Section 1 Short title
This Act may be cited as the “Remote Access Security Act”.
Remote Access Security Act
A BILL
To amend the Export Control Reform Act of 2018 to provide for control of remote access to items, and for other purposes.
Sec. 2 Control of remote access of items under the Export Control Reform Act of 2018
Definition of remote access— Section 1742 of the Export Control Reform Act of 2018 (50 U.S.C. 4801) is amended by adding at the end the following:
“(15) Remote access
“(A) In general—The term remote access means access to an item subject to the jurisdiction of the United States and included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations, by a foreign person of concern through a cloud infrastructure service from a location outside the United States and other than where the item is physically located, if the Secretary determines that the use of the item has demonstrated a serious risk to the national security or foreign policy of the United States through the use of software, such as by—
“(i) training an artificial intelligence dual-use model that—
“(I) substantially lowers the barrier of entry for experts or nonexperts to design, synthesize, acquire, or use chemical, biological, radiological, or nuclear weapons or other weapons of mass destruction;
“(II) conducts offensive cyber operations through automated vulnerability discovery and exploitation against a wide range of potential targets of cyber attacks (not including for defensive purposes such vulnerability reporting or mitigation); or
“(III) evades human control or oversight of automated systems through means of deception or obfuscation;
“(ii) accessing capabilities primarily designed for offensive cyberspace operations (not including accessing such capabilities for network defense activities); or
“(iii) conducting surveillance primarily designed to undermine human rights, such as by using spyware (as defined in section 1102A of the National Security Act of 1947 (50 U.S.C. 3232a(a))), location tracking technology, or biometric identification technology primarily designed for such surveillance.
“(B) Cloud infrastructure service defined—For purposes of subparagraph (A), the term cloud infrastructure service has the meaning given the term “Infrastructure as a Service” by the National Institute of Standards and Technology in Special Publication 800–145 (or any successor publication).
“(16) Foreign person of concern—The term foreign person of concern means—
“(A) the government of—
“(i) a country specified in section 4872(f)(2) of title 10, United States Code; or
“(ii) any region within such a country, including the Macau Special Administrative Region and the Hong Kong Special Administrative Region of the People’s Republic of China;
“(B) an entity located or headquartered in, or the ultimate parent company of which is headquartered in, such a country or region; or
“(C) a person subject to the jurisdiction of a government described in subparagraph (A).”
Statement of policy— Section 1752 of the Export Control Reform Act of 2018 (50 U.S.C. 4811) is amended—
in paragraph (1)—
in subparagraph (A), by inserting “, and provision of remote access to,” after “export of”; and
in subparagraph (B), by inserting “, and provision of remote access to,” after “export of”; and
in paragraph (2)—
in the matter preceding subparagraph (A), by inserting “, and provision of remote access to,” after “transfer of”; and
in subparagraph (A), in the matter preceding clause (i), by inserting “, or provision of remote access to,” after “release of”.
Authority of President— Section 1753 of the Export Control Reform Act of 2018 (50 U.S.C. 4812) is amended—
in subsection (a)—
in paragraph (1), by striking “and” at the end;
in paragraph (2)(F), by striking the period at the end and inserting “; and”; and
by adding at the end the following:
“(3) the provision of remote access to items subject to the jurisdiction of the United States to foreign persons of concern.”
in subsection (b)—
in paragraph (6), by striking “and” at the end;
in paragraph (7), by striking the period at the end and inserting “; and”; and
by adding at the end the following:
“(8) regulate the provision of remote access to items described in subsection (a)(3).”
in subsection (c)—
by inserting “, or provision of remote access to,” after “in-country transfer of”;
by striking “subsections (b)(1) or (b)(2)” and inserting “paragraphs (1), (2), and (8) of subsection (b), as applicable,”; and
by striking “or in-country transfer occurs” and inserting “in-country transfer, or provision of remote access occurs”.
Additional authorities— Section 1754 of the Export Control Reform Act of 2018 (50 U.S.C. 4813) is amended—
in subsection (a)—
in paragraph (3), by inserting “, and provision of remote access to,” after “transfers of”;
in paragraph (4), by inserting “, and provision of remote access to,” after “transfers of”;
in paragraph (5), in the matter preceding subparagraph (A), by inserting “, and provision of remote access to,” after “transfers of”;
in paragraph (6), by striking “United States export control” and inserting “United States control”;
in paragraph (7), by striking “export controls” and inserting “controls”;
in paragraph (10), by striking “or in-country transferred” and inserting “in-country transferred, or accessed remotely”;
in paragraph (11), by adding at the end before the semicolon the following: “or remote access”; and
in paragraph (15), by striking “to export” and inserting “for export, reexport, in-country transfer, or provision of remote access”;
in subsection (b), by inserting “, or provision of remote access to,” after “transfer of”; and
in subsection (d)(1)(A), by inserting “, or provision of remote access to,” after “in country-transfer of”.
