Dept of Commerce Proposes Rule for Securing the Nation’s Information and Communications Technology and Services Supply Chain

The US Department of Commerce issued a notice of proposed rulemaking and requested comment on the implementation of Executive Order 13873, Securing the Information and Communications Technology and Services (ICTS) Supply Chain. The proposed rule sets out the procedures the Sec of Commerce plans to use to identify, assess, and address ICTS transactions that pose an undue risk to ICTS in the US, to the critical infrastructure or the digital economy in the US, or an unacceptable risk to national security or to the security and safety of US persons. The public will have a 30-day period to submit comments.

The President issued EO 13873 on May 15, 2019 pursuant to statutory authorities, including the International Emergency Economic Powers Act and the National Emergencies Act, in light of the finding that foreign adversaries are increasingly exploiting ICTS to commit cyber actions, including economic and industrial espionage against the US. The EO gives the Sec of Commerce, in consultation with other relevant Federal agencies, authority to prohibit or mitigate transactions initiated, pending, or completed after May 15, 2019, that involve ICTS designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary, if such transactions pose: an undue risk of sabotage or subversion of ICTS in the US; an undue risk of catastrophic effects on the security and resiliency of critical infrastructure or the digital economy in the US; or an unacceptable risk to national security or to the security and safety of US persons. The Sec has chosen to adopt a case-by-case, fact-specific approach to determine which transactions must be prohibited, or which can be mitigated, according to the requirements in the Executive Order.