Dangers of U.S. Export Control Law & the Cybersecurity Market

Andrew Bigart

This article examines the export controls applicable to the field of cybersecurity, an increasingly global industry in which U.S. companies sell their products and services to multinational companies, U.S. agencies with overseas operations, and even foreign governments, when permitted. The cybersecurity market – both public and private – hit $60 billion in 2011 and is expected to increase steadily over the next several years. Indeed, cybersecurity is one of the few defense “growth” areas to buck recent U.S. budget cuts.

As U.S. companies continue to expand in the market, however, so too does the risk of non-compliance with the confusing web of U.S. laws and regulations that govern export-related activities. U.S. law places the burden of complying with export controls and economic sanctions squarely on U.S. companies and their officers and employees. The cybersecurity industry is no exception, and may be particularly vulnerable to government scrutiny given the strategic need to protect U.S. technological advantages, critical infrastructure, and access to confidential information. In this regard, violating U.S. export laws can result in criminal law enforcement actions, jail time, and significant fines and penalties, including debarment from federal contracting.

U.S. Export Controls

The U.S. government maintains a complex set of regulations that govern the export of goods – including technology, software, and technical data – to foreign countries and specified foreign entities and individuals.

The State Department’s Directorate of Defense Trade Controls (DDTC) regulates the export of defense articles, related technical data, and defense services listed on the United States Munitions List (USML) through the International Traffic in Arms Regulations (ITAR). All manufacturers, exporters, and brokers of defense articles, related technical data and defense services are required to register with DDTC. Registration with DDTC is a prerequisite to applying for export licenses.

The Department of Commerce’s Bureau of Industry and Security (BIS) regulates anything that is not listed on the USML, including the export of commercial and dual-use commodities, software, and technology through the Export Administration Regulations (EAR). Both DDTC and BIS regulate exports depending on an item’s technical characteristics, destination, end-user, and end-use. In this regard, cybersecurity products and services present a challenge because the exports may contain a mixture of different software, encryption functions, and controlled technical information.

Finally, although not the focus of this article, it’s import to note that the Department of Treasury’s Office of Foreign Assets Control (OFAC) enforces trade embargoes and economic sanctions against specific countries (Cuba, Iran, North Korea – you get the picture) and individuals and entities (terrorists, narcotics traffickers and other bad guys). OFAC publishes the names of these ne’er-do-wells in the “Specially Designated Nationals” or “SDN” list. (BIS also maintains several lists of prohibited persons). Together, the Commerce and State export controls and OFAC sanctions programs are designed to protect U.S. foreign policy interests and to prevent U.S. persons from doing business with the wrong types of customers.

Classifying Cybersecurity Products and Services for Export Purposes

Whether an export license or other authorization is required for the export of a cybersecurity product is a fact-specific determination that includes a review of the items or services being exported, the destination, end-user and end-use. Given the complexity in classifying cybersecurity-related items, many companies request commodity jurisdiction determinations from the export agencies for guidance on whether their products are properly classified under the DDTC or BIS frameworks. These determinations, which are published, in part, by DDTC and BIS, highlight the breadth of USML and EAR classifications that potentially cover cybersecurity products and software. For example, DDTC has advised that a company’s “Customizable USB thumb drive that conducts targeted searches of digital assets for critical files” is classified under the USML section XI, which covers military electronics, as are certain military-grade GPS and cryptography products.

On the other hand, data manipulation software that uses Security Socket Layer (SSL) encryption usually qualifies for BIS’s “Mass Market Encryption” exception for items classified under Export Control Classification Numbers 5A992 and 5D992. This exception allows certain “publicly available” software to be exported to most countries without a license if the exporter registers with BIS by obtaining an Encryption Registration Number.

Moreover, both DDTC and BIS regulations define an export as including the disclosure (orally or visually) of technical information or software to a foreign person. Thus, a “deemed export” takes place when technology or software is released to foreign a person or national for visual inspection (such as reading technical specifications, plans, blueprints, etc.); when technology is exchanged orally with a foreign person or national; or when technology is made available by practice or application to a foreign person or nationals under the guidance of persons with knowledge of the technology. Depending on the nature of the technology and the country to which the technology is disclosed, releasing technology to a foreign person or national may require an export license (or in the case of ITAR possibly a Technical Assistance Agreement, depending on the individual circumstances).

