H.R. 2683, Remote Access Security Act

H.R. 2683 would authorize the Bureau of Industry and Security (BIS), an agency of the Department of Commerce, to issue licenses and impose penalties on exporters of technology that could be accessed over a network connection between foreign and U.S. entities, such as a cloud computing service. Under its current regulations, BIS can require licenses or impose penalties for the export, reexport, or in-country transfer of such technology. It is not authorized to take those actions when the technology is remotely accessed by foreign entities.

BIS has proposed rules that would expand export controls to cover cloud-based access to U.S. technology. Using information from BIS about its work on similar export controls, CBO anticipates that the agency would need seven full-time employees to finalize regulations, process license applications, and identify unlicensed exporters. Based on information from BIS, CBO estimates that annual compensation for each of those employees would cost $240,000 and total $9 million over the 2025-2030 period. Such spending would be subject to the availability of appropriated funds.

The costs of the legislation, detailed in Table 1, fall within budget function 050 (national defense).

CBO estimates that enacting H.R. 2683 would increase the number of people who would be subject to civil or criminal penalties for violating U.S. export laws. Penalties are recorded as revenues and a portion of those penalties can be spent without further appropriation. Because CBO expects that very few people would be subject to penalties, CBO estimates that the bill’s enactment would have insignificant effects on both revenues and direct spendingand would, on net, reduce deficits by insignificant amounts over the 2025-2035 period.

H.R. 2683 would impose a private-sector mandate as defined in the Unfunded Mandates Reform Act (UMRA) on exporters by requiring them to obtain an export license from BIS before allowing remote access of technologies subject to export controls, such as superconductor chips, to foreign entities. The cost of the mandate would be the costs to comply with BIS regulations and the loss of income from losing access to some foreign markets otherwise available to them under current law. Based on industry data of the size and value of cloud services and superconductor chips that would be affected, CBO estimates that the cost of regulatory compliance and losses in revenue would exceed the threshold established in UMRA for private-sector mandates ($206 million in 2025, adjusted annually for inflation).

The bill would not impose intergovernmental mandates as defined in UMRA.

The CBO staff contacts for this estimate are Aldo Prosperi (for federal costs) and Grace Watson (for mandates). The estimate was reviewed by Christina Hawley Anthony, Deputy Director of Budget Analysis.