A Look At The New Export Control Rules For Cloud Computing

Transcription

1 Portfolio Media. Inc. 860 Broadway, 6th Floor New York, NY Phone: Fax: A Look At The New Export Control Rules For Cloud Computing Law360, New York (June 18, 2015, 5:31 PM ET) -- On June 3, 2015, the U.S. Department of Commerce s Bureau of Industry and Security and theu.s. Department of State s Directorate of Defense Trade Controls published proposed rules revising key definitions in the Export Administration Regulations and International Traffic in Arms Regulations to harmonize the two export control regimes. The proposed rules would make certain substantive changes, most notably excluding from the definition of export the transfer and storage of technology or software in encrypted form, subject to certain conditions. For the most part, the revisions are intended to harmonize the substance and structure of the EAR and the ITAR as part of the ongoing export control reform process, as well as to codify existing policies. Mario Mancuso The proposed rules would revise important EAR and ITAR definitions, including the following: export, reexport, technology and technical data, release, transfer, required and peculiarly responsible, published and public domain and defense service. The revisions largely deal with controls over technology and technical data. While certain differences will remain between the two legal regimes, these proposed rules seek to make the language and structure of the EAR and the ITAR more consistent. The administration s intent is to facilitate export compliance by harmonizing the two legal regimes, thus furthering the policy goals of the export control rules, and to take another step toward the ultimate export control reform objective of creating a common set of regulations. In fact, both BIS and the DDTC borrow from the other s existing regulations and mix the content and structure of current EAR and ITAR definitions, to seek harmonization of the distinct legal regimes that developed separately over time. Most of the proposed revisions would not substantively change the existing rules. Instead, they would foster substantive harmonization (i.e., using the same words for the same concepts in the EAR and the ITAR) and structural harmonization (i.e., using similar definitions in a common format that makes the differences clear). The agencies often use a common structure, under which paragraph (a) of a particular section provides the definition or included items, while paragraph (b) lists the exclusions to the definition or rule. This structure permits the agencies flexibility and facilitates amendments to the rules and exceptions in the future. We summarize below the main provisions of the proposed rules and their potential effect on exporters of U.S.-controlled items. Export of Encrypted Data

2 The main substantive aspect of the proposed rules is to decontrol the transfer and storage of technology and software encrypted according to certain requirements. This change reflects recent developments in the way data is shared and stored (e.g., cloud computing) and responds to suggestions that industry has made for years. It is the first recognition by BIS and the DDTC that properly encrypted information does not pose a national security risk because it cannot be accessed. In particular, the rules would state that the terms export, reexport, release, retransfer and transfer would exclude sending, taking or storing technology/technical data or software that are: (1) unclassified; (2) secured using end-to-end encryption; (3) secured using cryptographic modules compliant with FIPS 140-2, supplemented by software implementation, key management and other procedures and controls in accordance with NIST publications and guidance. Note that BIS would also allow similarly effective cryptographic means, while the DDTC would strictly require FIPS compliant cryptography; and (4) not be stored in a country subject to a U.S. arms embargo (i.e., EAR Country Group D:5 or ITAR Section 126.1) or Russia. Under this proposal, end-to-end encryption requires uninterrupted cryptographic protection of data between an originator and an intended recipient, including between an individual and himself or herself. Also, the means to access the data in unencrypted form is not given to any third party, including to any Internet service provider, application service provider or cloud service provider. Therefore, qualifying cloud providers may not store the data unencrypted or decrypt/re-encrypt the data anytime before delivery to the intended recipient. Similarly, under the proposed rules, the ability to access encrypted technology/technical data or software would not be considered a release or reexport of such items. If these rules are adopted, U.S. companies would be able to transfer and store their unclassified exportcontrolled data using cloud computing and systems without any export control obligations (subject to the encryption requirements). Currently, industry is reluctant to use such solutions for controlled data, despite their cost and efficiency benefits, because cloud system providers often rely on servers around the world and may employ foreign national employees in the United States. Under current rules, these patterns could constitute exports or deemed exports that require licenses or other authorizations. While this proposed change could provide a great benefit to many companies, it would also create a compliance risk (and potential complications for the current commercial model of many cloud computing services) because of the strict encryption requirements. For example, the rules would require that only the exporter maintain the encryption keys, while it may be more efficient for the cloud service provider to do so. Also, the definition of end-to-end encryption appears to require that the sender itself begin the encryption, which may only be decrypted by the recipient. However, BIS has stated that the term originating party may provide some flexibility and is considering the possibility of permitting encryption to begin at the sender s firewall or security perimeter. Cloud service providers may also have to refine their offerings to ensure that data is not decrypted at any time (even if only momentarily) and that no servers are located in restricted countries. While this rule is a welcome development, it remains to be seen whether BIS and the DDTC may revise the definitions in the final rules and how strictly the agencies will interpret these new requirements.

