U.S. Department of Commerce Expands Controls on Biotech Software in Final Rule

BIS, consistent with its obligations under the Export Control Reform Act of 2018 (ECRA), previously identified this software as potential emerging technology essential to U.S. national security that could be misused for biological weapons purposes in a notice of proposed rulemaking on November 6, 2020. The final rule comes on the heels of the 42-country Australia Group’s decision to add the software to its biological equipment control list, thereby aligning U.S. controls with multilateral export control regimes.

The final rule can be found here, and our prior update on ECRA and BIS’s identification of emerging technologies can be found here.

Below, we highlight five key takeaways from the final rule.

I. BIS is fulfilling its mandate under ECRA one emerging technology rule at a time.

When BIS initiated its review pursuant to ECRA in November 2018, it identified 14 representative technology categories that contained potential emerging technologies essential to U.S. national security. Since then, the agency has drawn criticism — particularly from Congress — for not issuing regulations defining and controlling emerging technologies at a faster pace. Although the process has taken longer than expected, this final rule marks another step in the incremental yet steady progress BIS has made since 2018. Indeed, as of this rule, BIS has identified and controlled over 35 items as emerging technologies, and we expect the agency to make further progress in the coming months.

II. BIS will likely continue implementing controls first adopted by multilateral regimes.

The issuance of the final rule after the Australia Group’s determination is notable. The timeline demonstrates that BIS continues to follow the established multilateral review processes in fulfilling its mandate under ECRA — which is a good thing. Unilaterally controlling emerging technologies before international adoption of similar controls would place U.S. exporters at a competitive disadvantage in global markets without meaningfully constraining access to the controlled technologies. The resulting fragmented regulatory environment would be detrimental to U.S. companies as competitors would fill the void created in restricted jurisdictions. Thus, BIS’ continuing to control emerging technologies via the normal, multilateral process will result in more coherent and effective controls.

III. The final rule, although restrictive, is narrowly tailored.

The final rule imposes a license requirement on the software when exported to most countries, with the exception of a number of ally countries, including for “deemed exports” to foreign nationals in the United States. However, the software at issue in the final rule performs a very particular function: designing and building functional genetic elements from digital sequence data. Therefore, the parties affected by the new licensing requirements will generally be limited to research institutes and life science companies, which may already be familiar with these restrictions because related equipment is similarly controlled.

IV. More rules controlling biotechnology-related items are likely.

To date, the relatively few export controls on biotechnology have been focused on chemical and biological weapon concerns. This final rule fits that pattern as the software could be misused to create biological weapons. Nevertheless, future controls on biotechnology could have expanded reasons for control. BIS has identified biotechnology as a priority for emerging technology review and has more broadly signaled its willingness to use export controls to prevent human rights abuses. For example, the agency has placed more than 50 parties on the Entity List, thereby restricting their access to all items subject to the EAR without a license, for human rights violations. Some of these entities include companies that used biotechnology to conduct genetic analyses used to repress Uyghurs and other Muslim minorities in Xinjiang. Additionally, BIS amended the EAR last October to clarify that it will consider human rights concerns when reviewing license applications for items controlled for reasons other than crime control. As such, while the present final rule was implemented for national security reasons and is narrow in its application and effect, we would expect to see additional, and potentially more wide-ranging, biotechnology controls in the future.

V. The final rule expands CFIUS’s jurisdiction and triggers mandatory filings.

According to the Foreign Investment Risk Review Modernization Act, emerging technologies identified by BIS, as well as items controlled under multilateral export regimes, are considered “critical technologies.” Foreign investments in U.S. critical technology companies are subject to the expanded jurisdiction of the Committee on Foreign Investment in the United States (CFIUS) over noncontrolling investments and require CFIUS filings when U.S. regulatory authorizations (i.e., export licenses) would be required to export, reexport, or transfer the critical technology to the foreign investor. Thus, certain investments by foreign investors in U.S. companies that produce, design, test, or develop the software controlled under the final rule will now be subject to mandatory CFIUS filings — regardless of the investment’s dollar amount or the U.S. company’s size. Moreover, as BIS identifies and controls more emerging technologies, CFIUS’s jurisdiction to review foreign investments will continue to expand.

Thank you to Sidley Law Clerk Nick Wiggins for his significant contribution to this Update.