Proposed Rule2021-25329
Securing the Information and Communications Technology and Services Supply Chain; Connected Software Applications
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
November 26, 2021
Issuing agencies
Commerce Department
Abstract
To implement provisions of Executive Order 14034, ``Protecting Americans' Sensitive Data from Foreign Adversaries'' (E.O. 14034), the Department of Commerce is proposing to amend its Interim Final Rule on Securing the Information and Communications Technology and Services Supply Chain (Supply Chain Rule), which was published on January 19, 2021, 86 FR 4909. Specifically, this proposed rule would amend the Supply Chain Rule to provide for additional criteria that the Secretary of Commerce (the Secretary) may consider specifically when determining whether ICTS Transactions (as defined in the Supply Chain Rule) that involve connected software applications present an undue or unacceptable risk. The rule also makes conforming changes by revising the definition of ICTS to expressly include ``connected software applications'' and adding a definition of ``connected software application'' that is consistent with that used in E.O. 14034. The Department is interested in the public's views on the additional criteria for connected software applications, including whether they should be applied to all ICTS Transaction reviews, whether there are other criteria that should be applied, and how the Secretary should apply the criteria to ICTS Transactions involving connected software applications.
Full Text
<html>
<head>
<title>Federal Register, Volume 86 Issue 225 (Friday, November 26, 2021)</title>
</head>
<body><pre>
[Federal Register Volume 86, Number 225 (Friday, November 26, 2021)]
[Proposed Rules]
[Pages 67379-67383]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2021-25329]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF COMMERCE
15 CFR Part 7
[Docket No. 211115-0230]
RIN 0605-AA62
Securing the Information and Communications Technology and
Services Supply Chain; Connected Software Applications
AGENCY: U.S. Department of Commerce.
ACTION: Notice of Proposed Rulemaking.
-----------------------------------------------------------------------
SUMMARY: To implement provisions of Executive Order 14034, ``Protecting
Americans' Sensitive Data from Foreign Adversaries'' (E.O. 14034), the
Department of Commerce is proposing to amend its Interim Final Rule on
Securing the Information and Communications Technology and Services
Supply Chain (Supply Chain Rule), which was published on January 19,
2021, 86 FR 4909. Specifically, this proposed rule would amend the
Supply Chain Rule to provide for additional criteria that the Secretary
of Commerce (the Secretary) may consider specifically when determining
whether ICTS Transactions (as defined in the Supply Chain Rule) that
involve connected software applications present an undue or
unacceptable risk. The rule also makes conforming changes by revising
the definition of ICTS to expressly include ``connected software
applications'' and adding a definition of ``connected software
application'' that is consistent with that used in E.O. 14034. The
Department is interested in the public's views on the additional
criteria for connected software applications, including whether they
should be applied to all ICTS Transaction reviews, whether there are
other criteria that should be applied, and how the Secretary should
apply the criteria to ICTS Transactions involving connected software
applications.
DATES: Comments to this proposed rule must be received on or before
December 27, 2021.
ADDRESSES: All comments must be submitted by one of the following
methods:
<bullet> By the Federal eRulemaking Portal: <a href="http://www.regulations.gov">http://www.regulations.gov</a> at docket number DOC-2021-0005.
<bullet> By email directly to: <a href="/cdn-cgi/l/email-protection#ade4eef9ded8ddddc1d4cec5ccc4c3edc9c2ce83cac2db"><span class="__cf_email__" data-cfemail="f2bbb1a6818782829e8b919a939b9cb2969d91dc959d84">[email protected]</span></a>. Include
``RIN 0605-AA62'' in the subject line.
<bullet> Instructions: Comments sent by any other method, to any
other address or individual, or received after the end of the comment
period, may not be considered. For those seeking to submit confidential
business information (CBI), please clearly mark such submissions as CBI
and submit by email, as instructed above. Each CBI submission must also
contain a summary of the CBI, clearly marked as public, in sufficient
detail to permit a reasonable understanding of the substance of the
information for public consumption. Such summary information will be
posted on <a href="http://regulations.gov">regulations.gov</a>.
FOR FURTHER INFORMATION CONTACT: Joseph Bartels, U.S. Department of
Commerce, telephone: (202) 482-0224. For media inquiries: Brittany
Caplin, Deputy Director of Public Affairs and Press Secretary, U.S.