Why Should The Cybersecurity Industry Care?

As the importance of cybersecurity has grown from a national defense perspective, so too has the U.S. government’s focus on regulating the export of sensitive technology. A number of recent U.S. government enforcement actions involve U.S. persons selling software, encryption products, and other cybersecurity related information abroad:

• In 2010, a resident of China was sentenced by a federal court to serve 96 months in prison for his efforts to obtain sensitive encryption, communications, and global positioning system equipment without a DDTC license.
• In 2009, a U.S. national working for Technical Integration Group was sentenced to six years in prison and paid $1.1 million for exporting mobile telecommunications equipment containing encryption properties to Iraq, in violation of the then U.S. embargo on Iraq.
• In 2008, two companies paid administrative penalties to settle BIS allegations that the companies exported U.S.-origin engineering software to Iran and to companies on the BIS Entity List without the required licenses.
• In 2002, Neopoint Inc. paid a $95,000 civil penalty to settle charges that it unlawfully exported 128-bit encryption software to South Korea.

The consequences for non-compliance with U.S. laws overseas are severe and can include large monetary fines per violation for businesses, and similar monetary fines and imprisonment for individuals. On top of that, in cases of significant violations, the consequences can include a denial of future export privileges and federal contract debarment, which is particular onerous for cybersecurity companies dependent primarily on business from U.S. government contracts.

What Can My Company Do To Minimize Risk When Selling Abroad?

The first step in minimizing export-related risk is to understand the nature of your business and potential customers, including the who, what, and where of every export transaction. The U.S. government expects companies that export to inform themselves of the facts of any export transaction and exercise reasonable care in complying with applicable U.S. export requirements. This process requires companies to determine the appropriate export classifications for their products and services. If any of your products or services falls under the USML, then you must register with DDTC as a manufacturer, exporter, or brokerer.

The next step is to develop a compliance plan that is tailored to your company’s specific export needs. A compliance plan should address, at a minimum, the following:

• Overview of applicable laws;
• A list of prohibited activities and employee responsibilities;
• Regular compliance training for employees;
• Required checking of all business partners and customers against OFAC’s SDN list on a transactional basis;
• Rigorous internal financial and audit controls to monitor export and FCPA compliance; and
• Required due diligence on all agents or independent contractors and required written contracts with export, economic sanctions, and FCPA prohibitions and certifications.

Finally, under U.S. law, exporters that become aware of – or should be aware of – “red flags” are required to resolve them before proceeding with a transaction. Monitoring the activities of your business partners overseas is particularly important because the conscious avoidance of knowledge of wrong doing is not a defense. Typical red flags include:

• Transactions with incomplete information regarding end users, country of origin or destination;
• Exportation of products that do not not fit the buyer’s line of business;
• Unusual contract terms, payments in cash, or requests for high commissions;
• Direct or indirect payments to government officials or their families or payments to persons outside the normal scope of a transaction;
• Payment for travel, lodging, or business expenses or extravagant gifts or entertaining of government officials or their families; and
• Consultants who are connected with a foreign government or political party.

What if a Potential Violation Arises?

Unfortunately, for some companies the legal risks of doing business abroad are not apparent until something goes wrong. If you discover questionable business practices regarding your export-related activities, stop the conduct in question immediately and report the activities to your company’s compliance officer. If your company finds itself in such a position, consider the option of a voluntary disclosure. Each of the agencies discussed above – Commerce, State, and OFAC – maintain procedures that encourage companies to self-report violations under certain circumstances. Although these programs do not allow companies to evade liability completely, they do offer reduced penalties and other incentives.

Conclusion

There is no doubt that the export market for cybersecurity products and services remains an attractive and growing market for U.S. exporters. Before taking the leap overseas, however, take the time to review and understand your company’s responsibilities under U.S. export control and economic sanctions. An ounce of prevention in this regard goes a long way in keeping your business profitable and out of trouble.