3 Export and Reexport Beyond the encrypted data rule, BIS and the DDTC also propose restructuring the definitions of export and reexport more generally, with the two definitions generally mirroring each other. One substantive change to these definitions is to add that an export includes the release or other transfer of the means of access to encrypted data. Since the transfer of properly encrypted data would not constitute an export, providing the decryption key, password or other means of accessing the data must result in the return of export control requirements for the technology/technical data or software. However, BIS (but not the DDTC) would only consider this transfer to result in an export if the release or transfer occurred with knowledge that it would cause or permit the transfer of technology/technical data in clear text to a foreign national. This is one of the few areas of difference between the two proposed rules. The new definitions of export contain some other notable aspects. First, while a deemed export under EAR applies only to release of software source code to a foreign national (presumably because BIS believes that release of the object code does not provide controlled information), the DDTC would apply the deemed export rule to both software source code and object code released to a foreign national. Second, for the first time the DDTC would explicitly consider the posting of technical data to the Internet to be an export. Third, the proposed rules would codify current agency practice regarding the interpretation of nationality under the EAR and the ITAR. The BIS rule states that a deemed export to a foreign national is considered an export to the foreign national s most recent country of citizenship or permanent residency. Yet, the DDTC rule states that a deemed export to a foreign national is considered an export to all countries in which the foreign national has held citizenship or permanent residency. In the related definition of release, one important change is that a visual inspection by foreign nationals would only be considered a controlled release if it actually reveals technology/technical data or software source code to that foreign national. This definition also codifies another existing BIS agency practice (similar to the ITAR concept of a defense service) that a release of technology or source code includes the application abroad of personal knowledge or technical experienced acquired in the United States, to the extent that such application actually reveals technology or software source code to a foreign national. Finally, the BIS rule would codify its current guidance on deemed reexports, which treats these transfers consistently with the license exemptions in ITAR Sections and Finally, the agencies propose revising the definition of transfer (in-country) under EAR and retransfer under the ITAR, as the third main control event along with exports and reexports. The revision would make clear that a retransfer is a change in end use or end user within the same foreign country. Technology and Technical Data The definitions of technology and technical data themselves would be revised and harmonized in several ways, although they will be maintained as separate terms because of slight differences. While many of the proposed revisions are not substantive, there are some changes and notes meant to aid exporters. First, due to the new rules on shipments of encrypted data, the definitions of technology and technical data would now also include decryption keys or other means that would allow access to encrypted technology/technical data in clear text. Second, the DDTC would remove software from the definition of technical data to match the structure of the EAR, although this change is meant to be nonsubstantive and the DDTC will not make conforming changes throughout the ITAR at this time. Third, BIS would codify its existing practice that use technology must meet all six activities in the definition

4 (operation, installation (including on-site installation), maintenance (checking), repair, overhaul and refurbishing). Fourth, the agencies would add a note to clarify that technology/technical data for the modification of an item into a new item would be considered technology/technical data for the development of the new item. This note is meant to assist in jurisdictional determinations since technology/technical should be controlled under the same legal regime as the items to which they relate. In determining which information is considered controlled technology/technical data, the proposed rules have clarified the term required. They also add new definitions for the currently undefined term peculiarly responsible, which largely mirrors the catch-and-release aspects of the specially designed definition. The DDTC would adopt the EAR definition of required, which relates to that portion of technology/technical data that is peculiarly responsible for achieving or exceeding the controlled performance levels, characteristics or functions. Both agencies would make clear that the terms characteristics and functions refer to the dictionary definition of an item if the control list does not provide technical parameters. For example, since the control lists do not provide technical specifications for certain bombers or military aircraft, any technology/technical data peculiar to making an aircraft a bomber or a military aircraft (as opposed to other aircraft) would be considered required for those items. Again, this note is intended to ensure that technology/technical are controlled under the same legal regime as the items to which they relate. Items Subject to the EAR and the ITAR The proposed rules would largely align the EAR provision for items subject to the EAR and the ITAR definition of defense articles. They would clarify when technology or software is published (under the EAR) or in the public domain (under the ITAR), two analogous concepts that will nonetheless be maintained as different terms. The DDTC has stated that the public domain definition would become broader, although this is not entirely clear. The proposed ITAR rule would codify existing practice that technical data or software is not in the public domain if it has been made public without authorization from an authorized U.S. government agency. However, the ITAR would only prohibit another party from exporting, reexporting or retransferring such technical data or software if that party had knowledge (i.e., actual knowledge or reason to know) that the technical data or software was made public without authorization. Therefore, a third person would not violate the ITAR by reusing publicly available technical data unless that person knew that the information was originally released without required approval. Conclusion These proposed rules may affect a wide range of exporters. While many of the changes are merely structural or semantic, there are several substantive changes that may determine when items and transactions are subject to U.S. export control rules. Most notably, the cloud computing rule would actually be an export control reform that benefits a great number of exporters, although it does involve compliance requirements for exporters and cloud service providers. Even the nonsubstantive changes may aid exporters in ensuring compliance by harmonizing the two separate export control regimes and making key definitions more consistent. BIS and the DDTC will accept comments on the proposed rules until Aug. 3, One interesting note is that the proposed rules would become effective 30 days after the final rules are published rather than the usual six-month grace period for export control reform rules because these rules do not actually change the CCL and USML control lists. Accordingly, once final rules are issued, exporters will

5 have a relatively short time to incorporate these changes into their compliance policies and procedures. By Mario Mancuso and Michael Gershberg, Fried Frank Harris Shriver & Jacobson LLP Mario Mancuso, a former U.S. undersecretary of commerce for industry and security, is a partner and Michael Gershberg is special counsel in Fried Frank s Washington, D.C., office. The opinions expressed are those of the author and do not necessarily reflect the views of the firm, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice. All Content , Portfolio Media, Inc.