The sample questionnaire proposed by DDTC represents the agency’s suggestion as to one way that such screening should take place. Some of the questions are poorly drafted, and many of the others are just plain silly and can be roughly paraphrased as simply asking the person involved whether or not he or she is a foreign spy — as if they would answer that question truthfully if they were.

In the poor drafting category, we have this question:

Do you have business contacts, business partners, business contracts, brokers, or any other relationship with a business in another country or other countries subject to U.S. or U.N. embargo?

Because the question as to whether there are contacts with “another country” would necessarily include countries subject to embargo, the final clause is unnecessary and potentially confusing.

Also in the poorly drafted category, we have this incredibly broad inquiry:

Have you ever served in or provided information to the government of another country (e.g., military, foreign ministry, intelligence agency or law enforcement)?

Anybody who has ever traveled to a foreign country would have to answer this affirmatively because of the requirement to provide information to customs and immigration officials upon entry in to the country. And, of course, a third country national will have provided tons of information to his home country government in terms of tax returns, driver’s license applications, and the like. And what about state-owned enterprises? Does information provided to them constitute information provided to the government?

Then we have the “are you a spy” questions:

Do you have contacts with any other individuals or groups involved in acquiring controlled defense articles, including technical data, illegally or otherwise circumventing export control laws? Please explain the nature of that contact.

Do you have contacts with agents from another country or another country’s government?

Do you have contacts with agents from another country or another country’s government?

It is a little known historical fact that Mata Hari, when asked questions of these sorts, broke down into tears, confessed to the French government that she was a spy and asked to be immediately taken to the firing squad for execution.

The questionnaire also has the dual or third country national attest that he or she has given the company complete and accurate “social networking addresses.” Apparently whoever wrote this had heard that all the kids these days do these Twitter and Facebook thingies but didn’t really understand how any of them worked. There really isn’t any such thing as a “social network address,” unless the DDTC expects that something like www.facebook.com be provided as a response to this question. Presumably the idea here would be that the employee has allowed the company to follow or “friend” the employee on Facebook, Twitter, Google Plus or the like. This would mean, I guess, that the foreign licensee will then inspect all the tweets or postings of the employee to make sure that he or she hasn’t said in one or more of them that they are passing controlled technical data to foreign government agents. It is probably easier just to not use the exemption.

One thing the report gets quite right is its observations that the questions of the application of export law to cloud computing are issues that pre-date the current cloud computing phenomenon and were raised initially by the trans-national characteristics of the Internet itself. Consider this example provided by the report:

Person A, a U.S. citizen located in the United States, sends an e-mail containing EAR-restricted information in the body of the message to Person B, a U.S. citizen who normally works at a location in the United States. Unbeknownst to Person A, Person B is on a short trip overseas. Person B logs onto his e-mail while overseas using a public computer in the lobby of his hotel, sees that he has an e-mail message from Person A, but since he does not have any reason to believe in advance that it will contain EAR-restricted information, proceeds to click on the message and read it.

Assuming this is an export violation, and under a literal reading of the Export Administration Regulations (“EAR”) it would be, who has broken the rules? The party sending the email without knowing it was going to leave the country or the party opening the email not knowing it contained export controlled data? The report piles on another question and another wrinkle: suppose the email provider moved the email on to a foreign server after noticing that Person B was accessing the email from abroad. Is the email provider guilty of an export violation? These same issues that are posed by a simple email are also posed when companies begin storing data on the cloud without full control or knowledge of where the cloud servers may be located.

Of course, the literal interpretation of export rules might well forbid the use of email, cloud services or the Internet in general with respect to export-controlled data. Is it time to shut off the computers, address a bunch of envelopes, and crank up the dusty postage meter in the back of your office?

The report suggests that regulators might avoid charges of Luddism and the enshrinement of nineteenth-century concepts of exports by looking at data encryption. Under current rules, data is exported if it crosses borders whether it does so as clear or encrypted text. Perhaps securely encrypted text can find a safe harbor from traditional concepts of export. And although the regulations do not currently take this approach, I have advised people emailing export-controlled data to do so always in encrypted form to guard against things similar to the scenario posed above. If the controlled data, through the miracle of the Internet, winds up on a foreign server, at least the contents of that data aren’t available in any practicable sense to any foreign persons with access to that server. If not a defense to the export violation, it is at least going to be a mitigating factor in any penalty action.

This position may require an export license from the Department of Commerce, Bureau of Industry and Security and/or the Department of State, Directorate of Defense Trade Controls. Issuance of any required license is a prerequisite for this position.

This is odd, because that license is only required if the person filling the position is not a U.S. citizen or permanent resident. And if the person is not, a work visa is required, which is a prerequisite prior to any export license. So why the emphasis on the requirement of an export license? Do people now think that export licenses may be required for any jobs involving controlled technical data?