Eric Savitz, Forbes Staff  -  Guest post written By Andrew Bigart
Andrew Bigart is an associate with Venable LLP, a Washington-based law firm.
Newscribe : get free news in real time   

Related posts:
 Washington seeks to extend hegemony to trade

China successfully launches two more Beidou navigation satellites

China has moved a step closer to completing its own navigation and positioning satellite network with the launch of two more navigation satellites.

China plans to launch 35 navigation satellites

It brings the Beidou system, which became operational with coverage of China last December, to 13 satellites.

To have global coverage, the country eventually aims to have 35 satellites in orbit by 2020.

China hopes that Beidou will wean it off the US Global Positioning System.

Just like GPS, the Chinese system is designed to let users determine their positions to within a few meters.

Beidou, also known as Compass, has been developed for both military and civilian uses.

The two satellites went up on Monday morning from the Xichang Satellite Launch Centre in southwest Sichuan province.

They were carried on a Long March-3B rocket, according to the state-run Xinhua news agency.

"The two satellites will help improve the accuracy of the Beidou, or Compass system," Xichang Satellite Launch Centre said in a statement carried by the agency.

• Sat-nav systems determine a position by measuring the distances to a number of known locations - the spacecraft constellation in orbit
• In practice, a sat-nav receiver will capture atomic-clock time signals sent from the satellites and convert them into the respective distances
• A sat-nav device will use the data sent from at least four satellites to get the very best estimate of its position - whether on the ground or in the sky
• The whole system is monitored from the ground to ensure satellite clocks do not drift and give out timings that might mislead the user

Now partially operational, Beidou makes China only the third country in the world, after the US and Russia, to have its own navigation system.

Russia's Glonass satellite network has 31 satellites in orbit, but only 24 of them are operational. Four more are in reserve, one undergoing trials, and two under maintenance.

According to the Russian Space Agency, Roscosmos, Russia plans to spend $694m (£427m) on its Glonass system this year.

At a recent annual Satellite Navigation Forum in Moscow, Russia's deputy prime minister Vladislav Surkov said that more than 300 billion roubles (£6bn, $10.2bn) have been budgeted to further develop Glonass and bring 30 satellites into operation by 2020.

Europe has also been building a navigation system, called Galileo, which has two satellites in orbit, launched in October last year. The next two are scheduled to follow later this year.

The space project of the European Commission, the EU's executive arm, plans to have all 26 Galileo satellites in orbit by the end of 2015. - BBC Newscribe : get free news in real time

Play Video

China has successfully launched a pair of navigation satellites. The launch took place on Sunday Morning from Xichang Satellite Launch Center and marks the first time the Long March 3B launch vehicle has been used for this kind of mission.

The Compass Navigation Satellite System is China’s second-generation satellite navigation system, capable of providing continuous, real-time passive 3D geo-spatial positioning and speed measurement.

The Long March-3B rocket carrying two satellites blasts off from the launch pad at the Xichang Satellite Launch Center in Xichang,southwest China's Sichuan Province,on April 30,2012.China successfully launched two satellites into space Monday morning,the 12th and 13th of its indigenous global navigation and positioning network known as Beidou, or Compass system,the launch center said.(Xinhua/Tao Ming)

Related posts:
China implements Beidou navigation satellite system ...
Chinese Rocket Launches New Navigation Satellite

Bersih 3.0: the good, bad and ugly Malaysians

When people who want change take to the streets, some stick to the perimeters of the law while others, with ulterior motives, break barriers and turn things unruly. 

BERSIH 3.0 co-chairman Datuk Ambiga Sreenevasan's call for people to show their displeasure and demand for electoral reforms on Saturday brought out thousands of Malaysians from all races and walks of life in a colourful expression of free will.

But Ambiga's calls also brought out the professionals the hardcore saboteurs who dreamt of regime change and the provocateurs who simply wanted chaos and trigger a mass protest that could eventually lead to the toppling of a democratically-elected government.

These people dream of sustained protests on the streets that eventually drive away tourists and worry investors.

Taking law into their own hands: Rioters using sticks and helmets to smash a car carrying the TV3 news crew as it was leaving Jalan Tun Perak, Kuala Lumpur, in 1999, soon after the verdict on Anwar was delivered.

