Christopher J. Cochlin

1. Export-Controlled Technology: The Cost of Non-ComplianceIT.Can Quarterly Roundtable SeriesSeptember 24, 2008 Christopher J. Cochlin

2. Canadian Export Controls • Overview of Canadian Regime • Getting Started: Checklist for Export Controls • Internal Controls for Compliance • Common Misconceptions

3. Canadian Export Controls • Overview of Canadian Regime

4. Overview of Canadian Regime: Who Is Behind It? • DFAIT: Export Controls Division (Issuance of Export Permits; Administration of Export and Import Permits Act) • DFAIT: Legal Affairs Bureau, Economic Law Section (Int’l Negotiations; Economic Sanctions) • Canada Border Services Agency: Administration and Enforcement of Customs Act; Export Declarations • Others: CSIS, DND, RCMP, Communications Security Establishment (CSE), Justice Canada, Industry Canada, International Like-Minded Community (e.g. other Wassenaar Arrangement countries)

5. Overview of Canadian Regime: “Controlled” • Export “controlled” does not mean export “prohibited”: • If a good is classified as “controlled”, an export permit is required • Permit issued at the discretion of Minister of Foreign Affairs: • Briefing and recommendations by DFAIT, on consultation with OGDs

6. Overview of Canadian Regime: What is covered? • Permit required by destination: • Area Control List (Myanmar, Belarus) • United Nations Act (Regulations covering: Côte d’Ivoire, North Korea, Democratic Republic of the Congo, Iran, Iraq, Lebanon, Liberia, Rwanda, Sierra Leone, Sudan, Terrorists and Terrorist Organizations) • Special Economic Measures Act (Myanmar, Zimbabwe)

7. Overview of Canadian Regime: What is covered? • Permit Required for Listed “Goods” and “Technology”: • All items listed on the Export Control List • All items listed in Canadian economic sanctions regulations (usually by reference to UNSC resolutions)

8. Overview of Canadian Regime: What is covered? • Identifying coverage based on product is a technical classification exercise: →Group 1 – Dual-Use List (commercial goods) Group 2 – Munitions List Group 3 – Nuclear Non-Proliferation List Group 4 – Nuclear-Related Dual Use List Group 5 – Miscellaneous Control Regime List (e.g. “stategic/5504 goods”) Group 6 – Missile Technology Control Regime List Group 7 – Chemical and Biological Weapons Non-Proliferation List

9. Overview of Canadian Regime: What is covered? • Group 1 “Dual-Use” (key categories for IT products): • Category 1 – Advanced Materials • Category 2 – Material Processing • → Category 3 – Electronics • → Category 4 – Computers • → Category 5 – Part 1 (Telecoms) & Part 2 (Information Security) • Category 6 – Sensors and Lasers • Category 7 – Navigation and Avionics • Category 8 – Marine • Category 9 – Propulsion

10. Overview of Canadian Regime: What is covered? • “Goods”: • Technical interpretation required for classification of tangible goods/equipment: • Exhaust all possible classifications • Identify all applicable definitions • Assess all available exceptions (including in general technical notes, category-specific notes, or definitions)

11. Overview of Canadian Regime: What is covered? • “Technology”: • Same classification exercise as for “goods” • “Technology” defined as information necessary for development, production or use of a product: • Covers “Technical Data” (e.g. tangible or intangible blueprints, plans, specifications, instructions, etc.) • Covers “Technical Assistance” (e.g. instruction, skills, training, consulting services) • Found in “Part E” of every Category of Group 1 • Control of technology linked to control of underlying good

12. Overview of Canadian Regime: What is covered? • “Software”: • Same classification exercise as “goods” and “technology” • “Software” defined as a collection of one or more programs or microprograms fixed in any tangible medium of expression • Found in “Part D” of every Category of Group 1 • Control of “software” linked to control of underlying good or technology

13. Overview of Canadian Regime: What is covered? • “Information Security” (Category 5 – Part 2): • Covers stand-alone cryptographic products or other product solutions that include cryptographic elements (including third party elements) • Covers relatively low encryption strengths – assess products against ECL Item 1-5.A.2(1)(a) & (b) • Exceptions are limited: (1) “Note 2” - products accompanying user for the user’s personal use; (2) “Note 3” - generally available to the public + installed with little support + crypto not easily changed; (3) authentication or digital signature functions; (4) smart cards limited for radio, television, banking, etc.