The question revolves around the meaning of “use” under the Export Administration Regulations (“EAR”). For example, in the case of supercomputers controlled by ECCN 4A003, the corresponding technology ECCN 4E001 defines controlled technology as technology “for the “development”, “production”, or “use” of equipment” controlled by ECCN 4A003. “Use” is defined in the EAR as “[o]peration, installation (including on-site installation), maintenance (checking), repair, overhaul and refurbishing.” BIS has interpreted this definition to mean that the mere operation of a dual use item by a foreign national is not a deemed export; rather, a deemed export occurs only when the foreign national is given information that would permit the foreign national to engage in all six activities defined as use.

Since 1994, the GAO has been complaining that this definition is unclear because it does not take into account that controlled information is often transferred in the course of training a foreign national to use a dual use item. Presumably this means that GAO thinks that in teaching a foreign national how to operate the item, an employer or university will also transfer information relating to installation, maintenance, repair, overhaul and refurbishing of the dual use item.

Further confusion exists with respect to dual use items that are being used for fundamental research. According to the GAO report some BIS officials have said that in such an instance there is no deemed export, presumably even if information on all six use aspects is transferred. The GAO report cites an instance where this confusion caused BIS to flip-flop on license applications by the NIH designed to permit foreign nationals to work at a facility with controlled equipment. Initially, NIH took the position that because it was engaged in fundamental research, no deemed export was occurring. When BIS told NIH in 2008 that it needed export licenses notwithstanding that it was only engaged in fundamental research. Between August 2008 and December 2009, NIH applied for 37 deemed export licenses to permit foreign nationals to operate controlled equipment. In December 2009, BIS reversed course and told NIH that no licenses were necessary because NIH was engaged in fundamental research.

So which is it? Frankly, it seems to me that the project in which the controlled item is engaged is irrelevant. If a 4A003 supercomputer is being used to, say, play Jeopardy, that doesn’t mean that you could transfer to a foreign national information on how to operate, install, maintain, repair, overhaul and refurbish that computer. But what I think isn’t important. What’s important is what BIS thinks, and it seems to be of two minds on the issue.

In the 2009 advisory opinion, BIS noted that the provider of cloud computing services was only providing a service and was not exporting data or technology. Only the customer of the service could be the exporter, and only the customer of the service would be in export hot water if the data or technology was transferred in violation of the Export Administration Regulations. This logic seemed a bit at odds with the normal concept that providing access to technical data to foreign nationals was an export, but let’s not trouble ourselves here with minor details. A sly little sentence dropped at the end of the opinion also reminded everyone that the Office of Foreign Assets Control (“OFAC”) might have concerns with the provision of cloud computing services to blocked persons or embargoed destinations even if BIS did not.

Now, two years later, BIS confronts the related and more difficult question of what cloud computing service provides ought to do about their own foreign national IT staff who might have access to controlled technology placed on the cloud by the service’s customers. Not to worry, says the opinion, because the cloud computing service provider isn’t an exporter and thus can’t be a deemed exporter:

Because the service provider is not an “exporter,” [it] would not be making a “deemed export” if a foreign national network administrator monitored or screened, as described above, user-generated technology subject to the EAR.

But the problem with this logic is that the person who gives a foreign national access to controlled technology is a deemed exporter even if he isn’t an exporter. That’s why they call it a “deemed” export.

Of course, none of this addresses the 900-pound gorilla in the room which is, of course, the user of the cloud service and its liability for using a cloud service where foreign IT personnel have access to the controlled data that the user may have placed on the cloud. And don’t think the problem starts and ends with cloud computing. The Internet, is also a cloud of sorts linking various servers together to permit transit of data to its final destination. Any of those servers may have foreign network administrators who could use packet sniffers to see controlled technical data. Worse yet, the routing servers may be located in foreign countries even when the sender and the receiver are both located in the United States.

What I think we’d like to hear is what BIS and DDTC think about this. Or maybe not.

In case you can’t read the text of the “WARNING” in this RFP from the Naval Air Systems Command sent to me by an alert reader, it says:

WARNING: THIS DOCUMENT CONTAINS TECHNICAL DATA WHOSE EXPORT IS RESTRICTED BY THE ARMS EXPORT CONTROL ACT (TITLE 22, U.S.C. SEC 2751 ET SEQ) OR THE EXPORT ADMINISTRATION ACT OF 1979, AS AMENDED, (TITLE 50, U.S.C. APP 2401, ET SEQ). VIOLATIONS OF THESE EXPORT

Which is why, of course, the document is posted on the web where any foreign person in any country could download the document and obtain export-restricted technical data. I was able to download without problem all of the documents attached to the RFP.

Perhaps the contracting officer was unaware that the Internet was available outside the United States or that foreign nationals in the United States could actually access the Internet. Or did the contracting officer think that if, say, an Iranian saw this “WARNING” either a crise de conscience or fear of the long arm of U.S. law would cause him or her to heed the warning and not download the juicy details? (I have blurred the details of the RFP so as to not to assist any foreign person in locating this particular RFP, and I’m not providing a link for the same reason.)

