I. Introduction
The use of commercially marketed cyber surveillance technology by authoritarian governments is a global policy problem.Footnote 1 Its impact is not confined to the countries where advanced surveillance techniques are employed to repress the population as it easily crosses borders.Footnote 2 Concerns about the export of cyber surveillance technology to governments with questionable human rights records and a weak(er) rule of law were initially flagged by human rights activists, and local struggles quickly became a global cause. By restricting the supply side of cyber surveillance goods and technologies, export control mechanisms can provide one of the few options to effectively regulate its availability and transfer.Footnote 3
The Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies (‘the Wassenaar Arrangement’) is currently the only international agreement that provides a transnational legal framework for restricting the export of surveillance equipment, software and expertise.Footnote 4 This scheme captures an extensive list of dual-use goods and technologies for which States agree to adopt export control laws, empowering licensing authorities to approve, reject and review their transfer. Cyber surveillance technology has been the most controversial addition to this list since its adoption in 1996. The so-called ‘cyber’Footnote 5 amendments to Wassenaar adopted in the course of the 2010s had a significant impact on subsequent dual-use export reforms in many parts of the world, including the United States (US), China, and the European Union (EU), who assume leading roles in the production, sales and governance of cyber surveillance technology.
The essence of the Wassenaar Arrangement is a list of dual-use goods and technologies laying out the detailed technical attributes of the controlled items. As the control list itself does not contain substantive treaty obligations, it has been a widely shared practice for both member States like the US and non-member States such as China to use this list as a key reference point to develop and update their domestic export control systems. While the updates to Wassenaar have been closely reflected in the equivalent mechanisms at national and regional levels, the addition of cyber surveillance technology has changed this narrative of broad acceptance and impact. The cyber amendments are a test case examining the (in)ability of conventional export control mechanisms to address various risks associated with the rapid technological development in highly sensitive dual-use items such as cyber surveillance technology.
As analysed below, the US, China, and the EU all aim to become a stronger and more autonomous regulatory entity in the global export control regime, and prefer to tighten restrictions on the use and transfer of cyber surveillance technology. It has increasingly become apparent that Wassenaar implementation strategies in this area have been significantly disrupted. Based on the recent developments of export control laws in these three jurisdictions, this article argues that their regulatory approaches to the export of cyber surveillance technology diverge not only from the terms of equivalent Wassenaar controls, but also from one another. The new laws and control categories adopted as a result of nation (region)-wide dual-use export reforms are eroding the very foundations of international cooperation for a more effective control of cyber surveillance technology.
Export controls on cyber surveillance technology and Wassenaar implementation in this area have been of interest to many legal scholars and human rights groups. Yet, their approaches are country-(or region) specific, and mainly focus on legal developments in the West, overlooking relevant legal reforms by emerging actors in export control governance such as China.Footnote 6 There are also interesting projects evaluating the terms of cyber amendments, but many do not examine subsequent updates renegotiated by Wassenaar States.Footnote 7 This article not only fills the gap in existing literature regarding these aspects, but also provides a bigger picture of global regulatory divergence among national, regional and international approaches to governing cyber surveillance technology. The article examines the many reasons for such regulatory divergence. A simple explanation would be the institutional weakness of the Wassenaar Arrangement due to its nature as soft law. Wassenaar implementation primarily depends on national discretion. A more substantial explanation can be obtained from examining the context (beyond Wassenaar) in which the US, China, and the EU redesign their export control systems. In developing a global export control regime for cyber surveillance technology, neither the common geopolitical positions that sustained Cold War-style technology transfer restrictions, nor long-standing commitments shared amongst member States for collective non-proliferation can be restored in the short term.
