,,ii #aaith ,,congress #ast ,session ,s4 #ceai ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,december #ag1 #bjbe ,mr4 ,mc,cormick 7for himself1 ,mr4 ,wyden1 ,mr4 ,cotton1 and ,mr4 ,coons7 introduced the following bill2 which was read twice and referred to the ,committee on ,banking1 ,housing1 and ,urban ,affairs ,a ,,bill ,to amend the ,export ,control ,reform ,act of #bjah to provide for control of remote access to items1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,remote ,access ,security ,act4 #b4 ,control of remote access of items under the ,export ,control ,reform ,act of #bjah 7a7 ,definition of remote access ,section #agdb of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhja7 is amended by adding at the end the following3 7#ae7 ,remote access 7,a7 ,in general ,the term remote access means access to an item subject to the jurisdiction of the ,united ,states and included on the ,commerce ,control ,list set forth in ,supplement ,no4 #a to part #ggd of the ,export ,administration ,regulations1 by a foreign person of concern through a cloud infrastructure service from a location outside the ,united ,states and other than where the item is physically located1 if the ,secretary determines that the use of the item has demonstrated a serious risk to the national security or foreign policy of the ,united ,states through the use of software1 such as by-- 7i7 training an artificial intelligence dual-use model that-- 7,i7 substantially lowers the barrier of entry for experts or nonexperts to design1 synthesize1 acquire1 or use chemical1 biological1 radiological1 or nuclear weapons or other weapons of mass destruction2 7,,ii7 conducts offensive cyber operations through automated vulnerability discovery and exploitation against a wide range of potential targets of cyber attacks 7not including for defensive purposes such vulnerability reporting or mitigation72 or 7,,iii7 evades human control or oversight of automated systems through means of deception or obfuscation2 7ii7 accessing capabilities primarily designed for offensive cyberspace operations 7not including accessing such capabilities for network defense activities72 or 7iii7 conducting surveillance primarily designed to undermine human rights1 such as by using spyware 7as defined in section #aajb;,a of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cbcb;a7a7771 location tracking technology1 or biometric identification technology primarily designed for such surveillance4 7,b7 ,cloud infrastructure service defined ,for purposes of subparagraph 7,a71 the term cloud infrastructure service has the meaning given the term ,infrastructure as a ,service by the ,national ,institute of ,standards and ,technology in ,special ,publication #hjj-ade 7or any successor publication74 7#af7 ,foreign person of concern ,the term foreign person of concern means-- 7,a7 the government of-- 7i7 a country specified in section #dhgb7;f77#b7 of title #aj1 ,united ,states ,code2 or 7ii7 any region within such a country1 including the ,macau ,special ,administrative ,region and the ,hong ,kong ,special ,administrative ,region of the ,people's ,republic of ,china2 7,b7 an entity located or headquartered in1 or the ultimate parent company of which is headquartered in1 such a country or region2 or 7,c7 a person subject to the jurisdiction of a government described in subparagraph 7,a74 4 7b7 ,statement of policy ,section #ageb of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhaa7 is amended-- 7#a7 in paragraph 7#a7-- 7,a7 in subparagraph 7,a71 by inserting 1 and provision of remote access to1 after export of2 and 7,b7 in subparagraph 7,b71 by inserting 1 and provision of remote access to1 after export of2 and 7#b7 in paragraph 7#b7-- 7,a7 in the matter preceding subparagraph 7,a71 by inserting 1 and provision of remote access to1 after transfer of2 and 7,b7 in subparagraph 7,a71 in the matter preceding clause 7i71 by inserting 1 or provision of remote access to1 after release of4 7c7 ,authority of ,president ,section #agec of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhab7 is amended-- 7#a7 in subsection 7a7-- 7,a7 in paragraph 7#a71 by striking and at the end2 7,b7 in paragraph 7#b77;,f71 by striking the period at the end and inserting 2 and2 and 7,c7 by adding at the end the following3 7#c7 the provision of remote access to items subject to the jurisdiction of the ,united ,states to foreign persons of concern4 2 7#b7 in subsection 7b7-- 7,a7 in paragraph 7#f71 by striking and at the end2 7,b7 in paragraph 7#g71 by striking the period at the end and inserting 2 and2 and 7,c7 by adding at the end the following3 7#h7 regulate the provision of remote access to items described in subsection 7a77#c74 2 and 7#c7 in subsection 7c7-- 7,a7 by inserting 1 or provision of remote access to1 after in-country transfer of2 7,b7 by striking subsections 7b77#a7 or 7b77#b7 and inserting paragraphs 7#a71 7#b71 and 7#h7 of subsection 7b71 as applicable12 and 7,c7 by striking or in-country transfer occurs and inserting in-country transfer1 or provision of remote access occurs4 7d7 ,additional authorities ,section #aged of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhac7 is amended-- 7#a7 in subsection 7a7-- 7,a7 in paragraph 7#c71 by inserting 1 and provision of remote access to1 after transfers of2 7,b7 in paragraph 7#d71 by inserting 1 and provision of remote access to1 after transfers of2 7,c7 in paragraph 7#e71 in the matter preceding subparagraph 7,a71 by inserting 1 and provision of remote access to1 after transfers of2 7,d7 in paragraph 7#f71 by striking ,united ,states export control and inserting ,united ,states control2 7,e7 in paragraph 7#g71 by striking export controls and inserting controls2 7,f7 in paragraph 