U.S. Departments of Commerce and State Issue Proposed Rules Regarding Support for Foreign Military, Security, and Intelligence End Uses and End Users; Other Recent U.S. Export Controls Developments

On July 25, 2024, the U.S. Commerce Department, Bureau of Industry and Security (“BIS”) and U.S Department of State, Directorate of Defense Trade Controls (“DDTC”) issued proposed rules that, in the case of the BIS proposed rules, would impose enhanced restrictions on exports, reexports, and in-country transfers of items subject to the Export Administration Regulations (“EAR”) and U.S. person support for foreign military, intelligence, and security services and, in the case of the DDTC proposed rule, would expand the scope of defense services controlled by the International Traffic in Arms Regulations (“ITAR”).

BIS issued two proposed rules which would build on existing EAR restrictions on military and military-intelligence end users and end uses and U.S. person activities, pursuant to expanded authority granted to BIS by the Fiscal Year 2023 National Defense Authorization Act. The proposed rules focus on:

• Expanding end use and end user controls to apply to all items subject to the EAR when destined to the armed forces, national guard, or paramilitary forces of countries subject to a U.S. arms embargo (such as China), or to civilian or military intelligence agencies and entities of 45 countries of concern;
• Imposing end use and end user controls on certain items subject to the EAR and identified on the Commerce Control List (“CCL”) when destined to police and security services or entities that support military activities (e.g., defense contractors) in or from arms-embargoed and/or terrorist-supporting countries;
• Expanding restrictions on U.S. person support activities regarding end uses and end users of concern; and
• Increasing restrictions on the export, reexport, and in-country transfer of certain facial recognition systems that can enable mass surveillance.

The proposed DDTC rule would revise the definition of “defense service” in the ITAR and extend control to certain services related to intelligence and military assistance, regardless of a nexus to a defense article.

Both BIS and DDTC are seeking public comment on the proposed rules by no later than September 27, 2024.

This alert summarizes each of the proposed BIS and DDTC rules as well as recent actions by BIS to update and expand other provisions of the EAR, including with respect to international standards-related activities and the Iran Foreign Direct Product Rule.

Proposed Revisions to the EAR

BIS issued on July 25, 2024 two proposed rules regarding new and expanded end use- and end user-based export controls and U.S. person activities: End-Use and End-User Based Export Controls, Including U.S. Persons Activities Controls: Military and Intelligence End Uses and End Users (the “Military/Intelligence Proposed Rule”) and Export Administration Regulations: Crime Controls Expansion/Update of U.S. Person Controls (the “Foreign-Security Proposed Rule”) (together, the “BIS Proposed Rules”). These proposed rules were issued pursuant to expanded authority under § 1753(a)(2) of the Export Control Reform Act (Pub. L. 115-232, August 13, 2018) as amended by the Fiscal Year 2023 National Defense Authorization Act (Pub. L. 117-263, December 23, 2022) (authorizing BIS to impose controls on “the activities of United States persons, wherever located, relating to specific . . . foreign military, security, or intelligence services” (emphasis added)). The proposed measures are summarized below.

End Use- and End User-Based Export Controls

Proposed Expansion of Existing Military End Use/End User Rule

The Military/Intelligence Proposed Rule contains significant proposed revisions to and expansions of the existing Military End Use/End User (“MEU”) Rule at EAR § 744.21. Specifically, the product scope of the MEU Rule for all covered MEUs (not just Russian and Belarusian MEUs, as is the case currently) would be expanded to apply to all items subject to the EAR (including items classified in the least-sensitive EAR99 category), not just items specified in Supplement No. 2 to EAR Part 744. The current MEU license requirement also would be expanded to apply to exports, reexports, and transfers (in-country) with “knowledge” (as defined at EAR § 772.1) that the item is intended, entirely or in part, for:

• A military end use that occurs in Macau or a destination identified in Country Group D:5 at Supplement No. 1 to EAR Part 740 (which presently consists of 23 countries and is not just limited to Burma/Myanmar, Belarus, Cambodia, China, Nicaragua, Russia, or Venezuela, as is the case with the current MEU Rule);
• A military end use, the product of which is destined for Macau or a destination in Country Group D:5; or
• A military end user of Macau or a destination in Country Group D:5, wherever located. (Note that the Military/Intelligence Proposed Rule also does not define what BIS means by an entity that is “of” a particular destination; it could mean, for example, that the entity is located in that destination or organized under the laws of that destination, but this is uncertain.)