Discussion of the repressive use of cyber surveillance technology dates back to the early 2010s.Footnote 8 In the aftermath of the Arab Spring that swept across the Middle East and North Africa, the private surveillance industry, which used to evade public scrutiny, was brought into the spotlight for the first time. There was a strong connection between surveillance products marketed by many Western companies and human rights violations in importing countries that used these products for repressive purposes. The Egyptian case involving UK-based Gamma International and its subsidiary Finfisher is one example. After the fall of Mubarak, it was revealed that the Egyptian authority had deployed FinSpy, the company's signature spyware, to monitor and track down human rights campaigners, political dissidents and journalists.Footnote 9 Covertly installed on target devices, FinSpy monitors calls, messages and file transfers. It can turn on a web cam or microphone in the user's device, record all the keystrokes on the computer, and extract passwords typed into different browsers and communication platforms. The use of Internet monitoring and filtering technology has also been widespread, blocking and monitoring tens of thousands of Internet domains, redirecting traffic to inject malware, and/or compromising high-profile international media outlets. Illicitly obtained information on targeted individuals was used to subsequently detain and/or torture them. Some of the well-established cases involve network surveillance systems installed and maintained by Amesys in Libya, Blue Coat in Iran and Syria, Sandvine in Egypt, and Trovicor in Bahrain during the same period.Footnote 10 These companies are headquartered in France, the US, Canada and Germany respectively.
State-led surveillance programs have increased in an expanding variety of destination countries. New industry actors and products have appeared in the surveillance sector. For example, in 2015, the Hacking Team, a prominent Italian company, was the victim of a cyberattack that exposed 400 gigabytes of data containing its client lists, contracts, invoices and source codes.Footnote 11 Its flagship product, the Remote Control System (RCS), was supplied to 21 States spread over different regions, many of which were found to use RCS in ways that led to serious human rights violations. While a global web of companies of Western origins dominated the early surveillance industry, China is now at the forefront of the stage, globally exporting its surveillance equipment and know-how.Footnote 12 China has employed surveillance technology on a massive scale in the domestic realm. Thanks to State-sponsored surveillance projects and research programmes, a new generation of Chinese surveillance companies is on the rise. They have taken steps to disseminate nationally tested surveillance models overseas, marketing products not only to authoritarian and semi-authoritarian governments but also to liberal democracies.Footnote 13 Their commercial and technological presence is evident from their many new government clients in Africa and Central and Southeast Asia.Footnote 14
The cyber amendments to Wassenaar marked a timely international response to numerous incidents showing how the repressive use of cyber surveillance technology has enabled serious human rights violations. The expansion of the Wassenaar list was welcomed with a hope that it would lead to more effective control of problematic end-uses and end-users of surveillance tools. There is strong approval for expanding the list even further to cover a broader range of cyber surveillance technology. The agreed-upon entries of goods and technologies introduced by the cyber amendments does not capture many other (new) surveillance items that are unlisted but can be exploited to cause grave threats to security and human lives. The narrowly defined list also cannot keep up with the rapid technological development in this area. In contrast, the private sector has voiced concerns over the overbroad control categories under Wassenaar. Many industry representatives and security researchers argued that export controls on the surveillance items as adopted in the control list would cripple legitimate cybersecurity research and hinder the information sharing necessary to identify and quickly counter cybersecurity threats.Footnote 15 Being at the forefront of developing and testing various cyber surveillance products, these stakeholders have lobbied their home governments to limit the scope and impact of Wassenaar implementation. Accordingly, difficult questions remain for States on how to tailor their export control regulations to address concerns about overreach without sacrificing the goal of addressing security threats and human rights concerns.
Against this backdrop, Part II clarifies the meaning of cyber surveillance technology and examines key features of the surveillance industry. Part III analyses three Wassenaar control classes created to regulate cyber surveillance technology. In Part IV, the article examines how leading State actors in the global surveillance industry and governance—namely the US, China, and the EU—have led their export control reforms. As Part IV shows, Wassenaar implementation strategies in this area seemed to work well initially, but eventually proved far less successful than implementing controls on many other Wassenaar-listed dual-use items. Finally, Part V summarises the analysis of how the US, China, and the EU differ in their approaches to regulating the export of cyber surveillance technology.
II. Cyber Surveillance Technology as Dual-Use Items and the Booming Global Surveillance Industry
While there is no generally agreed definition of cyber surveillance technology, this term has been discussed among legal academics, practitioners and legislators in works examining surveillance goods and technologies as dual-use items.Footnote 16 This article uses the term ‘technology’ to encompass not only finished products of equipment and software, but also the provision of expertise required to create those items and facilitate their application. ‘Cyber surveillance technology’ can be understood as equipment, software and expertise used by intelligence and law enforcement agencies or by network operators acting under their direction to covertly monitor, exploit and/or analyse data that is stored, processed and transferred through ICT means.Footnote 17 It has civilian applications due to its ostensibly legitimate use such as law enforcement and computer security projects, but can also be deployed to enhance military capabilities. ICT-powered surveillance tools can easily be used in the violation of the rights to privacy and freedom of expression and political association. Monitoring, collecting and disrupting individuals’ communications through these tools can also lead to other human rights violations including arbitrary arrest and detention, torture and extrajudicial killings.
