BIS's ECRA Delay Hindering Work of CFIUS, Allowing 'Unfettered' Exports, Congressional Commission Says

A congressional commission said the Commerce Department has “failed” to carry out its export control responsibilities over emerging and foundational technologies, which is hindering the work of other government bodies and allowing some sensitive dual-use technologies to be freely exported from the U.S. The commission said Commerce’s Bureau of Industry and Security, which is in charge of the export control effort, has taken “limited action to strengthen or introduce new controls” since its 2018 congressional mandate and should look to other agencies to help with the process.

BIS has issued some emerging technology controls but no restrictions over foundational technologies since Congress passed the Export Control Reform Act of 2018, which called for a broad review of controls for those technologies. Although ECRA’s mandate to create a list of emerging and foundational technologies is “one of the most challenging to implement,” the U.S.-China Economic and Security Review Commission (USCESRC) said BIS should be moving faster.

“The years-long delay in developing these definitions may exacerbate national security risks,” the commission said in a June 1 report, which was written by USCESRC staff. The House’s Republican-led China task force offered similar criticisms against BIS last year and threatened to take the responsibility of ECRA away from the agency (see 2010010020), a move some lawmakers are still considering (see 2104070026).

BIS officials have acknowledged delays in the export control process (see 2002040057) but have pointed to its approximately 40 emerging technology controls as progress. Officials have also said the foundational technology effort has proved challenging and they prefer to take their time crafting multilateral controls rather than rushing restrictions that could impose overly broad licensing burdens on U.S. exporters and damage U.S. competitiveness.

A BIS spokesperson stressed that the agency doesn't plan to publish a complete, initial list of emerging and foundational technology controls, but said the controls will be in a continuous process. "Since innovation is not static and technology triggering national security concerns can evolve over time, the goal to identify such technologies will be a continuous effort and will not be an objective that is 'finished' or 'complete,'" the spokesperson said in an email.

"It is incorrect that no emerging technologies have been identified," the spokesperson added. "Additionally, BIS has another group of emerging technology controls pending with the relevant multilateral regimes."

The commission also said BIS isn’t working closely enough with its technical advisory committees to seek new controls, including its recently established Emerging Technology Technical Advisory Committee (ETTAC) (see 2002240033). The agency’s TACs are composed of industry representatives and academics who provide feedback and proposals on export control changes, but BIS's “use of this resource, however, has been minimal over the past three years,” the report said. The commission specifically said “there do not yet appear to have been any conclusions or follow-on actions as a result” of the few times the ETTAC has met.

The delay continues to hinder the work of the Committee on Foreign Investment in the U.S., the commission said, which recently saw its jurisdiction expanded to cover transactions involving critical technologies such as emerging and foundational items. Because CFIUS doesn’t have a clear and complete picture of technologies to target, the commission said there may be many “undisclosed transactions” to CFIUS that should be disclosed -- a “notable gray area of activity that foreign investment may be exploiting.”

This may be particularly prevalent for investment transactions involving a wide range of artificial intelligence-powered technologies, the commission said, which could eventually fall under BIS’s emerging technology effort but are not yet controlled. “Clear definitions of AI technologies considered emerging or foundational likely would have triggered a mandatory filing requirement for some of these transactions,” the report said, “and made the task of examining such a high volume of transactions far simpler.”

And as BIS “continues to struggle with defining these technologies,” investors may be paralyzed by regulatory uncertainty, the commission said. “Without a final rule or determination, it remains unclear what types of technologies should be subject to CFIUS review,” the report said. “Foreign investors are increasingly wary of putting money in a venture that may face additional restrictions if it eventually falls under an emerging or foundational technology category in the final rule.”

The lack of controls is also allowing “unfettered” U.S. exports of sensitive technologies that will eventually be subject to controls. While controls currently cover “conventional bioweapons,” the commission said the government hasn’t taken “concrete, final steps to address risks” of gene editing, which can be used to “simplify or refine the development of biological weapons or bioweapons that target the environment.” BIS issued a proposed control in November for software that would fall under this category but hasn’t yet finalized it (see 2011050043).

Similar challenges also face the foundational technology effort (see 2012020044, 2011130037 and 2011020057), which may be even more unclear because BIS has so far only issued an advance notice of proposed rulemaking but not concrete restrictions (see 2008260045). “With the current ambiguity,” the report said, “no one can reasonably predict how foundational technologies might ultimately be understood under the export control regime.” The agency said in March it was still reviewing feedback on its foundational technology pre-rule (see 2103190037).

A BIS spokesperson said the agency has "instituted additional controls on items that may be later found to be foundational technologies" and pointed to its work on controls surrounding military end-users and end-uses and military intelligence end-users and end-uses (see 2105050048). "These unilateral controls on a wide range of technologies help further prevent their misuse," the spokesperson said.

Although the responsibility of ECRA has “largely been left” to Commerce, USCESRC said there are opportunities for “multiple stakeholders” to get more involved. “Stronger coordination across agencies on methodology and identification of export-controlled items might enable faster, more uniform implementation of controls and other national security tools across the U.S. government,” the report said.

Despite its criticism, the commission acknowledged the “great deal of technical expertise and deep understanding” of technologies that is required to craft these controls. It also suggested BIS could use more resources and pointed to its 2021 budget proposal, which asks for five more employees to help with the implementation of ECRA (see 2105070017). But the commission also made clear that “current progress in implementation falls short of congressional expectations.”