Additionally, the Military/Intelligence Proposed Rule would revise the current definition of a “military end user” at EAR § 744.21(g)—i.e., “the national armed services (army, navy, marine, air force, or coast guard), as well as the national guard and national police, government intelligence or reconnaissance organizations . . . , or any person or entity whose actions or functions are intended to support ‘military end uses’ as defined in [§ 744.21(f)]”—to:

• Remove from the definition “national police, government intelligence, or reconnaissance organizations,” which are proposed to instead be included in new definitions of “foreign-security end users” (for national police) and “intelligence end users” (for government intelligence and reconnaissance organizations), as discussed below;
• Remove from the definition “any person or entity whose actions or functions are intended to support ‘military end uses,’” which would instead be included in the new definition of “military-support end users,” as discussed below;
• Add to the definition “any person or entity performing the functions of a ‘military end user,’ including mercenaries, paramilitary, or irregular forces,” which is intended to capture private companies, non-state actors, or parastatal entities that engage in combat or other activities akin to traditional armed forces; and
• Include entities identified on the BIS Entity List at Supplement No. 4 to EAR Part 744 with either a Footnote 3 designation (for Russian/Belarusian MEUs) or a Footnote 5 designation (for MEUs from Macau or other Country Group D:5 destinations).

As revised, the term “military end user” would be defined to mean “the national armed services (army, navy, marine, air force, or coast guard), the national guard, or any person or entity performing the functions of a ‘military end user,’ including mercenaries, paramilitary, or irregular forces,” as well as “entities designated with a footnote 3 or 5 on the Entity List.”

These revisions also would involve the removal from the EAR of the MEU List at Supplement No. 7 to EAR Part 744 and transfer of all entities currently identified on the MEU List to the Entity List with a Footnote 5, 6, 7, or 8 designation, as applicable (for MEUs, “military-support end users,” “intelligence end users,” or “foreign-security end users,” respectively).

Further, the Military/Intelligence Proposed Rule would make a minor, technical revision to the current definition of “military end use” at EAR § 744.21(f)—i.e., “[i]ncorporation into a military item described on the U.S. Munitions List (USML) [(ITAR Part 121)]; incorporation into items classified under Export Control Classification Numbers (ECCNs) ending in ‘A018’ or under ‘600 series’ ECCNs; or any item that supports or contributes to the operation, installation, maintenance, repair, overhaul, refurbishing, ‘development,’ or ‘production,’” of such items—to remove references to ECCNs ending in “A018” because these entries on the CCL do not currently control any items. The definition of “military end use” would otherwise remain unchanged.

Proposed Addition of Military-Support End User Rule

BIS proposes, through the Military/Intelligence Proposed Rule, to add at EAR § 744.22 a new license requirement for the export, reexport, or transfer of items that are subject to the EAR and identified by any ECCN on the CCL with “knowledge” (as defined at EAR § 772.1) that the item is intended, entirely or in part, for a “military-support end user” (“MSEU”):

• In Macau or Country Group D:5; or
• Wherever located, if identified on the Entity List with a Footnote 6 designation.

A “military-support end user” would be defined to mean:

• Any person or entity whose actions or functions support “military end uses,” as defined at EAR § 744.21(f); or
• An entity identified on the Entity List with a Footnote 6 designation.

Notably, the Military/Intelligence Proposed Rule would merely relocate the language “any person or entity whose actions or functions support military end uses” from the current definition of a “military end user” at EAR § 744.21(g) to this new definition of an MSEU. The rule does not include any further clarification on the meaning of this language, which has historically been a source of interpretive uncertainty for industry.

The scope of this new license requirement would, however, differ in certain respects from the scope of the proposed revised MEU Rule, as described above. In particular, the MEU Rule would apply to all items subject to the EAR, including items classified as EAR99, whereas the MSEU Rule would apply to all items identified by ECCNs on the CCL but would exclude EAR99 items. Additionally, the MEU Rule would apply to MEUs of Macau or D:5 countries wherever located, regardless of whether such MEUs were identified on the Entity List. The MSEU Rule, by contrast, would apply to MSEUs located in Macau or Country Group D:5 or to MSEUs wherever located that are identified on the Entity List with a Footnote 6 designation.

Proposed Addition of Intelligence End User Rule

The Military/Intelligence Proposed Rule would remove the existing Military-Intelligence End Use/End User (“MIEU”) Rule from EAR § 744.22 and would add a new Intelligence End User (“IEU”) Rule at EAR § 744.24 with a significantly broader scope of restrictions. A BIS license would be required to export, reexport, or transfer (in-country) all items subject to the EAR (including items classified as EAR99) with “knowledge” (as defined in EAR § 772.1) that such items are intended, entirely or in part, for an IEU, wherever located, that is from a destination identified in Country Groups D or E (but that is not also listed in Country Groups A:5 or A:6). (Note that the Military/Intelligence Proposed Rule also does not define what BIS means by an entity that is “from” a particular destination; it could mean that the entity is located in that destination or organized under the laws of that destination, but this is not clear.)