Department of Commerce, telephone: (202) 482-4883, email:
<a href="/cdn-cgi/l/email-protection#f6a683949a9f95b79090979f8485b6929995d8919980"><span class="__cf_email__" data-cfemail="69391c0b05000a280f0f08001b1a290d060a470e061f">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION:
[[Page 67380]]
Background
On January 19, 2021, the Department published an interim final rule
in the Federal Register on ``Securing the Information and
Communications Technology and Services Supply Chain.'' 86 FR 4909. The
Supply Chain Rule implemented Executive Order 13873, ``Securing the
Information and Communications Technology and Services Supply Chain''
(84 FR 22689), including by setting out procedures by which the
Secretary of Commerce, in consultation with the appropriate heads of
other administrative agencies, would review ICTS Transactions for
whether they present an undue or unacceptable risk due to a foreign
adversary's involvement. The Supply Chain Rule defines ``ICTS'' as
``any hardware, software, or other product or service, including cloud-
computing services, primarily intended to fulfill or enable the
function of information or data processing, storage, retrieval, or
communication by electronic means (including electromagnetic, magnetic,
and photonic), including through transmission, storage, or display.''
The Supply Chain Rule further provides that an ``ICTS Transaction'' is,
``any acquisition, importation, transfer, installation, dealing in, or
use of any information and communications technology or service,
including ongoing activities, such as managed services, data
transmission, software updates, repairs, or the platforming or data
hosting of applications for consumer download. An ICTS Transaction
includes any other transaction, the structure of which is designed or
intended to evade or circumvent the application of E.O. 13873. The term
ICTS Transaction includes a class of ICTS Transactions.''
On June 9, 2021, the President issued E.O. 14034 to ``elaborate
upon measures to address the national emergency with respect to the
information and communications technology and services supply chain
that was declared in Executive Order 13873 of May 15, 2019, `Securing
the Information and Communications Technology and Services Supply
Chain.' '' E.O. 14034 sets out the finding ``that the increased use in
the United States of certain connected software applications designed,
developed, manufactured, or supplied by persons owned or controlled by,
or subject to the jurisdiction or direction of, a foreign adversary,
which the Secretary of Commerce acting pursuant to E.O. 13873 has
defined to include the People's Republic of China, among others,
continues to threaten the national security, foreign policy, and
economy of the United States.'' This rule would implement E.O. 14034 by
specifically adding the term ``connected software applications'' and
the accompanying criteria, which do not appear in E.O. 13873, to the
Supply Chain Rule to ensure the rule clearly and consistently
identifies the ICTS that is threatened.
E.O. 14034 orders the Secretary to ``evaluate on a continuing basis
transactions involving connected software applications that may pose an
undue risk of sabotage or subversion of the design, integrity,
manufacturing, production, distribution, installation, operation, or
maintenance of information and communications technology or services in
the United States; pose an undue risk of catastrophic effects on the
security or resiliency of the critical infrastructure or digital
economy of the United States; or otherwise pose an unacceptable risk to
the national security of the United States or the security and safety
of United States persons.''
E.O. 14034 further sets out certain factors, consistent with the
criteria established in E.O. 13873 and in addition to those set forth
in the Supply Chain Rule, that should be considered in evaluating the
risks of a transaction involving connected software applications.
Specifically, E.O. 14034 lists the following as potential indicators of
risk related to connected software applications: ``ownership, control,
or management by persons that support a foreign adversary's military,
intelligence, or proliferation activities; use of the connected
software application to conduct surveillance that enables espionage,
including through a foreign adversary's access to sensitive or
confidential government or business information, or sensitive personal
data; ownership, control, or management of connected software
applications by persons subject to coercion or cooption by a foreign
adversary; ownership, control, or management of connected software
applications by persons involved in malicious cyber activities; a lack
of thorough and reliable third-party auditing of connected software
applications; the scope and sensitivity of the data collected; the
number and sensitivity of the users of the connected software
application; and the extent to which identified risks have been or can
be addressed by independently verifiable measures.''
This proposed rule incorporates these potential indicators of risk
as criteria to be considered by the Secretary when assessing whether an
ICTS Transaction involving connected software applications poses an
undue or unacceptable risk. The Department seeks public comments on
these criteria, including how the Secretary should apply these to ICTS
Transactions involving connected software applications, and whether
there are additional criteria that should be considered by the
Secretary with respect to connected software applications. The
Department is also interested in the public's views as to whether these
criteria should be applied to all ICTS Transaction reviews or just
those that involve connected software applications. In addition, the
Department seeks comment on any other considerations the Secretary
should take into account when determining whether an ICTS Transaction
involving connected software applications should, consistent with the
authority and procedures of E.O. 13873 and the Supply Chain Rule, be
allowed, mitigated, or prohibited.
