Canada's export control regime, regulated by multiple domestic laws, international agreements and diplomatic obligations can be difficult to navigate. When combined with the rapidly changing landscape of software development, this complex field of regulation can easily lead to even further confusion. Yet consequences for failing to comply can be severe. Contravention of the Export and Import Permits Act1 can result in significant fines or even criminal charges, with sentences up to a maximum of ten years of imprisonment. At the same time, these laws may change at any time as technology advances, as international agreements are altered, or as Canada's relationship with other countries changes.
Working through Canada's export control laws is not an insignificant undertaking and requires a sophisticated knowledge of the technology in question and the business' distribution channels. The broad application of Canada's export control laws surprises many people. Export permits may be required to, not only ship goods outside of Canada, but to provide services associated with designated technologies, discuss designated technologies with certain employees, participate in phone or video conversations about designated technologies, correspond by email, fax or otherwise through cyberspace about designated technologies, and even before leaving Canada's borders on business trips. Factors such as the nature, characteristics, origin of componentry, uses to be made of the technology, destination and end users of the technology are all relevant to whether an export permit is required. This article will set out some of the threshold issues to be considered and more significant questions to be answered by a business dealing with technology to ensure compliance with Canada's export control regime.
The starting point of working through Canada's export control laws is section 3 of EIPA. Section 3 of EIPA provides that the Governor in Council may establish a list of goods and technology (called the Export Control List), including therein any article the export or transfer of which the Governor in Council deems it necessary to control.2 The reasons for the Governor in Council asserting such control are varied and include Canada's security, Canada's economic stability and to ensure Canada's reputation in international diplomatic relations.3
For purposes of this article, it is key to consider that EIPA defines "technology" to include technical data, technical assistance and information necessary for the development, production or use of an article included in an Export Control List; and defines "transfer in relation to technology" to mean, to dispose of it or disclose its content in any manner from a place in Canada to a place outside Canada.
The result is that EIPA applies to not only physical form but to intangible forms, such as know-how, show how, technical services and support of certain technologies, and the breadth of the definition of transfer means that for each type of restricted technology, a person may need an export permit for any disclosure of such technology "in any manner" such as via the Internet, email, phone conversation, video streaming, teleconferencing and faxing outside of Canada. Consider the implications for cross-border financings, reseller arrangements, licensing arrangements, permissions for sublicensing, joint ventures, co-development arrangements, employee or contractor recruiting and communication, outsourcing arrangements, structuring and networking global enterprises, service arrangements (including customer training), marketing efforts and simply business to business communication.
What is the Product for Export?
As can be surmised, the Export Control List (ECL), a regulation under the EIPA, is fundamental to Canada's export control regime. The ECL identifies specific technologies that are controlled for export from Canada to other countries, regardless of their means of delivery4 (including uploading, provision of relating and supporting services, via telephone, video streaming or even fax). Depending on its properties, componentry and uses, software may fit into a variety of different categories.
If the software is generally available to the public and is designed for installation by the end user without further substantial support, software will generally not be controlled by any category of the ECL. Software will also be exempt from controls if it is "in the public domain." However, despite these broad exemptions, there is a wide variety of criteria that may nonetheless necessitate an export permit, even where the software to be exported is publicly available. Some of these criteria relate to the destination or intended user of the product; these will be discussed below. There are a number of criteria; however, that relate specifically to the componentry or possible uses of the product.