This would present a meaningful expansion from the scope of the existing MIEU Rule, which applies only to military-intelligence end uses and end users in or from Belarus, Burma/Myanmar, Cambodia, China, Russia, Venezuela, and destinations in Country Groups E:1 and E:2 (i.e., Cuba, Iran, North Korea, and Syria). The restrictions under the proposed IEU Rule would apply to all 45 destinations in Country Groups D and E that are not also identified in Country Groups A:5 or A:6 and would therefore apply to important strategic partners for many industries such as Saudi Arabia and the United Arab Emirates. This proposed end user scope would be notably broader than the proposed end user scopes of the MEU and MSEU Rules described above, and the Foreign-Security End User (“FSEU”) Rule described below. That is, the MEU and MSEU Rules would apply to MEUs or MSEUs in or from Macau or Country Group D:5, and the FSEU Rule would apply to FSEUs of Country Groups D:5 and E, while as noted the IEU Rule would apply to IEUs, wherever located, from the entirety of Country Groups D and E (other than countries also identified in Country Groups A:5 or A:6).

Additionally, the current definitions of “military-intelligence end use” and “military-intelligence end user” would be removed from the EAR, and an “intelligence end user” would instead be defined as:

• Any foreign government intelligence, surveillance, or reconnaissance organization or other entity performing functions on behalf of such an organization; or
• An entity identified on the Entity List with a Footnote 7 designation.

BIS explains in the Military/Intelligence Proposed Rule that this revised definition would encompass not only military, but also other governmental (i.e., civilian) intelligence and reconnaissance organizations and private entities performing functions on behalf of such organizations. The proposed definition is intended to cover both traditional and economic espionage activities and would capture entities performing intelligence functions such as planning and directing, processing and exploiting, analyzing and producing, disseminating and integrating, surveilling, and evaluating and providing feedback related to such functions.

Proposed Addition of Foreign-Security End User Rule

The Foreign-Security Proposed Rule would impose a new license requirement at EAR § 744.25 for the export, reexport, and transfer (in-country) any item subject to the EAR and specified by any ECCN on the CCL with “knowledge” (as defined at EAR § 772.1) that such an item is intended, entirely or in part, for an FSEU of a country listed in Country Groups D:5 or E. As noted above, whether a party is “of” a particular destination is undefined, and this end user scope would differ from the end user scope of the proposed MEU, MSEU, and IEU Rules.

A “foreign-security end user” would be defined to mean:

• Governmental and other entities with the authority to arrest, detain, monitor, search, or use force in furtherance of their official duties, including persons or entities at all levels of the government police and security services from the national headquarters or the Ministry level, down to all subordinate agencies/bureaus (e.g., municipal, provincial, regional);
• Other persons or entities performing functions of a “foreign-security end user,” such as arrest, detention, monitoring, or search, and may include analytic and data centers (e.g., genomic data centers), forensic laboratories, jails, prisons, other detention facilities, labor camps, and reeducation facilities; or
• An entity identified on the Entity List with a Footnote 8 designation.

BIS also proposes to include two notes to the FSEU definition, which would clarify the following:

• The definition does not include civilian emergency medical, firefighting, and search-and-rescue end users. In situations in which a country integrates police, emergency medical, firefighting, and search-and-rescue services into a single public safety department, BIS explains that it seeks to ensure that the export, reexport, or transfer (in-country) of items necessary to protect lives is not disrupted and that in these circumstances it would apply a case-by-case license application review policy.
• If the end user also satisfies the definition of “military end user” under the MEU Rule at EAR § 744.21, then the MEU Rule controls apply. BIS states in the Foreign-Security Proposed Rule that, “e.g., if the national police is integrated into or organized under the military of a country listed in Country Group D:5 or E, the MEU Rule applies.”

In the preamble to the Foreign-Security Proposed Rule, BIS also indicates that it “seeks to ensure that the export, reexport, or transfer (in-country) of items necessary to protect lives at airport terminals, railway and rapid transit stations, and other public transport hubs is not disrupted.” However, BIS has not included a note to this effect in the proposed FSEU definition.

