Is your software company looking for new markets due to the impact of the COVID-19 pandemic on your existing customers? Are some of the markets you are considering selling to outside of North America? If so, you should ask yourself if you may require a federal export permit before selling your software solution abroad.
As world economies react to COVID-19 related shutdowns, many companies are finding a changed marketplace awaits them. Existing customers who earlier this year were on the verge of purchasing software solutions, may be cancelling or deferring these projects. In order to generate revenue, many software companies may now be considering offering their software solutions outside of their traditional North American markets. In these cases, software companies should investigate whether the sale of their software outside of Canada requires a federal export permit.
Why would I need an export permit to sell commercial software?
For over 70 years, Canada has had export control laws in place geared towards ensuring that military and strategic goods being exported are consistent with Canada’s foreign and defense policies.
Many companies that produce products for the defense industry are fully aware of laws that govern the export of their products. However, software companies whose solutions are geared for business or civilian use may be required to obtain export permits if their software is of “dual use” – that is, their products could also be used or modified for military purposes. An example of where this may apply includes software that incorporates controlled encryption functionality.
Canada regularly maintains and updates its list of products subject to export controls. While most software that is generally available to the public or is in the public domain is not subject to export controls, certain dual-use software is subject to export controls.
The potential dual-use software noted in the Guide to Canada’s Export Control List includes the following:
- Software for digital computers. One of many examples is software designed or modified for the development or production of equipment of digital computers having and adjusted peak performance exceeding 15 Weighted TeraFlops (WT);
- Computer-Aided-Design software. One such example is certain software specially designed for the development of active flight control systems, helicopter multi-axis fly-bywire or fly-by-light controllers or helicopter circulation controlled anti-torque or circulation-controlled direction control systems;
- Intrusion software. One of many examples is as software specially designed or modified to avoid detection by monitoring tools or to defeat protective countermeasures of a computer or network-capable device, or the modification of system or user data;
- Cryptographic information security software including:
- software applications that do not contain encryption but call up cryptographic libraries;
- general purpose processing cards which happen to use a processing chip that has hardware crypto accelerators even if the processing card does not make any use of the encryption functionality embedded in one of the chips;
- custom secure data storage applications for corporate clients that do not contain any cryptographic functionality, but rather call up cryptographic libraries located on the operating system that the application is designed to run on;
- software for certain numerical control systems used by manufacturers; and
- software to restore microprocessors after an electro-magnetic pulse.
If your company develops dual-use software that appears on Canada’s Export Control List, an export permit is needed before transferring or selling that software to customers in certain countries.
Do I really need an export permit to send an email?
For most people, exporting conjures up a picture of goods loaded onto a plane, train, truck or ship. However, Canada’s export control laws apply to any method of delivery. According to Canada’s Export and Brokering Control Handbook, exporting can include:
- providing services or training,
- sending software via email,
- allowing software to be downloaded or through an electronic file transfer,
- file sharing,
- cloud access, and
- communicating via fax, telephone conversation, teleconference or face-to-face meetings.
Therefore, if your software solution is a dual use product that is the subject of export controls, you could be in violation of the law if the software is emailed or otherwise transferred abroad without first getting an export permit.
What are the penalties for violating Canada’s export control laws?
Violating Canada’s export controls laws can result in fines of $25,000 or more, and a prison sentence of almost ten years. If your company has inadvertently violated Canada’s export control laws, there is a process of disclosure that can allow a company to avoid liability. However, before disclosing, a careful review of the violation may take place. Depending on the gravity of the offence, investigations can be conducted into alleged non-complying conduct.
If we are a software company that is unsure if our products are the subject of export controls, what do we do?
If you are unsure whether your product is a dual use, there are three options.
- First, you can self-assess against Canada’s Export Control List to determine if your software is subject to export control;
- Second, you can request an Advisory Opinion from the Export Controls Division of Global Affairs Canada on whether your products are subject to export controls; or
- Third, you can apply for an Export Permit before the software is transferred.
Of the three options, only a decision on an application for an Export Permit is binding.
If our software is subject to export controls, what should we do?
If you produce dual-use software and wish to sell or transfer it abroad, you may find that an export permit is not needed based on the country of destination. However, if an export permit is needed, the following needs to be completed before you transfer your product abroad:
- Ensure that you have conducted due diligence verifications on the actual and potential foreign customers who are in your export permit application.
- Apply for an export permit. Until an export permit is granted, the software should not be transferred.
- Make sure you set up a system that maintains all necessary documents needed for each export in case of a government audit.
- Where necessary, develop and put in place a policy or standard operating procedure to ensure your employees know what sort of action requires an export permit.
The lawyers at MLT Aikins would be pleased to help your organization navigate the regulatory and legal challenges associated with exporting your software solution.
Note: This article is of a general nature only and is not exhaustive of all possible legal rights or remedies. In addition, laws may change over time and should be interpreted only in the context of particular circumstances such that these materials are not intended to be relied upon or taken as legal advice or opinion. Readers should consult a legal professional for specific advice in any particular situation.