With exponential growth in the use of various Internet-based communication tools, individuals generate and exchange an ever-growing amount of data. Rapid technological advances and diversification of online communication have led intelligence and law enforcement authorities to reconsider traditional intelligence-gathering and interception methods, many of which are incapable of meeting novel challenges arising from these changes. On the regulatory front, State authorities may request device manufacturers, service providers and network operators to cooperate with the process as set pursuant to a judicial or administrative order. For example, manufacturers may be required to decrypt encrypted data in a target's device. Network operators may be asked to provide data concerning their users to a monitoring centre operated by an enforcement agency. At the same time, States gradually equip themselves with surveillance technology, which can give them direct access to relevant communications data. Governments across the world have relied on the private sector in obtaining those tools.
As many countries lack home-grown technological capabilities and telecommunications infrastructure required for extensive surveillance operations, companies find lucrative business opportunities in assisting these States to realise their ambitions for technologically-enabled intelligence and law enforcement. The surveillance sector is a burgeoning industry consisting of a wide variety of companies in terms of size and technological expertise.Footnote 18 The sector spans a variety of participants, each providing their own technical capabilities to consumers. For example, military contractors supply a range of cyber surveillance technology, whereas technology giants such as Ericsson, Huawei and Nokia produce telecommunications networks.
As a part of operational requirements, network providers are often required to maintain interception systems and monitoring centres. Hundreds of smaller companies are specialised in the development and sales of surveillance products, from commercially available items that are sold to private users to more sophisticated systems that are marketed exclusively to intelligence and law enforcement authorities. The Surveillance Industry Index (SII), the largest publicly accessible database on the surveillance sector, has documented 526 companies in detail.Footnote 19 From this it appears that the US, the UK, France, Germany, Israel, and Italy are the six countries in which surveillance companies are most likely to be headquartered and have offices. Another study finds that 87 per cent of companies are based in States that are OECD members.Footnote 20 Meanwhile, Chinese firms have been increasingly prominent in the industry.Footnote 21
III. The Wassenaar Arrangement and Cyber Surveillance Technology
A. The Creation and the Development of International Export Control Mechanisms
Export controls are measures instituted by States to supervise export flows. The export control mechanism was originally devised to address ‘military’ risks in the proliferation of biological, chemical and nuclear weapons and other conventional arms.Footnote 22 The strict civil–military distinction embedded in the traditional export control regime was incapable of accommodating rapidly changing geopolitical, military and technological circumstances in the global security scene. States gradually abandoned the dichotomy and modernised the regime by expanding its coverage to a variety of dual-use items.Footnote 23 There are four main international legal instruments aiming at non-proliferation of various types of goods and technologies: the Nuclear Supplier Group (NSG), the Australian Group, The Missile Technology Control Regime (MTCR), and the Wassenaar Arrangement.Footnote 24 Under these multilateral schemes developed over many decades, States establish export restrictions and licensing procedures concerning transfer of the controlled items. Companies seeking to make a transfer need to obtain licenses from the designated authorities. The Wassenaar Arrangement identifies and regulates items enumerated in the Munitions List and the List of Dual-Use Goods and Technologies. Categories 4 and 5 deal with cyber surveillance technology.
The core component of the Wassenaar Arrangement is a list of items agreed by consensus between 42 countries. Members include Argentina, Australia, Canada, India, Japan, Mexico, South Africa, South Korea, the US, the UK and almost all EU Member States and Russia, with the notable absence of China, Israel and Singapore. While those nations do not participate in Wassenaar, they have domestic legislation that partially incorporates the list of goods and technologies identified by the Arrangement.Footnote 25 The institutional predecessor of Wassenaar was the Coordinating Committee for the Control of Multinational Trade (COCOM), created in 1950 by the US and its close allies during the Cold War.Footnote 26 COCOM left a legacy of State-to-State cooperation and coordination regarding trade in strategically sensitive goods. Until its dissolution in 1994, COCOM States maintained a common control scheme to prohibit transfers of arms, nuclear-related products and some sensitive dual-use technologies to the Soviet bloc, specifically the Warsaw Pact countries.Footnote 27 In contrast, Wassenaar controls do not target any State or a group of States. The initial 33 members of the Arrangement included many of the former Warsaw Pact countries.