U.S. Person Activities Controls

New and Expanded U.S. Person Activities Controls

In conjunction with each of the proposed end use/end user controls described above, the BIS Proposed Rules would impose at EAR §§ 744.6(b)(5)-(8) new and revised restrictions on the activities of U.S. persons, such that a BIS license would be required for a U.S. person to “support”:

• A “military end user,” as defined in proposed revised EAR § 744.21, located in or from Macau or a destination in Country Group D:5, including but not limited to MEUs identified on the Entity List with a Footnote 3 or 5 designation, as well as “military-support end users” identified on the Entity List with a Footnote 6 designation (but not other unlisted MSEUs, and only to the extent that such support activities relate to items described in the license requirement column of the relevant entity’s Entity List entry or their foreign-origin equivalents);
• A “military-production activity” (as defined below), when such activity occurs in, or the product of such activity is destined to, Macau or a destination in Country Group D:5;
• An “intelligence end user,” as defined in proposed EAR § 744.24, wherever located, from a destination in Country Groups D or E (but not also listed in Country Groups A:5 or A:6), including but not limited to IEUs identified on the Entity List with a Footnote 7 designation; and
• A “foreign-security end user,” as defined in proposed EAR § 744.25, that is identified on the Entity List with a Footnote 8 designation, but not other unlisted FSEUs.

A “military-production activity” would be defined to mean “incorporation into the following types of items or any other activity that supports or contributes to the operation, installation, maintenance, repair, overhaul, refurbishing, ‘development,’ or ‘production’ of the following types of items”:

• “600 series” items, including foreign-origin items not subject to the EAR; or
• Any other item that is either described on the CCL in other than a “600 series” ECCN, or designated EAR99, including foreign-origin items not subject to the EAR, with “knowledge” (as defined at EAR § 772.1) that the item is ultimately destined to or for use by an MEU.

Each of these U.S. person activities controls would apply only to the extent that the relevant activities are not subject to a license requirement or general prohibition administered by another federal department or agency, such as under the ITAR (i.e., “defense services,” as discussed below), certain sanctions regulations (including but not limited to 31 C.F.R. Parts 500-599) administered by the Department of the Treasury’s Office of Foreign Assets Control (“OFAC”), or the Assistance to Foreign Atomic Energy Activities Regulations (10 C.F.R. Part 810) administered by the Department of Energy.

Revisions to the Definition of U.S. Person “Support”

In addition to the proposed new U.S. person activities controls, the Military/Intelligence Proposed Rule would relocate the definition of U.S. person “support” from EAR § 744.6(b)(6) to new EAR § 744.6(a)(1), and would revise the definition such that “support” would mean:

• Shipping or transmitting from one foreign country to another foreign country, or transferring in-country, any item not subject to the EAR with knowledge that it will be used in or by any of the end uses or end users described in EAR §§ 744.6(b)(1)-(7)— including MEUs and certain MSEUs, military-production activities, and IEUs (but not certain FSEUs, which would be described in § 744.6(b)(8) pursuant to the Foreign-Security Proposed Rule, and which may have been inadvertently excluded from this revised definition)—including the sending or taking of such item to or from foreign countries in any manner;
• Facilitating such shipment, transmission, or in-country transfer; or
• Performing any contract, service, or employment with knowledge that it may assist or benefit any of the end uses or end users described in EAR §§ 744.6(b)(1)-(7)—including MEUs and certain MSEUs, military-production activities, and IEUs (but not certain FSEUs, which would be described in § 744.6(b)(8))—including, but not limited to, ordering, buying, removing, concealing, storing, using, selling, loaning, disposing, servicing, financing, transporting, freight forwarding, or conducting negotiations to facilitate such activities.

The Military/Intelligence Proposed Rule also would exclude from the definition of “support” the following:

• Activities related to items that are not subject to the EAR because they are described in EAR § 734.3(b) (e.g., technology or software that is published or that arises during, or results from, fundamental research);
• Activities related to items enumerated on the USML or the United States Munitions Import List (“USMIL,” 27 C.F.R. § 447.21), to the extent such activities are controlled under the ITAR;
• Activities limited to administrative services, such as providing or arranging office space and equipment, hospitality, advertising, or clerical, visa, or translation services, collecting product and pricing information to prepare a response to a request for proposal, generally promoting company goodwill at trade shows, or activities by an attorney that are limited to the provision of legal advice;
• With respect to end uses and end users described only in new EAR §§ 744.6(b)(5)-(7)—i.e., U.S. person activities controls applicable to MEUs and certain MSEUs, military-production activities, and IEUs, but not to certain FSEUs (which would be controlled by new EAR § 744.6(b)(8), though as noted this may have been an inadvertent omission)—commercial activities related to the movement of goods by common carriers (except BIS explained in the preamble of the Military/Intelligence Proposed Rule that, to the extent a U.S. person undertakes shipping, transmitting, and transferring activities involving items not subject to the EAR with “knowledge” that such items will support MEUs and certain MSEUs, military-production activities, and IEUs, such activities would remain controlled under EAR § 744.6(b)); or
• Certain activities conducted for, or on behalf of, or in connection with the U.S. government, including specified programs or agreements executed by a U.S. government department or agency.

