On September 15, 2022, President Joseph R. Biden, Jr. issued Executive Order 14,083 on “Ensuring Robust Consideration of Evolving National Security Risks by the Committee on Foreign Investment in the United States.”Footnote ¹ The order provides the Committee on Foreign Investment in the United States (CFIUS), a Treasury Department-led interagency committee charged with reviewing foreign investment for national security concerns, with the first “formal Presidential direction on the risks that the Committee should consider when reviewing a covered transaction.”Footnote ² It directs CFIUS to focus on five national security factors pertaining to “preserving U.S. technological leadership, protecting Americans’ sensitive data, and enhancing U.S. supply chain resilience.”Footnote ³ The order in effect codifies the Committee's recent practices. It does not extend the Committee's jurisdiction or change its processes. Nor does it focus on specific countries by name. Still, together with the first CFIUS Enforcement and Penalty Guidelines, issued on October 20, 2022, the executive order signals an increased emphasis on CFIUS review and seeks to provide focus to that review.Footnote ⁴ Despite its neutral appearance, the executive order is also part of a broad range of inbound and outbound trade and investment measures related to national security stemming from heightened geopolitical competition between the United States and China.Footnote ⁵

President Gerald R. Ford established CFIUS by executive order in 1975 following an increase in investments in American securities, stocks, and bonds by members of the Organization of the Petroleum Exporting Countries (OPEC).Footnote ⁶ The order sought to “dissuade Congress from enacting new restrictions on foreign investment” by providing “reassur[ance] . . . that we could anticipate and deal effectively with any threats in this area, and at the same time maintain our basically liberal [foreign investment] policy.”Footnote ⁷ It gave the Committee the “primary continuing responsibility within the Executive Branch for monitoring the impact of foreign investment in the United States, both direct and portfolio, and for coordinating the implementation of United States policy on such investment.”Footnote ⁸ Government officials soon questioned the Committee's authority to collect data concerning foreign investment. The International Investment Survey Act of 1976 remedied these concerns by granting the president explicit authority to collect such information.Footnote ⁹

The Committee's first five years were not active, but in the early 1980s, at the request of the Department of Defense, CFIUS began reviewing the acquisition of American companies by Japanese firms, and concern over Japanese investment eventually led to congressional action. Because CFIUS was established pursuant to executive order, any measures by the president regarding foreign investment could only be taken pursuant to existing statutory authority, such as the International Emergency Economic Powers Act (IEEPA). Enactment of the Exon-Florio Amendment in 1988 gave the president for the first time the authority to “make an investigation to determine the effects on national security of mergers, acquisitions, and takeovers . . . by or with foreign persons which could result in foreign control” and to “suspend or prohibit any acquisition, merger, or takeover, of a person . . . by or with foreign persons so that such control will not threaten to impair the national security.”Footnote ¹⁰ Such authority could be exercised, however, only if there was “credible evidence that . . . the foreign interest exercising control might take action that threatens to impair the national security” and also if “provisions of law” other than IEEPA did not provide the president with adequate and appropriate means to protect national security.Footnote ¹¹