Breaking Down the Elements Within Technology
The first group in the ECL includes "dual use" items. This list includes items that may be used equally for everyday tasks, and for uses that pose a security threat to Canada. An example of a dual use item is software that contains an element of cryptographic technology. Cryptographic technology is a program that executes an algorithm on data, rendering it unrecoverable to anyone who does not hold the key to the algorithm. The level of security is measured in terms of the type of algorithm (e.g. symmetric or asymmetric) and the "key length," measured in bits. As a means of securing data, cryptographic technology has a wide range of applications, protecting anything from online credit card transactions to highly sensitive government data. Given the wide range of uses to which it may be put, cryptographic technology is controlled under Canada's export regime. Within the category of "cryptographic technology," however, the ECL makes numerous distinctions which can impact whether or not a particular product is controlled. The current regime provides a broad exception for software available to the public whose cryptographic functionality cannot easily be changed by the user. Although this broad exception exists, the ECL provides very detailed, technical specifications of the forms of cryptographic technologies that are controlled. As a result, it is necessary to be aware of the precise properties of any element within a product for export. Cryptographic technology serves as a good example of both everyday technology that is controlled, and as an area in which changes to the export control regime may occur rapidly. To ensure compliance with the regime, it is important to keep abreast of such changes when they occur.
It is very important that the classification of items to be exported is assessed and completed by a person with extensive technical knowledge of the products, including all of the components contained therein. Regulations under the ECL provide technical specifications of the items that are prohibited; but these items might simply be one small component of a larger whole. Furthermore, prohibited items may be defined in terms of their functions or capabilities. An administrative clerk charged with filling out an export permit application will not necessarily know, for example, whether a particular piece of software or equipment can compute "discrete logarithms in a multiplicative group of a finite field of size greater than 512 bits (e.g., Diffie-Hellman over Z/pZ)."5 As software and other technologies become increasingly complex, any given product may contain a variety of controlled items, and may become more difficult to categorize.
Are There Components from Different Countries?
In an increasingly globalized world, a single product may contain components from a variety of different countries. In those situations, the product may be subject not only to Canada's export control regime, but also to the export control regimes of the countries in which the foreign components originated. For exporters, being required to comply with multiple export control regimes may seem an onerous and unnecessary task. Such measures are nevertheless important to preserve the effectiveness of controls. An export control regime would not be very effective if one could export to a prohibited country simply by first shipping the components of that product to a permitted zone. Canada imposes restrictions on this activity through its Transhipment Regulations under the EIPA. As a result, it is important to consider whether any components of a product originate in a country that imposes export controls.
All goods that originate in the United States are subject to control under Item 5400 of the Export Control List. U.S.- origin goods will not; however, be subject to such control if they have been further manufactured or processed within Canada so as to substantially change their value, form or use, or if they are used in the production of new goods.6 Exporters who are not sure whether their U.S.-origin goods have been "substantially changed" should err on the side of caution by applying for a permit. In general, U.S.-origin goods can be exported under General Export Permit No. 12, unless they are being exported to Cuba, Iran, Syria, North Korea, or any destination listed on Canada's Area Control List. While this means that U.S.-origin goods can effectively be exported with little administrative difficulty, it is extremely important to ensure that GEP 12 is quoted on any export documentation. Simply omitting this quotation will be considered noncompliance, with all of the resulting consequences.
What are the Product's Potential Uses?
Software and technology occupy a special role within the export control regime, based on the wide variety of uses to which they may be put. For example, it would not make sense to apply the same controls to a children's computer game as to an advanced global imaging program. Both of these items fall within the umbrella of "software," yet the government's interest in monitoring the whereabouts of each is wildly different. For this reason, each category within the dual use list specifically provides that any software or technology specially created for the development or use of items within that category is also controlled. It is self-evident that the controls imposed by the "Telecommunications" and "Information Security" categories would include related software; software clearly plays a crucial role in both of these areas. Less obvious examples are the "Sensors and Lasers" or "Propulsion" categories. Similarly, "libraries," defined as "parametric technical databases" designed to assist in the performance of any controlled function, are also controlled. As a result, software exporters must be careful to consider the various uses to which their product may be put, and then determine whether any of those uses may be included within any category of controlled item within Canada's export control regime.
Destination of the Product
Canadian exporters may not export to countries listed on the Area Control List under the EIPA. Currently, the list includes only two countries: Myanmar (Burma) and Belarus. In addition to the Area Control List, there are a variety of other pieces of legislation that prohibit or restrict export to particular destinations. The United Nations Act and the Special Economic Measures Act impose trade sanctions that affect export to particular countries. These sanctions differ depending on the country, and are subject to change at any time. For example, the controls on exports to Iran include a number of dual use items, and have been amended as recently as April 2008.