It is worth noting that the definition of U.S. person “support” applicable to the proposed EAR §§ 744.6(b)(5)-(7) restrictions on support for MEUs and certain MSEUs, military-production activities, and IEUs (and potentially also the proposed EAR § 744.6(b)(8) restrictions on support for certain FSEUs, which as noted above may have been inadvertently omitted from the revised “support” definition) remains broad, and would differ from the definition of U.S. person “support” applicable to the EAR § 744.6(c)(2) controls on U.S. person support for certain semiconductor manufacturing-related end uses and end users. Under EAR § 744.6(c)(3), which was implemented pursuant to BIS’s October 17, 2023 Advanced Computing Rule (as described in our previous client alert), restricted semiconductor manufacturing-related U.S. person “support” activities are limited to authorizing or conducting the shipment, transmission, transfer, or servicing (including maintaining, repairing, overhauling, or refurbishing) of items not subject to the EAR and described in EAR §§ 744.6(c)(2)(i)-(iii). The proposed U.S. person activities controls applicable to MEUs and certain MSEUs, military-production activities, and IEUs (and potentially also certain FSEUs) would not be so limited. Moreover, unlike the semiconductor manufacturing-related U.S. person controls, BIS has not proposed a carve-out from the MEU-, MSEU-, military-production activity-, IEU-, or FSEU-related U.S. person controls for natural U.S. persons employed by or working on behalf of a company headquartered in the United States or a destination specified in Country Groups A:5 or A:6.

New and Updated License Review Policies

The Military/Intelligence Proposed Rule would implement the following license review policies for applications submitted under the new and revised MEU, MSEU, and IEU Rules, and corresponding U.S. person activities controls:

• Applications for Macau, Nicaragua, and countries subject to a U.S. arms embargo under ITAR § 126.1, other than Russia and Belarus—i.e., Burma/Myanmar, China, Cuba, Iran, North Korea, Syria, and Venezuela—as applicable, depending on the relevant control, would be reviewed under a presumption of denial;
• Applications for Russia and Belarus would be reviewed with a policy of denial, consistent with EAR § 746.8(b)(1); and
• All other applications would be reviewed under a case-by-case review policy, consistent with U.S. arms embargo policies under ITAR § 126.1.

By contrast, pursuant to the Foreign-Security Proposed Rule, all license applications under the new FSEU Rule and the corresponding U.S. person activities control would be reviewed on a case-by-case basis “to determine whether there is an unacceptable risk of use in human rights violations or abuses.” Applications that would pose such an unacceptable risk would be reviewed with a presumption of denial. As noted above, BIS would apply a case-by-case review policy to license applications in circumstances where a country integrates police, emergency medical, firefighting, and search-and-rescue services into a single public safety department.

Additionally, BIS proposes to make conforming revisions to the Entity List license requirements set out at EAR § 744.11. Specifically, given the contemplated addition to the Entity List of MEUs (identified by Footnotes 3 and 5), MSEUs (identified by Footnote 6), IEUs (identified by Footnote 7), and FSEUs (identified by Footnote 8), BIS proposes to set forth at EAR §§ 744.11(a)(2)(ii) and (iv)-(vii) the license requirements applicable to Entity List parties identified by each footnote, consistent with the license requirements set out in proposed EAR §§ 744.21, 744.22, 744.24, and 744.25.

New Destination-Based Controls for Certain Facial Recognition Systems

Finally, in order to protect against human rights abuses, BIS proposes through the Foreign-Security Proposed Rule to revise certain ECCNs in Category 3 of the CCL to impose Crime Control Column 1 (“CC1”) controls on certain facial recognition systems and related software and technology. BIS states that such systems allow “state actors of concern [to] arbitrarily and unlawfully track, mistreat, detain, and monitor people.”

BIS proposes to amend ECCN 3A981 to control “facial recognition systems,” in addition to the commodities already controlled. The proposed rule also would add a new Note 2 to ECCN 3A981 explaining that “[i]tem 3A981 does not control detection or authentication items versus identification items, nor items that facilitate individual access to personal devices or facilities.” In conjunction, ECCN 3D980 would be revised to control not only (a) software specially designed for the development, production, or use of commodities controlled by ECCNs 3A980 and 3A981, but also (b) software “‘specially designed’ for the analysis and matching of voice, fingerprints, or facial features for facial recognition.” However, this new entry would explicitly state that it does not control “software solely for person or object detection or for individual authentication to facilitate individual access to personal devices or facilities.” ECCN 3E980, which currently controls technology specially designed for the development, production, or use of commodities controlled by ECCNs 3A980 and 3A981, would remain unchanged.

