Technology Transfers in the Cloud Environment: The Application of Canadian and US Export Controls and Economic Sanctions I.E. Canada Webinar John W. Boscariol

Technology Transfers in the Cloud Environment: The Application of Canadian

and US Export Controls and Economic Sanctions

I.E. Canada Webinar

John W. Boscariol

[email protected]

September 29, 2015

2

Growing Impact of Canadian Trade Controls ¬ what’s driving this?

¬ since 9/11, new emphasis of Canadian authorities on security (vs. government revenues)

¬ more recently, increased penalties, enforcement by U.S. authorities

¬ pressure from U.S. affiliates, suppliers and customers (and U.S. government)

¬ but Canada now a “sanctions hawk”

¬ penalty, operational, reputational exposure

¬ Canadian companies are now more concerned than ever before about whom they deal with, where their products and technology end up, and who uses their services

¬ financings, banking relationships, mergers and acquisitions

John W. Boscariol, International Trade and Investment Law Group, McCarthy Tétrault LLP / mccarthy.ca

3

What Are Canada’s Trade Controls? ¬ export and technology transfer controls

¬ Export Control List¬ Area Control List

¬ economic sanctions¬ Special Economic Measures Act¬ United Nations Act¬ Freezing Assets of Corrupt Foreign Officials Act¬ Criminal Code

¬ domestic industrial security¬ Defence Production Act, Controlled Goods Program

¬ other legislation of potential concern¬ blocking orders (Cuba)¬ anti-boycott policy and discriminatory business practices laws¬ anti-bribery law (Corruption of Foreign Public Officials Act and FCPA)

¬ compliance convergence


4

Today’s Focus

¬ application of export controls and economic sanctions to cloud computing structures


5

Structure of Cloud Computing

¬ common examples of cloud models

¬ infrastructure as a services (IaaS)

¬ platform as a service (PaaS)

¬ software as a service (SaaS)

¬ can be a public, private or hybrid service


6

Structure of Cloud Computing¬ three key export control elements for

assessing compliance for your cloud activities

¬ what is the nature of the data or technology being transferred or accessed?

¬ where is data being stored, transferred to or accessed from?

¬ what parties are involved in the storage, transfer or access?


7

Export Controls on Technology

¬ exporting or transferring technology included in the Export Control List (ECL) requires an export permit

¬ technology is defined as specific information necessary for the “development”, “production” or “use” of a product, and takes the form of “technical data” or “technical assistance” ¬ technical data – may take forms such as blueprints, plans,

diagrams, models, formulae, tables, engineering designs and specifications, manuals and instructions written or recorded on other media or devices, such as disc, tape, read-only memories

¬ technical assistance – may take forms such as instructions, skills, training, working knowledge, consulting services and may involve transfer of technical data


8

Export Controls on Technology

¬ transfer of technology is considered to occur when it is disposed of or its content is disclosed in any manner, from a place in Canada to a place outside Canada


9

Export Controls on Technology¬ ECD provides examples of transfers by intangible means in its

latest Export Controls Handbook (June 2015):

¬ provision of services or training

¬ downloads or other electronic file transfers

¬ file sharing

¬ cloud access

¬ e-mails

¬ faxes

¬ telephone conversations

¬ teleconference

¬ face-to-face meetings


10

Do You Need to Apply for an Export Permit?

¬ key questions

¬ is it on the Export Control List?

¬ goods, technology and software

¬ is the destination on the Area Control List?

¬ ECL - Guide to Canada’s Export Controls incorporates changes to the multilateral export control regimes up to December 2013


11

Where is the Technology Being Transferred to or Accessed From? ¬ the Area Control List (applies to export of any

goods or technology)

¬ Belarus

¬ North Korea

¬ individual permits may be issued for humanitarian purposes

¬ do not forget countries subject to Canada’s trade embargo legislation


12

Is the Technology on the Export Control List?¬ Group 1 dual-use goods, technology and software

¬ 9 categories ¬ Advanced Materials

¬ Materials Processing

¬ Electronics

¬ Computers

¬ Telecommunications

¬ Information Security (crypto)

¬ Sensors and Lasers

¬ Navigation and Avionics

¬ Marine

¬ Propulsion


13

Is the Technology on the Export Control List? (cont’d)

¬ Group 2 munitions goods

¬ Group 3 nuclear non-proliferation goods

¬ Group 4 nuclear-related dual use goods

¬ Group 5 miscellaneous goods (including U.S.-origin goods and technology)

¬ Group 6 missile technology control regime goods

¬ Group 7 chemical and biological weapon non- proliferation goods


14

Canadian Controls on U.S.-Origin Goods and Technology (cont’d)

¬ ECL item 5400: a permit is required for the export of all U.S.-origin goods and technology from Canada

¬ excludes “goods that have been further processed or manufactured outside of the United States so as to result in a substantial change in value, form or use of the goods or in the production of new goods”

¬ 50% rule of thumb used to be applied


15

Canadian Controls on U.S.-Origin Goods and Technology (cont’d)

¬ available GEP No. 12 permits export of U.S.-origin goods and technology to all destinations except Belarus, Cuba, North Korea, Iran and Syria