As noted above, the Transhipment Regulations impose specific requirements on any product that is to be exported to a prohibited country by means of transport through a permitted country. Therefore, it is very important to determine where a product exported from Canada is ultimately going, not just the first stop on the distribution channel.
End User of the Product
In addition to being aware of the end use of a product, it is equally important to be aware of the end user of a product. Just as cryptographic technology can be used in a wide variety of software, it may be possible for users to turn seemingly benign software and technology to illicit purposes. As a result, Canada includes terrorists, Al Qaeda and the Taliban among those to whom export is prohibited, by virtue of regulations under the UN Act.
Catch-all Controls
In 2002, Canada added Item 5505 to the ECL. Item 5505 is a catch-all list that attempts to address items not listed elsewhere in the ECL, but nevertheless should be controlled or restricted in their distribution. Item 5505 mandates a permit on any item that is destined for end-use or an end-user involved (directly or indirectly) in the development or production of chemical, biological, or nuclear weapons or weapons of mass destruction, or their missile delivery systems.7
Could There be an Export by Intangible Means?
The export control regime does not merely control physical products. Under the General Technology Note contained within the Guide to Canada's Export Controls, controlled technology includes anything required for the development, production or use of a controlled item. This means that tangible and intangible items such as technological assistance, user manuals, or software used in the development of a controlled item will be controlled. These controls may apply even if the technology is applied to a non-controlled item, but will generally not apply to technology available in the public domain. As a result, when applying for a permit for a software product that will include online or telephone technical support, it is important to be aware that such support must be included within the application.
It is not necessary to physically send a product across the border for it to constitute an export; making a piece of software available for download amounts to an export as well. In fact, export by "intangible means" can occur in a variety of ways, including the provision of online training or services, downloads or other electronic file transfers, emails, faxes, telephone conversations, video streaming or conferences, or even face to face meetings.8 For example, if a Canadian resident attends a meeting in a foreign country, at which he or she imparts controlled technical information to a foreign individual about a controlled product, this will be considered an export. To constitute an export, the discussions have to be sufficiently detailed for the information imparted to meet the definition of controlled technology.
When a transfer by intangible means is going to occur, it is necessary for the exporter to apply for an export permit, or to include the product to be transferred as a separate line item in an existing, related application. This application must include information about the type of product it is, the uses to which it will be put, the form in which it will be exported, and the means by which the export will occur. Based on these controls, it can be very important for software developers, licensors and sublicensors to closely monitor their online activities. Any time information crosses a border, whether that border is in cyberspace, over the phone, or even when an individual who has crossed a border has a conversation, an export permit may be required.
Conflict Between Canadian and U.S. Export Controls
Multiple compliance can become problematic when controls conflict. For example, the United States requires a license for any export to Cuba, and maintains a general policy of denying all requests for such a license.9 Canada, in contrast, prohibits any company or person from agreeing to not ship to Cuba.10 These conflicting laws can pose a problem for any Canadian subsidiary of a U.S. company, or for any Canadian exporter whose products include American components.11 In general, the U.S. will not impose its controls on products that contain less than 20 per cent American componentry; yet this general guideline is subject to change based on any number of factors. Given current American attitudes towards Cuba, these rules may soon change. For example, although the embargo on trade with Cuba remains in place, policies were recently amended to permit the granting of licenses to telecommunications companies where the export will provide telecommunications services between the U.S. and Cuba.12 Furthermore, licenses may be granted to software companies exporting to non-governmental organizations and news agencies for the purposes of strengthening civil society and disseminating news to the general public.13 These exemptions have lessened the impact of the contradictory Canadian and U.S. policies towards Cuba for certain types of exports. Nevertheless, the remaining potential for conflict represents an important example of why it is necessary for software exporters to fully examine the control regimes of any country in which their product components originate.
