This website uses cookies for a range of purposes to help us understand your interests and improve the website. By using our website, you acknowledge the use of essential cookies and consent to the use of non-essential cookies, as described in our Cookie Policy. To understand more about how we use cookies or to change your preference and browser settings, please see our Cookie policy

Back toArticles
Advanced
Filters

Canadian Government Launches Consultations on Encryption Controls

Yesterday, Foreign Affairs and International Trade Canada’s Export Controls Division (ECD) launched its "Consultation on the International Interpretations of the Wassenaar Arrangement Cryptography Note by Wassenaar Arrangement Participating States." These consultations will be of particular significance for companies engaged in the export or transfer from Canada of encryption goods, software or technology or items that have been designed or modified to use or work with encryption.

Encryption controls have been a challenge for many Canadian software and hardware vendors. Category 5 — Part 2 of Canada’s Export Control List identifies information security items that require a permit in order to be exported from Canada to destinations other than the United States. Because the threshold for control is very low — key lengths in excess of 64 bits (in the case of symmetric algorithms) — many vendors have been surprised to learn that the export or transfer of their encryption goods and technology requires a permit before shipment to their foreign customers. Often, they first discover this when the Canada Border Services Agency detains these goods just prior to export. Failure to obtain a permit prior to exporting or transferring controlled goods or technology can attract significant penalties.

Mass Market Exemption

Many vendors who may be aware of the encryption controls are of the view that they qualify for an exemption because the encryption functionality of their product is based on open source, publicly available encryption libraries or because their product or technology is "mass market." With regard to this latter basis, the ECL’s Cryptography Note provides an exemption for encryption items if they meet all of the following criteria:

  1. they are generally available to the public by being sold, without restriction, from stock at retail selling points by means of over-the-counter transactions, mail order transactions, electronic transactions, or telephone call transactions;
  2. their cryptographic functionality cannot be easily changed by the user;
  3. they are designed for installation by the user without further substantial support by the supplier; and
  4. when necessary, details of the items are accessible, and will be provided, upon request, to Canadian authorities in order to ascertain compliance with the above conditions.

These encryption controls and exemptions are based on the 1996 Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technology agreed to by Canada, the United States, and 38 other Participating States. These requirements are incorporated into the domestic laws of Participating States and then subject to the interpretation and enforcement policies of each state.

Contrast With U.S. Interpretation

In the past, the ECD has narrowly interpreted this exemption in many cases to be restricted to retail transactions with consumers. This is to be contrasted with the experience of many vendors in the United States who appear to be able to qualify their encryption items for the mass market exemption based on a broader interpretation employed by the U.S. Department of Commerce under the review procedures for mass market encryption commodities and software set out in Section 742.15(b)(2) of the U.S. Export Administration Regulations.

Because of the administrative burden and delays imposed by having to obtain permits prior to shipment of controlled goods or transfers of related technology, and its impact on the just-in-time business models employed by many, a more liberal interpretation of the mass market exemption in the United States and other countries can put Canadian software and hardware vendors at a competitive disadvantage in their export markets.

ECD Consultations

The ECD’s consultations have been launched with a view to seeking input on the mass market exemption from Canadian companies that have obtained either (i) a formal government ruling from the United States or another Wassenaar Participating State in respect of an item assessed as complying with its mass market exemption; or
(ii) supplemental information issued by a Participating State’s export control authority clarifying any of the provisions of the mass market exemption, including a presentation, briefing, or correspondence issued by the government authority.

The ECD is requesting specific information regarding these materials and has undertaken to treat all submissions received as company protected information. Submissions are due by April 30, 2010. More information can be found at http://www.international.gc.ca/controls-controles/about-a_propos/expor/Wassenaar_crypto.aspx?lang=eng.

McCarthy Tétrault’s International Trade and Investment Law Group has significant expertise in encryption controls, and regularly assists clients in developing solutions to compliance and enforcement issues in this area. We are available to advise on these or any other export control, economic sanctions or trade matters.

Authors