14. Overview of Canadian Regime: What is covered? US-origin “goods” or “technology”: • Canada tracks and controls re-export of US goods • Prevents Canada from being a diversion point for US-embargoed countries • Re-export of US-origin product is controlled either because: • Product is specifically identified on Canada’s ECL; or • Product falls into the catch-all ECL Item 5400

15. Overview of Canadian Regime: What is covered? • Exception regarding destinations: • No export permit required for shipments to the United States or its territories, dependencies or possessions if: • US location is final destination; and • Sale is for end use of the product in the US • Exceptions to the US exception: permit required for shipment to US of specific munitions, strategic/military, and agricultural/forestry goods

16. Overview of Canadian Regime: Permits • Number of permit options: • Individual Export Permit (IEP): general/default rule applicable for specific transactions • General Export Permit (GEP) 12: for re-exports of US-origin goods to non-embargoed countries (IEP for embargoed countries) • Multi-destination, multi-shipment permits: for companies with strong compliance/internal controls (requires after-the-fact reporting of shipment details; valid over a specified period of time and subject to conditions)

17. Overview of Canadian Regime: Conclusion • Take-away items: • Canadian regime is a product of the broader government security community (and implements international agreements) • Control is based on: • Shipment destination • Product characteristics (tangibles and intangibles) • Product/input origin (US content) • Controlled products = export permit application required • “Software” and “Technology” controlled to same extent as underlying good • “Encryption” = automatic assessment required • Exports to US (final destination + end use) = no permit required* • Multi-destination, multi-shipment permit is best bet: requires demonstrated compliance

18. Canadian Export Controls • Getting Started: Checklist for Canadian Export Controls

19. Checklist • Identify and compile all existing products (incl. inputs) • Identify in-house technical expertise: • For use in classification exercise for each product and each input element (where applicable) • Consider product from “good”, “software”, and/or “technology” perspectives for analysis purposes • Identify and assess any foreign export control documentation provided by suppliers of inputs (e.g. US export control classification)

20. Checklist • Identify and assess any US content (e.g. cost of acquisition as a percentage of value of final good) • Compile (and keep) transaction records for possible controlled products: • POs, invoices, customs accounting documentation (tangible transfers), email communications or FTP downloads (intangible transfers)

21. Checklist • If non-compliance is discovered for existing products: • Establish the facts, prepare the documentation (incl. all relevant transactions records), and DISCLOSE • To avoid “knowing” violations of EIPA, discontinue all shipments of the product until: (1) disclosure is made; (2) a permit application is processed; (3) and a permit is received • Retain outside counsel, if required

22. Checklist • Going forward: • Be ahead of the curve on new product deployments to avoid delays relating to permit applications (e.g. consult with DFAIT during development phase) • Establish a compliance-oriented track record with the Canadian governmental security community • Do so through appropriate internal controls

23. Canadian Export Controls • Internal Controls for Compliance

24. Compliance • Canada’s approach is compliance-oriented but statutory penalties are severe: • Section19 EIPA: Every person who contravenes any provision of this Act or the regulation is guilty of: • an offence punishable on summary conviction and liable to a fine not exceeding twenty-five thousand dollars or to imprisonment for a term not to exceed twelve months, or to both, or • an indictable offence and liable to a fine in an amount that is in the discretion of the court or to imprisonment for a term not exceeding ten years or to both. • Penalties also under United Nations Act or Special Economic Measures Act • Canada Border Services Agency, RCMP, CSIS, etc., will be involved in investigating possible violations of EIPA

25. Internal Controls • Controls are key to compliance with Canada’s Export Control Regime • Recall that intangibles are covered: electronic transfers outside of Canada (e.g. FTP downloads); travel by technical support staff and any “technology” that they bring • Treat export control issues like any other accounting issue (do not re-invent the wheel)

26. Internal Controls • Consider, for example: • Establishing internal oversight and reporting relationships for export controls • Ensuring redundancy within operational units and proper record keeping • Appropriate tasking for appropriate personnel: sales staff (know your customer, know your destination); financial staff (oversight of sales staff); contracting/regulatory staff • Ensuring timely applications for export permits (DFAIT) and timely filing of export declarations (CBSA) • Anticipating permit expiry (multi-destination, multi-shipment) and ensure prompt and seamless renewal • Maintaining internal reporting of sales of controlled products or external reporting to DFAIT (depending on nature of permit): monthly; quarterly; annually • Provide for internal training and awareness to key staff regarding export control compliance requirements

27. Canadian Export Controls • Common Misconceptions

28. Common Misconceptions • Electronic transmission is not “exporting” for purposes of EIPA • ECL Guide: “regardless of their destination or means of transmission (e.g. facsimile, electronic transfers, consulting services, etc.)” • If my supplier has an export permit, I will be “covered” by my supplier’s export permit • Exporter of the good is responsible for obtaining permit • Only Canadian residents may apply for permits

29. Common Misconceptions • If my company receives an export permit, no further export controls compliance activity is required • Must adhere to conditions in export permit • Must be on top of new products, new customers, and new export destinations • Other issues to consider regarding extraterritorial application of other export controls/sanctions laws (e.g. US) and Canadian “blocking” legislation (i.e. FEMA)