Export Control Blog

Update Day 1: China Controls

1:17pm Waiting for what could prove to be one of the more lively sessions of the day to begin.

1:22 While we're cooling our heels, you can reach some ECB's past China coverage and the proposed rule to restrict exports to Chinese military end-uses.

1:29 Bernard Kritzer, Director of the Office of National Security and Technology Transfer Controls, begins by introducing some of the current and former China trade hands in the room, including the current export controls attache in Beijing, Jeanette Chu.

1:32 $2.4 billion of the $38.9 billion in exports to China last year were shipped under BIS license. There were about $12.5 million in denials.

1:37 Kritzer claims numerous improvements to China license processing time, government-level interaction w/Chinese government, etc. over the past few years.

1:39 BIS extending comment period of proposed reg another 30 days to early December.

1:42 The new rule clarifies that the policy is to deny the export of National Security controlled items to Chinese military end-use. Also creates new authorization Validated End User (VEU) -- a whitelist of sorts for vetted Chinese entities. You could think of this as an "open" Special Comprehensive License (SCL). Open in the sense that it's use wouldn't be restricted to a single applicant like a SCL.

1:44 One largely overlooked provision of the proposed rule increases the frequency with which US exporters will need to obtain an end-use certificate from the Chinese Ministry of Commerce to any licensed export valued at more than $5000.

1:48 State Department representative, Foreign Service Officer Peter Secor, begins by noting that China now has an embassy in Grenada, the location of his last assignment.

1:58 This is big picture stuff -- important, no doubt -- but I wonder just how interesting to this quite practical audience.

2:02 Q: Will BIS have the resources to follow-up on this?  What does China think of the rule? A: Shorter Chu: yes.

2:03 Q: Can other US citizens do PSVs? A: Yes, as long as her name is Jeanette Chu (cue symbol crash).

2:06 Q: MOFCOM end-user certificate originates in local Chinese trade bureau. Also, check out MOFCOM's website which has English instructions on how to get a cert.

2:09 Q: Is there a primary category of the 47 ECCNs subject to the new rule? A: Not really, but Cat. 3, 4, and 9 are among the more significant ones.

2:10 Q: Will VEU cover technology transfer? A: Specify in VEU advisory opinion request what you want, but BIS doesn't envision VEU covering technology as a general rule.

2:12 Q: How long will it take to get an entity approved under VEU? A: Once rule is final, exporters can begin to apply. We'll try to get started quickly.

2:14 Q: How will the US determine foreign availability given that the US is the only country interpreting the Wassenaar military catch-all so strictly toward China. A: "Specific technical facts" -- point us to the evidence and we will consider it.

2:15 Q: How will the rule affect the Chinese ARJ program? A: If OEMs are commercial entities, we'll consider them, but if they have a military pedigree not so much.

2:16 Q: Will the rule impact civil aircraft flying Chinese leaders? A: Tough one, we've received a number of comments about this.

2:18 Q: The definition of military end-use sounds a lot like the ITAR. Is this rule redundant? A: We are only looking at end-use, not end-user.

2:19 Q: What's the status of Hong Kong? A: Status quo -- one country, two systems. That goes for the EAR, too. HK maintains a "first rate and very responsive" export control system.

2:21 Q: Doesn't the US understand the structure of the Chinese Government? Could you give us some more information to help us? A: We don't understand the PRC's bureaucracy as well as you think we do. You don't have to determine if every entity you deal w/is related to the PLA. The issue is end-use not end-user.

2:24 Q: How will you consider past licensing w/China? A: If the record of the end-users on your previous licenses has been good in PSVs, that could well help you with VEU.

2:25 Q: Can the exporter send a rep or can their distributor send a rep to an end-use visit? A: Sure, it's largely up to the end-user. Chinese Gov't reps always go along with the BIS attache.

2:28 Q: Do you expect US subsidiaries in China to have any easier time than other Chinese companies in qualifying for VEU? A: We'll see, but they still need to meet our standards.

2:30 Q: Will the recent hacking of BIS by the Chinese affect the reg? A: No, unless we find out who they are and they want to be a VEU in which case they're SOL.

