On July 29, the US government proposed big changes to rules about supporting or exporting to foreign military, intelligence, and security entities.

The US Department of Commerce’s Bureau of Industry and Security (BIS) is seeking to expand the types of activities that US persons have to get a license for, as well as beef up restrictions on exports, reexports, and transfers of items subject to US export controls that everyone needs to get a license for.

There are two proposed rules: one updating the rules for military end users (MEUs) and introducing new controls pertaining to military-support end users (MSEU), “military-production activities,” and certain intelligence end-users (MEU Plus Proposed Rule); and a second one for facial recognition technology and introducing controls for ‘foreign-security end users’ (Crime Control Proposed Rule). DDTC published a proposed and long-awaited definition of defense services on the same date, which will be the subject of another alert.

Comments on BIS’s proposed rules are due 60 days after its publication in the Federal Register, making the deadline September 27. Knowing whether to comment or what the rules mean will be tricky, as BIS didn’t make it easy to figure out the scope of the new end-user/use controls and US person activity restrictions.

Overview: What Do the New Rules Propose to Do?

The MEU Plus Proposed Rule and the Crime Control Proposed Rule are long and complex and figuring out all the changes will take a while. We believe these are the big ticket items:

• MEUs: updated definition, expanded export controls that include all items subject to the EAR, not just those in Supplement 2 to Part 744 of the Export Administration Regulations (EAR). MEUs include Entity List entities with Footnotes 3 (preexisting) and 5 (new).
• Four new types of proscribed end uses/users:
  • MSEUs: new license requirements and US person restrictions. Includes Entity List entities with Footnote 6.
  • Military Production Activities: new US person restrictions.
  • Intelligence End Users: new license requirements and US person restrictions. Includes Entity List entities with Footnote 7.
  • Foreign Security End Users (FSEUs): new license requirements and US person restrictions. Includes Entity List entities with Footnote 8.
• US persons now need a license to “support” the above end users (although the prohibited end users are limited to footnoted entities on the Entity List for MSEUs and FSEUs), a major expansion of US person controls.
• New proposed export controls on facial recognition technologies.

We have boiled down these new rules into a chart — see below — where you can (hopefully) see at a glance which controls may affect you and your company. We say “you and your company” because, yes, many of you reading this may be US persons (individuals). As a reminder, the term “US person” includes:

1. Any individual who is a citizen of the United States, a permanent resident alien of the United States, or a protected individual as defined by 8 U.S.C. 1324b(a)(3);
2. Any juridical person organized under the laws of the United States or any jurisdiction within the United States, including foreign branches; and
3. Any person in the United States.

Proposed Facial Recognition Controls

Let’s get the easy part done first. The Crime Control Proposed Rule proposes new Crime Control (CC) Column 1 controls on facial recognition systems (in ECCN 3A981) and facial recognition software (in ECCN 3D980). CC Column 1 is a strict control meaning that if BIS sticks to its guns, facial recognition exports will require a license to most countries.[1] The proposed control would exempt facial recognition solely for person or object detection or for individual authentication to facilitate individual access to personal devices or facilities, following well-worn exceptions in the fingerprint matching control areas. As explained in BIS’s preamble to the Crime Control Proposed Rule, the agency intends to control “facial recognition systems specially designed for surveillance and crowd scanning.” There are certain to be difficult classification issues. For example, what about systems in airports that scan your face to display your flight and gate number, but the images are stored in a database accessible by the police? Those systems are facilitating passengers’ access to their gates and flights, to be sure, but to do so they may also aid surveillance for security reasons. Controlled or exempt?

Footnote Frenzy: Charting the Proposed End-User/US Person Activity Controls

BIS starts out with a laudable objective of unpacking the military end use and military end-user definitions into bite-size chunks that we can understand. Currently, an MEU can be a company producing military items, a government body doing the same, an intelligence agency, or the national police. What BIS proposes to do is separate these end-users and activities into different definitions and under EAR Part 744, so that they are, perhaps, more understandable, taken one at a time. So far, we’re on board.