¬no written ECD policy for granting permits for export of U.S.-origin goods or technology to these countries


16

Canadian Controls Over Encryption ¬ Export Control List, Group 1, Category 5 – Part 2:

“Information Security”¬ goods, software, technology designed or modified to use

cryptography or performing any cryptographic function¬ exceptions

¬ authentication/digital signature (no encryption except as directly related to the protection of passwords, PINs, or similar data to prevent unauthorized access)

¬ not user-accessible and is specially designed for copy protection

¬ software and technology “in the public domain” ¬ “mass market” – generally available to the public from retail

selling points¬ ancillary encryption (effective December 2011)


17

General Export Permits¬ where a GEP is available, no individual export permit application is

necessary

¬ GEP Examples

¬ GEP No. 12: United States Origin Goods

¬ GEP No. 18: Portable Personal Computers and Associated Software

¬ GEP No .41: Dual-Use Goods and Technology to Certain Destinations (new – August 12, 2015)

¬ GEP No. 43: Nuclear Goods and Technology to Certain Destinations

¬ GEP No. 44: Nuclear-Related Dual-Use Goods and Technology to Certain Destinations

¬ GEP No. 45: Cryptography for the Development or Production of a Product

¬ GEP No. 46: Cryptography for Use by Certain Consignees

¬ reporting/record keeping requirements

¬ must cite applicable GEP number in export documentation John W. Boscariol, International Trade and Investment Law Group, McCarthy Tétrault LLP / mccarthy.ca

18

Canada’s Current Position on Export Controls and the Cloud¬ generally, transfers within a cloud structure that

involve cross-border transfers or access are covered

¬ ECD currently working on written guidance similar to June 3, 2015 proposed rules issued by US Department of Commerce and US Department of State’s Directorate of Defense Trade Controls¬ who has control over / access to the data?

¬ in meantime, if any uncertainty regarding control status, can apply for a permit to obtain comfort


19

Defence Production Act – Controlled Goods

¬ companies that deal with “controlled goods” under DPA must also carefully monitor transfer and access issues within Canada

¬ risk of unauthorized transfer

¬ address cloud structure in security plan

¬ obligation to report security breach


Canada’s Economic Sanctions Regime

¬ United Nations Act

¬ implementation of UN Security Council resolutions

¬ Special Economic Measures Act

¬ impose economic sanctions absent or in addition to a UN Security Council resolution

¬ Freezing Assets of Corrupt Foreign Officials Act

¬ politically exposed persons

¬ Egypt, Tunisia and Ukraine

¬ Criminal Code – terrorist groups

¬ Area Control List under Export and Import Permits Act

¬ Belarus and North Korea

20


Canada’s Economic Sanctions Regime ¬ Special Economic Measures Act and United

Nations Act

¬ key measures (depending upon the country program)

¬ ban on providing or sourcing goods

¬ ban on providing services, technology/data

¬ assets freezes – cannot deal with listed individuals, companies, organizations (“designated persons”) – includes facilitation

¬ ban on investment

¬ sectoral measures

¬ monitoring and reporting obligations

21


United Nations Act Regulations

¬ targeted countries and groups

22

Al-Qaida and Taliban

Côte d’Ivorie

Democratic Republic of the Congo

Iran

Sudan

Sierra Leone

Lebanon

Yemen

Iraq

Somalia

Eritrea

terrorists and terrorist organizations

Liberia

North Korea

Libya

Central African Republic


Special Economic Measures Act Regulations

23

¬ targeted countries

¬ Iran

¬ Syria

¬ Burma

¬ Zimbawe

¬ North Korea

¬ Ukraine

¬ Russia

¬ South Sudan


Examples of Prohibited Data/Tech Transfers Under Economic Sanctions

24

¬ technical assistance related to the provision, manufacture, maintenance or use of arms and related material (most UNA sanctions)

¬ technical and other services related to certain oil exploration or production goods (Russia)

¬ technical data for use in monitoring telecommunications (Syria)

¬ technical data related to certain oil and gas, mining, and shipping activities (Iran)

¬ any technical data transfer (North Korea)

¬ applies to transfer to the target country from anywhere (not just Canada)


Addressing Your Risk in the Cloud

¬ know who you are dealing with and, as it relates to your business, who they are dealing with (subcontractors)

¬ address “designated person” risk exposure

¬ applies regardless of where operations occurring and whether or not there is a transfer from Canada

¬ “designated person” reporting obligations

25



¬ contract clauses important but not enough – need to carefully diligence your supplier on where data will reside or operations performed

26



¬ compliance with US export controls and economic sanctions will not be sufficient

¬ different “blacklisted” individuals and entities

¬ Canadian export controls and sanctions measures can differ significantly

¬ crypto controls

¬ Russia and Iran sanctions

27


John W. BoscariolMcCarthy Tétrault LLPInternational Trade and Investment Lawwww.mccarthy.caDirect Line: 416-601-7835

E-mail: [email protected]: www.linkedin.com/in/johnboscarioltradelaw Twitter: www.twitter.com/tradelawyer

Documents

Technology Transfers in the Cloud Environment: The Application of Canadian and US Export Controls and Economic Sanctions I.E. Canada Webinar John W. Boscariol