Shorter Kritzer: we love you guys.

Update Day 1: State Department Export Controls

Courtesy Doug Jacobson of International Trade Law News here's his summary of this morning's deemed export breakout session:

Department of State Export Controls and Licensing, Ann Ganzer, Director of Office of Defense Trade Controls Policy

--Provided an overview of DDTC – The ITAR is an illustration of what is controlled. “We believe that we control things that have not been invented yet.”

--Export – Conversation, fax, tech data by e-mail. Many things that are exported are electrons only, such as the JSF which is being exported

--Licenses – Going electronic. Had a wake for Ellie Net on Friday. D-Trade licenses get processed first. First, look at applicant first. Exporting is a privilege not a right. Look at end-user and end-use. Look at foreign policy. What impact on country seeking equipment, etc. Look at human rights impact  on other countries.

--DOD reviews 1/3 of applications. Staffed to other agencies, such as NASA. But DDTC makes final decision.

--Congressional notifications. When required, DDTC does not notify Congress when it is not in session. This impacts the licensing timetable.

--If approved, will issue with provisos. If not, will RWA or deny. Unlike BIS, at DDTC RWAs are not a good thing. Many licenses have technical flaws or carelessness that  cause the application to rejected. Many of these problems are addressed by D-Trade.

--DDTC processed 70K applications in FY 2006.

--After about 15 minutes, Anne started taking questions from the audience.

-- Deemed exports under State – Long running joke between BIS and State. At State, it is an export, not a deemed export. DDTC looks at all citizenships held.

--Review of USML? Still working on it. Now looking at revising sections of ITAR, not entire category. Under “constant review” since 2000, but becoming more and more complex.

--Demilitarized Aircraft policy – not a broad brush policy. Need to see specifics of proposed transactions.

--License processing times – Taking from 2 days to 5 months by D-Trade. Could have been an electronic glitch, but would need to see specifics.

--How to get items decontrolled by DDTC? Come in and talk.

--DDTC Venezuela sanctions not in accordance with BIS.  Working on revising ITAR, but should assume in section 126.1.

--Greg Suchan noted 10,000 case backlog will it ever get fixed? “always hopeful”. Like filling a bathtub with drain open. Have a few new people, but are new. Take time to train. Times are decreasing.

--Public domain technology – Can take public domain info and create defense article. Like Oklahoma City bonding. Can provide defense service even if items are not ITAR controlled.

--Punted brokering questions.

--Trying to improve outreach efforts – Staffing problems caused nearly zero programs last year. Trade between work and outreach.  Working on it.

--Aircraft Parts – Does ITAR part ever lose its ITAR identity? Section 38(f) requires congressional notification to remove from USML. If aircraft part, needs to be removed from USML before migrating to commercial. Easier to use commercial components on military aircraft, rather than the reverse.

--Item on USML does not lose its character. Used QRS-11 as example. Three CJs held that QRS-11 was on USML. “Bomb in a suitcase is still a bomb, not a suitcase.” QRS-11 carve-out for stand-by instruments. Carve out for FPAs in night vision. Carve out for personal protection gear.

--Providing USML item to foreign person in US would require a license. Transfer of title can be an export.

--Best not to contact licensing officers, contact Response Team.

--Have to register with DDTC if you are engaged in defense services or are manufacturing defense articles. If you are selling toothbrushes to the Navy, no need to register.

--Electronic registration is being worked on, but time table is not set.

-UK and TAAs. No broader change of policy, but let DDTC know if there is a problem.

--Due diligence on buying and selling ITAR within US. Depends on case.  Confirming registration is good. Depends on who you are selling to though.

--Voluntary disclosures – Concerned about companies that do not submit VSDs.

--Consistency of license approvals is an issue – DDTC is looking at this issue. End-users can change, though, requiring a fresh look. Concerned about consistency.

--No additional brochures publish on defense service, but will look at that.

--If you changed fit for military use, it is subject ITAR.

--Freight forwarders and export licenses – if FF can fulfill requirements of exporter under ITAR, they can apply for and obtain a license. However, if a FF can’t open the package then they can’t apply for a license.

