Canada, as a Participating State of the Wassenaar Arrangement, controls cryptography under Category 5, Group 1 of its Export Control List. The threshold for control is relatively low — e.g., cryptography having a symmetric algorithm employing a key length exceeding 56 bits. Those seeking to export or transfer from Canada covered goods, software and related technology employing cryptography must apply for and obtain a permit for destinations other than the United States.

Because of the administrative burden, uncertainty and delays experienced in having to obtain permits prior to shipment of these items, and the difficulties these present for the just-in-time business models employed across industry, some Canadian exporters and vendors of these items have been expressing significant concerns with the current process. They have also found that streamlined export licensing procedures and more flexible interpretations of exemptions in the United States and other countries have placed them at a competitive disadvantage when selling and supporting their products in the international market place.

These competitive issues have intensified recently with further steps being taken in the United States to liberalize export controls, and in particular the controls over encryption items, putting Canadian vendors and exporters at a further disadvantage.

The ECD has stated that it is now seeking the views of industry stakeholders on ways to improve the efficiencies of the administration of export controls on these items while continuing to meet Canada’s Wassenaar commitments and national security requirements. The ECD has drafted a brief paper intended to provide broad context for these consultations:Export Controls on Information Security (Cryptography) Items. The ECD has also created anInformation Security (Cryptography) Questionnaire that allows interested parties to provide information and express their views on this issue and that is available upon request.

The deadline for filing submissions is August 5, 2010.

Encryption controls have been a challenge for many Canadian software and hardware vendors. Category 5 — Part 2 of Canada’s Export Control List identifies information security items that require a permit in order to be exported from Canada to destinations other than the United States. Because the threshold for control is very low — key lengths in excess of 64 bits (in the case of symmetric algorithms) — many vendors have been surprised to learn that the export or transfer of their encryption goods and technology requires a permit before shipment to their foreign customers. Often, they first discover this when the Canada Border Services Agency detains these goods just prior to export. Failure to obtain a permit prior to exporting or transferring controlled goods or technology can attract significant penalties.

Mass Market Exemption

Many vendors who may be aware of the encryption controls are of the view that they qualify for an exemption because the encryption functionality of their product is based on open source, publicly available encryption libraries or because their product or technology is “mass market.” With regard to this latter basis, the ECL’s Cryptography Note provides an exemption for encryption items if they meet all of the following criteria:

1. they are generally available to the public by being sold, without restriction, from stock at retail selling points by means of over-the-counter transactions, mail order transactions, electronic transactions, or telephone call transactions;
2. their cryptographic functionality cannot be easily changed by the user;
3. they are designed for installation by the user without further substantial support by the supplier; and
4. when necessary, details of the items are accessible, and will be provided, upon request, to Canadian authorities in order to ascertain compliance with the above conditions.

These encryption controls and exemptions are based on the 1996 Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technology agreed to by Canada, the United States, and 38 other Participating States. These requirements are incorporated into the domestic laws of Participating States and then subject to the interpretation and enforcement policies of each state.

Contrast With U.S. Interpretation

In the past, the ECD has narrowly interpreted this exemption in many cases to be restricted to retail transactions with consumers. This is to be contrasted with the experience of many vendors in the United States who appear to be able to qualify their encryption items for the mass market exemption based on a broader interpretation employed by the U.S. Department of Commerce under the review procedures for mass market encryption commodities and software set out in Section 742.15(b)(2) of the U.S. Export Administration Regulations.

Because of the administrative burden and delays imposed by having to obtain permits prior to shipment of controlled goods or transfers of related technology, and its impact on the just-in-time business models employed by many, a more liberal interpretation of the mass market exemption in the United States and other countries can put Canadian software and hardware vendors at a competitive disadvantage in their export markets.

ECD Consultations

The ECD’s consultations have been launched with a view to seeking input on the mass market exemption from Canadian companies that have obtained either (i) a formal government ruling from the United States or another Wassenaar Participating State in respect of an item assessed as complying with its mass market exemption; or
(ii) supplemental information issued by a Participating State’s export control authority clarifying any of the provisions of the mass market exemption, including a presentation, briefing, or correspondence issued by the government authority.

The ECD is requesting specific information regarding these materials and has undertaken to treat all submissions received as company protected information. Submissions are due by April 30, 2010. More information can be found at http://www.international.gc.ca/controls-controles/about-a_propos/expor/Wassenaar_crypto.aspx?lang=eng.