Electronic Commerce and Export Controls

By Alan Gahtan - LEXPERT Magazine, November 1999

The expansion of Electronic Commerce means that businesses will be able to more easily market their products and services to new foreign markets (using the Internet to effect the sale but then using traditional distribution channels to physically ship the goods), and that where products are available in digital form (for instance, books, music, graphics, photographs, software, technical information, etc.) then such products can be both sold and transferred to the end consumer directly through the Internet. In either case, this means that Canadian businesses will increasingly have to consider the application of Canada's export control regimes to their activities.

Most business lawyers are aware that certain types of goods, such as those that contain encryption capabilities, may be subject to export controls. Many common types of software programs, including browsers, word processing programs, database programs, and others incorporate encryption functions and are therefore within the scope of such controls. Until now, Canadian businesses have been able to benefit from fairly liberal exemptions. However, changes are expected soon in respect of goods incorporating cryptography in either hardware or software. Also, the distribution directly through the Internet of any types of goods must be designed so that the goods cannot be transferred to residents of certain designated countries.

Overview of Canada's Export Control Regime

Export controls exist in order to fulfil Canada's obligations in bilateral and multilateral agreements. They are designed to prevent or regulate the movement of certain goods by controlling the sources of supply. From 1950 to 1994, Canada was a member of the Coordinating Committee for Multilateral Strategic Export Controls (COCOM). On March 31, 1994, COCOM ceased to exist and the former COCOM members agreed to establish a new multilateral arrangement known as the "Wassanaar Arrangement on Export Controls for Conventional Arms and Dual-use Goods and Technologies."

In order to export goods that are (i) destined for a country on Canada's Area Control List (ACL), (ii) on Canada's Export Control List (ECL) or (iii) of U.S. origin, an exporter must first obtain a federal export permit from the Department of Foreign Affairs and International Trade (DFAIT). Regardless of the product, any goods going to a country on the ACL require a permit before they can be exported. Similarly, any nation that is embargoed by the United Nations (e.g., Iraq) may require additional approvals over and above any export permit which may be required.

Any specific types of goods listed on the ECL require permits for export regardless of the destination. The ECL includes strategic goods and technologies such as those that have military uses or which have dual military and non-military uses. Cryptographic products are included on Canada's ECL.

Goods which originate in the United States are also controlled for re-export from Canada. In most cases, exporters can benefit from General Export Permit 12 (sort of like a blanket exemption which avoids the need to obtain individual export permits) which generally permits re-export of U.S. origin goods (subject to Canada's export control rules) except to certain designated countries.

Cryptographic Products

The Wassanaar Arrangement obligates the imposition of controls on the export of hardware and software products which incorporate cryptographic capabilities. However, the Wassenaar Arrangement provides certain flexibility which is utilized to a greater extent by some countries. While Canada already permits the export of cryptography products that are generally available to the public in Canada (under a "mass market" exemption), in a Notice to Exporters issued December 23, 1998, the Government outlined proposed changes, expected to take effect before the end of 1999.

Some of these proposed changes would remove certain goods from control and therefore can be expected to have a positive effect on Electronic Commerce. For instance, controls are expected to be lifted from goods performing authentication, supporting digital signatures, where the cryptographic capability is not user-accessible, is designed and limited to banking use or money transactions, and from goods which employ a symmetric algorithm with a key length of 56 bits or less (in English, this means weak strength encryption which can now be easily broken).

However, Canada, along with the other Participating States also agreed to drastically narrow the availability of the current "mass market" exemption. The existing rules exempt software which is "generally available to the public" and which is "designed for installation by the user without further substantial support by the supplier." The new rules impose additional requirements: the cryptographic functionality must not be easily changeable by the user, and the product must not contain a symmetric algorithm employing a key length exceeding 64 bits (in other words, it must not support "strong encryption"). These restrictions do not prohibit exports which do not meet these requirements, but rather require the exporter to obtain an export permit. The proposed changes would also not alter the ability of Canadians to use, develop or import any strength of cryptographic products

These restrictions can be expected to hurt Canada's developing cryptography industry which relies heavily on exports, and will likely mean further impediments to products designed to support electronic commerce. However, Canada has indicated that, as soon as practicable, it would issue a General Export Permit for mass market software employing a symmetric algorithm with a key length not exceeding 128 bits (in other words, which supports what is today considered to be strong encryption). Also, these regulatory changes will not affect the export of cryptographic goods and techniques to the United States (where there will continue to be no permit requirements for exports of cryptographic goods from Canada). It should also be noted that the U.S. announced certain policy changes on September 16, 1999 which may affect Canada's announced approach.

Implications for Electronic Commerce

Businesses who use the Internet to expand their sales to foreign countries will need to ensure that such countries are not on Canada's ACL, and are not subject to U.N. embargo. Furthermore, if the goods in question are of U.S. origin, then compliance with the additional restrictions imposed by the U.S. will also be required.
Technical means should be incorporated into any Web site from which goods in digital form is intended to be distributed using the Internet to ensure that such goods are not distributed in contravention of Canada's export control laws.
In the case of goods which incorporate encryption functionality, changes to Canada's mass market exemption will need to be carefully monitored. Also, it is important to note that, unlike Canada and the U.S., certain other countries may restrict the importation or use of encryption technology.

© 2005 Alan M. Gahtan. All Rights Reserved | Use is subject to these Legal Terms
Disclaimer: Not all materials may be applicable in your jurisdiction. Not intended to be a substitute for professional advice. No implied endorsement of, or affiliation with, any linked sites. Path to individual pages may change - please link to home page only. Linking Info