The government regularly threatens defense contractors, universities (cf. Professor Roth), and others with huge fines and criminal penalties for disclosures of ITAR-controlled technical data, even data that is already available elsewhere on the Internet. So why haven’t I read about a raid on the Naval Air Command Systems office at the Pentagon and seen pictures of ICE carting off all their computers?

An alert reader pointed me to this CBS News story about hard drives found in almost all copy machines built after 2002. They store images of the last 20,000 or more things copied on the machines to which they are attached. Your resumé. Your tax return if you copied it at work before you sent it. The photocopy you hilariously made at the office Christmas party of, well, you know who you are and you know what I mean.

It also includes any export-controlled technical data copied on the machine. And since you probably lease that machine, your vendor comes in periodically to replace the machine, whisking away the old one, and its hard drive, and sending them to destinations unknown. Have you worked up a cold sweat yet?

The CBS reporters downloaded copies of hard drives from used copy machines Each copier was bought for $300 each. They found confidential patient medical records, details of an on-going drug investigation by the Buffalo police, and pay stubs with names, addresses and, yes, social security numbers. And I’m sure that export-controlled technical data wouldn’t be hard to find either. At the facility where CBS bought the used copy machines, two containers of used copy machines were being packed for export to Singapore and Argentina. Was your copy machine in that batch?

As soon as you finishing reading this, you probably want to take steps to make sure that copy-machine hard drives are scrubbed before the machines leave your facility and that, in the future, all export-controlled technical data or technology is only copied on secure machines that implement a factory option to erase each image from the hard drive after the copy is made.

Second, Obama promised reform in a somewhat obscure area of export law mostly known to export control junkies and geeks:

And second, we’re going to eliminate unnecessary obstacles for exporting products to companies with dual-national and third-country-national employees. Currently, our exporters and foreign consumers of these goods have to comply with two different, conflicting set of standards. They’re running on two tracks, when they could be running just on one. So we’re moving towards harmonizing those standards

What Obama is referring to here is the conflict between the standards applied by the State Department and the Commerce Department on “deemed exports.” Under the deemed export rules, exports of technology are deemed to be exports to the country of which the recipient is considered a national.

Under Commerce’s deemed export rules, an export to a foreigner with multiple citizenships or countries of permanent residencies is considered an export to the country of the most recently acquired citizenship or permanent residency. Under State Department rules, the export is considered to be an export to each of the countries — with the most restrictive licensing policy applied.

Obama doesn’t say which of these conflicting rules will yield to the other as they are “harmonized.” We can only hope that the Commerce rules will prevail.

Oddly, this requirement is only for employees needing BIS deemed export licenses. Those requiring a deemed export license from the Directorate of Defense Trade Controls (“DDTC”) for foreign workers involved with technologies controlled by the United States Munitions List (“USML”) can apply for the visa and the license at the same time.

BCIS, with typical transparency, announced the revision and asked for comments in this public notice in the Federal Register. The public notice doesn’t reveal the nature of the proposed changes or how to find them other than suggesting that employers go try to find the proposed forms at regulations.gov. Good luck with that. We can only thank a loyal reader for tracking down the proposed, but undisclosed, changes in the visa application form.

Comments on this proposed change are due by April 9, 2010. Comments can be submitted by fax to 202–272–8352, or via e-mail to rfs.regs@dhs.gov.

At issue is the difference between the way the Bureau of Industry and Security (“BIS”) and DDTC treat foreign nationals with respect to approving transfer of controlled technical data to them. For example, DDTC may use the country of birth of a foreign national to deny licenses or agreements involving transfer of technical data to that individual. BIS, on the other hand, considers the individual’s current citizenship in evaluating his or her ability to receive controlled technical data regarding dual use items.

DDTC’s policy of considering country of birth has created some concern within the export community because it has been applied inconsistently and without any clear statement of applicable guidelines. In some formulations, it appears that the DDTC would automatically apply the policy to bar access to technical data by persons born in, but not citizens of, countries subject to arms embargos under section 126.1 of the International Traffic in Arms Regulations. At other times, DDTC has suggested that a case-by-case consideration would be applicable to foreign nationals born in proscribed countries, an approach that makes more sense when you consider situations such as a child of French diplomats born in China.

The policy has also drawn criticism from abroad. Human rights commissions in Canada and Australia have pointed out that the DDTC’s policy is, in effect, an illegal discrimination based on national origin. This has put U.S. contractors doing business in those countries in a difficult position since it is impossible for them to comply both with DDTC requirements and local laws.

Although a review of these issues for the purposes of achieving uniformity is laudable, DDTC’s motive in requesting that review is somewhat hard to determine. On the one hand, perhaps DDTC is looking for administrative cover to back away from its stricter rule and provide some relief from U.S. defense contractors with overseas operations. On the other hand, DDTC might simply be seeking to have its own narrower view imposed on BIS and other export agencies.