Additionally, consistent with E.O. 14034's recognition of the
ongoing threat, identified in E.O. 13873, by foreign adversaries to
steal or otherwise obtain data through connected software applications,
the Department notes that the term ``information and communications
technology and services'' encompasses ``connected software
applications'' and is proposing to revise the definition of ICTS
accordingly to expressly so specify. This rule would also make a
conforming revision to the term ``ICTS Transaction,'' and would define
``connected software applications'' as ``software, a software program,
or a group of software programs, that is designed to be used on an end-
point computing device and includes as an integral functionality, the
ability to collect, process, or transmit data via the internet.''
Section 7.1 Scope
The Department proposes to add the phrase ``connected software
applications'' to section 7.1 of Title 15 of the Code of Federal
Regulations (CFR).
Section 7.2 Definitions
As noted above, consistent with E.O. 14034's recognition of the
ongoing threat by foreign adversaries to steal, otherwise obtain, or
disrupt data through connected software applications, this rule would
expressly specify that the term ``information and communications
technology and services or ICTS'' encompasses ``connected software
applications.'' The proposed definition of ``connected software
applications'' is taken from E.O. 14034: ``software, a software
[[Page 67381]]
program, or a group of software programs, that is designed to be used
on an end-point computing device and includes as an integral
functionality, the ability to collect, process, or transmit data via
the internet.''
The Department welcomes comment on whether this definition is
sufficient to identify fully this category of ICTS, or whether further
clarification or elaboration is needed. For instance, are there
technical aspects to the definition that are used in industry or
engineering that should be incorporated into the definition? Should the
Department include other devices, such as those that communicate
through short message service (SMS) messages, or low-power radio
protocols? Should the definition be extended from ``end-point'' devices
to ``end-to-end'' technology, and is ``end-to-end'' a term of art that
we should employ? Are there other means of communication or
transmission that are not encompassed by this definition but should be
included?
Section 7.3 Scope of Covered Transactions
Further, the Department proposes to add new Sec. 7.3(a)(4)(v)(E)
regarding the types of software ``designed primarily for connecting
with and communicating via the internet that is used by greater than
one million U.S. persons'' involved in ICTS Transactions that are
subject to the Secretary's review.
Section 7.103 Initial Review of ICTS Transactions
To incorporate the new criteria for determining whether a
transaction involving connected software applications poses an undue or
unacceptable risk, as defined in the Supply Chain Rule, this rule would
amend Sec. 7.103 to add the criteria from E.O. 14034 in a new
paragraph. Notably, these criteria complement, and are in addition to,
the criteria already in 7.103(c) for determining whether an ICTS
Transaction poses an undue or unacceptable risk. In making this
determination for connected software applications, the Secretary would
evaluate both the criteria in 7.103(c) and in the new paragraph.
Specifically, the Department would redesignate current paragraph
7.103(d) as 7.103(e) and add new paragraph 7.103(d) to include the
following criteria:
<bullet> Ownership, control, or management by persons that support
a foreign adversary's military, intelligence, or proliferation
activities;
<bullet> use of the connected software application to conduct
surveillance that enables espionage, including through a foreign
adversary's access to sensitive or confidential government or business
information, or sensitive personal data;
<bullet> ownership, control, or management of connected software
applications by persons subject to coercion or cooption by a foreign
adversary;
<bullet> ownership, control, or management of connected software
applications by persons involved in malicious cyber activities;
<bullet> a lack of thorough and reliable third-party auditing of
connected software applications;
<bullet> the scope and sensitivity of the data collected;
<bullet> the number and sensitivity of the users of the connected
software application; and
<bullet> the extent to which identified risks have been or can be
addressed by independently verifiable measures.
As noted above, while the proposed regulatory text below adds these
criteria in a new sub-paragraph applicable only to ICTS Transactions
involving connected software applications, the Department is also
inviting comments on whether these criteria are sufficient or whether
others should be added. For example, should the Department add a
criterion such as whether the software has any embedded out-going
network calls or web server references, regardless of the ownership,
control, or management of the software? The Department also seeks
comments on whether the criteria should be more generally applicable to
ICTS Transactions.
