HeinOnline is a subscription-based resource containing thousands of academic and legal journals from inception; complete coverage of government documents such as U.S. Statutes at Large, U.S. Code, Federal Register, Code of Federal Regulations, U.S. Reports, and much more. Documents are image-based, fully searchable PDFs with the authority of print combined with the accessibility of a user-friendly and powerful database. For more information, request a quote or trial for your organization below.
![handle is hein.crs/govejfp0001 and id is 1 raw text is: Congressional Research Service
Informing the legislative debate since 1914
Updated October 26, 2022
The Information and Communications Technology and Services
(ICTS) Rule and Review Process
In January 2021, the Department of Commerce
(Commerce) created a new process for the executive branch
to review transactions involving information and
communications technology and services (ICTS) and to
determine whether those transactions present national
security and economic risks. Commerce established the
process under an interim final rule (86 FR 4909), which
implements Executive Order 13873 (May 15, 2019). When
a transaction in ICTS involves foreign adversaries and
presents certain undue or unacceptable risks to the United
States, the new rule (Supply Chain Rule) allows Commerce
to either block the transaction or negotiate risk-mitigation
measures. The ICTS review process regulates individual
ICTS transactions-broadly defined as any acquisition,
importation, transfer, installation, dealing in, or use of any
[ICTS]. As such, it could subject a wide range of
commercial interactions to a new federal approval process.
What is ICTS?
ICTS is defined as any hardware, software, or other
product or service ... primarily intended to fulfill or enable
the function of information or data processing, storage,
retrieval, or communication by electronic means. The term
includes a broad array of technologies and services, such as
internet systems, wireless networks, cellular phones,
computers, satellite systems, artificial intelligence, quantum
computing, and cloud computing services.
Executive Order 1 3873
The Supply Chain Rule implements Executive Order
13873, titled Securing the Information and
Communications Technology and Services Supply Chain.
Invoking National Emergencies Act (50 U.S.C. § 1601) and
citing the International Emergency Economic Powers Act
(50 U.S.C. § 1701), then-President Trump declared a
national emergency because of the threat of foreign
adversaries exploiting vulnerabilities in ICTS. In response
to this threat, Executive Order 13873 prohibits transactions
involving foreign-owned ICTS that present (1) an undue
risk of sabotage or subversion to ICTS in the United States,
(2) an undue risk of catastrophic effects on the security or
resiliency of critical infrastructure or the digital economy in
the United States, or (3) an unacceptable risk to U.S.
national security or the security and safety of U.S. persons.
The order delegates implementation to Commerce.
What Is a Foreign Adversary?
Executive Order 13873 references risks posed by foreign
adversaries, which the order defines as any foreign
government or foreign person engaged in a long-term
pattern or serious instances of conduct significantly
adverse to U.S. security or the safety of U.S. persons. The
executive order does not identify entities that meet the
definition, but Commerce elaborated on the term in the
Supply Chain Rule. Commerce identified China (including
Hong Kong), Cuba, Iran, North Korea, Russia, and the
Nicolis Maduro regime in Venezuela as foreign
adversaries. Commerce based its determination on several
sources, including the U.S. National Security Strategy, the
U.S. Intelligence Community's Worldwide Threat
Assessment, the 2018 U.S. Cyber Strategy, and other
reports and assessments from U.S. agencies. Commerce is
to periodically review the list of foreign adversaries.
Determining F oreign Adversary
Involvement
To be subject to the ICTS review process, a transaction
must involve ICTS designed, developed, manufactured, or
supplied by persons or entities owned by, controlled by, or
subject to the jurisdiction of a foreign adversary. In
determining whether the foreign adversary element is met,
Commerce may consider (1) whether the party to the
transaction or its suppliers have headquarters or other
facilities in a foreign country controlled by a foreign
adversary, (2) personal and professional ties between the
party and a foreign adversary, (3) laws and regulations of
the foreign adversary in which a party is headquartered or
conducts operations, and (4) other factors that the Secretary
of Commerce deems appropriate.
What Transactions Will Be Reviewed?
In addition to the foreign adversary requirement, a
transaction must meet several criteria to be subject to the
ICTS review process. First, the transaction must involve
property subject to U.S. jurisdiction or activity conducted
by an individual or entity subject to U.S. jurisdiction.
Second, the transaction must involve property in which a
foreign country or foreign national has an interest. Third,
the transaction must be initiated, pending, or completed
after January 19, 2021. Finally, the transaction must involve
one of six categories of technology:
1. Critical infrastructure: ICTS that will be
used in one of 16 critical infrastructure sectors
designated in Presidential Policy Directive 21;
2. Network infrastructure and satellites: ICTS
integral to wireless local area networks,
mobile networks, satellite payloads, satellite
operations and control, cable access points,
wireline access points, core networking
systems, or long- and short-haul systems;
3. Sensitive personal data processing: ICTS
integral to data hosting or computing services
that process (or are expected to process)](ViewImageLocal?handle=hein.crs/govejfp0001&div=1&collection=&method=preview&ext=.png&size=3)