BIS explains in the preamble of the Foreign-Security Proposed Rule that these new controls are intended to be narrowly tailored and would not apply to “systems that merely restrict individual access to personal devices, automobiles, or residential or work premises by verifying that a person attempting to gain such access is authorized to do so.”

Request for Comments

Both of the BIS Proposed Rules indicate that BIS “seeks to provide the interested public with an opportunity to submit comments in order to avoid any unnecessary disruption to supply chains, ensure that the controls are drafted to be as effective as possible, and that the provisions of the controls are clear and unambiguous for ease of compliance by exporters, reexporters, and transferors.” BIS explains that it is continuing to evaluate the scope of the items and end users subject to these proposed rules and the potential for complementary end use controls. As noted, comments on each proposed rule are due to BIS by September 27, 2024.

Proposed Revisions to the ITAR

In parallel with BIS, DDTC published a proposed rule, International Traffic in Arms Regulations: Revisions to Definition and Controls Related to Defense Services (the “DDTC Proposed Rule”), which would amend the definition of “defense service” in the ITAR and revise the scope of related controls. After undertaking a review of the definition of “defense service” at ITAR § 120.32, DDTC determined the proposed revisions are warranted to control activities of U.S. persons that provide a critical military or intelligence advantage that are not currently subject to the ITAR and to clarify the current language to better describe existing controls. These changes would affect how the USML describes and controls activities qualifying as defense services in several ways, as summarized below.

Proposed Amendment to Definition of Defense Service

Proposed Revisions to ITAR § 120.32(a)(1)

Currently, under ITAR § 120.32, a “defense service” means:

“(a)(1) The furnishing of assistance (including training) to foreign persons, whether in the United States or abroad in the design, development, engineering, manufacture, production, assembly, testing, repair, maintenance, modification, operation, demilitarization, destruction, processing, or use of defense articles;

(a)(2) The furnishing to foreign persons of any technical data controlled under this subchapter, whether in the United States or abroad; or

(a)(3) Military training of foreign units and forces, regular and irregular, including formal or informal instruction of foreign persons in the United States or abroad or by correspondence courses, technical, educational, or information publications and media of all kinds, training aid, orientation, training exercise, and military advice.”

In its proposed rule, DDTC would amend ITAR §120.32(a)(1) to read as follows: “The furnishing of assistance, including training or consulting, to foreign persons in the development (including, e.g., design), production (including, e.g., engineering and manufacture), assembly, testing, repair, maintenance, modification, disabling, degradation, destruction, operation, processing, use or demilitarization of a defense article.”

By removing the parenthetical “(including training)” and replacing it with a new clause clarifying that covered “assistance” includes training or consulting, DDTC states in the proposed rule that it seeks to clarify that it does not only treat “training” to mean direct instructional activity, but also providing the tools or means of furnishing training to a foreign person so that the foreign person may conduct the training.

The proposed revision also moves several activities currently specified in ITAR § 120.32(a)(1) into parentheticals following defined terms in which they are included and adds two new references—“disabling” and “degradation.” The DDTC Proposed Rule explains that DDTC is proposing these new terms to make explicit that the act of harming a military capability through the disabling or degradation of defense articles via any method is a controlled activity.

Proposed Removal of Current ITAR § 120.32(a)(2), (a)(3) and Amendment to ITAR § 120.11

In conjunction with the revisions described above, DDTC proposes to remove the current ITAR § 120.32(a)(2) as redundant (because the furnishing of technical data to a foreign person is already a controlled event described in other sections of the ITAR) and to remove the current ITAR § 120.32(a)(3). In their stead, DDTC would include a new paragraph (a)(2) that would direct persons to revised USML Category IX subcategories regulating the furnishing of assistance to foreign persons that does not involve defense articles. The covered services would be specifically described in two new entries at USML Category IX(s)(2) and IX(s)(3), as discussed below.

DDTC also proposes to amend ITAR § 120.11, which describes the order of review, to include a paragraph (d) specific to defense services. The new ITAR § 120.11(d) would provide that defense services described in ITAR § 120.32(a)(1) are controlled under the relevant paragraph of each USML category that includes defense services “directly related” or “relating” to particular defense articles, and defense services that are not “directly related” to defense articles are controlled in USML Category IX(s)(2) and (3).

