Canadian Export Controls - Technology/Software

1. What constitutes an "export" of technology/software?

Technology or software is considered to be exported when is content is transferred or disclosed in any manner, from a place in Canada to a place outside Canada, including by embodiment in hardware that is exported from Canada, or by Internet download, fax, email or telephone.

2. Which technology/software is controlled for export?

A broad range of technology/software listed on Canada's Export Control List is controlled for export, with the effect that a permit may be required.

Group 1 of the Export Control List (Dual-use goods) contains several categories which capture information technology goods. In particular, such goods are listed in the following categories:

Category 3: Electronics
Category 4: Computers
Category 5, Part 1: Telecommunications
Category 5, Part 2: Information Security

"Technology" is defined as information necessary for the development, production or use of a product, and is included as Part E of every category of Group 1.

"Software" is defined as a collection of one or more programs/micro programs files in any tangible medium of expression, and is included as Part D of every category of Group 1.

3. Which products that use cryptography are subject to export controls?

Subject to narrow exceptions, almost all hardware or software products that use cryptography are subject to export controls. These products are listed on the Export Control List as Group 1, Category 5, Part 2.

Virtually all products that use cryptography employ key lengths that render the product subject to control. The following hardware, software and technology is controlled:

• Having a "symmetric algorithm" employing a key length in excess of 56 bits
• Having an "asymmetric algorithm" where the security of the algorithm is based on any of the following:
  • Factorization of integers in excess of 512 bits
  • Computation of discrete logarithms in a multiplicative group of a finite field of size greater than 512 bits
  • Discrete logarithms in a group other than those mentioned above in excess of 112 bits.

4. What are the exceptions to controls on cryptography?

Certain types of products employing cryptography are not subject to control, for example:

• Cryptography used in software only for authentication or digital signatures
• Certain personalized smart cards
• Receiving equipment for radio broadcasts, pay TV or similar restricted audience consumer broadcasts, if digital encryption only used for sending billing or programme-related information back to broadcast provider
• Equipment when the cryptographic capability is not user-accessible and which is specially designed and limited to:
  • execution of copy-protected software
  • limiting access to copy-protected contents stored on read-only media
  • limiting access to information stored in encrypted form on media (e.g. for IPR protection) when the media is offered for sale in identical sets to the public
  • copying control of copyrighted protected audio/video data
  • encryption and/or decryption for protection of libraries, design attributed or associate data for the design of semiconductor devices or integrated circuits
• Cryptographic equipment specially designed and limited for banking use or money transactions
• Portable or mobile radiotelephones for civil use (e.g. for use with commercial civil cellular radio communications systems) that are not capable of end to end encryption
• Cordless telephone equipment not capable of end-to-end encryption where the maximum effective range of unboosted cordless operation is less than 400 meters according to the manufacturers specifications

Certain categories of products may be exempt from control:

• Note 2 - products accompanying user for personal use
• Note 3 - cryptography note (the "mass market exemption")
• Exports to the U.S.

5. Does my product qualify for the "mass market exemption"?

Note 3 of Group 1, Category 5, Part 2 of the Export Control List sets out the following requirements to qualify for the "mass market exemption":

1. Generally available to the public by being sold, without restriction, from stock at retail selling points by means of any of the following:
   1. Over the counter transactions;
   2. Mail order transactions;
   3. Electronic transactions; or
   4. Telephone call transactions.
2. The cryptographic functionality cannot easily be changed by the user;
3. Designed by installation with the user without substantial support by the supplier;
   ...

Canada's Export and Import Controls Bureau interprets this exemption very restrictively, for example, by interpreting the requirement to be "generally available to the public" as requiring sale to individual consumers versus business to business sales.

For more information on these and other trade law issues, please contact:

Wendy Wagner
Partner
613.786.0213
wendy.wagner@gowlings.com

Click here to download the presentation "Top Ten Export Traps (& Tips)"

The content provided on this site is general information only. It is not intended as nor should it be regarded or relied upon as legal advice or opinion. We would be pleased to provide you with more information or specific advice of matters of interest to you at your request. You should not rely on, take any action or take or fail to take any action based solely upon information appearing in this publication.

Please note as well that the presentation of information on this site or your use or reliance upon such information does not establish a lawyer-client relationship between you and Gowlings or between you and any Gowlings professional.