The United States takes the position that its laws relating to export control apply regardless of whether the product is still in the United States. U.S. law applies to transactions involving technology incorporating U.S. content, as well as to U.S. persons. The latter includes U.S. citizens, permanent residents of the U.S. as well as U.S. foreign branches of U.S. companies. The United States also applies its policies in relation to Cuba to foreign subsidiaries of U.S. companies. Controls may even be applicable to inter-company transfers to a foreign office or affiliate. Furthermore, the United States has a "deemed export" concept which restricts the release of software or other technology to a foreign national within the United States.14 As a result, United States laws may apply much more widely than is apparent at first instance.
Although Canada does not have a "deemed export" rule similar to the one in force in the U.S., foreign nationals within Canada face restrictions on access to particular controlled goods. If a foreign national wishes to examine, possess or transfer goods controlled under Groups 2 or 6, or under Item 5504 of the ECL, he or she requires a permit from the Canadian Government. The products controlled in this manner include munitions, missile technology and strategic goods. Although these categories are all related to military uses, the category "strategic goods" includes software controlled under Group 1 when it is used for particular purposes. For example, software associated with global navigation satellite systems is considered a strategic good.15 As a result, it is extremely important for a software developer, licensor or sublicensor to properly assess all possible classifications of its software.
Compliance with International Agreements
Canada's export control regime has a number of purposes. Among others, these controls are aimed at ensuring that Canadian exports are not used to undermine national or international security; are not used to commit human rights violations; do not contribute to the development of weapons of mass destruction; and comply with multilateral economic sanctions, such as those approved by the United Nations Security Council. In the case of items such as agricultural products, controls may also be applied because those goods are subject to foreign import quotas. Many controls are governed by international agreements in which Canada is a participant. Most applicable to the export of software is the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-use Goods and Technology. Based on this international agreement, controls for the items contained therein may be similar in participating countries. For example, the Wassenaar Arrangement's "Cryptography Note" is contained in both the Canadian ECL, and the U.S. Export Administration Regulations. Despite these similarities, however, compliance with each provision may be achieved in a different way. For example, the American regulation requires that encryption commodities that are eligible for the Cryptography Note still be reviewed if they meet certain technical specifications.16 Potential differences in such technical specifications require that exporters pay close attention to the applicable export regimes. Membership in the same international agreement does not ensure that countries will impose the same export requirements.
Compliance and Disclosure of Non-Compliance
Voluntary compliance is central to the export control regime. As a result, it is recommended that exporters report any unintentional non-compliance as soon as it is discovered. Section 14.1 of the EIPA provides that an exporter will not be deemed to have violated the permit requirement if he or she did not apply for one, and if it would have been issued had he or she applied. As a result, it is possible to avoid penalty under the act by reporting non-compliance. If noncompliance is discovered by border officials, however, penalties can be severe. In 2007, the Canada Border Services Agency (CBSA) referred 236 detentions of export shipments to the Department of Foreign Affairs and International Trade (DFAIT), which is responsible for administering export controls. A further 49 post-export queries were completed to determine applicability of export controls. CBSA also has the power to investigate suspected violations, and undertook four such investigations in 2007.17 It can be extremely problematic, from a business perspective, to have an export shipment detained due to suspected violations.
A history of compliance can also result in favourable treatment. DFAIT may issue export permits based on broader terms and conditions, with the result that fewer permits are required, and those that are required are issued more quickly. As a result, compliance with the regime may result in fewer administrative difficulties and costs for the future.