--DFARS and export control policy change – Doesn’t think that DDTC will be issuing additional guidance.

--Whether to release licenses to a customer is the exporter’s decision.

--Example of an item that is first used for military, but not subject to ITAR. For example, an aircraft part that was first used by military while waiting for FAA certification.

--Can’t rely on Response Team guidance for legal purposes.  Response Team is supposed to be a help to the exporting public, but can’t absolutely rely on it. Even if you contacted Response Team 27 times, it won’t absolve exporter of  liability.

--Can exporter find out which agency provided provisos. Not specifically, but they can be figured out. Most come from DOD.

--If major reorganization of a registered company is pending, request a meeting.

--DDTC considers all citizenships when reviewing licenses. Thus, if person holds Chinese citizenship, prohibits exports of USML items to China and Chinese nationals.

--DDTC wants to get the word out. Has long-relationship with SIA, but interested in working with other organizations.

--10% in crease in CJs in 2006. Total of 364. Expect companies to do their own CJs, but consult with DDTC in gray areas or where you can’t figure it out. Working with groups to develop best practices in CJs.

--DDTC has been successful on keeping aircraft parts from Iran’s military.

--President Bush has only waived sanctions on China three time. Very rare. Examples included bomb disposal equipment and chemical weapons destructions equipment.

--Regarding military grade safety glass, some on USML and some on CCL. Armored Suburban may be on CCL, but would want to look at this issue closely.

Update Day 1: Encryption

10:35 The Information Technology Division's analyst Joseph Young begins with an overview...

10:37 ITCD completed 2301 reviews and classifications last year, 18% mass market encryption, 69% License Exception ENC, the balance a grab bag. Also, 837 licenses, the vast majority crypto IVLs.

10:39 Young explains that Wassenaar added a new metric for HPC controls, with APP replacing CTP, including a nice discussion of Moore's Law.

10:45 On to encryption...don't forget about Category 5, Part II's see-through rule, which captures items with cryptographic capabilities regardless of whether or not data confidentiality is their main function.

10:50 ITCD analyst Mike Pender: "policy continues to evolve" even though the regulations have been reasonably static lately.

10:56 A few important issues in encryption reviews

• Bundling: Should never involve something new, but rather two (or more) previously classified/reviewed items. For example, a program using the (very common) OpenSSL library is a new product from the BIS point of view, potentially requiring notification or review, and is not a bundle. Bottom line -- and I've seen clients struggle with this often enough myself -- it doesn't matter where the crypto comes from, just that it's being used in some manner. Pender suggests listing parts/components of an item separately on a classification request, along with the bundle or combined product. (See Part 770.2(m) for more)
• Open Source: Open source and publicly available are NOT synonymous.
• Crypto aware: Hooks and calls to third party encryption can still make your product subject to encryption rules even in the absence of innate crypto functionality.
• Dormant crypto: A product exported w/encryption features disabled is still considered an encryption item requiring review. Consider listing enabled/disabled separately on classification request. BIS wants to know:
  • Is there an interface to install new software?
  • Is the missing SW available for download?
  • Just waiting for activation key?
  • Can another product's key be used?
  • Enhances performance of other products?

11:03 There's a bit of irony in the ITCD explaining the EAR's encryption controls by comparison to the ITAR's see-through rule since DDTC isn't hot on that term.

11:07 Pender is refreshingly frank about the limits and failings of the encryption regs.

11:15 Longtime BIS encryption analyst Judith Currie discusses the benefits the nirvana state of encryption controls -- mass market status -- with the help of a pleasant Cinderella analogy warning off you envious corporate step-sisters who don't meet the mass market criteria.

11:21 Currie: don't bury changes to a previously-reviewed product. Put them up front and save us all some time. And don't regurgitate the mass market criteria, explain how the hardware of software meets them.

11:27 Aaron Amundson discusses the once quite popular Encryption Licensing Arrangements (ELAs), which have largely gone by the wayside with the invention of License Exception ENC several years ago. But Aaron wants you to consider applying for an ELA whenever an IVL is required. And he's got a point -- if you're going to have to go through the bother of getting a license for an export to one customer, why not at least attempt to get permission to export a range of products to a range of customers in a number of destinations?

