Federal Register/Vol. 86, No. 11/Tuesday, January
Total Page:16
File Type:pdf, Size:1020Kb
Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations 4909 DEPARTMENT OF COMMERCE reasonable understanding of the upon national security, including substance of the information for public economic security, and public health 15 CFR Part 7 consumption. Such summary and safety. [Docket No. 210113–0009] information will be posted on The purchase, incorporation, and use regulations.gov. by U.S. persons of ICTS—such as RIN 0605–AA51 • Supporting documents: network management or data storage— Æ The Regulatory Impact Analysis is produced by any person owned by, Securing the Information and available at http://www.regulations.gov controlled by, or subject to the Communications Technology and at docket number [DOC–2019–0005]; jurisdiction or direction of a foreign Services Supply Chain Æ The Center for Strategic & adversary—can create multiple AGENCY: U.S. Department of Commerce. International Studies, ‘‘Significant opportunities for those foreign Cyber Incidents 2020’’ is available at adversaries to exploit potential ACTION: Interim final rule; request for vulnerabilities in the ICTS. That, in comments. https://www.csis.org/programs/ technology-policy-program/significant- turn, could cause direct and indirect SUMMARY: The Department of Commerce cyber-incidents; harm to both the immediate targets of is promulgating regulations to Æ The National Security Strategy of the adverse action and to the United implement provisions of Executive the United States is available at https:// States as a whole. While attacks can Order 13873, ‘‘Executive Order on www.whitehouse.gov/wp-content/ originate from remote foreign sources, Securing the Information and uploads/2017/12/NSS-Final-12-18- incorporating certain software, Communications Technology and 2017-0905.pdf; equipment, and products into U.S. Services Supply Chain’’ (May 15, 2019). Æ ODNI’s 2016–2019 Worldwide domestic ICTS networks, as well as the These regulations create the processes Threat Assessments of the U.S. use of certain cloud, network and procedures that the Secretary of Intelligence Community are available at management, or other services, greatly Commerce will use to identify, assess, https://www.dni.gov/files/documents/ increases the risk that potential and address certain transactions, Newsroom/Testimonies/ vulnerabilities may be introduced, or including classes of transactions, SSCI%20Unclassified%20SFR%20- that vulnerabilities may be present between U.S. persons and foreign %20Final.pdf (2017), https:// without being detected. These potential persons that involve information and www.dni.gov/files/documents/ vulnerabilities, if exploited, could communications technology or services Newsroom/Testimonies/2018-ATA--- undermine the confidentiality, integrity, designed, developed, manufactured, or Unclassified-SSCI.pdf (2018), https:// and availability of U.S. person data supplied, by persons owned by, www.dni.gov/files/ODNI/documents/ including personally identifiable controlled by, or subject to the 2019-ATA-SFR---SSCI.pdf (2019); and information or other sensitive personal jurisdiction or direction of a foreign Æ The 2018 National Cyber Strategy data. Some foreign adversaries are known adversary; and pose an undue or of the United States of America is to exploit the sale of software and unacceptable risk. While this interim available at https:// hardware to introduce vulnerabilities final rule will become effective on www.whitehouse.gov/wp-content/ that can allow them to steal critical March 22, 2021, the Department of uploads/2018/09/National-Cyber- intellectual property, research results Commerce continues to welcome public Strategy.pdf. (e.g., health data), or government or input and is thus seeking additional FOR FURTHER INFORMATION CONTACT: financial information from users of the public comment. Once any additional Henry Young, U.S. Department of software or hardware. Such comments have been evaluated, the Commerce, telephone: (202) 482–0224. vulnerabilities can be introduced in the Department is committed to issuing a For media inquiries: Meghan Burris, network, cloud service, or individual final rule. Director, Office of Public Affairs, U.S. product data; allow traffic monitoring or DATES: Effective March 22, 2021. Department of Commerce, telephone: surveillance; and may be resistant to Comments to the interim final rule (202) 482–4883. detection by private purchasers or must be received on or before March 22, SUPPLEMENTARY INFORMATION: telecommunications carriers. Once 2021. I. Background detected, such vulnerabilities may be ADDRESSES: All comments must be extremely costly or impossible to submitted by one of the following The information and communications remediate. methods: technology