The Bureau of Industry and Security is seeking public input by April 29 on a proposal to adopt new requirements for Infrastructure as a Service providers (IaaS) to address the risk of foreign malicious actors using U.S. cloud services to pursue malicious cyber-enabled activities to harm U.S. critical infrastructure or national security, including to train large artificial intelligence models.
According to a BIS press release, the proposed rule introduces potential regulations that would require U.S. cloud infrastructure providers and their foreign resellers to implement and maintain customer identification programs that would include the collection of “know your customer” information. Similar KYC requirements already exist in other industries and seek to assist service providers in identifying and addressing potential risks posed by providing services to certain customers. Such risks include fraud, theft, facilitation of terrorism, and other activities contrary to U.S. national security interests.
The proposal would also authorize the imposition of certain special measures that can restrict malicious cyber-enabled actors’ access to U.S. IaaS. BIS is seeking public input on a number of issues, including minimum verification standards, access, and recordkeeping requirements that providers would have to adopt; the procedures by which the Department of Commerce would decide when and how to impose a special measure; and the definitions of several key IaaS and AI-related terms as they apply to the regulations.
Under Secretary for Industry and Security Alan Estevez indicated that this proposal “gives the Secretary of Commerce the tools she needs to address risks while maintaining the Department’s overall approach to national security: to innovate and do business wherever we can, and to protect what we must.”
Copyright © 2024 Sandler, Travis & Rosenberg, P.A.; WorldTrade Interactive, Inc. All rights reserved.