 

Such sustained protests were last seen during the reformasi years in the 1990s with the arrest and jailing of the then Deputy Prime Minister Datuk Seri Anwar Ibrahim.

The same man was present on Saturday, after warning months earlier that Middle East-style protests could hit South-East Asian countries if the reforms were delayed.



If Ambiga thought she could keep everyone within limits, then she was sadly mistaken.

Different people read differently into a mass protest and the hardcore politicians in the crowd have other ideas too.

Reportedly, PKR deputy president Azmin Ali had egged on the crowd to break down the police barriers at Dataran Merdeka that were put up due to a court order declaring the place “out of bounds”.

Ambiga had given the order to disperse at about 3pm, but some marched forward and broke thorough the barriers.

They pelted a police car with bottles and stones, jumped on it and smashed the windscreen and later overturned it. They then attacked a police motorcycle and tried to grab a policeman's gun.

The attack on the police car was reminiscent of an incident in 1999 when a TV3 car was set upon during the reformasi protest.

At a press conference later, Ambiga expressed shock over the turn of events.

The initial carnival mood where people were giving flowers to FRU personnel, who reciprocated by wearing them, was hijacked by a section of the crowd.

Ambiga described the violence as “highly unusual” and suspected that it could have been instigated by agent provocateurs.

The problem is that while Ambiga heads a civil rights movement which is winning support by the day from young people, who incidentally make up the bulk of new voters, she has chosen to tie that movement with Opposition politics.

She has given Opposition leaders an opportunity to ride on the Bersih movement.

Ostensibly, independent non-politicians fill the Bersih steering committee but they are also enthusiastic Pakatan Rakyat supporters.

The Opposition leaders are hardened politicians who have served time in jail, have courted arrest many times and are willing to take greater risk to trigger mass action.

During the two previous Bersih rallies in November 2007 and July 9 last year, a similar scene took place; a section of the crowd taking over the protest and turning it violent.

The same police force, which was peaceful in the morning, was forced to fire tear gas and arrest protesters in the afternoon.

It brings to mind DAP vice-chairman Senator Tunku Abdul Aziz Tunku Ibrahim's warning that by not using the stadiums offered, Bersih 3.0 “encourages Malaysians to break the law”.

He had said he supported an individual's constitutional right to assembly but felt that it must be exercised within the provisions of the law. “As a lawmaker I am not willing to break the law.”

That same advice could also apply to Ambiga, a lawyer, but for politicians who desire regime change it is another matter.

The clock has been turned back on a burgeoning civil rights movement, and what could have been a shining example of peaceful protest, turned into a violent demonstration.

There were no warnings of reprisals in the days leading to Bersih 3.0, no roadblocks set around the city and no arrest of people streaming in for the protest.

But all that was blown away after some protesters breached the police barriers.

Many of the protesters who turned up on Saturday were those who genuinely wanted to bring about positive change. They had meant well and they represented middle Malaysia.

And, for the thousands of young Malaysians who braved Ambiga's call for a sit-in protest over the slow pace of electoral reforms, it was their first baptism of fire and one that they can wear as a badge of honour.

Comment by BARADAN KUPPUSAMY

Related posts:
Bersih 3.0 rally: Malaysia braces for electoral reform protests 
More than 20,000 Malaysians march for election reforms, Bersih 3.0 rally 
Malaysian police fire tear gas at more than 25,000 protesters, Bersih 3.0 rally 
When the Malaysia's Elections will be after Bersih 3 & Occupy Dataran? 
More tests for Malaysian democracy

A father's lament: The real world is not a game!

Learning should be fun, but that doesn't mean we should be trying to hook kids into playing computer games that just happen to teach. 

There was something about the Mama Bear family tech conference a week ago that creeped me out. I am the father of a 5-year-old boy, and perhaps a third of the people at this conference were trying to build apps for him. All the apps were well-intentioned. All were, at some level, educational.

Still, all the apps felt wrong to me. I wanted my son to have nothing to do with any of them.