7#aj71 by striking or in-country transferred and inserting in-country transferred1 or accessed remotely2 7,g7 in paragraph 7#aa71 by adding at the end before the semicolon the following3 or remote access2 and 7,h7 in paragraph 7#ae71 by striking to export and inserting for export1 reexport1 in-country transfer1 or provision of remote access2 7#b7 in subsection 7b71 by inserting 1 or provision of remote access to1 after transfer of2 and 7#c7 in subsection 7d77#a77;,a71 by inserting 1 or provision of remote access to1 after in country-transfer of4 7e7 ,administration of controls ,section #agee of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhad7 is amended-- 7#a7 in subsection 7b77#b7-- 7,a7 in subparagraph 7,c71 by inserting 1 and provision of remote access to1 after in-country transfers of2 and 7,b7 in subparagraph 7,e71 by inserting 1 and remote access to1 after in-country transfers of2 and 7#b7 in subsection 7c71 by striking export controls and inserting controls4 7f7 ,licensing ,section #agef of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhae7 is amended-- 7#a7 in subsection 7a71 in the matter preceding paragraph 7#a71 by inserting 1 and provision of remote access to1 after in-country transfer of2 and 7#b7 in subsection 7b71 by inserting 1 or provide remote access to1 after in-country transfer4 7g7 ,compliance assistance ,section #ageg of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhaf7 is amended-- 7#a7 in subsection 7a71 by inserting 1 or provision of remote access to1 after in-country transfer of2 and 7#b7 in subsection 7c77#b71 by striking export controls and inserting controls4 7h7 ,penalties ,section #agfj of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhai7 is amended-- 7#a7 in subsection 7a77#b77;,f7-- 7,a7 in clause 7ii71 by striking any export control document or any report and inserting any document or report2 and 7,b7 in clause 7iii71 by inserting 1 or provision of remote access to1 after in-country transfer of2 7#b7 in subsection 7c77#a77;,c71 by striking or in-country transfer and inserting in-country transfer1 or remotely access2 and 7#c7 in subsection 7e77#a77;,a7-- 7,a7 in clause 7i71 by inserting 1 or remotely access or provide remote access to1 after ,united ,states2 and 7,b7 in clause 7ii71 by striking or in-country transfer and inserting in-country transfer1 or remotely access1 or provide remote access to14 7i7 ,enforcement ,section #agfa of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhbj7 is amended-- 7#a7 in subsection 7a77#e71 by striking or in-country transferred and inserting in-country transferred1 or remotely accessed2 and 7#b7 in subsection 7h77#a77;,b71 by inserting 1 or provide remote access to1 after in-country transfer4 7j7 ,annual report ,section #agfe7;a77#a7 of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhbd7;a77#a77 is amended by inserting 1 and provision of remote access to1 after in-country transfers of4 7k7 ,effect on other ,acts ,section #agfg of the ,export ,control ,reform ,act of #bjah 7#ej ,u4,s4,c4 #dhbe7 is amended-- 7#a7 in subsection 7a71 by inserting 1 or remote access to1 after reexport of2 and 7#b7 in subsection 7b77#b7-- 7,a7 in subparagraph 7,a71 by inserting 1 and remote access by and provision of remote access to such persons to1 after persons of2 and 7,b7 in subparagraph 7,c71 by striking or in-country transferred and inserting in-country transferred1 or remotely accessed4 7l7 ,termination ,the authority under part ,i of the ,export ,control ,reform ,act of #bjah1 as amended by this section1 to impose controls on remote access to items terminates on the date that is #aj years after the date of the enactment of this ,act4 #c4 ,consultations with ,congress ,the ,secretary of ,commerce shall ensure ,congress is kept fully and currently informed of any anticipated promulgation of regulations to control remote access to items under the ,export ,control ,reform ,act of #bjah1 as amended by section #b1 including ensuring that ,congress is informed1 in a classified setting as necessary1 on-- 7#a7 the national security or foreign policy risk that would be addressed by the regulations2 7#b7 how the method of the regulations addresses that risk2 and 7#c7 how the regulations may impact the economy of the ,united ,states1 including the impact on the competitiveness of ,united ,states industry in cloud services and related industries as a result of the regulations4 #d4 ,report and recommendations 7a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,secretary of ,commerce shall submit to ,congress and make available to the public a report assessing and making recommendations with respect to-- 7#a7 the implementation of this ,act and the amendments made by this ,act2 7#b7 maximizing the level of privacy1 and minimizing compliance costs1 for entities seeking licenses relating to remote access to items under the ,export ,control ,reform ,act of #bjah1 as amended by section #b2 7#c7 improving the speed at which and consistency with which applications for such licenses are reviewed2 7#d7 identifying relevant national security and foreign policy concerns related to remote access to items in the interest of improving certainty for ,united ,states businesses2 7#e7 increasing cooperation with international partners with respect to remote access to items2 7#f7 ensuring export controls relating to remote access to items are consistent1 clear1 and up to date2 and 7#g7 recommending amendments to the ,export ,control ,reform ,act of #bjah to strengthen the provisions of that ,act relating to remote access4 7b7 ,consultations ,in developing the report required by subsection 7a71 the ,secretary shall seek input from the public1 including holding a public roundtable with industry participants4