SUPPLEMENTARY INFORMATION:

Background

Entity List

The Entity List (supplement no. 4 to part 744 of the EAR) identifies entities for which there is reasonable cause to believe, based on specific and articulable facts, that the entities have been involved, are involved, or pose a significant risk of being or becoming involved in activities contrary to the national security or foreign policy interests of the United States. The EAR (15 CFR parts 730-774) impose additional license requirements on, and limit the availability of most license exceptions for, exports, reexports, and transfers (in-country) to listed entities. The license review policy for each listed entity is identified in the “License Review Policy” column on the Entity List, and the impact on the availability of license exceptions is described in the relevant Federal Register document adding entities to the Entity List. Bureau of Industry and Security (BIS) places entities on the Entity List pursuant to part 744 (Control Policy: End-User and End-Use Based) and part 746 (Embargoes and Other Special Controls) of the EAR.

The End-User Review Committee (ERC), composed of representatives of the Departments of Commerce (Chair), State, Defense, Energy and, where appropriate, the Treasury, makes all decisions regarding additions to, removals from, or other modifications to the Entity List. The ERC makes all decisions to add an entry to the Entity List by majority vote and makes all decisions to remove or modify an entry by unanimous vote.

ERC Entity List Decisions

Additions to the Entity List

This rule implements the decision of the ERC to add four entities to the Entity List. The four entities are added based on § 744.11 (License requirements that apply to entities acting contrary to the national security or foreign policy interests of the United States) of the EAR. The four entities are located in Israel, Russia, and Singapore.

The ERC determined that NSO Group and Candiru be added to the Entity List based on § 744.11(b) of the EAR: Entities for which there is reasonable cause to believe, based on specific and articulated facts, that the entity has been involved, is involved, or poses a significant risk of being or becoming involved in activities that are contrary to the national security or foreign policy interests of the United States and those acting on behalf of such entities. Specifically, investigative information has shown that the Israeli companies NSO Group and Candiru developed and supplied spyware to foreign governments that used this tool to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.

The ERC determined that Positive Technologies, located in Russia, and Computer Security Initiative Consultancy PTE. LTD., located in Singapore, be added to the Entity List based on their engagement in activities counter to U.S. national security. Specifically, these entities traffic in cyber exploits used to gain access to information systems, threatening the privacy and security of individuals and organizations worldwide.

Pursuant to § 744.11(b) of the EAR, the ERC determined that the conduct of the above-described four entities raises sufficient concerns that prior review, via the imposition of a license requirement for exports, reexports, or transfers (in-country) of all items subject to the EAR involving these four entities and the possible issuance of license denials or the possible imposition of license conditions on shipments to these entities, will enhance BIS's ability to prevent violations of the EAR or otherwise protect U.S. national security or foreign policy interests. In addition, the ERC also determined that no license exceptions should be available for exports, reexports, or transfers (in-country) to the persons being added to the Entity List in this rule. The ERC imposed a license review policy of a presumption of denial for these four entities. The acronym “a.k.a.,” which is an abbreviation of `also known as,' is used in entries on the Entity List to identify aliases, thereby assisting exporters, reexporters, and transferors in identifying entities on the Entity List.

For the reasons described above, this final rule adds the following four entities to the Entity List and includes, where appropriate, aliases:

Israel

Candiru;and

NSO Group

Russia

• Positive Technologies

Singapore

• Computer Security Initiative Consultancy PTE. LTD.

Savings Clause

Shipments of items removed from eligibility for a License Exception or export, reexport, or transfer (in-country) without a license (NLR) as a result of this regulatory action that were en route aboard a carrier to a port of export, reexport, or transfer (in-country), on November 4, 2021, pursuant to actual orders for export, reexport, or transfer (in-country) to or within a foreign destination, may proceed to that destination under the previous eligibility for a License Exception or export, reexport, or transfer (in-country) without a license (NLR).

Export Control Reform Act of 2018

On August 13, 2018, the President signed into law the John S. McCain National Defense Authorization Act for Fiscal Year 2019, which included the Export Control Reform Act of 2018 (ECRA) (50 U.S.C. 4801-4852). ECRA provides the legal basis for BIS's principal authorities and serves as the authority under which BIS issues this rule. ( printed page 60760)

Rulemaking Requirements

1. Executive Orders 13563 and 12866 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This rule has been determined to be not significant for purposes of Executive Order 12866.

2. Notwithstanding any other provision of law, no person is required to respond to or be subject to a penalty for failure to comply with a collection of information, subject to the requirements of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.) (PRA), unless that collection of information displays a currently valid Office of Management and Budget (OMB) Control Number. This regulation involves collections previously approved by OMB under control number 0694-0088, Simplified Network Application Processing System, which includes, among other things, license applications and commodity classification, and carries a burden estimate of 29.6 minutes for a manual or electronic submission for a total burden estimate of 31,835 hours. Total burden hours associated with the PRA and OMB control number 0694-0088 are not expected to increase as a result of this rule.

3. This rule does not contain policies with federalism implications as that term is defined in Executive Order 13132.

4. Pursuant to section 1762 of ECRA, this action is exempt from the Administrative Procedure Act (5 U.S.C. 553) requirements for notice of proposed rulemaking, opportunity for public participation, and delay in effective date.

5. Because a notice of proposed rulemaking and an opportunity for public comment are not required to be given for this rule by 5 U.S.C. 553, or by any other law, the analytical requirements of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq., are not applicable. Accordingly, no regulatory flexibility analysis is required and none has been prepared.

Accordingly, part 744 of the Export Administration Regulations (15 CFR parts 730-774) is amended as follows:

1. The authority citation for 15 CFR part 744 is revised to read as follows:

Authority: 50 U.S.C. 4801-4852; 50 U.S.C. 4601 et seq.;50 U.S.C. 1701 et seq.;22 U.S.C. 3201 et seq.;42 U.S.C. 2139a; 22 U.S.C. 7201 et seq.;22 U.S.C. 7210; E.O. 12058, 43 FR 20947, 3 CFR, 1978 Comp., p. 179; E.O. 12851, 58 FR 33181, 3 CFR, 1993 Comp., p. 608; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13099, 63 FR 45167, 3 CFR, 1998 Comp., p. 208; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; E.O. 13224, 66 FR 49079, 3 CFR, 2001 Comp., p. 786; Notice of September 15, 2021, 86 FR 52069 (September 17, 2021); Notice of November 12, 2020, 85 FR 72897 (November 13, 2020).

2. Supplement No. 4 to part 744 is amended:

a. Under ISRAEL, by adding in alphabetical order entries for “Candiru” and “NSO Group”;

b. Under RUSSIA, by adding in alphabetical order an entry for “Positive Technologies”; and

c. Under SINGAPORE, by adding in alphabetical order an entry for “Computer Security Initiative Consultancy PTE. LTD.”.

The additions read as follows:

Supplement No. 4 to Part 744—Entity List