Proposed Controls on Military and Intelligence Assistance

Proposed Amendments to USML Category IX - Military Training Equipment and Training

DDTC proposes to rename USML Category IX as “Military Training Equipment, Intelligence Defense Services, and Military Defense Services” to better describe the controls in this category. The proposed new USML Category IX(s)(2) would describe defense services relating to intelligence assistance that do not necessarily involve defense articles and provides specified carve-outs to the general description of controlled activities, as discussed below. Similar carve-out provisions are also proposed for military assistance controlled in USML Category IX(s)(3). DDTC has determined that rather than relying only on the definition of “defense service” at ITAR § 120.32, it would be preferable to direct the regulated community to the USML to conduct their classification analysis because the USML allows for more detailed articulation of the specific activities meriting ITAR control.

Proposed USML Category IX(s)(2) would control the furnishing of “[a]ssistance, including training or consulting, for a foreign government, unit, or force, or their proxy or agent, and training a foreign government, unit or force, or their proxy or agent, that creates, supports, or improves intelligence activities, including through planning, conducting, leading, providing analysis for, participating in, evaluating on, or otherwise consulting on such activities, for compensation.” By separating the controls related to intelligence activities from those describing military assistance, DDTC intends to provide clearer notice to the regulated communities that the ITAR regulate services related to intelligence activities regardless of any nexus to a defense article. Notably, the intelligence assistance identified in USML Category IX(s)(2) would be limited in that the assistance must be “for compensation,” thereby limiting the control to those services that are provided commercially or in a professional capacity. Compensation, however, need not be limited to financial compensation, and could include gifts, goods or services, political favors, or legislative or legal relief. DDTC included this text to ensure the ITAR does not control “non-critical intelligence assistance provided on a volunteer basis (and not for hire or compensation).” See 89 Fed. Reg. 60,980, 60,983.

Proposed USML Category IX(s)(3) would control the furnishing of “[a]ssistance, including training or consulting, to a foreign government, unit, or force, or their proxy or agent, that creates, supports, or improves the following:

• The organization or formation of military or paramilitary forces;
• Military or paramilitary operations, by planning, leading, or evaluating such operations; or
• Military or paramilitary capabilities through advice or training, including formal or informal instruction.”

This would include assistance in the development and organization of foreign military services (e.g., armies, navies, air forces) at any stage. The proposed controls in this section would also cover assistance that creates, supports, or improves military or paramilitary operations by planning, leading, or evaluating aspects of such operations, including, for example, logistical support. DDTC included this text to cover assistance being provided in the conduct and analysis of military operations by foreign military services, whether in war or peace. DDTC has replaced the terminology “regular” and “irregular” units and forces with references to “military” and “paramilitary,” stating that the latter terms are more generally understood and provide clearer notice that providing training to create, support, or improve military or paramilitary capabilities of any kind of unit or force, governmental or not, is a defense service requiring authorization.

As noted above, in conjunction with the proposed addition of USML Category IX(s)(3), DDTC also proposes to remove the text of current ITAR § 120.32(a)(3) regarding military training and the corresponding reference to military training in the current USML Category IX(e)(3), which controls “military training not directly related to defense articles or technical data enumerated in this subchapter.”

Carve-outs to Military Assistance and Intelligence Assistance Controls

With respect to the proposed controls on military assistance in Category IX(s)(3), DDTC has proposed three specific carve-outs in proposed paragraph (s)(3)(iv). The activities carved out include:

• Furnishing of medical, translation, financial, insurance, legal, scheduling, or administrative services, or acting as a common carrier;
• Participation as a member of a regular military force of a foreign nation by a U.S. person who has been drafted into such a force; or
• Training and advice that is entirely composed of general scientific, mathematical, or engineering principles commonly taught in schools, colleges, and universities.

DDTC has also proposed to carve out six specific sets of activities from the controls on intelligence assistance described in the proposed USML Category IX(s)(2). Three of the carve-outs, those proposed in paragraphs (s)(2)(i) through (iii), are identical to the three military assistance activities carve-outs described above. The other three carve-outs to intelligence assistance are set forth in proposed paragraph (s)(2)(iv)-(vi), and include:

• Information technology services that support ordinary business activities not specific to a particular business sector;
  • These would include services related to IT infrastructure, composed of the hardware (including switches, routers, and servers) and software (including operating systems and basic network security applications) that enable an organization to run specialized software applications. DDTC notes that IT infrastructure is not necessarily co-located with the organization, as it may include cloud infrastructure such as remote data centers, edge computing, and various “as a service” (e.g., SaaS) models.
• Any lawful activity of a U.S. local or federal law enforcement or intelligence agency; or
• Maintenance or repair of a commodity or software.
  • DDTC included this carve-out to avoid imposing duplicative export licensing requirements for these activities, since they are already regulated or proposed for regulation under the ITAR or EAR. 