I've been trying to understand why these educational apps were getting under my skin to this extent. It's not like I'm anti-technology when it comes to my child. He plays Angry Birds. We watch TV (together). He's a child of technology; how could he live in my house and not be?

A psychiatrist friend, listening to me rant about how these apps are trying to wilt my son's brain, sympathized, but not completely. Yes, he said, computer games can be addictive. In fact, in his opinion, teaching kids to expect the world to work like a computer game deprives them of learning real-world life skills.

But, he said, a truly good educational app can be effective like a book, or a teacher. You can't stick everything that pops up on a kid's iPad into the "evil" category.

So where are the really good apps?

The Vinci Tab II is an Android tablet preloaded with educational software for kids up to 5 years old. 

(Credit: Rafe Needleman/CNET)

A few days ago, I handed my son a Vinci tablet to try out. This is another well-intentioned product for young children. It comes with pre-installed educational games carefully geared to kids up to about my son's age (actually he's a little old for it, but I occasionally make him earn his keep as a product reviewer).

I had the same feeling of foreboding about this product as I did about many children's apps I see. The Vinci reinforced this, unfortunately. While the game did in fact have educational payloads, the mechanics were, for the most part, dumb. How does pressing a button at exactly the right time to jump over a beach ball on-screen teach anything but how to operate a game, no matter what the game says it's supposed to be about?

The boy liked the tablet and its apps. But it's how he liked them that bothered me. The software sucked him in, and whatever lessons it tried to teach him were obstacles that seemed about as interesting as the flatly drawn beach balls. The real red flag came when I told my boy it was time to put the tablet down. He was so dialed in to the game mechanics that he panicked. He wasn't in learning mode, he was in addiction mode.

Did he retain the factoids and basic math and spelling skills he learned while playing? I think so. But I don't want him learning this way.

There is hope, though.

On the DIY app, kids snap pictures of their projects. On the Web site, shown, family and friends can award badges.

(Credit: Screenshot by Rafe Needleman/CNET)

 

Yesterday, I read about the launch of DIY, a site and app for kids that's supposed to be a social destination for them to share their creative projects. They upload photos of stuff they've designed, built, written, or drawn, and then their friends and family members can award them badges.

Something about this site appealed to me as a father. Why was it better than all the learning games, with their impressive educational pedigrees? I couldn't put my finger on it. So I called up DIY's CEO, Zach Klein (formerly of Vimeo). Klein isn't a father himself, but he understands the child's mind. In a few words he crystalized for me what I find distasteful about most kids' programming.

"They are gravity-fed," he says. "There's a path of least resistance to get to the next screen." The player's job is to find that path, he says. Games like this "infantilize children."

The real world doesn't work like this. There are no shortcuts in life. You don't get a big reward for each tiny action. Real rewards take real work.

DIY, he says, "gives children more responsibility than they are used to, not less." And the rewards aren't programmed. They come from peers and family. "We want kids to feel satisfaction, but we're suggesting it will take time and craft and love to earn it."

DIY is in a very early stage, and is too basic at the moment. In the interest of protecting kids, there's no personal information anywhere on the system; kids' identities are masked behind handles, and if a family member awards a kid a sticker, the kid can't see who it came from. But the thinking of DIY is right, at least to me: Encourage kids to engage with the real world. Use social-networking mechanics to reinforce it.

I loaded the DIY app on to my old iPhone 3G. I plan to let my boy use the app on this device without supervision. It's the first app I've seen that passes that test for me. I'm not sure he'll use it, but I bet he will. And I like it, because it's an accessory to his physical world, not a replacement for it.

Rafe Needleman

Rafe reviews mobile apps and products for fun, and picks startups apart when he gets bored. He has evaluated thousands of new companies, most of which have since gone out of business. Feeling lucky? Send pitches to rafe@cnet.com. And watch Rafe's tech issues podcast, Reporters' Roundtable.

Newscribe : get free news in real time

Related posts:
Cyber addicts, angry mum sets up 'rehab' centre for you!
CYBER bullying, a worldwide big problem
Cyber crooks target gamers
Cyber crooks target gamers; E-gambling dens menace ...

When the Malaysia's Elections will be after Bersih 3 & Occupy Dataran?

