Control of remote access of items under the Export Control Reform Act of 2018

The Export Control Reform Act of 2018 is amended—(1)in section 1742 (50 U.S.C. 4801), by adding at the end the following:

(15)

Remote access

The term remote access means access to an item that is subject to the jurisdiction of the United States (without regard to the physical location of the item) and included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations, by a foreign person through a network connection, including the internet or a cloud computing service, from a location other than where the item is physically located, to use the functions of the item if the use of those functions may pose a serious risk to the national security or foreign policy of the United States, such as by—(A)training an artificial intelligence model that could—(i)substantially lower the barrier of entry for experts or non-experts to design, synthesize, acquire, or use chemical, biological, radiological, or nuclear weapons or weapons of mass destruction;(ii)enable offensive cyber operations through automated vulnerability discovery and exploitation against a wide range of potential targets of cyber attacks; or(iii)permit the evasion of human control or oversight of automated systems through means of deception or obfuscation; or(B)accessing a quantum computer that could enable offensive cyber operations or other risks to national security; or(C)accessing hacking tools.

;

(2)in section 1752 (50 U.S.C. 4811)—(A)in paragraph (1)—(i)in subparagraph (A), by inserting or remote access after export; and(ii)in subparagraph (B), by inserting or remote access after export; and(B)in paragraph (2)—(i)in the matter preceding subparagraph (A), by striking and in-country transfer of items and inserting in-country transfer, and remote access of items; and(ii)in subparagraph (A)—(I)in the matter preceding clause (i), by striking release and inserting release or remote access;(II)in clause (iv), by striking ; or and inserting a semicolon;(III)in clause (v), by striking the period at the end and inserting ; or; and(IV)by adding at the end the following:

(vi)offensive cyber operations.

;

(3)in section 1753 (50 U.S.C. 4812)—(A)in subsection (a)—(i)in paragraph (1), by striking and at the end;(ii)in paragraph (2)(F), by striking the period at the end and inserting ; and; and(iii)by adding at the end the following:

(3)the remote access to—(A)items subject to the jurisdiction of the United States (without regard to the physical location of the items) that are determined by the President to warrant controls with respect to access by foreign persons or countries of concern; and(B)the functions of such items.

;

(B)in subsection (b)—(i)by redesignating paragraphs (3) through (7) as paragraphs (4) through (8), respectively; and(ii)by inserting after paragraph (2) the following:

(3)regulate the remote access by foreign persons of items as described in subsection (a)(3);

; and

(C)in subsection (c)—(i)by striking or in-country transfer each place it appears and inserting in-country transfer, or remote access; and(ii)by striking subsections (b)(1) or (b)(2) and inserting subsections (b)(1), (b)(2), or (b)(3);(4)in section 1754 (50 U.S.C. 4813)—(A)in subsection (a)—(i)in paragraph (3), by striking and in-country transfers and inserting in-country transfers, and remote access;(ii)in paragraph (4), by striking and in-country transfers and inserting in-country transfers, and remote access;(iii)in paragraph (5), by striking and in-country transfers and inserting in-country transfers, and remote access;(iv)in paragraph (10), by striking or in-country transferred and inserting in-country transferred, or remotely accessed;(v)in paragraph (11), by adding at the end before the semicolon the following: or remote access; and(vi)in paragraph (15), by adding at the end before ; and the following: or remotely access (including the provision thereof); (B)in subsection (b), by striking or in-country transfer and inserting in-country transfer, or remote access; and(C)in subsection (d)(1), by amending subparagraph (A) to read as follows:

(A)the export, reexport, or in-country transfer of, or remote access to, items described in paragraph (2), or remote access to items described in section 1742(15), including, in both cases, items that are not subject to control under this part; and

(5)in section 1755(b)(2) (50 U.S.C. 4814(b)(2))—(A)in subparagraph (C), by striking and in-country transfers and inserting in-country transfers, and remote access; and(B)in subparagraph (E), by striking and in-country transfers and inserting in-country transfers, and remote access; and(6)in section 1756 (50 U.S.C. 4815)—(A)in subsection (a), in the matter preceding paragraph (1), by striking and in-country transfer and inserting in-country transfer, and remote access; and(B)in subsection (b), by striking or in-country transfer and inserting in-country transfer, or remote access;(7)in section 1757(a) (50 U.S.C. 4816(a)), by striking or in-country transfer and inserting in-country transfer, or remote access; and(8)in section 1760 (50 U.S.C. 4819)—(A)in subsection (a)(2)(F)(iii), by striking or in-country transfer and inserting in-country transfer, or remote access;(B)in subsection (c)(1)(C), by striking or in-country transfer and inserting in-country transfer, or remotely access (including the provision thereof); and(C)in subsection (e)(1)(A)—(i)in clause (i), by striking or in-country transfer outside the United States any item and inserting in-country transfer outside the United States any item, or remotely access any item; and(ii)in clause (ii), by striking or in-country transfer and inserting in-country transfer, or remote access;(9)in section 1761 (50 U.S.C. 4820)—(A)in subsection (a)(5), by striking or in-country transferred and inserting in-country transferred, or remotely accessed; (B)in subsection (d)(2), by striking export each place it appears and inserting export control; and (C)in subsection (h)(1)(B), by striking or in-country transfer and inserting in-country transfer, or remotely access; and(10)in section 1767 (50 U.S.C. 4825)—(A)in subsection (a), by striking or reexport and inserting reexport, or remote access; and(B)in subsection (b)(2)—(i)in subparagraph (A), by striking and in-country transfer and inserting in-country transfer, and remote access; and(ii)in subparagraph (C), by striking or in-country transferred and inserting in-country transferred, or remotely accessed.