(A)—

(A) in clause (i), by inserting, or remotely access or provide remote access to, after United States; and

(B) in clause (ii), by striking or in-country transfer and inserting in-country transfer, or remotely access, or provide remote access to,.

Section 1761 of the Export Control Reform Act of 2018 (50 U.S.C. 4820) is amended—

(1) in subsection (a)(5), by striking or in-country transferred and inserting in-country transferred, or remotely accessed; and

(2) in subsection (h)(1)(B), by inserting, or provide remote access to, after in-country transfer.

Section 1765(a)(1) of the Export Control Reform Act of 2018 (50 U.S.C. 4824(a)(1)) is amended by inserting, and provision of remote access to, after in-country transfers of.

Section 1767 of the Export Control Reform Act of 2018 (50 U.S.C. 4825) is amended—

(1) in subsection (a), by inserting, or remote access to, after reexport of; and

(2) in subsection (b)(2)—

(A) in subparagraph (A), by inserting, and remote access by and provision of remote access to such persons to, after persons of; and

(B) in subparagraph (C), by striking or in-country transferred and inserting in-country transferred, or remotely accessed.

The authority under part I of the Export Control Reform Act of 2018, as amended by this section, to impose controls on remote access to items terminates on the date that is 10 years after the date of the enactment of this Act.

(1) the national security or foreign policy risk that would be addressed by the regulations;

(2) how the method of the regulations addresses that risk; and

(3) how the regulations may impact the economy of the United States, including the impact on the competitiveness of United States industry in cloud services and related industries as a result of the regulations.

Not later than 1 year after the date of the enactment of this Act, the Secretary of Commerce shall submit to Congress and make available to the public a report assessing and making recommendations with respect to—

(1) the implementation of this Act and the amendments made by this Act;

(2) maximizing the level of privacy, and minimizing compliance costs, for entities seeking licenses relating to remote access to items under the Export Control Reform Act of 2018, as amended by section 2;

(3) improving the speed at which and consistency with which applications for such licenses are reviewed;

(4) identifying relevant national security and foreign policy concerns related to remote access to items in the interest of improving certainty for United States businesses;

(5) increasing cooperation with international partners with respect to remote access to items;

(6) ensuring export controls relating to remote access to items are consistent, clear, and up to date; and

(7) recommending amendments to the Export Control Reform Act of 2018 to strengthen the provisions of that Act relating to remote access.

In developing the report required by subsection (a), the Secretary shall seek input from the public, including holding a public roundtable with industry participants.