The post Navigating the Export Implications of Cloud Computing appeared first on Export Compliance Training Institute.
]]>Export controls require a license or license exception for certain types of technical data and software, including such computing technologies as encryption [see related post: License Exception ENC and the Complications Around Encryption].
The growth of cloud computing, and the related concept of Software as a Service (SaaS), have raised new questions about how these rules apply, while simultaneously making the regulations relevant to companies that may not even realize they have an export concern.
The reasons for confusion revolve around two issues:
According to TechCrunch, two-thirds of worldwide cloud computing activity in 2022 was supported by the cloud infrastructure of just three entities: Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) – all of which maintain interconnected data centers around the globe. AWS has data centers in more than 20 countries, including six in China alone, according to Dgitl Infra, which serves the global digital infrastructure industry.
So even if your business operates only in the United States, there is some risk that your export-controlled software or technology is accessible in a foreign location where it doesn’t belong without proper export control authorization. And if you have partners in other countries that handle sales, distribution, manufacturing or aftermarket services, securing access to export-controlled data or technology can be difficult.
Should you be worried? And what steps can you take to prevent the unintentional export of controlled software, technology or data?
So far, neither the Bureau of Industry and Security (BIS) nor the Directorate of Defense Trade Controls (DDTC), which administer the EAR and ITAR respectively, has addressed the issue to a great extent through regulations.
But BIS has published a handful of advisory opinions on the matter, a summary of which is available in the related post: What Happens in the Cloud Stays in the Cloud. The answer depends on your role in the cloud.
For the major U.S.-based providers of cloud infrastructure – giants like AWS and GCP – providing “computational capacity” in itself is not subject to the EAR, according to BIS guidance.
This opinion views the cloud service providers like telephone and mobile communications carriers: A carrier like Verizon or AT&T can’t be held responsible for what you say in a phone conversation that’s carried on its network.
There are boundaries to the BIS opinion. If a cloud provider allows access by “foreign persons” to its operating technology – such as technical data and support information that isn’t publicly available – that may in fact become an export subject to the EAR.
Also, cloud services are subject to the same restrictions as any other U.S. entity in providing items to individuals, entities and countries that are under sanction, like Iran and North Korea.
For Software-as-a-Service companies that use the cloud to distribute software functionality that businesses use every day, the questions go beyond storage and retrieval of data.
Examples of these companies include Slack (team collaboration), Salesforce.com (customer relationship management) and Autodesk (CAD/CAM), to name just a few of the thousands that exist. The chances are that you’ll use several SaaS offerings before today is over.
Prior to cloud computing and SaaS, such software would have been made available on CDs or through downloads, which in many instances is a controlled export. But these tended to be housed on individual computers, or available through corporate Local Area Networks, which are relatively easy to secure.
But when CAD/CAM software, as an example, is made available through the cloud, users will create simulations of their own products and manufacturing systems using computer servers that might be located anywhere in the world. Some of these may be for sensitive items, like nuclear power components or navigational systems for the U.S. military.
In such a case, the issue isn’t simply whether they’re exporting software, but that they’re storing details about highly controlled technology.
Since 2016, both the relevant sections of the ITAR (Section 120.54) and the EAR (Section 734.18) have been updated to say that technical data and software are not considered to be exported if the following conditions are met:
Ultimately, it means that SaaS providers must secure their own technology from being exported, but like the cloud service providers, they aren’t likely to be held responsible for the content users place in their network.
Meanwhile, the users of cloud services must take action, including the use of end-to-end encryption, to ensure that their actions are not considered to be exports (potentially requiring a license) under the ITAR or EAR. If the activity is not an export, it logically follows that no license would be required; this is the main advantage of these exclusions from regulation.
With the responsibility of cloud services and SaaS providers limited, the ultimate responsibility for security of information that flows through these systems falls to the end-user. The same regulations that apply to cloud and SaaS entities apply to other businesses as well: Section 120.54 of the ITAR and Section 734.18 of the EAR.
The primary concerns for the end-user are to:
Based on industry concerns around these issues, a number of cloud providers now offer what they call government-compliant cloud services. These premium offerings may include things like encryption capabilities that meet the above-referenced federal standard; exclusive storage on servers based in the United States; and operating teams comprised only of U.S. citizens.
For example, the AWS product, called GovCloud US, claims its solutions “comply with FedRAMP High baseline; the DOJ’s Criminal Justice Information Systems (CJIS) Security Policy; U.S. International Traffic in Arms Regulations (ITAR); Export Administration Regulations (EAR); Department of Defense (DoD) Cloud Computing Security Requirements Guide (SRG) for Impact Levels 2, 4 and 5; FIPS 140-2; IRS-1075; and other compliance regimes.”
While these services may offer value, they are also widely misunderstood.
The export regulations define the obligations of exporters, but they don’t prescribe how to meet them.
These premium services aren’t authorized or approved by the U.S. government. So these government-compliant clouds may provide an extra level of security, but they can’t provide indemnity, and they aren’t required in order to be compliant with export regulations.
Do you have questions about the export implications of cloud computing? Visit gfqs.chinafotoe.com to learn about our company, our faculty, our staff and our esteemed Export Compliance Professional (ECoP®) certification program. To find upcoming e-seminars, live seminars and live webinars and browse our catalog of 80-plus on-demand webinars, visit our ECTI Academy. You can also call the Export Compliance Training Institute at 540-433-3977 for more information.
Scott Gearity is President of ECTI, Inc.
The post Navigating the Export Implications of Cloud Computing appeared first on Export Compliance Training Institute.
]]>