11:36 Amundson's colleague C. Lauren Jackson makes a plea for good, by which she means well-written, applications and also offers a tip that the BIS IT environment cuts out the model number from SNAP applications, so include that in the technical specs block. And focus on a full description of what the product is and does, not things like IRS tax statements or dozens of pages of marginally relevant technical details. (In my experience, if BIS wants that kind of detail -- and they rarely do -- they'll ask for it.)

11:42 Q: Will ENC reporting requirement be eliminated in the near future: A: No.

11:43 Q: Will BIS clarify the regs to emphasize that encryption controls can capture products outside Cat. 5 Part II? A: We're always trying to improve.

11:44 Q: For short range wireless >64-bits do you need a review to use 5A002? A: There's a carve-out for short range wireless that's not essentially an encryption product, but just an item w/short-range wireless added (e.g. wireless toaster).

11:45 Q: When can you self-classify? A: Password only authentication, copy protection, items w/certain banking-specific fields, etc.

11:46 Q: Will there be any guidance on civilian government end-user definition for ELAs? A: Not planned, but excludes military and law enforcement.

11:47 Q: Where does EAR say to use most conservative classification? A: It's common-sense.

11:50 Q: Does the ENC provision for exports to US subsidiaries (wo/reporting or review) work for subs of other companies? A: Yes, it's not just for your own sub. (Don't confuse with related provision for exports to other countries -- mainly the EU -- which are limited to use for internal development.)

11:53 Q: If we install 5D002 software on a 4A994 computer is another review required? A: Not necessarily, but it's your option if you're concerned US Customs might be confused that there's no "G number" for the hardware.

11:56 Q: What's the purpose of reporting under ENC and ELAs? A: It's intended to lessen the burden on exporters, to allow use of license exceptions, we do keep a database. (Not a very satisfying answer IMHO, given that this is a substantial burden on US exporters that their foreign competitors do not face.)

11:58 Q: How do we know if someone else's software has been reviewed? A: You've got to ask the manufacturer. (My own tip -- check out the right hand column of this blog for links to corporate websites that may well tell you.)

Update Day 1: Kickoff Plenary

8:33am And it begins...and there's a theme -- it's "a decade of change". (I voted for moonlight & roses, but alas...)

8:36 Office of Exporter Services Director Eileen Albanese says the new and improved SNAP, SNAP-R, is live. I'll have to check that out.

8:38 Acting Under Secretary for Industry and Security Mark Foulon fast facts -- he's a Rhodes scholar and previously worked for a Democratic senator.

8:41 Foulon says BIS "committed to explaining what we are thinking in a direct, unvarnished manner and listening to what you say in return", but "listening does not always lead to full agreement".

8:42 Last year saw a 13% jump in applications, processed in average of 33 days, for about $36 billion in value.

8:44 Highlights cooperation w/China and India. Very brief mention of the proposed China military end-use rule. (BIS published additional guidance on this subject just last Friday.)

8:46 Last year: 34 criminal convictions and over $3 million in criminal fines; 104 administrative cases and $13+ million in penalties.

8:48 MF's turn at the annual airing of regulators' grievances about the failure to renew the EAA noted, but not particularly emphasized.

8:54 Newly-confirmed Assistant Secretary for Export Administration Christopher Padilla takes the podium.

8:57 Themes for CP's talk: 1) evolving nature of security threat, 2) globalization of high-tech R&D, 3) need to cooperate internationally on export controls. (There are similarities here to his statement to the Senate committee evaluating his nomination.)

9:00 BIS will expand the Validated End-User (VEU) license exception, which originated in the proposed China rule, to India and possibly other countries. This is potentially significant, depending on precisely how VEU shapes up.

9:04 Padilla says about the proposed China rule that it's "simply wrong to call this a catch-all" since it only applies to specific circumstances. He plans to visit allies to encourage them to take similar measures.  Count me among the skeptics that such an effort will bear much fruit.

9:06 Creating an intelligence liaison in his office who will work with a new interagency working group to evaluate end-users.