With regard to the phrase ``ownership, control or management,''
should it be understood to include both continuous control/management
and sporadic control/management (e.g., when a third-party must be
temporally granted access to apply updates/upgrades/patches/etc.), or
should this phrase be further clarified?
Additionally, the Department seeks comment on whether and how the
Department should specifically define the terms ``reliable third-
party'' and ``independently verifiable measures,'' and, if so, whether
there are generally accepted definitions or terms of art that the
Department should consider adopting. The Department is also interested
in whether the reference to ``third-party auditing of connected
software applications'' is sufficiently clear or whether it needs
further definition. For example, would it be understood to apply to
audits by a third party of only the connected software applications, or
to audits of the organizations implementing the software applications
as well? Also, should the requirement to audit applications be revised
to make clear that auditing is a continuous process through the
development and deployment life cycle of the application? And would the
requirement to audit applications be understood to refer only to
source-code examination and verification, or would it also include
monitoring of logs or other data that the application collects?
Classification
A. Executive Order 12866 (Regulatory Policies and Procedures)
Pursuant to the procedures established to implement Executive Order
12866, the Office of Management and Budget has determined that this
rule is significant but not economically significant.
C. Regulatory Flexibility Analysis
The Chief Counsel for Regulation of the Department of Commerce
certifies to the Chief Counsel for Advocacy of the Small Business
Administration that this proposed rule would not have a significant
economic impact on a substantial number of small entities. The factual
determination for this determination is as follows.
This proposed rule would update the regulations at 15 CFR part 7
that implement E.O. 13873 to revise the term ICTS to specifically
include ``connected software applications,'' as well as to affirm that
a transaction involving connected software applications is an ICTS
Transaction. It would add criteria the Secretary and the appropriate
agency heads may use in making determinations about the risks
potentially posed by ICTS Transactions involving connected software
applications. The rule would also make conforming changes.
Accordingly, this proposed rule does not increase the scope of
applicability of the existing regulations, the economic effects of
which were evaluated in the regulatory impact analysis (RIA) associated
with the Supply Chain Rule, at 86 FR 4909. (The RIA can be found online
at <a href="http://reginfo.gov">reginfo.gov</a>, and at <a href="http://regulations.gov">regulations.gov</a>, with a search for RIN 0605-
AA51.) This proposed rule, once implemented, will not add any costs or
burdens to any entity, small or large, because it does not expand the
application scope of the Supply Chain Rule. Because this proposed rule
neither increases the number of entities to which the Supply Chain Rule
applies, nor increases the cost and burdens on those entities, it would
not have a significant economic impact on a substantial number of small
businesses.
[[Page 67382]]
D. Paperwork Reduction Act
The Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.) (PRA)
provides that an agency generally cannot conduct or sponsor a
collection of information, and no person is required to respond to nor
be subject to a penalty for failure to comply with a collection of
information, unless that collection has obtained Office of Management
and Budget (OMB) approval and displays a currently valid OMB Control
Number. This proposed rule does not contain a collection of information
requirement subject to review and approval by OMB under the PRA.
E. Unfunded Mandates Reform Act of 1995
This proposed rule would not create a Federal mandate (under the
regulatory provisions of Title II of the Unfunded Mandates Reform Act
of 1995) for State, local, and tribal governments or the private
sector.
F. Executive Order 13132 (Federalism)
This proposed rule does not contain policies having federalism
implications requiring preparations of a Federalism Summary Impact
Statement.
G. Executive Order 12630 (Governmental Actions and Interference With
Constitutionally Protected Property Rights)
This rule does not contain policies that have unconstitutional
takings implications.
H. Executive Order 13175 (Consultation and Coordination With Indian
Tribes)
The Department has analyzed this proposed rule under Executive
Order 13175 and has determined that the action would not have a
substantial direct effect on one or more Indian tribes, would not
impose substantial direct compliance costs on Indian tribal
governments, and would not preempt tribal law.
I. National Environmental Policy Act
The Department has reviewed this rulemaking action for the purposes
of the National Environmental Policy Act (42 U.S.C. 4321 et. seq). It
has determined that this proposed rule would not have a significant
impact on the quality of the human environment.
List of Subjects in 15 CFR Part 7
Administrative practice and procedure, Business and industry,
Communications, Computer technology, Critical infrastructure, Executive
orders, Foreign persons, Investigations, National security, Penalties,
Technology, Telecommunications.
Dated: November 16, 2021.
Trisha Anderson,
Deputy Assistant Secretary for Intelligence and Security, U.S.
Department of Commerce.
