New rules updated treatment of electronically transmitted and stored technology and software. The most significant change under the new rules is the decontrol of sending, taking, and storing of certain encrypted technology or software. Under the new rule, sending, taking, or storing this type of technology or software will not constitute an export if the technology or software is:
- Secured using “end-to-end encryption."
- Secured using cryptographic modules (hardware or software) compliant with Federal Information Processing Standards Publication 140-2 (FIPS 140-2) or its successors, supplemented by software implementation, cryptographic key management, and other procedures and controls that are in accordance with guidance provided in current U.S. National Institute for Standards and Technology publications, or other equally or more effective cryptographic means.
- Not intentionally stored in a military-embargoed country (Country Group D:5, per 15 CFR Supplement No. 1 to Part 740) or in the Russian Federation. Note: data in transit via the Internet is not deemed to be stored.
- The technology or software will not be in unencrypted form while between the originator and recipient or these parties’ respective “in-country security boundaries."
- The means of decryption will not be provided to a third party.
Furthermore, the final rule of 2016, includes language which states that “access information,” such as decryption keys, passwords, or other information that allows access to encrypted data sent, taken, or stored under this provision, is subject to the same export control requirements that apply if the data were not encrypted. The EAR also contain an important limitation that releasing decryption keys or other access information that will permit a foreign person access to technology or technical data will constitute an export and be subject to the export control restrictions applicable to the foreign country in question. In addition to maintaining the requisite level of encryption, the university will need to establish ongoing data security practices to take advantage of this provision.
Such revisions make feasible a wider variety of cloud computing and cloud storage solutions, and significantly simplify associated compliance with export controls, relative to EAR controlled technology and software. However, the EAR also contain an important limitation that releasing decryption keys or other access information that will permit a foreign person access to technology or technical data will constitute an export and be subject to the export control restrictions applicable to the foreign country in question.
In addition to maintaining the requisite level of encryption, institutions will need to establish ongoing data security practices to take advantage of this provision. It is important to keep in mind that these changes do not apply to ITAR controlled technical data, with respect to which restrictions on the use of the cloud have not changed. ITAR data may not be placed on shared infrastructure managed by non-US-Persons or alongside other organizations who do not have a license to export as defined in 22 CFR 120.17 and 22 CRF 120.13.
Don’t forget contractual obligations. In addition to the requirement to comply with U.S. export regulations, externally funded research and sponsored projects may contain contractual restrictions on the release of information that could include prohibition on the use of cloud computing services or third-party digital data storage. Failure to comply with contractual restrictions could result in a breach of contract and if the contract is federally funded, possible civil or criminal and penalties may be applied.