However, taken together, the proposed rules are complex and mind-boggling. While the Bible was satisfied with the Four Horsemen of the Apocalypse, BIS’s latest action has us trying to come to grips with five types of proscribed end uses/users: MEUs, MSEUs, military production activities, intelligence end-users, and FSEUs. The definitions of the restricted activities and end-users are broad, and the geographic scope varies across different parts of the new rules. Some of the end users will be easily identifiable by a footnote on the Entity List (see our discussion of Footnote Frenzy below), but some parts of the new rules will require exporters and US persons to determine for themselves when and to whom the controls apply. We can see industry already tearing their hair out about the added due diligence headache.

Apparently recognizing that some of the new proposed definitions are shockingly broad – for example, an FSEU as proposed would include “analytic and data centers (e.g., genomic data centers) [and] forensic laboratories” – BIS has come up with four more Entity List footnotes to narrow the definitions (but again, only in some cases). We should have known, after BIS started assigning footnotes to Entity List entities in 2020, that we had not seen the end of this pernicious trend. Besides currently existing footnotes 1 (Huawei entities), 3 (Russia military end users), and 4 (other companies like Huawei), BIS proposes to introduce a new MEU footnote 5, a new MSEU footnote 6, a new Intelligence End User footnote 7, and a new FSEU Footnote 8. Dr. Seuss wisely stopped at Thing One and Thing Two.

Overlay onto this the fact that, under the proposed regulation, a US person would need a license to “support” nearly all of these end-users as well as military production activities, and you have one hot mess. Support is broadly defined to mean:

1. Shipping or transmitting from one foreign country to another foreign country any item not subject to the EAR you know will be used in or by any of the restricted end uses or end users, including the sending or taking of such item to or from foreign countries in any manner.
2. Transferring (in-country) any item not subject to the EAR you know will be used in or by any of the restricted end uses or end users.
3. Facilitating such shipment, transmission, or transfer (in-country).
4. Performing any contract, service, or employment you know may assist or benefit any of the restricted end uses or end users, including, but not limited to: ordering, buying, removing, concealing, storing, using, selling, loaning, disposing, servicing, financing, transporting, freight forwarding, or conducting negotiations to facilitate such activities.

Given this whopping definition of pretty much anything a US person can do, there are some welcome exclusions:

1. Activities related to “published” items described Section 734.3(b) of the EAR.
2. Activities related to items on the US Munitions List and US Munitions Import List to the extent they are subject to International Traffic in Arms Regulations (ITAR) control.
3. Activities related to administrative services which includes our personal favorite – “activities by an attorney that are limited to the provision of legal advice”.
4. For the new US person controls only (not MEUs and the other preexisting controls) commercial activities related to the movement of goods by common carrier.
5. A whole bunch of US government exclusions.

The chart below attempts to fit all the definitions, controls, geography and yes, footnotes onto a single page:

	US Person Activities Controls: What is Restricted?	US Person Activities Controls: For Which Countries?	Export License Requirements: End-User Control for Items Subject to the EAR	Export License Requirements: For Which End Users?	Export License Requirements: For Which Countries?
Military End Users (MEUs)	“Support” of a restricted country’s (see next column) national armed services (army, navy, marine, air force, or coast guard),national guard, or any person or entity performing the functions of an ‘MEU,’ including mercenaries, paramilitary, or irregular forces. MEU also includes entities designated with a footnote 3 or 5 on the Entity List.	MEUs in or from a destination specified in Country Group D:5 or Macau.	You may not export, reexport, or transfer (in-country) any item subject to the EAR without a license if you have “knowledge,” that the item is intended, entirely or in part, for a military end-use or end-user.   License required for EAR99 items.	A restricted country’s (see next column) national armed services (army, navy, marine, air force, or coast guard), the national guard, or any person or entity performing the functions of an ‘MEU,’ including mercenaries, paramilitary, or irregular forces. MEU also includes entities designated with a footnote 3 or 5 on the Entity List.	* When the ‘military end use’ occurs in, or the product of the ‘military end use’ is destined to Macau or a D:5 country.   *A ‘military end user,’ wherever located, “of” Macau or D:5.
Military-Support End Users (MSEU)	“Support” of only those entities designated with a footnote 6 on the Entity List.	N/A – US person restrictions apply only to Footnote 8 entities.	You may not export, reexport, or transfer (in-country) any item subject to the EAR specified in any ECCN on the CCL without a license if you have knowledge,” that the item is intended, entirely or in part, for a MSEU.   You may not export, reexport, or transfer (in-country) any item subject to the EAR specified in the license requirement column of the corresponding entry in supplement no. 4 without a license from BIS if you have “knowledge” that the item is intended, entirely or in part, for a `military-support end user’ with a Footnote 6 designation.   License required for EAR99 items for Footnote 6 entities, but nor for other MSEUs.	Any person or entity whose actions or functions support ‘military end uses,’ including entities designated with a footnote 6 on the Entity List	‘Military support end user,’ in Macau or D:5, or wherever located if Entity List entity with footnote 6 designation.
Military-Production Activities	“Support” of ‘Military production Activity,’ which means incorporation into the following types of items or any other activity that supports or contributes to the operation, installation, maintenance, repair, overhaul, refurbishing, “development,” or “production” of the following types of items: (1) “600 series” items, including foreign-origin items not subject to the EAR; or (2) Any other item that is either described on the Commerce Control List in other than a “600 series” ECCN, or designated EAR99, including foreign-origin items not subject to the EAR, that you “know” is ultimately destined to or for use by a ‘military end user,’	When such activity occurs in or the product of such activity is destined to a country listed in Country Group D:5 or Macau	NADA – this is only a US person activity control, because the military end use control probably already covers it – see 2 lines above	n/a	n/a
Certain Intelligence End-Users	“Support” of an ‘intelligence end user,’ means any foreign government intelligence, surveillance, or reconnaissance organizations or other entities performing functions on behalf of such organizations. IEU includes entities designated with a footnote 7 on the Entity List.	IEUs wherever located, from a destination specified in Country Group D or E, but not also listed in Country Group A:5 or A:6   Intelligence end-users must be the worst kind of end-user to get all of Country Group D and not just D:5 and Macau!	You may not export, reexport, or transfer (in-country) any item subject to the EAR without a license from BIS if you have “knowledge” that the item is intended, entirely or in part, for an ‘intelligence end user.’   License required for EAR99 items.	An ‘intelligence end user,’ means any foreign government intelligence, surveillance, or reconnaissance organizations or other entities performing functions on behalf of such organizations. IEU includes entities designated with a footnote 7 on the Entity List.	Wherever located, that is from a country or destination specified in Country Group D or E, but not also listed in A:5 or A:6
Foreign-Security End Users’	“Support” of only ‘foreign-security end users,’ that are designated with a footnote 8 on the Entity List.	N/A – US person restrictions apply only to Footnote 8 entities.	You may not export, reexport, or transfer (in-country) any item subject to the EAR with an ECCN on the CCL without a license from BIS if you have “knowledge” that the item is intended, entirely or in part, for foreign security end-users.   License NOT required for EAR99 items.	Foreign-security end user’ means any of the following:   (1) Governmental and other entities with the authority to arrest, detain, monitor, search, or use force in furtherance of their official duties, including persons or entities at all levels of the government police and security services from the national headquarters or the Ministry level, down to all subordinate agencies/bureaus (e.g., municipal, provincial, regional), (2) Other persons or entities performing functions of a ‘foreign-security end user,’ such as arrest, detention, monitoring, or search, and may include analytic and data centers (e.g., genomic data centers) forensic laboratories, jails, prisons, other detention facilities, labor camps, and reeducation facilities, or (3) Entities designated with a footnote 8 on the Entity List	A country listed in Country Group D:5 or E.   We expect that BIS will add Macau to the country scope here, when/if the rule gets finalized.

What Should the Industry Do If the New Rule Goes Into Effect?

1. Monitor US person activities.
2. Monitor where items subject to the EAR are being exported to.
3. If your transaction involves US persons or items subject to the EAR, conduct due diligence similar to what is appropriate for managing the risks of transacting with sanctioned parties, MEUs, companies on the Entity List, etc.
4. Update end-use certificates and statements to reflect the above updated controls.
5. Provide updated trainings and update policies and procedures to reflect these new controls.

---

[1] Countries that would not require a license are: Albania, Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, India, Ireland, Italy, Japan, South Korea, Latvia, Liechtenstein, Lithuania, Luxembourg, Netherlands, New Zealand, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey, and the United Kingdom.