President Ronald Reagan delegated to CFIUS the authority to initiate and conduct investigations and to make recommendations regarding any actions regarding covered investments, transforming the committee from a monitoring and advisory body to one with power to review and (with presidential approval) impede transactions.Footnote ¹² In 1992, the Byrd Amendment added a requirement that an investigation must be undertaken when “an entity controlled by or acting on behalf of a foreign government seeks to engage in any merger, acquisition, or takeover . . . that could affect the national security.”Footnote ¹³ Fifteen years later, the Foreign Investment and National Security Act of 2007 (FINSA) gave CFIUS a statutory foundation for the first time. FINSA detailed the Committee's review and investigation processFootnote ¹⁴ and also provided the Committee the authority to “negotiate, enter into or impose, and enforce any agreement or condition with any party to the covered transaction in order to mitigate any threat to the national security of the United States that arises as a result of the covered transaction.”Footnote ¹⁵ The statute included five factors for the president (and hence CFIUS) to consider when determining whether to “suspend or prohibit any covered transaction that threatens to impair the national security of the United States.”Footnote ¹⁶ Earlier statutes had identified six such factors, thus bringing the total to eleven.Footnote ¹⁷ In 2018, largely due to concerns over investments by Chinese entities, the Foreign Investment Risk Review Modernization Act (FIRRMA) expanded the foreign investments subject to the Committee's jurisdiction from its previous focus on transactions resulting in foreign control to include a broader array of investments pertaining to “critical technologies,” “critical infrastructure,” and “sensitive personal data,” as well as those relating to “the purchase or lease by, or a concession to, a foreign person of private or public real estate that” created national security risks.Footnote ¹⁸ The statute also required the submission to CFIUS of a declaration by the parties to a covered transaction “if the transaction involves an investment that results in the acquisition, directly or indirectly, of a substantial interest in . . . [U.S. critical technologies, critical infrastructure, or sensitive personal data] business[es] . . . by a foreign person in which a foreign government has, directly or indirectly, a substantial interest.”Footnote ¹⁹ FIRRMA did not add to or update the list of national security factors.Footnote ²⁰ CFIUS's review of transactions intensified with the broadening of covered transactions, the introduction of mandatory declarations, the increase in its staffing and funding, and the continued sensitivity to Chinese investment.Footnote ²¹

President Biden's executive order specifies five factors that the committee must consider in light of “an evolving national security landscape,” expanding upon two of the eleven statutory factors and adding three.Footnote ²² The first focuses on supply chains, elaborating on the statute's concern with an investment's “control of domestic industries and commercial activity by foreign citizens as it affects the capability and capacity of the United States to meet the requirements of national security.”Footnote ²³ It directs the committee to consider “the covered transaction's effect on supply chain resilience and security, both within and outside of the defense industrial base, in manufacturing capabilities, services, critical mineral resources, or technologies that are fundamental to national security.”Footnote ²⁴ The order specifies here, and in the other factors, that the concern is not only with “a foreign person who is a party to the covered transaction . . . [but also a foreign person] who might have relevant third-party ties that might cause the transaction to pose . . . a threat” to national security.Footnote ²⁵ Supply chain anxieties have previously led CFIUS to oppose some transactions. In 2017, for example, President Donald J. Trump prohibited the acquisition of Lattice Semiconductor Corp. by a Chinese company due in part to “the importance of semiconductor supply chain integrity.”Footnote ²⁶ In December 2021, a Chinese company's merger with Magnachip Semiconductor Corp. was abandoned due to CFIUS's objections.Footnote ²⁷

The second factor elaborates on the statute's focus on an investment's “potential effects . . . on United States international technological leadership in areas affecting United States national security.”Footnote ²⁸ The order directs the committee to consider whether a “covered transaction involves manufacturing capabilities, services, critical mineral resources, or technologies that are fundamental to United States technological leadership and therefore national security, such as microelectronics, artificial intelligence, biotechnology and biomanufacturing, quantum computing, advanced clean energy, and climate adaptation technologies.”Footnote ²⁹ CFIUS has taken a particular interest in the acquisition of semiconductor technologies,Footnote ³⁰ but its concerns have extended to other industries as well, including telecommunications.Footnote ³¹ In December 2022, for example, Borqs Technologies Inc., a China-based company, was notified that it would need to divest itself of Holu Hou Energy LLC, a Hawaiian solar energy storage supplier.Footnote ³²

