Export Control Laws - A Labyrinth Of Surprising Reach

Article by

Paige Backman*

Canada's export control regime, regulated by multiple

domestic laws, international agreements and diplomatic obligations

can be difficult to navigate. When combined with the rapidly

changing landscape of software development, this complex field of

regulation can easily lead to even further confusion. Yet

consequences for failing to comply can be severe. Contravention of

the Export and Import Permits Act1 can result

in significant fines or even criminal charges, with sentences up to

a maximum of ten years of imprisonment. At the same time, these

laws may change at any time as technology advances, as

international agreements are altered, or as Canada's

relationship with other countries changes.

Working through Canada's export control laws is not an

insignificant undertaking and requires a sophisticated knowledge of

the technology in question and the business' distribution

channels. The broad application of Canada's export control laws

surprises many people. Export permits may be required to, not only

ship goods outside of Canada, but to provide services associated

with designated technologies, discuss designated technologies with

certain employees, participate in phone or video conversations

about designated technologies, correspond by email, fax or

otherwise through cyberspace about designated technologies, and

even before leaving Canada's borders on business trips. Factors

such as the nature, characteristics, origin of componentry, uses to

be made of the technology, destination and end users of the

technology are all relevant to whether an export permit is

required. This article will set out some of the threshold issues to

be considered and more significant questions to be answered by a

business dealing with technology to ensure compliance with

Canada's export control regime.

The starting point of working through Canada's export

control laws is section 3 of EIPA. Section 3 of EIPA provides that

the Governor in Council may establish a list of goods and

technology (called the Export Control List), including therein

any article the export or transfer of which the Governor in Council

deems it necessary to control.2 The reasons for the

Governor in Council asserting such control are varied and include

Canada's security, Canada's economic stability and to

ensure Canada's reputation in international diplomatic

relations.3

For purposes of this article, it is key to consider that EIPA

defines "technology" to include technical data,

technical assistance and information necessary for the

development, production or use of an article included in an Export

Control List; and defines "transfer in relation to

technology" to mean, to dispose of it or disclose its

content in any manner from a place in Canada to a place

outside Canada.

The result is that EIPA applies to not only physical form but to

intangible forms, such as know-how, show how, technical services

and support of certain technologies, and the breadth of the

definition of transfer means that for each type of restricted

technology, a person may need an export permit for any disclosure

of such technology "in any manner" such as via the

Internet, email, phone conversation, video streaming,

teleconferencing and faxing outside of Canada. Consider the

implications for cross-border financings, reseller arrangements,

licensing arrangements, permissions for sublicensing, joint

ventures, co-development arrangements, employee or contractor

recruiting and communication, outsourcing arrangements, structuring

and networking global enterprises, service arrangements (including

customer training), marketing efforts and simply business to

business communication.

What is the Product for Export?

As can be surmised, the Export Control List (ECL), a regulation

under the EIPA, is fundamental to Canada's export control

regime. The ECL identifies specific technologies that are

controlled for export from Canada to other countries, regardless of

their means of delivery4 (including uploading, provision

of relating and supporting services, via telephone, video streaming

or even fax). Depending on its properties, componentry and uses,

software may fit into a variety of different categories.

If the software is generally available to the public and is

designed for installation by the end user without further

substantial support, software will generally not be controlled by

any category of the ECL. Software will also be exempt from controls

if it is "in the public domain." However, despite these

broad exemptions, there is a wide variety of criteria that may

nonetheless necessitate an export permit, even where the software

to be exported is publicly available. Some of these criteria relate

to the destination or intended user of the product; these will be

discussed below. There are a number of criteria; however, that

relate specifically to the componentry or possible uses of the

product.

Breaking Down the Elements Within Technology

The first group in the ECL includes "dual use" items.

This list includes items that may be used equally for everyday

tasks, and for uses that pose a security threat to Canada. An

example of a dual use item is software that contains an element of

cryptographic technology. Cryptographic technology is a program

that executes an algorithm on data, rendering it unrecoverable to

anyone who does not hold the key to the algorithm. The level of

security is measured in terms of the type of algorithm (e.g.

symmetric or asymmetric) and the "key length," measured

in bits. As a means of securing data, cryptographic technology has

a wide range of applications, protecting anything from online

credit card transactions to highly sensitive government data. Given

the wide range of uses to which it may be put, cryptographic

technology is controlled under Canada's export regime. Within

the category of "cryptographic technology," however, the

ECL makes numerous distinctions which can impact whether or not a

particular product is controlled. The current regime provides a

broad exception for software available to the public whose

cryptographic functionality cannot easily be changed by the user.

Although this broad exception exists, the ECL provides very

detailed, technical specifications of the forms of cryptographic

technologies that are controlled. As a result, it is necessary to

be aware of the precise properties of any element within a product

for export. Cryptographic technology serves as a good example of

both everyday technology that is controlled, and as an area in

which changes to the export control regime may occur rapidly. To

ensure compliance with the regime, it is important to keep abreast

of such changes when they occur.

It is very important that the classification of items to be

exported is assessed and completed by a person with extensive

technical knowledge of the products, including all of the

components contained therein. Regulations under the ECL provide

technical specifications of the items that are prohibited; but

these items might simply be one small component of a larger whole.

Furthermore, prohibited items may be defined in terms of their

functions or capabilities. An administrative clerk charged with

filling out an export permit application will not necessarily know,

for example, whether a particular piece of software or equipment

...