ExportLawBlog » Technical Data Export

Archive for the ‘Technical Data Export’ Category

Aug

9

Are You Now, or Have You Ever Been, a Spy?

Posted by Clif Burns at 5:00 pm on August 9, 2011

With the August 15 implementation date for the new dual and third country national rule fast approaching, I wanted to comment briefly on the Sample Questionnaire that the Directorate of Defense Trade Controls (“DDTC”) has proposed as an example of something foreign companies should use to review whether a dual or third-country national has “substantive contacts” with other countries. Under the new rule, foreign companies covered by a technical assistance agreement (“TAA”) can share technical data with full-time employees who are also nationals of countries other than the company receiving the data under the TAA. One of the conditions, however, for using that rule is that the foreign licensee must examine the “substantive contacts” of that third-country or dual national with other countries to determine whether there is a risk of diversion of the technical data outside the home country of the foreign licensee.

The sample questionnaire proposed by DDTC represents the agency’s suggestion as to one way that such screening should take place. Some of the questions are poorly drafted, and many of the others are just plain silly and can be roughly paraphrased as simply asking the person involved whether or not he or she is a foreign spy — as if they would answer that question truthfully if they were.

In the poor drafting category, we have this question:

Do you have business contacts, business partners, business contracts, brokers, or any other relationship with a business in another country or other countries subject to U.S. or U.N. embargo?

Because the question as to whether there are contacts with “another country” would necessarily include countries subject to embargo, the final clause is unnecessary and potentially confusing.

Also in the poorly drafted category, we have this incredibly broad inquiry:

Have you ever served in or provided information to the government of another country (e.g., military, foreign ministry, intelligence agency or law enforcement)?

Anybody who has ever traveled to a foreign country would have to answer this affirmatively because of the requirement to provide information to customs and immigration officials upon entry in to the country. And, of course, a third country national will have provided tons of information to his home country government in terms of tax returns, driver’s license applications, and the like. And what about state-owned enterprises? Does information provided to them constitute information provided to the government?

Then we have the “are you a spy” questions:

Do you have contacts with any other individuals or groups involved in acquiring controlled defense articles, including technical data, illegally or otherwise circumventing export control laws? Please explain the nature of that contact.

Do you have contacts with agents from another country or another countryâ€™s government?

Do you have contacts with agents from another country or another countryâ€™s government?

It is a little known historical fact that Mata Hari, when asked questions of these sorts, broke down into tears, confessed to the French government that she was a spy and asked to be immediately taken to the firing squad for execution.

The questionnaire also has the dual or third country national attest that he or she has given the company complete and accurate “social networking addresses.” Apparently whoever wrote this had heard that all the kids these days do these Twitter and Facebook thingies but didn’t really understand how any of them worked. There really isn’t any such thing as a “social network address,” unless the DDTC expects that something like www.facebook.com be provided as a response to this question. Presumably the idea here would be that the employee has allowed the company to follow or “friend” the employee on Facebook, Twitter, Google Plus or the like. This would mean, I guess, that the foreign licensee will then inspect all the tweets or postings of the employee to make sure that he or she hasn’t said in one or more of them that they are passing controlled technical data to foreign government agents. It is probably easier just to not use the exemption.

Permalink

Comments (2)

Jul

26

Cloudy, With A Chance of Heavy Fines

Posted by Clif Burns at 5:45 pm on July 26, 2011

Category: Deemed Exports • Export Reform • Technical Data Export

The Brookings Institution just issued a brief report entitled “Addressing Export Control in the Age of Cloud Computing.” The report raises more issues than it answers, which is not surprising given the brevity of the report and the uncertain state of the application of export rules and regulations to cloud computing.

One thing the report gets quite right is its observations that the questions of the application of export law to cloud computing are issues that pre-date the current cloud computing phenomenon and were raised initially by the trans-national characteristics of the Internet itself. Consider this example provided by the report:

Person A, a U.S. citizen located in the United States, sends an e-mail containing EAR-restricted information in the body of the message to Person B, a U.S. citizen who normally works at a location in the United States. Unbeknownst to Person A, Person B is on a short trip overseas. Person B logs onto his e-mail while overseas using a public computer in the lobby of his hotel, sees that he has an e-mail message from Person A, but since he does not have any reason to believe in advance that it will contain EAR-restricted information, proceeds to click on the message and read it.

Assuming this is an export violation, and under a literal reading of the Export Administration Regulations (“EAR”) it would be, who has broken the rules? The party sending the email without knowing it was going to leave the country or the party opening the email not knowing it contained export controlled data? The report piles on another question and another wrinkle: suppose the email provider moved the email on to a foreign server after noticing that Person B was accessing the email from abroad. Is the email provider guilty of an export violation? These same issues that are posed by a simple email are also posed when companies begin storing data on the cloud without full control or knowledge of where the cloud servers may be located.

Of course, the literal interpretation of export rules might well forbid the use of email, cloud services or the Internet in general with respect to export-controlled data. Is it time to shut off the computers, address a bunch of envelopes, and crank up the dusty postage meter in the back of your office?