9:10 CP: "I will go to China"...to put on an export control seminar.

9:15 Now up -- a panel discussion moderated by Deputy Assistant Secretary for Export Administration Matthew Borman.

9:26 State's Deputy Assistant Secretary for Threat Reduction, Export Controls, and Negotiations, Acting Donald A. Mahley offers the story of bad end-user in a MTCR member country, which came under heat and moved next door to another MTCR state, which also shut it down.

9:28 Increase in membership of multilateral export control regimes is both good news and bad news. Bad news is the "least common denominator" problem -- unserious states "hogtie" the regime.

9:31 The DOD rep on the panel, Acting DTSA Director Beth McCormick...

9:34 McCormick says 2006 a banner year for Wassenaar with about 90 percent agreement on member state proposals.

9:39 Working with India and Pakistan on national export control programs. Israel, too, where BM says the government will be promulgating a new, strengthened dual-use export control law. (More on this subject from Israeli business newspaper Globes.)

9:41 Greg Suchan, Deputy Assistant Secretary for Political-Military Affairs, notes that the president can remove Nimitz-class aircraft carriers from the munitions list, but not civilian communications satellites. Also notes that interagency cooperation on export controls used to compare unfavorably to "whale poop", but is now significantly better than aforementioned marine mammal dung.

9:51 Suchan argues that "access to US defense technology is the quid pro quo" for many countries (specifically mentioning India) in a positive national security relationship with the US, as opposed to during the Cold War when many other tools were more available to US policymakers (troop deployments, security aid, etc.).

9:53 Says Israelis scooped up a lot of arms provided by many countries, including some "really good stuff", fired by Hezbollah during this past summer's war.

9:55 119 people arrested last year for Arms Export Control Act violations.

9:58 GS says DDTC's backlog is 10,000 cases! Somewhat more staff, including military officers, increasingly mandatory D-Trade are helping.

10:03 Q: Why does China rule sound so much like EAR National Security controls (on items excluded from such controls)? A: Wassenaar members can take action on "non-listed dual-use items".

10:05 Q: How can industry and gov't cooperate? A: We all have programs, GS says State trying to RWA less by working with applicants, increasing automated validation of application details in D-Trade.

10:06 That's it -- next stop is that ol' chesnut, encryption, in a breakout session scheduled for 10:30.

Live From Update

8:21am It's a sunny, chilly morning here in Washington. A beautiful day, really, perfect conditions for spending the next ten hours in the subterranean home of this year's update at the Grand Hyatt Washington. (Note to latecomers -- take the 11th Street exit from the Metro Center station to directly enter the hotel.)

Things kick off in earnest in about ten minutes. See you then, so long as my (5A991?) WWAN card holds out anyway.

8:28 Feel free to email me at feedback {atsymbol} exportcontrolblog.com if you've got anything to contribute once we're under way.

Max Blanca, Compliance Detective

I don't know anything about the company behind it, but this export compliance training demo from Northern Virginia-based Content Enablers is more visually attractive and -- gasp -- entertaining than anything in the genre. Here's how the Indian developer behind the instructional website describes it:

International Trade Arms Regulation training is about reading miles of content. Apparatus converted this task into an experience styled after film noir style comic books. With a compliance detective called Max Blanca, video snippets, and more the course was a big hit with the learners.

...After deliberating over the concept we finally arrived at the Film Noir detective comic book and Max Blanca was born. We scripted the overviews, created the strips for scenarios, photographed and constructed the case studies at our Bangalore studio. The video snippets of Max were shot with a talent and a voice talent recorded the noir-style voice over at Virginia.

This page will tell you more about Content Enablers' offerings. Don't mistake this for an endorsement, but if you're looking to roll out online training, especially in a far-flung organization, their solutions might be worth investigating further.

Liveblogging Update 2006

In response to some inquiries, yes I do intend to liveblog Update again this year. I've already got a few new twists planned for those of you who can't make it to DC, but feel free to send on any suggestions for breakouts to attend or questions to ask and I'll do my best. If you're new to ECB or just need a refresher of how this worked last time around, check out this wrap up post from last year's conference.

