As enterprises began to confront the issues raised by cloud computing, this article on TMCnet is a good reminder that export issues may be some of the most intractable. Although some clouds, like Amazon’s EC2, provide servers in defined locations, other cloud providers, Google notably, are more secretive about where their clouds are located or on which clouds user data is stored. If ITAR-controlled technical data or CCL-controlled technology is stored by a U.S. company on a cloud outside the United States, an export has occurred. If no license has been obtained it is safe to say that this is going to be a cloud without a silver lining.

BIS did issue an advisory opinion in January 2009 on cloud computing. The advisory opinion was requested by an unnamed provider of cloud computing service and fails to address the export issues relating to users of such cloud computing services. In the advisory opinion, BIS stated, among other things, that the provision of cloud computing services is not an export subject to the EAR and that the cloud provider is not considered to be the exporter of any data that users place on and retrieve from the cloud.

The TMCnet article focuses unduly on the location of the server while neglecting that even if the cloud is wholly within the United States an export could occur if foreign nationals employed by the cloud provider in the United States have access to controlled technology or technical data. The same article also neglects to point out that export issues are raised in other Internet contexts. If an email contains controlled technology or technical data an illegal export will have occurred if the email transits a foreign server even if the email is sent from a server in the United States and is addressed to a server in the United States. The same issue could exist for VOIP voice communications if the VOIP provider utilizes any servers located outside the United States.

The BIS advisory opinion shows a laudable effort to understand and accommodate issues posed by cloud technology, at least from the perspective of the cloud provider. Hopefully, it will show the same practical considerations for users of cloud technology. Whether OFAC and DDTC will demonstrate similar understanding of the technology remains to be seen.

Permalink