The report suggests that regulators might avoid charges of Luddism and the enshrinement of nineteenth-century concepts of exports by looking at data encryption. Under current rules, data is exported if it crosses borders whether it does so as clear or encrypted text. Perhaps securely encrypted text can find a safe harbor from traditional concepts of export. And although the regulations do not currently take this approach, I have advised people emailing export-controlled data to do so always in encrypted form to guard against things similar to the scenario posed above. If the controlled data, through the miracle of the Internet, winds up on a foreign server, at least the contents of that data aren’t available in any practicable sense to any foreign persons with access to that server. If not a defense to the export violation, it is at least going to be a mitigating factor in any penalty action.

Permalink

Comments Off

May

25

“Do What I Say” Etc., Etc.

Posted by Clif Burns at 5:45 pm on May 25, 2010

Category: Criminal Penalties • DDTC • Deemed Exports • Technical Data Export

NASC RFP

In case you can’t read the text of the “WARNING” in this RFP from the Naval Air Systems Command sent to me by an alert reader, it says:

WARNING: THIS DOCUMENT CONTAINS TECHNICAL DATA WHOSE EXPORT IS RESTRICTED BY THE ARMS EXPORT CONTROL ACT (TITLE 22, U.S.C. SEC 2751 ET SEQ) OR THE EXPORT ADMINISTRATION ACT OF 1979, AS AMENDED, (TITLE 50, U.S.C. APP 2401, ET SEQ). VIOLATIONS OF THESE EXPORT

Which is why, of course, the document is posted on the web where any foreign person in any country could download the document and obtain export-restricted technical data. I was able to download without problem all of the documents attached to the RFP.

Perhaps the contracting officer was unaware that the Internet was available outside the United States or that foreign nationals in the United States could actually access the Internet. Or did the contracting officer think that if, say, an Iranian saw this “WARNING” either a crise de conscience or fear of the long arm of U.S. law would cause him or her to heed the warning and not download the juicy details? (I have blurred the details of the RFP so as to not to assist any foreign person in locating this particular RFP, and I’m not providing a link for the same reason.)

The government regularly threatens defense contractors, universities (cf. Professor Roth), and others with huge fines and criminal penalties for disclosures of ITAR-controlled technical data, even data that is already available elsewhere on the Internet. So why haven’t I read about a raid on the Naval Air Command Systems office at the Pentagon and seen pictures of ICE carting off all their computers?

Permalink

Comments (8)

Feb

8

Do Not Open That Email Attachment

Posted by Clif Burns at 10:11 am on February 8, 2010

Category: China • Technical Data Export

Big News! Everyone that has sensitive data (including, of course, ITAR-controlled data) on their computers networks should read this sobering article in Wired, which reveals, for the first time that I am aware of, the methodology, extent and scope of Chinese cyber-attacks on U.S. computer networks. After you read this article, there will be no question in your mind that these attacks are orchestrated and carried out by the Chinese government, even though the Chinese government is currently issuing risible denials of its involvement. Also, you will never open an email attachment again from anyone. The problem is, of course, that someone on your network will.

Called Advanced Persistent Threats (APT), the attacks are distinctive in the kinds of data the attackers target, and they are rarely detected by antivirus and intrusion programs. Whatâ€™s more, the intrusions grab a foothold into a companyâ€™s network, sometimes for years, even after a company has discovered them and taken corrective measures. â€¦

The Heartland and RBS attackers, and other criminal hackers of their ilk, tend to use SQL injections attacks to breach front-end servers. The APT attackers, however, employ undetectable zero-day exploits and social engineering techniques against company employees to breach networks.

â€¦ They attempt to take every Microsoft Word, PowerPoint and Adobe PDF document from every machine they compromise, as well as all e-mail, says Mandia. â€¦

Last year, for example, an unidentified defense contractor discovered 100 compromised systems on its network, and found that the intruders had been inside since at least 2007.

APT attackers also appear to be well-funded and well-organized. In some cases, Mandiant has found multiple groups inside a network, each pursuing their own data in a seemingly uncoordinated fashion. â€¦

Many entities donâ€™t discover a breach until someone from law enforcement tells them. By then, itâ€™s too late.

â€œBy the time the government is telling you, youâ€™ve already lost the stuff you didnâ€™t want to lose usually,â€ Mandia says, noting that itâ€™s generally not possible to ascertain everything that an attacker took.

While APT attacks are sophisticated, they use simple techniques to gain initial entry and, once inside, adhere to a pattern.

For starters, the attackers conduct reconnaissance to identify workers to target in spear-phishing attacks â€” such as key executives, researchers and administrative assistants who have access to sensitive information â€” and then send malicious e-mails or instant messages that appear to come from a trusted colleague or friend.

The e-mails have an attachment or link to a ZIP file containing zero-day malware that exploits Microsoft Office or Adobe Reader vulnerabilities. Google employees received an e-mail with malware that exploited a vulnerability in Internet Explorer 6 that Microsoft had not yet publicly disclosed.

Once the attackers have a foothold on one system, they focus on obtaining elevated access privileges to burrow further into the network. They do this by grabbing employee password hashes from network domain controllers â€” and either brute-force decrypt them or use a pass-the-hash tool that tricks the system into giving them access with the encrypted hash.

Not only should you be extremely cautious about email attachments and forwarded links, even from trusted friends, but also you might think about taking down your entry on LinkedIn or other business networking sites. Unless, of course, it’s already too late.

Permalink

Comments (4)