The GAO released on March 7 a report, dated February 2, that chastised the Bureau of Industry and Security (“BIS”) for confusion within BIS concerning the proper scope and interpretation of its own deemed export rule. The precise issue is one which has confused exporters even more than BIS and which relates to whether or not giving a foreign national access to an export-controlled dual-use item, such as a high-powered computer covered by ECCN 4A003, is a deemed export or not.

The question revolves around the meaning of “use” under the Export Administration Regulations (“EAR”). For example, in the case of supercomputers controlled by ECCN 4A003, the corresponding technology ECCN 4E001 defines controlled technology as technology “for the “development”, “production”, or “use” of equipment” controlled by ECCN 4A003. “Use” is defined in the EAR as “[o]peration, installation (including on-site installation), maintenance (checking), repair, overhaul and refurbishing.” BIS has interpreted this definition to mean that the mere operation of a dual use item by a foreign national is not a deemed export; rather, a deemed export occurs only when the foreign national is given information that would permit the foreign national to engage in all six activities defined as use.

Since 1994, the GAO has been complaining that this definition is unclear because it does not take into account that controlled information is often transferred in the course of training a foreign national to use a dual use item. Presumably this means that GAO thinks that in teaching a foreign national how to operate the item, an employer or university will also transfer information relating to installation, maintenance, repair, overhaul and refurbishing of the dual use item.

Further confusion exists with respect to dual use items that are being used for fundamental research. According to the GAO report some BIS officials have said that in such an instance there is no deemed export, presumably even if information on all six use aspects is transferred. The GAO report cites an instance where this confusion caused BIS to flip-flop on license applications by the NIH designed to permit foreign nationals to work at a facility with controlled equipment. Initially, NIH took the position that because it was engaged in fundamental research, no deemed export was occurring. When BIS told NIH in 2008 that it needed export licenses notwithstanding that it was only engaged in fundamental research. Between August 2008 and December 2009, NIH applied for 37 deemed export licenses to permit foreign nationals to operate controlled equipment. In December 2009, BIS reversed course and told NIH that no licenses were necessary because NIH was engaged in fundamental research.

So which is it? Frankly, it seems to me that the project in which the controlled item is engaged is irrelevant. If a 4A003 supercomputer is being used to, say, play Jeopardy, that doesn’t mean that you could transfer to a foreign national information on how to operate, install, maintain, repair, overhaul and refurbish that computer. But what I think isn’t important. What’s important is what BIS thinks, and it seems to be of two minds on the issue.

The Bureau of Industry and Security (“BIS”) previously did battle with cloud computing in an advisory opinion it released in January 2009. Almost two years later BIS charges into battle yet again, and yet again there is no clear victor.

In the 2009 advisory opinion, BIS noted that the provider of cloud computing services was only providing a service and was not exporting data or technology. Only the customer of the service could be the exporter, and only the customer of the service would be in export hot water if the data or technology was transferred in violation of the Export Administration Regulations. This logic seemed a bit at odds with the normal concept that providing access to technical data to foreign nationals was an export, but let’s not trouble ourselves here with minor details. A sly little sentence dropped at the end of the opinion also reminded everyone that the Office of Foreign Assets Control (“OFAC”) might have concerns with the provision of cloud computing services to blocked persons or embargoed destinations even if BIS did not.

Now, two years later, BIS confronts the related and more difficult question of what cloud computing service provides ought to do about their own foreign national IT staff who might have access to controlled technology placed on the cloud by the service’s customers. Not to worry, says the opinion, because the cloud computing service provider isn’t an exporter and thus can’t be a deemed exporter:

Because the service provider is not an “exporter,” [it] would not be making a “deemed export” if a foreign national network administrator monitored or screened, as described above, user-generated technology subject to the EAR.

But the problem with this logic is that the person who gives a foreign national access to controlled technology is a deemed exporter even if he isn’t an exporter. That’s why they call it a “deemed” export.

Of course, none of this addresses the 900-pound gorilla in the room which is, of course, the user of the cloud service and its liability for using a cloud service where foreign IT personnel have access to the controlled data that the user may have placed on the cloud. And don’t think the problem starts and ends with cloud computing. The Internet, is also a cloud of sorts linking various servers together to permit transit of data to its final destination. Any of those servers may have foreign network administrators who could use packet sniffers to see controlled technical data. Worse yet, the routing servers may be located in foreign countries even when the sender and the receiver are both located in the United States.

What I think we’d like to hear is what BIS and DDTC think about this. Or maybe not.