Administration of controls— Section 1755 of the Export Control Reform Act of 2018 (50 U.S.C. 4814) is amended—
in subsection (b)(2)—
in subparagraph (C), by inserting “, and provision of remote access to,” after “in-country transfers of”; and
in subparagraph (E), by inserting “, and remote access to,” after “in-country transfers of”; and
in subsection (c), by striking “export controls” and inserting “controls”.
in subsection (a), in the matter preceding paragraph (1), by inserting “, and provision of remote access to,” after “in-country transfer of”; and
in subsection (b), by inserting “, or provide remote access to,” after “in-country transfer”.
Compliance assistance— Section 1757 of the Export Control Reform Act of 2018 (50 U.S.C. 4816) is amended—
in subsection (a), by inserting “, or provision of remote access to,” after “in-country transfer of”; and
in subsection (c)(2), by striking “export controls” and inserting “controls”.
in subsection (a)(2)(F)—
in clause (ii), by striking “any export control document or any report” and inserting “any document or report”; and
in clause (iii), by inserting “, or provision of remote access to,” after “in-country transfer of”;
in subsection (c)(1)(C), by striking “or in-country transfer” and inserting “in-country transfer, or remotely access”; and
in subsection (e)(1)(A)—
in clause (i), by inserting “, or remotely access or provide remote access to,” after “United States”; and
in clause (ii), by striking “or in-country transfer” and inserting “in-country transfer, or remotely access, or provide remote access to,”.
in subsection (a)(5), by striking “or in-country transferred” and inserting “in-country transferred, or remotely accessed”; and
in subsection (h)(1)(B), by inserting “, or provide remote access to,” after “in-country transfer”.
Annual report— Section 1765(a)(1) of the Export Control Reform Act of 2018 (50 U.S.C. 4824(a)(1)) is amended by inserting “, and provision of remote access to,” after “in-country transfers of”.
Effect on other Acts— Section 1767 of the Export Control Reform Act of 2018 (50 U.S.C. 4825) is amended—
in subsection (a), by inserting “, or remote access to,” after “reexport of”; and
in subsection (b)(2)—
in subparagraph (A), by inserting “, and remote access by and provision of remote access to such persons to,” after “persons of”; and
in subparagraph (C), by striking “or in-country transferred” and inserting “in-country transferred, or remotely accessed”.
Termination— The authority under part I of the Export Control Reform Act of 2018, as amended by this section, to impose controls on remote access to items terminates on the date that is 10 years after the date of the enactment of this Act.
Sec. 3 Consultations with Congress
The Secretary of Commerce shall ensure Congress is kept fully and currently informed of any anticipated promulgation of regulations to control remote access to items under the Export Control Reform Act of 2018, as amended by section 2, including ensuring that Congress is informed, in a classified setting as necessary, on—
the national security or foreign policy risk that would be addressed by the regulations;
how the method of the regulations addresses that risk; and
how the regulations may impact the economy of the United States, including the impact on the competitiveness of United States industry in cloud services and related industries as a result of the regulations.
Sec. 4 Report and recommendations
In general— Not later than 1 year after the date of the enactment of this Act, the Secretary of Commerce shall submit to Congress and make available to the public a report assessing and making recommendations with respect to—
the implementation of this Act and the amendments made by this Act;
maximizing the level of privacy, and minimizing compliance costs, for entities seeking licenses relating to remote access to items under the Export Control Reform Act of 2018, as amended by section 2;
improving the speed at which and consistency with which applications for such licenses are reviewed;
identifying relevant national security and foreign policy concerns related to remote access to items in the interest of improving certainty for United States businesses;
increasing cooperation with international partners with respect to remote access to items;
ensuring export controls relating to remote access to items are consistent, clear, and up to date; and
recommending amendments to the Export Control Reform Act of 2018 to strengthen the provisions of that Act relating to remote access.
Consultations— In developing the report required by subsection (a), the Secretary shall seek input from the public, including holding a public roundtable with industry participants.