The third factor, the first of three that supplement those codified by statute, “relat[es] to aggregate industry investment trends that may have consequences for an individual covered transaction's impact on national security.”Footnote ³³ The order notes that “[i]ncremental investments over time in a sector or technology may cede, part-by-part, domestic development or control in that sector or technology” in a way that threatens national security.Footnote ³⁴ The Committee is therefore directed to consider “the risks arising from the covered transaction in the context of multiple acquisitions or investments in a single sector or in related manufacturing capabilities, services, critical mineral resources, or technologies.”Footnote ³⁵

“[C]ybersecurity risk” is the order's fourth factor.Footnote ³⁶ CFIUS must consider “whether a covered transaction may provide a foreign person . . . with direct or indirect access to capabilities or information databases and systems on which threat actors could engage in malicious cyber-enabled activities.”Footnote ³⁷ This includes: “activity designed to undermine the protection or integrity of data in storage or databases or systems housing sensitive data”; “activity designed to interfere with United States elections, United States critical infrastructure, the defense industrial base, or other cybersecurity national security priorities”; and “the sabotage of critical energy infrastructure, including smart grids.”Footnote ³⁸

The order's fifth and final factor focuses on “sensitive data.”Footnote ³⁹ It explains that “[d]ata is an increasingly powerful tool for the surveillance, tracing, tracking, and targeting of individuals or groups of individuals, with potential adverse impacts on national security.”Footnote ⁴⁰ The Committee therefore is required consider whether a covered transaction involves a U.S. business that “has access to United States persons’ sensitive data, including United States persons’ health, digital identity, or other biological data and any data that could be identifiable or de-anonymized, that could be exploited to distinguish or trace an individual's identity” or “has access to data on sub-populations in the United States that could be used by a foreign person to target individuals or groups of individuals.”Footnote ⁴¹ Concerns about access to sensitive personal data has led CFIUS, for example, to order Beijing Kunlun Tech Co. Ltd. to sell its stake in Grindr, iCarbonX to sell its interest in PatientsLikeMe, and reportedly ByteDance Ltd. to divest itself of TikTok.Footnote ⁴²

Five weeks following the issuance of the executive order, the Treasury Department released the first CFIUS Enforcement and Penalty Guidelines.Footnote ⁴³ The Guidelines provide “three categories of conduct that may constitute a [v]iolation,” including “[f]ailure to timely submit a mandatory declaration or notice,” non-compliance with CFIUS mitigation agreements, conditions, or orders, and “[m]aterial misstatements in or omissions from information filed with CFIUS, and false or materially incomplete certifications [that are] filed.”Footnote ⁴⁴ When determining a penalty, the Committee will consider as aggravating or mitigating factors: accountability and future compliance; harm (or threat to national security); negligence and intent; persistence and timing; response and remediation, including self-disclosure of noncompliance; and record of compliance.Footnote ⁴⁵ Any penalties imposed by CFIUS are separate from civil or criminal penalties provided for by other authorities.Footnote ⁴⁶ “Today's announcement sends a clear message: Compliance with CFIUS mitigation agreements is not optional, and the Committee will not hesitate to use all of its tools and take enforcement action to ensure prompt compliance and remediation,” Assistant Secretary of the Treasury for Investment Security Paul Rosen said.Footnote ⁴⁷

The executive order, Secretary of the Treasury Janet L. Yellen, chair of CFIUS, noted, “highlights CFIUS's increasing attention to national security risks in several key areas and sharpens the Committee's focus on protecting America's national security, while maintaining the U.S. open investment policy.”Footnote ⁴⁸ Together with the new enforcement and penalty guidelines, the order, according to the White House, “send[s] a very clear message, a public message, to the private sector . . . about what are some factors that we as an administration are very focused on.”Footnote ⁴⁹ It also sends a message to “the public as a whole, as well as foreign governments, allies, and partners around the world.”Footnote ⁵⁰ Part of a broader set of actions, the order “explicitly ties CFIUS's role, actions, and capabilities with the Administration's overall national security priorities.”Footnote ⁵¹ It is a part, as well, of a transnational proliferation of heightened investment screening.Footnote ⁵²