H.R. 2683 — Remote Access Security Act

This section establishes a definition of "remote access" in the Export Control Reform Act of 2018 (ECRA) (50 U.S.C. 4801)—i.e., access on a purposeful, knowing, reckless, or negligent basis by a foreign person via network connection (including internet or cloud computing service) from outside the item's physical location to an item subject to U.S. jurisdiction, if the Secretary of Commerce determines such use poses a serious risk to U.S. national security or foreign policy (with a clarification that it does not lower criminal mens rea standards under ECRA section 1760 (50 U.S.C. 4819)). The section makes conforming amendments throughout ECRA (50 U.S.C. 4811 et seq.) to extend licensing requirements, prohibitions on unlicensed activity, enforcement authorities, review processes, and civil/criminal penalties to remote access of controlled items (i.e., dual-use commodities, software, or technology with civilian and military/terrorism/WMD applications), treating it equivalently to exports and in-country transfers. (Thus, U.S. persons are prohibited from providing remote access to foreign persons without a license, subject to the same exceptions, end-use checks, and penalties as physical exports.)

This section requires the Secretary of Commerce to keep the appropriate congressional committees fully and currently informed, including in classified settings as necessary, prior to promulgating regulations under the Export Control Reform Act of 2018 (as amended by section 2) to control remote access to items. Such information must address (1) the national security risk to be mitigated, (2) how the regulations address that risk, and (3) potential impacts on the U.S. economy. The section specifies that committee approval is not required to exercise ECRA authorities and defines the appropriate congressional committees as the House Committee on Foreign Affairs and the Senate Committee on Banking, Housing, and Urban Affairs.