What Can Hold Up Your International Project?

The term “export controls” is enough to send most people either to sleep or running for the hills.  In the cybersecurity world it can have often unforeseen consequences. Let’s take a look at why this is. In Britain, Export Controls apply to cryptography in a very strange way and the impact can be overlooked until that unfortunate call that tells you your goods have been seized by customs.    By David Hayes
 
How the Controls Work
The easiest way to look at the controls is on a “catch and release” basis. 
Start by considering that any item that uses cryptography, effectively with a key length in excess of 56 bits, called a “described security algorithm” for “data confidentiality” is subject to export licensing.
 
It is tempting to dismiss this as being ridiculous – your phone would be export licensable! This is where the releases or “decontrols” come in.  Depending how they are counted, there are around fifteen separate decontrols. 
 
One of the main decontrols is what Americans call “mass market” and the UK calls the “Cryptography Note” or “Note 3”.  The American expression gives a clear indication of what the term means – it is sometimes informally called the “PC World test” in the UK.
 
There are many other, more specific, decontrols, ranging from items designed for a limited to banking or money transactions to devices limited to certain types of remote industrial monitoring. However, many items that cybersecurity professionals encounter daily are subject to export licensing, including many enterprise servers, firewalls, switches etc.
 
There are a number of assumptions that are made by exporters that often result in practical problems: 
  • I am only upgrading my employer’s global network – not selling the equipment, so I don’t need a licence.
  • I can buy this thing on the internet, so it must meet this Note 3 thing
  • It only uses readily available cryptography, like SSL
  • It’s my laptop and I’m carrying it with me

Only one of these, number four, means that the item does not require a licence.  Even then, any technology stored on the laptop, or accessed from overseas by using the clean laptop, may require a licence in its own right.

Note 3: Cryptography Note
The main provision of the Note relates to items that are generally available to the public by being sold, without restriction, from stock at retail selling points by means of any of the following:
  • Over-the-counter transactions;
  • Mail order transactions;
  • Electronic transactions; or
  • Telephone call transactions;
There are other elements, relating to whether the cryptography can easily be changed and to ease of installation but availability is the primary driver.
 
Different EU regulators take very different positions on the cryptography note, with some offering significantly more flexibility to exporters than others. The note is notoriously subjective and the UK’s interpretation is equally notoriously conservative, e.g. most satellite communications items are regarded as being export licensable. 
 
In classifying or decontrolling under Note 3, or more specifically the so-called “Note to Note 3”,  a regulator can take into account any factors it considers relevant - in essence, if the regulator wants an item to be controlled it is controlled.  Factors that may be considered include price and typical user - but not in isolation and not on a level playing field between products.  Product A at £10k may be ruled No Licence Required (NLR) under Note 3, while product B at £7k is ruled controlled, depending on the position of each in the market for that type of product and who are the typical purchasers of each.
 
Cryptography Exports – A suggested approach
Firstly, develop an understanding of your equipment, software and technology against the dual-use control list.  The current UK list can be found at: UK Strategic Export Control Lists
 
Look at Category 5, Part 2 Information Security: If you have a need to export from the UK items that use cryptography with a key length in excess of 56 bits, start from the position that, prima facie, these are export controlled. Can you document a rationale for why the item you are assessing meets a decontrol? If not, your item is licensable.  It may be that you are upgrading your own company infrastructure or exporting temporarily to a trade fair or a multitude of other “innocent” uses; it matters not! 
 
When exporting cryptography, a major arms manufacturer, a supermarket company and the world’s largest manufacturer of rubber ducks are all equals.
 
Finally, when dealing with the plethora of cryptographic items exported from the United States as “mass market”, or with a US Export Control Classification Number of 5*992 (where * is A-E), it is NOT safe to assume that the UK regulator will agree with the US decision.  You may well need a licence. Don’t forget that US origin items are often subject to US law outside the US.  US law ‘attaches’ to the item and compliance with US law by foreign nationals is expected and enforced.
 
David Hayes has many year’s experience in export controls, from the varied perspectives of regulator, Head of Compliance for global companies and is a highly as a successful independent consultant:  https://davidhayes-exportcontrols.com/
 
You Might Also Read:
 
Killer Robots For Export:
 
 
« US Police Display Powerful New Surveillance Tools
Taiwan's Entire Population Database Stolen »

Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Perimeter 81

Perimeter 81

Perimeter 81 is a Zero Trust Network as a Service designed to simplify secure network, cloud and application access for the modern and distributed workforce.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Free Access: Cyber Security Supplier Directory listing 5,000+ specialist service providers.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Evidian

Evidian

Evidian, a Bull Group company, is the European leader and one of the major worldwide vendors of identity and access management software.

ICSA Labs

ICSA Labs

ICSA Labs provides third-party testing and certification of IT security software and products, as well as network-connected devices.

H3Secure

H3Secure

H3 Secure focuses on Secure Data Erasure Solutions, Mobile Device Diagnostics and Information Technology Security Consulting.

Absolute IT Asset Disposals

Absolute IT Asset Disposals

Absolute IT Asset Disposals is an IT asset disposal (ITAD) company providing safe and secure recycling of IT assets.

CaliberDLT

CaliberDLT

CaliberDLT provides quality assurance, automation, security audits and development services for blockchain technology.

DMARC360

DMARC360

DMARC360 analyzes your email traffic patterns and sources, rapidly deploys email authentication protocols and monitors your email domains with automated recommendations and incident response.

Pixm

Pixm

Pixm’s computer vision based approach offers a truly unique and effective means to protect organizations from web-based phishing attacks.

Alertot

Alertot

Hackers attack minutes after a new vulnerability is published. Alertot helps to decrease exposure time in organizations by notifying new issues when they are disclosed.