Technology Law News, Winter 1996,
Osler, Hoskin & Harcourt
Dov Wisebrod, October 1995
Regulators around the world are struggling to adapt to a wired (and wireless) world without borders. Once connected to the Internet, for example, information is accessible from anywhere in the world. Geographic location, legal jurisdiction, and even borders are becoming meaningless to the transfer of information.
Export control requires the recognition of national borders. In Canada, export controls apply to certain kinds of software. However, software is easily transferred over the Internet as bits of digital data. The problem facing the Minister of Foreign Affairs, as the person responsible for administering export control law in Canada, is how to control the flow of restricted software in a digital world without borders.
On the Internet, software is normally available at anonymous FTP sites. FTP sites are databases of electronic files which are available to be downloaded over the Internet by the standard File Transfer Protocol. The files may be of any kind, including text, image, sound, and software programs. An anonymous FTP site allows the user to log in without requiring a special password.
Many software companies maintain anonymous FTP sites to provide to their existing and potential customers free samples and updates of their software. By maintaining an anonymous FTP site, a company is effectively inviting Internet users around the world to log in and download whatever software they choose.
The existence of such FTP sites raises interesting questions: When software is downloaded by a person outside of Canada, has there been an "export" of that software, potentially subject to controls? If the arrangement qualifies as an export, who has exported the software? The FTP site owner in Canada has not actively sent software out of the country. The Internet user who received the software may not have been in the country. Yet, there has undoubtedly been an acquisition of software from Canada.
In the United States, customs enforcement officials appear to have taken the position that the person making software available on a FTP site is responsible if that software is downloaded to a foreign location. American regulations classify software with strong cryptographic functions as "munitions" subject to strict export controls. Phil Zimmermann, a programmer who made his encryption program "Pretty Good Privacy" freely available on the Internet, was charged with the crime of exporting munitions.
In Canada, the export of software having cryptographic or cryptanalytic functions is also subject to restrictions. However, Canadian export controls allow any kind of software, whether or not it is otherwise embargoed, to be exported without restriction if it is distributed in certain ways. These ways are set out in A guide to Canada's Export Controls (April 1994), part 1000, as follows:
This List does not embargo "software" which is either:
1. Generally available to the public by being:
a. Sold from stock at retail selling points, without restriction, by means of:
2. "In the public domain".
1. Over-the-counter transactions;
b. Designed for installation by the user without further substantial support by the supplier; or
2. Mail order transactions; or
3. Telephone call transactions; and
Software "in the public domain" is defined to mean software "which has been made available without restrictions upon its further dissemination." In this instance, copyright restrictions do not remove software from being "in the public domain."
Software made available on an anonymous FTP site on the Internet is in the public domain as long as no restrictions other than copyright are placed on its further dissemination. It is excluded, therefore, from the restrictions imposed by Canada's export controls. Software disseminated by more restricted means, over the Internet or otherwise, remains subject to restrictions. As far as anonymous FTP sites are concerned, while the Internet may appear to be a smuggler's paradise, the treasure is free.