References:
Export and Import Permits Act, R.S. 1985, c. E-19:
Area Control List, SOR/81-543
Export Control List, SOR/89-202
General Export Permit No. 12 – United States Origin Goods, SOR/97-107
General Export Permit No. 39 – Cryptographic Goods [Repealed], SOR/99-238
Transhipment Regulations, C.R.C., c. 606
United Nations Act, R.S. 1985, c. U-2
Foreign Extraterritorial Measures Act, R.S. 1984, c. F-29
Foreign Extraterritorial Measures (United States) Order, 1992, SOR/92-584
Special Economic Measures Act, R.S. 1992, c. 17
Foreign Affairs and International Trade Canada, "A Guide to Canada's Export Controls," April 30, 2009. http://www.international.gc.ca/controls-controles/about-a_propos/expor/guide.aspx?menu_id=72&menu=R
Foreign Affairs and International Trade Canada, "Report of the Minister of Foreign Affairs Respecting operations under the EXPORT AND IMPORT PERMITS ACT for the year 2007." http://www.international.gc.ca/controls-controles/reportrapports/ report-rapport-2007.aspx#issuanceExport
Foreign Affairs and International Trade Canada, "Export Controls Handbook", February 2009. http://www.international. gc.ca/controls-controles/assets/pdfs/documents/ExportControlHandbook-eng.pdf
U.S. Export Administration Regulations, http://www.access.gpo.gov/bis/index.html
* Paige Backman is partner at Aird & Berlis LLP in the Corporate/Commercial Group and is a member of the firm's Technology Team.
Deep gratitude is extended to Miranda Spence, a Summer Student at Aird & Berlis LLP, who was very helpful in certain research, putting together earlier drafts and following up on various issues.
Footnotes
1 R.S., c. E-17, s. 1 [hereinafter EIPA].
2 Ibid, subsection 3(1).
3 Ibid, paragraph 3(1) provides a list of purposes for which an export permit may be required
(a) to ensure that arms, ammunition, implements or
munitions of war, naval, army or air stores or any articles deemed
capable of being converted thereinto, or made useful in the
production thereof or otherwise having a strategic nature or value
will not be made available to any destination where their use might
be detrimental to the security of Canada;
(b) to ensure that any action taken to promote the further
processing in Canada of a natural resource that is produced in
Canada is not rendered ineffective by reason of the unrestricted
exportation of that natural resource;
(c) to limit or keep under surveillance the export of any raw or
processed material that is produced in Canada in circumstances of
surplus supply and depressed prices and that is not a produce of
agriculture; (c.1) [Repealed, 1999, c. 31, s. 88]
(d) to implement an intergovernmental arrangement or
commitment;
(e) to ensure that there is an adequate supply and distribution of
the article in Canada for defence or other needs; or
(f) to ensure the orderly export marketing of any goods that are
subject to a limitation imposed by any country or customs territory
on the quantity of the goods that, on importation into that country
or customs territory in any given period, is eligible for the
benefit provided for goods imported within that limitation.
4 Export Controls Handbook, p. 4.
5 A Guide to Canada's Export Controls, 1-5.A.2 (a)(2).
6 Export Controls Handbook, p. 17.
7 Export Controls Handbook, p. 10.
8 Export Controls Handbook, p. 32.
9 Export Administration Regulation 746.2.
10 Foreign Extraterritorial Measures (United States) Order, 1992.
11 It is important to note that directors and officers of any corporation operating in Canada must give notice to the Attorney General of Canada of any directive, instruction, intimation of policy or other communication by an entity of the United States relating to extraterritorial reach of laws of the United States relating to trade with Cuba. In addition, directors and officers may face penalties for complying with any instruction by, or policy of, a United States entity, contrary to Canada's policies relating to the trading between Canada and Cuba.
12 Export Administration Regulation 746.2(b)(2).
13 Export Administration Regulation 746.2(b)(4).
14 U.S. Export Administration Regulations, §734.2(b)(2)(ii).
15 A Guide to Canada's Export Controls, 5504.2 (a)(i).
16 In particular, if they employ a key length greater than 64 bits for the symmetric algorithm.
17 Report of the Minister of Foreign Affairs, 2007. http://www.international.gc.ca/controls-controles/report-rapports/report-rapport-2007.aspx#issuanceExport .
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