The Arms Control Wonk Channels Foucault

Really, who else on the web ends his analysis of the North Koreans' recent nuclear test with a line like this?

I close this discourse about operational confidence by noting that the United States has built a missile defense that does not work, to defend against a North Korean missile that does not work, that would carry a nuclear warhead that does not work.

This is all very postmodern.

BIS Hacked

Between helping my clients and this guy, I've found myself with very little time for blogging lately. But what to make of today's story in today's Washington Post about an attack on the computer system at the Bureau of Industry and Security? The first couple grafs from WaPo read:

Hackers operating through Chinese Internet servers have launched a debilitating attack on the computer system of a sensitive Commerce Department bureau, forcing it to replace hundreds of workstations and block employees from regular use of the Internet for more than a month, Commerce officials said yesterday.

The attack targeted the computers of the Bureau of Industry and Security, which is responsible for controlling U.S. exports of commodities, software and technology having both commercial and military uses. The bureau has stepped up its activity in regulating trade with China in recent years as the United States increased its exports of such dual-use items to the growing Chinese market.

A few initial reactions:

• I'm no IT guru, but an attack on a level that BIS "cannot salvage the workstations that employees had been using and instead will build an entirely new system for the bureau" sounds either extraordinarily severe or the government is being extremely cautious in pulling out their entire system root-and-branch. Or both.
• This could well explain the licensing and classification disruptions and delays I've heard lately from folks.
• It might also explain why the BIS IT group seems to have let some of its more routine duties (like STELA and Update registration) slide lately as they focus on countering the hackers.
• Maybe I'm splitting hairs here, but a Commerce spokesman's assurance that "We have no evidence that BIS data has been lost or compromised" does not necessarily exclude the possibility that exporters' data normally protected under the confidentiality provision of section 12(c) of the EAA has been disclosed. (Same thought goes for the nine laptops BIS lost over the past few years.)
• All this is a good reason to encrypt reports submitted to BIS whenever possible (i.e. those made semi-annually under License Exception ENC). Send the password separately or just tell Commerce to call you for it.
• Could this incident prove to be more grist for the mill of the China hawks? Watch for someone to claim that this was an attempt by the Chinese military to gain access to sensitive American technologies in anticipation of the rollout of the proposed China military end-use rule, thereby making this proposal all the more vital. My vote's for Dana Rohrabacher, but other nominations are welcome. (Even if this were the intent of the hackers -- far from obvious that it was -- wouldn't it make more sense to wait for the rule to go final, triggering a big jump in license applications with detailed technical attachments?)

UPDATE: Rebecca MacKinnon passes on a plausible explanation of a tactic which may have been used by the people who attacked the BIS network:

This fits with something I recently heard from somebody who has long worked in Washington's China policy circles. A number of his contacts in various U.S. government agencies have recently been receiving e-mails that appeared to be sent from his e-mail address, including cleverly-labeled attachments with titles indicating subject matter that he might actually be inclined to share or discuss with these people. Except that they weren't from him - whoever sent them was spoofing his address, and the attachments contained malicious software that would enable somebody to take remote control of the computer of whoever was unfortunate enough to open the attachment....

LATE UPDATE: Bruce Schneier has a useful reminder:

...I have no way of knowing if this information was breached or if that's what the hackers were after, but it is interesting. On the other hand, any crypto product that relied on this information being secret doesn't deserve to be on the market anyway.

Thank You for Not Calling

I hesitate to write this lest I give anyone working at BIS, DDTC or OFAC any ideas, but here goes...

The agencies which collectively make up the American export control commissariat may be unlikely to win any customer service awards any time soon, but at least they will generally answer your calls (DDTC licensing officers excluded of course). Not so lucky are our British cousins, whose export control regulators at the DTI have officially, not to mention rather brazenly, decided to stop picking up the phone. And you guessed it, this act of bureaucratic nonchalance is being sold as a "change" to help DTI "respond more effectively to enquiries". There is an opportunity to provide "feedback on this new service", but no phone number was provided, natch.

Tip o' the hat to Keith O'Leary for the link.