PART 7--SECURING THE INFORMATION AND COMMUNICATIONS TECHNOLOGY AND
SERVICES SUPPLY CHAIN
0
1. The authority citation for part 7 continues to read as follows:
Authority: 50 U.S.C. 1701 et seq.; 50 U.S.C. 1601 et seq.; E.O.
13873, 84 FR 22689.
0
2. Revise Sec. 7.1 to read as follows:
Subpart A--General
Sec. 7.1 Purpose.
(a) These regulations set forth the procedures by which the
Secretary may:
(1) Determine whether any acquisition, importation, transfer,
installation, dealing in, or use of any information and communications
technology or service (ICTS Transaction), including connected software
applications, that has been designed, developed, manufactured, or
supplied by persons owned by, controlled by, or subject to the
jurisdiction or direction of foreign adversaries poses certain undue or
unacceptable risks as identified in the Executive Order;
(2) Issue a determination to prohibit an ICTS Transaction;
(3) Direct the timing and manner of the cessation of the ICTS
Transaction; and
(4) Consider factors that may mitigate the risks posed by the ICTS
Transaction.
(b) The Secretary will evaluate ICTS Transactions under this rule,
which include classes of transactions, on a case-by-case basis. The
Secretary, in consultation with appropriate agency heads specified in
Executive Order 13873 and other relevant governmental bodies, as
appropriate, shall make an initial determination as to whether to
prohibit a given ICTS Transaction or propose mitigation measures, by
which the ICTS Transaction may be permitted. Parties may submit
information in response to the initial determination, including a
response to the initial determination and any supporting materials and/
or proposed measures to remediate or mitigate the risks identified in
the initial determination as posed by the ICTS Transaction at issue.
Upon consideration of the parties' submissions, the Secretary will
issue a final determination prohibiting the transaction, not
prohibiting the transaction, or permitting the transaction subject to
the adoption of measures determined by the Secretary to sufficiently
mitigate the risks associated with the ICTS Transaction. The Secretary
shall also engage in coordination and information sharing, as
appropriate, with international partners on the application of these
regulations.
0
3. Amend Sec. 7.2 by adding, in alphabetical order, the definition for
``Connected software application'' and revising the definition of
``Information and communications technology or services or ICTS'' to
read as follows:
Sec. 7.2 Definitions.
* * * * *
Connected software application means software, a software program,
or a group of software programs, that is designed to be used on an end-
point computing device and includes as an integral functionality, the
ability to collect, process, or transmit data via the internet.
* * * * *
Information and communications technology or services or ICTS means
any hardware, software, including connected software applications, or
other product or service, including cloud-computing services, primarily
intended to fulfill or enable the function of information or data
processing, storage, retrieval, or communication by electronic means
(including electromagnetic, magnetic, and photonic), including through
transmission, storage, or display.
* * * * *
0
4. Amend Sec. 7.3 by adding paragraph (a)(4)(v)(E) to read as follows:
Sec. 7.3 Scope of Covered ICTS Transactions.
(a) * * *
(4) * * *
(v) * * *
(E) Connected software applications; or
* * * * *
0
5. In Sec. 7.103, redesignate paragraph (d) as paragraph (e) and add
new paragraph (d) to read as follows:
Sec. 7.103 Initial review of ICTS Transactions.
* * * * *
(d) For ICTS Transactions involving connected software applications
that are accepted for review, the Secretary's assessment of whether the
ICTS Transaction poses an undue or unacceptable risk may be determined
by evaluating the criteria in paragraph (c) of this section as well as
the following additional criteria:
(1) Ownership, control, or management by persons that support a
foreign adversary's military, intelligence, or proliferation
activities;
[[Page 67383]]
(2) Use of the connected software application to conduct
surveillance that enables espionage, including through a foreign
adversary's access to sensitive or confidential government or business
information, or sensitive personal data;
(3) Ownership, control, or management of connected software
applications by persons subject to coercion or cooption by a foreign
adversary;
(4) Ownership, control, or management of connected software
applications by persons involved in malicious cyber activities;
(5) A lack of thorough and reliable third-party auditing of
connected software applications;
(6) The scope and sensitivity of the data collected;
(7) The number and sensitivity of the users of the connected
software application; and
(8) The extent to which identified risks have been or can be
addressed by independently verifiable measures.
* * * * *
[FR Doc. 2021-25329 Filed 11-24-21; 8:45 am]
BILLING CODE 3510-DT-P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on November 26, 2021.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.