Executive Order 13873 and ICTS rules (2019)

Executive Order 13873 (2019), "Securing the Information and Communications Technology and Services Supply Chain," signed on 15 May 2019, is the United States authority permitting the Commerce Department to prohibit or condition transactions involving information and communications technology and services (ICTS) designed, developed, or supplied by persons subject to a foreign adversary's jurisdiction, where the transaction poses undue risk to US networks or national security. With its implementing ICTS rules it created a transaction-review regime for technology supply chains: an exclusion power that reaches commercial dealings the Entity List (15 CFR Part 744) and procurement bans do not touch.

Provisions

The order declared a national emergency over foreign-adversary exploitation of ICTS supply chains under the International Emergency Economic Powers Act (1977). Commerce's implementing rule, issued in interim final form in January 2021, established case-by-case review of covered transactions, with China, Russia, Iran, North Korea, Cuba, and Venezuela identified as foreign adversaries, and authorised prohibition, mitigation, or unwinding of transactions found to present undue risk. A dedicated office within the Bureau of Industry and Security (US Commerce) administers the programme. The model is CFIUS-like review generalised from investment to ordinary commerce: not a list of banned goods but a jurisdiction-based power over any ICTS transaction touching an adversary supplier.

Employment history

The authority's first outings were turbulent. The 2020 orders against TikTok and WeChat invoked the EO 13873 emergency, were enjoined by federal courts, and were revoked in June 2021 by Executive Order 14034, which redirected the programme toward rule-based review; the episode is treated at United States forced-divestiture policy towards TikTok (2020-present). The first completed prohibition came in June 2024, when Commerce issued a final determination barring Kaspersky Lab software from the US market, with sales prohibited from July and updates from September 2024, the first time a foreign software product was excluded from an entire national market by transaction rule. In 2025 Commerce finalised restrictions on Chinese and Russian hardware and software in connected vehicles, extending the regime from installed software to the automotive supply chain.

Effects

The ICTS regime marks the migration of economic warfare from goods and money to embedded services: the theory of harm is not the item at the border but the standing update channel, data flow, and remote-access relationship that modern technology products entail, terrain treated at Data as strategic terrain. Its breadth is contested. Supporters argue that only a transaction-level power can address risks that inhere in supplier jurisdiction rather than in any listable product; critics warn that "undue risk" review over the whole ICTS economy is a standing licence for discretionary decoupling, with compliance uncertainty itself functioning as a deterrent to any adversary-linked sourcing. In practice the regime has operated as the legal scaffolding for successive market exclusions, each converting a diffuse supply-chain anxiety into an enforceable prohibition.

By 30 July 2026 the Office of Information and Communications Technology and Services, OICTS, administered the programme inside Commerce. The connected vehicles rules and the Kaspersky determination are separate applications with their own product scope, implementation dates and authorisations. Executive Order 13873 does not automatically prohibit every transaction involving technology from a named foreign-adversary jurisdiction.

See also

Procurement ban on adversary technology · Secure and Trusted Communications Networks Act (2019) · Kaspersky Lab · United States forced-divestiture policy towards TikTok (2020-present) · Software and cloud-service denial · Data as strategic terrain · Entity List (15 CFR Part 744) · Technology denial · Economic statecraft

Sources

• Executive Order 13873, accessed 30 July 2026.
• Commerce OICTS overview, accessed 30 July 2026.
• Commerce connected vehicles programme, accessed 30 July 2026.
• Commerce Kaspersky determination, accessed 30 July 2026.