The proposed amendments to USML Category IX thus would utilize a “catch and release” control structure, which functions to initially describe a broad range of activities as a “catch” and then identifies specific limited carveouts as a “release” from the “catch.” Only assistance that is both “caught” and not “released” by the respective controls would be controlled under paragraphs (s)(2) or (s)(3)(i) through (iii). 

Request for Comments

Although DDTC states that the DDTC Proposed Rule is exempt from the notice-and-comment provisions of 5 U.S.C. § 553(b) because it involves a military or foreign affairs function of the United States, DDTC indicates that it has elected to seek public comments on the proposed rule, which are due on or before September 27, 2024. 

Other Recent U.S. Export Controls Developments

Separate from the BIS Proposed Rules and the DDTC Proposed Rule discussed above, BIS has in recent weeks taken action to update and expand certain other provisions of the EAR. These developments are summarized below.

EAR Revisions Regarding International Standards Development

On July 18, 2024, BIS published an interim final rule, Standards Related Activities and the Export Administration Regulations (the “July 2024 Standards Rule”) revising the existing exception for “standards-related activity” in the EAR. Comments may be submitted to BIS by September 16, 2024.

The most significant change made by BIS was to broaden the exception for “standards-related activity” so that it would operate as an exception from all EAR prohibitions, rather than only from the Entity List restrictions in § 744.11 of the EAR. Thus, BIS moved the exception into Part 734, which defines the scope of the EAR, so that if a release is eligible for this exception, it is thereby excluded from the scope of the EAR. See EAR § 734.10(b). BIS thereby ensured that the exception will apply notwithstanding any end use and end user prohibitions other than EAR § 744.11.

BIS also made less significant revisions to the standards-related activities exception, in particular clarifying that the exception applies to activities that occur in the context of standards that have already been published. See EAR § 734.10(b)(2)(i).

Expansion of the Iran Foreign-Direct Product Rule

Effective July 23, 2024, BIS issued a final rule, Iran Foreign Direct Product Rule (the “Iran FDPR Expansion Rule”), amending the Iran Foreign Direct Product Rule (“FDPR”) at EAR § 734.9(j), as required by the No Technology for Terror Act (Pub. L. 118-50, April 24, 2024). Specifically, BIS implemented the following changes to the scope of the Iran FDPR at EAR § 734.9(j):

• Expansion of the range of CCL categories caught by the product scope at EAR § 734.9(j)(1) to include Categories 6 (Lasers and Sensors), 8 (Marine), and 9 (Aerospace and Propulsion), such that a foreign-produced item is caught if it is:
  • The direct product of, or the product of a plant or major component of a plant located outside the United States that is itself the direct product of, U.S.-origin technology or software subject to the EAR that is specified in any ECCN in product groups D or E in Categories 3 through 9 of the CCL (rather than only Categories 3 through 5 and Category 7); and
  • Identified in Supplement No. 7 to EAR Part 746 or specified in any ECCN in CCL Categories 3 through 9.
• Revision of the destination and end use scope at EAR § 734.9(j)(2) to conform to the revised product scope.
• Addition of a new end user scope at EAR § 734.9(j)(3), which would apply if there is “knowledge” (as defined at EAR § 772.1) that the Government of Iran is party to any transaction involving the foreign-produced item, e.g., as a purchaser, intermediate consignee, ultimate consignee, or end user.
• BIS also made minor revisions to the license requirement at EAR § 746.7(a)(1)(iii) applicable to foreign-produced items subject to the EAR under the Iran FDPR, including to (1) expand the license requirement to apply to in-country transfers and (2) exclude from the scope of the license requirement EAR99 food, medicine, and medical devices, and certain items necessary and ordinarily incident to communications.

*           *           *

We are closely monitoring developments concerning U.S. export controls and will issue further updates in the event of material developments. In the meantime, we would be happy to address any questions you may have.

Covington’s International Trade Controls team—which includes lawyers in the firm’s offices in the United States, London, and Frankfurt—regularly advises clients across business sectors, and would be well-placed to provide support in connection with these new and proposed export controls developments, or to assist with comments on these proposed rules. Our trade controls lawyers also work regularly with Covington's Global Public Policy team—consisting of over 120 former diplomats and policymakers in the United States, Europe, the Middle East, Latin America, Africa, and Asia—many of whom have had substantial government experience in sanctions and export controls matters, and who regularly advise our clients on emerging sanctions policy matters and related engagements with government stakeholders.