The Bureau of Industry and Security has announced that, starting on December 8, a new license condition will appear on all validated licenses. That condition reads as follows:

Unless limited by a condition set forth below, the export, reexport or transfer (in-country) authorized by this license is for the item(s), end-use(s), and parties described in the license application and any letters of explanation. The applicant is responsible for informing the other parties identified on the license, such as ultimate consignees and end-users, of the license’s scope and of the specific conditions applicable to them. BIS has granted this license in reliance on representations the applicant made in the license application, letters of explanation, and other documents submitted.

The laudable purpose here is to get rid of the silly license conditions that simply reiterate existing requirements of the Export Administration Regulations, such as Part 744’s prohibition on nuclear end uses. BIS is concerned about possibility that the existence of, say, the no nuclear use condition will give someone the idea that it is okay to allow the exported item to be used in the production of chemical weapons in violation of section 744.4 of the EAR. Expressio unius and all that.

But I wonder, and the BIS announcement does not say, whether the language quoted above will replace the following condition that is included, in one form or another, on all licenses:

No resale, transfer, or reexport of the items listed on this license is authorized without prior authorization by the U.S. Government.

The issue here is an odd lacuna in the EAR. If you look through the General Prohibitions, there is no explicit prohibition against in-country transfers of items exported under license. The prohibitions on certain exports and re-exports do not, by definition, reach in-country transfers. Rather the General Prohibitions only address in-country transfers in connection with denial orders (General Prohibition 4) and illegally exported items (General Prohibition 10). Instead, the way that in-country transfers are prohibited is through General Prohibition 9, which prohibits violation of any license condition, such as the one quoted above, which makes clear that no in-country transfer can occur with U.S. Government approval.

The new license condition is worded in such a way that it seems possible that it will replace the standard condition prohibiting resale, transfer or re-export without government approval. But if it does, BIS will have unintentionally opened the door to unlicensed in-country transfer of items exported under license.

In an advisory opinion dated November 13, 2014, the Bureau of Industry and Security (“BIS”) rode once again into the cloud computing breach to confront the tricky metaphysical question of when software that lives in the cloud is exported.  At issue is this: when a foreign user accesses a U.S. server running a software application, say Adobe Photoshop, has the software for the application been exported to the  foreign user? In such a scenario, the foreign user will be using the software in exactly the same fashion as if it had been download and installed on his local hard drive, with the only difference being a slight lag if his Internet connection is poor.

The BIS advisory opinion takes what might be called, in philosophical terms, a positivist approach to this question:

Instead of downloading the software and processing data locally the foreign user of a U.S. server sends its data to the cloud for processing, and causes its processed data to be transmitted back to it. Although there may be export of technology in this context, there is no export of software.

So the silver lining here, for cloud companies, is this literalist view of software exports. Software is exported when a physical disk with the software or an electrical impulse representing the code crosses a border. Just because someone uses the software remotely it has not been exported.

Now for the “Or Not” in the headline. Although BIS’s literalist approach to the download of software has a certain appeal, and is likely to be welcomed by cloud providers, there is something that the advisory opinion does not say. And this is where we can see the utter insanity of having export control scattered over competing agencies each trying to establish their own primacy in the export control domain. The advisory opinion says nothing about the rules of the Office of Foreign Assets Control (“OFAC”) which, in more than a few instances, might be implicated by the cloud scenario described above. Suppose the foreign user is in, say, Iran. Although the U.S. cloud provider might not be exporting software to Iran, at least the way BIS sees it, it certainly will be exporting a service to Iran in violation of OFAC rules.

Faithful readers of this blog will likely recognize this issue, but others reading the BIS opinion might conclude that, because there is no export of the software to Iran, it is completely legal to make the program available to Iranians from a U.S. based cloud. Until all export control is moved under the control of one agency, this kind of nonsensical trap will continue to snare innocent people and businesses for no good reason.