Elections won’t be in June

The probability of the Prime Minister calling for polls in June will be unlikely from a strategic planning point of view.

FORGET about June; the more likely time for the polls will be in the first week of September.

If Bersih 3.0 and Occupy Dataran were meant to peak before the polls, then they have been premature.

On the government side, while the Prime Minister has made several nationwide trips, his series of visits, which emphasises his government transformation plans on services for the people, has only just started.

Both sides have also not finalised their list of candidates despite their bravado in making declarations that they are ready for elections.

With a tough fight ahead, being winnable candidates is not good enough; they have to be trustworthy too. Both sides do not want defections after the general election.

This is especially so for Pakatan Rakyat whose elected representatives defected after the polls.

For the Barisan Nasional, it would not want to deal with a situation similar to Datuk Seri Anwar Ibrahim’s attempt to woo Barisan MPs to cross over.

So far, only the DAP’s Karpal Singh has consistently argued for a law to stop defections. The rest from both sides have refused to be drawn into such a commitment, preferring perhaps to keep the options open.

Then there is the matter of seat swapping. Both sides are still at the negotiation table and, in the case of Pakatan Rakyat, the unhappy components have gone to the media to voice their frustrations.

In Sabah, the local opposition want the Pakatan Rakyat to stay out but the DAP, especially, is adamant in contesting. It will lead to a crowded fight if no compromises are made within the opposition.

In the Barisan, the seat-swapping issue is still being sorted out and has not even gone to the supreme council level yet.

Datuk Seri Najib Tun Razak’s diary is packed with commitments, including overseas visits. The media has already been informed of his trips to the United Kingdom and United States in mid-May.

It does not look like a red herring as planning for his meetings has been completed and he would also take a short holiday with his family after his official duties, which include meeting members of the Global Science and Innovation Advisory Council in New York.

The council was set up to enable the country to make a quantum leap from a middle-income status to a high-income one.

By the time Najib returns, it would be the last week of May, and calling for polls in June will be unlikely from a strategic planning point of view.

The push for rural votes – the core of Umno’s support – will continue in June, especially after the windfall for Felda settlers has been declared from the listing of Felda Global Ventures Holdings (FGVH) Bhd, either in end May or early June.

The windfall will be in two forms – cash and equity – but the excitement would be the amount of the quantum. But word is that the rewards would be good.

Over the next few days, Najib will also be announcing details of the minimum wage plan and there is also talk that the Government will unravel the nine-month Malaysia Airlines-Air Asia alliance as early as Wednesday.

The alliance has been a source of discontent for the 22,000-strong staff of the national flag carrier. Their number is big, and given the fact that they are believed to be supporters of the ruling coalition, and their family members who are voters would be too, this issue is significant.

Over in Sabah and Sarawak, there will be two major celebrations – the Kaamatan festival of the Kadazandusun community on May 30 and 31 and Gawai for the Sarawakian Dayaks on June 1 and 2.

As these festivals are the most important events on the calendars of the two main communities in these states, no one would be expected to campaign for elections during this period.

Many Sabahans and Sarawakians, especially those working in the peninsula, are also expected to take a long break at this time.

Those who talk about a June 9 general election obviously have no idea of what’s happening in Sabah and Sarawak.

By July, it will already be the fasting month, which means there won’t be any election campaign. After this, the whole month of August will be taken up by the Hari Raya celebrations.

That means the first week of September will be the last window period.

The general election cannot be in late September as the haj season would have begun, ending only in October.

Then there is the Parliament meeting from Sept 24 to Nov 27, where the Budget needs to be tabled.

Once it is tabled, it has to be approved by the Dewan Negara, which means the session will drag on until next year.

If you are planning a holiday or a major corporate event in May or June, go ahead, your plans won’t be disrupted.

In fact, Malaysia is hosting Asia’s largest oil and gas event from June 5 to 7, bringing top people from this industry to Kuala Lumpur.

If you have planned for the Olympics in London, enjoy the Games, which starts on July 26 and ends on Aug 12.

But don’t be away too long because the drumbeats of the general election would be very loud by then.

ON THE BEAT  By WONG CHUN WAI