and services (ICTS) supply Vulnerabilities to data integrity can be • By the Federal eRulemaking Portal: chain is critical to nearly every aspect created by including a foreign http://www.regulations.gov at docket of U.S. national security. U.S. business adversary’s hardware and software into number [DOC–2019–0005]. and governments at all levels rely U.S. networks and systems. This • By email directly to: heavily on ICTS, which: Underpin our incorporated hardware and software [email protected]. Include ‘‘RIN economy; support critical infrastructure poses opportunities to add or remove 0605–AA51’’ in the subject line. and emergency services; and facilitate important information, modify files or • Instructions: Comments sent by any the Nation’s ability to store, process, data streams, slow down, or otherwise other method, to any other address or and transmit vast amounts of data, modify the normal transmission or individual, or received after the end of including sensitive information, that is availability of data across U.S. networks. the comment period, may not be used for personal, commercial, Such capabilities could be exercised in considered. For those seeking to submit government, and national security areas as diverse as financial market confidential business information (CBI), purposes. The ICTS supply chain must communications, satellite please clearly mark such submissions as be secure to protect our national communications or control, or sensitive CBI and submit by email, mail, or hand security, including the economic consumer information. delivery as instructed above. Each CBI strength that is an essential element of A foreign adversary could also exploit submission must also contain a our national security. Ensuring the vulnerabilities provided by the summary of the CBI, clearly marked as resilience of, and trust in, our ICTS incorporation of hardware and software public, in sufficient detail to permit a supply chain is an issue that touches into U.S. environments by fully or VerDate Sep<11>2014 16:33 Jan 17, 2021 Jkt 253001 PO 00000 Frm 00033 Fmt 4700 Sfmt 4700 E:\FR\FM\19JAR1.SGM 19JAR1 khammond on DSKJM1Z7X2PROD with RULES 4910 Federal Register / Vol. 86, No. 11 / Tuesday, January 19, 2021 / Rules and Regulations partially closing down critical networks See, e.g., Center for Strategic & On November 27, 2019, the or functions at key times. These types of International Studies, ‘‘Significant Department of Commerce (Department) attacks are known as denial of service Cyber Incidents 2020,’’ available at published a proposed rule to implement attacks. Such attacks could cause https://www.csis.org/programs/ the terms of the Executive Order. (84 FR widespread problems, such as if they technology-policy-program/significant- 65316). The proposed rule set forth occur during periods of crisis, or they cyber-incidents. processes for (1) how the Secretary could be used selectively by targeting Consequently, the President has would evaluate and assess transactions individual corporations or important determined that the unrestricted involving ICTS to determine whether infrastructure elements or functions. acquisition or use of ICTS that are they pose an undue risk of sabotage to They could also be masked to make the designed, developed, manufactured, or or subversion of the ICTS supply chain, source of the disruption difficult to supplied by persons owned by, or an unacceptable risk to the national attribute and, therefore, difficult to trace controlled by, or subject to the security of the United States or the and stop. jurisdiction or direction of a foreign security and safety of U.S. persons; (2) These risks are not necessarily adversary constitutes an unusual and how the Secretary would notify parties confined to infrastructure environments. extraordinary threat to the national to transactions under review of the They could, for example, be present in security, foreign policy, and economy of Secretary’s decision regarding the ICTS the use of cloud services, as well as in the United States. Transaction, including whether the the widespread use of some consumer Executive Order 13873 of May 15, Secretary would prohibit or mitigate the devices, networked surveillance 2019, ‘‘Securing the Information and transaction; and (3) how parties to cameras, drones, or interconnection via Communications Technology and transactions reviewed by the Secretary the internet of computing devices Services Supply Chain’’ (84 FR 22689) could comment on the Secretary’s embedded in everyday objects, enabling (Executive Order), was issued pursuant preliminary decisions. The proposed them to send and receive data. For to the President’s authority under the rule also provided that the Secretary example, applications (‘‘apps’’), which Constitution and the laws of the