Deterring model extraction attacks and fraudulent account network providers

(a) Consideration of addition to Entity List (1) In general Not later than 210 days after the date of the enactment of this Act, the Under Secretary of Commerce for Industry and Security, in coordination with the head of each agency that is a member of the End-User Review Committee, shall add each entity described in paragraph (2) to the Entity List maintained by the Bureau of Industry and Security and set forth in Supplement No. 4 to part 744 of title 15, Code of Federal Regulations, or any successor regulations. (2) Entities described An entity described in this paragraph is— (A) an entity that is a person of concern identified, under subsection (a) or (e) of section 4, as having conducted model extraction attacks or having facilitated such attacks via fraudulent account networks; or (B) a subsidiary of such an entity (to be determined by ownership of 50 percent or more in the aggregate, directly or indirectly). (b) Imposition of sanctions (1) In general The President shall, pursuant to the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.), block and prohibit all transactions in all property and interests in property of each person of concern identified under subsections (a) and (e) of section 4 if such property and interests in property are in the United States, come within the United States, or are or come within the possession or control of a United States person. (2) Exceptions (A) Exception relating to the provision of humanitarian assistance Sanctions under paragraph (1) may not be imposed with respect to transactions or the facilitation of transactions for— (i) the sale of agricultural commodities, food, medicine, or medical devices; (ii) the provision of humanitarian assistance; or (iii) transporting goods or services that are necessary to carry out operations relating to humanitarian assistance. (B) Exception for intelligence, law enforcement, and national security activities Sanctions under this subsection shall not apply to any authorized intelligence, law enforcement, or national security activities of the United States. (3) Waiver (A) In general The President may, subject to subparagraph (B), waive the application of subsection (a) or (b) with respect to a person if, before issuing the waiver, the President submits to Congress— (i) a certification in writing that the issuance of the waiver is in the national interests of the United States; and (ii) a report explaining the basis for the certification. (B) Form of report Each report required by subparagraph (A) shall be submitted in unclassified form but may include a classified annex. (4) Penalties A person that violates, attempts to violate, conspires to violate, or causes a violation of this subsection or any regulation, license, or order issued to carry out that subsection shall be subject to the penalties set forth in subsections (b) and (c) of section 206 of the International Emergency Economic Powers Act (50 U.S.C. 1705) to the same extent as a person that commits an unlawful act described in subsection (a) of that section.