The Commerce Department's Bureau of Industry and Security (BIS) today announced new controls that will prohibit U.S. companies from exporting and reselling software and tools that could be used to fuel authoritarian practices through malicious Windows MSHTML zero-day: Exploits have been leaked to hacking forums and human rights abusers.
See also: RaidForums: Hacking forum backup created
The rule will take effect in 90 days and will effectively ban the export of hacking tools for National Security (NS) and Anti-Terrorism (AT) purposes.
It also establishes a new Cybersecurity Authorization Exception (ACE) that prohibits the export and resale of these items to countries like China and Russia, without a license.
The full list includes states that use weapons of mass destruction or have national security concerns or are subject to a US arms embargo.
"The United States government opposes the use of technology to abuse human rights or for other malicious cyber activities, and these new rules will help ensure that U.S. companies do not fuel authoritarian practices," the BIS said.
See also: Turla hacking group: New backdoor in attacks against the US and Afghanistan
The new BIS rule says that this data warrants checks because it could be used to conduct malicious online activities, including but not limited to, surveillance, espionage, or other actions that could disrupt, deny, or degrade access to network devices.
U.S. Commerce Secretary Gina M. Raimondoadded that the new law is designed to block malicious threats hacking tools that could be used to target U.S. entities and threaten the country's national security, while allowing them to be used for legitimate purposes.
See also: Windows MSHTML zero-day: Exploits have been leaked on hacking forums
"The United States is committed to working with our multilateral partners to prevent the spread of certain technologies that can be used for malicious activities that threaten cybersecurity and human rights," Raimondo said.
«The Commerce Department's final rule imposing export controls on certain types of cybersecurity is a tailored approach that protects America's national security from malicious cyber actors while ensuring legitimate cybersecurity activities».
