What is cloud computing? The short definition is the offering of applications and services via the Internet from providers all over the world. Examples of cloud computing include data backup and data storage, webmail and some of the applications offered by Microsoft and Google. A user in any location with an Internet connection can access a cloud located anywhere in the world to upload and download data. There are advantages and disadvantages of using outside sources to run applications and store data.
• Data, applications and other services are easy access from anywhere at any time.
• Data can be made available to multiple parties without being confined to one computer, such as a desktop computer located in an office in Wichita, Kansas.
• Hardware costs are reduced because the customer could purchase a basic computer without having to worry about memory and speed because the cloud would process and store the data.
• Companies may save money on IT services and storage space for servers
Disadvantages
• Companies may have security concerns related to releasing information outside of the company’s supervision and control. Could the data be more susceptible to hacking?
• Companies may worry about the privacy of their data if it can be accessed anywhere and anytime.
Along with privacy and security concerns, companies should consider possible export compliance violations when making decisions about the storage and retrieval of data. Without proper controls, companies could find themselves with costly export violations for exporting controlled technology, software and other data without the proper licensing. Let’s explore some possible scenarios. Think about how your company might handle these situations.
1. Classification of Data
If a U.S. company stores blueprints and copies of emails related to building a military ship on an international server without a license, has a violation been committed? Does it matter whether the data is accessed in a foreign country or whether the storage was unintentional?
2. Storage
If an employee of a U.S. company saves a file containing technology to a cloud server located in a foreign country, has an export taken place?
3. Location of Access
If a U.S. person located in Russia accesses controlled technology from a server located in Canada that stores the data for a company in the U.S., has any violation taken place? Was a license needed?
4. Where is the “provider” located when software or technology is transferred?
If a German employee of a German subsidiary of a U.S. company accesses company data from a server located in the U.S., has an export occurred?
5. Who is considered the exporter?
If the person accessing the data obtains it from the “cloud” provider, does that make the provider the exporter or the party who stored the data?
Information found in 15 C.F.R. § 734.2(b)(1) of the EAR and 22 C.F.R. § 120.17(a)(1) of the ITAR answers some of these questions for us. When controlled technical data is exported from the U.S., even in electronic format and regardless of whether that data is accessed abroad, an export has occurred that might require a license. No intention to export technology is required to violate the regulations.
An advisory opinion issued by The Bureau of Industry and Security answers some additional questions, while raising others. Click HERE to view the opinion.
As the use of cloud computing continues to grow, more companies may find themselves inadvertently violating various export regulations. This topic is still new and some of the regulations do not adequately address all of the potential situations. Your company may have already committed a violation. If you find that your company uses or is considering using “cloud computing” as a way to store and access data, you should encourage management to seek advice from an export compliance attorney.
Strickland, J. (2008, April). How cloud computing works. HowStuffWorks.com. Retrieved from http://communication.howstuffworks.com/cloud-computing.htm
McClafferty, E.R. (2010, February). Exporting into the cloud: Export compliance issues associated with cloud computing. TMCnet. Retrieved from http://it.tmcnet.com/topics/it/articles/74329-exporting-into-cloud-export-compliance-issues-associated-with.htm
No comments:
Post a Comment