The Wassenaar Arrangement is a soft law mechanism, and thus does not create legally binding obligations.Footnote 28 Member States do not automatically impose export restrictions and licensing requirements on certain items simply by virtue of the inclusion of those items in the Wassenaar list. This is different from COCOM which had a stronger implementation mechanism along with some oversight rules such as mandatory prior notification and a veto system regarding export of certain items listed as sensitive.Footnote 29 The Cold War context behind COCOM strengthened common strategic interests in maintaining a multilateral control mechanism based on unified national export control standards among them. That unifying foundation no longer exists in the Wassenaar era. Nevertheless, most member States have updated their export control systems to make them consistent with Wassenaar lists.Footnote 30
B. The ‘Cyber’ Amendments
As discussed in Part 1, Wassenaar States have extended the scope of the Arrangement to cyber surveillance technology. The cyber amendments have two main goals: creating controls on specific surveillance items and achieving a certain level of coherence among domestic export regulations on these newly covered goods and technologies.
Nothing in the terms directly associates the uncontrolled proliferation of cyber surveillance technology with human rights violations. Nevertheless, it is implicitly recognised that the export of sensitive surveillance technology must be better regulated because the repressive use of such tools has given rise to real concerns about serious human rights violations in many importing countries.Footnote 31 Exporting States were also urged to consider whether there is ‘a clearly identifiable risk’ that the controlled items might be used ‘to commit or facilitate the violation and suppression of human rights and fundamental freedoms’.Footnote 32 To some extent, the cyber amendments have made some changes to a strong national security foundation embedded in the Wassenaar scheme.
C. Three Categories of Cyber Surveillance Technology under Wassenaar
The Wassenaar Arrangement does not use the term ‘cyber surveillance technology’ as a separate category to the dual-use control list. It takes an item-by-item approach defining the specific types of surveillance equipment, software and technology subject to Wassenaar. Three categories have been added through a series of amendments: certain types of mobile telecommunications interception equipment (added in 2012), intrusion software-related items, and IP network surveillance systems (both added in 2013). These items are designed to provide and facilitate extensive surveillance capabilities. They are more or less exclusively sold to State intelligence and law enforcement authorities. Major network operators may also obtain them for compliance purposes.
There was little debate over the introduction of controls on the first item, but the 2013 amendment concerning the latter two categories was both praised and criticised by various stakeholders ranging from civil society to academics and security professionals. The major source of discontent was that the definitions provided by the 2013 amendment were either over-inclusive or under-inclusive of the covered items. As a response to mounting concerns from many Wassenaar States in the following years, decontrol notes and technical clarifications were added to the original 2013 amendment.
1. Mobile Telecommunications Interception—5.A.1.f-based Controls
Mobile telecommunications interception technology is used to track, identify, intercept and record mobile and satellite phones.Footnote 33 Such interception equipment was added to the Wassenaar list at the 2012 Plenary Meeting. Even prior to 2012, some States had placed controls on the equipment of this kind, yet their usage and interpretation of the term varied. According to 5.A.1.f, a range of ‘mobile telecommunications interception or jamming equipment’ is subject to Wassenaar controls. One of these is IMSI (International Mobile Subscriber Identity) catchers. The second sub-provision of 5.A.1.f defines them as ‘interception equipment designed for the extraction of client device or subscriber identifiers, signaling, or other metadata transmitted over the air interface’. Typically used in a ‘Man in the Middle Attack’ by faking a legitimate cell tower or base station, IMSI catchers capture and log all the IMSI numbers of mobile phones in the nearby area as these mobiles connect to it.Footnote 34 It can intercept the location and traffic information of thousands of mobile phones at the same time. More advanced versions can even intercept calls and text-messages and disrupt the availability of certain Internet services.
2. Intrusion Software-related Items—Controls based on 4.A.5, 4.D.4 and 4.E.1.c
Wassenaar controls associated with intrusion software are built upon two sets of rules: a multi-tiered structure of conceptualising the controlled items, and general exemptions. Notably, the Arrangement does not control intrusion software per se. Instead of restricting the whole class of intrusion software, it opts for targeted controls on specific equipment, software and technology that are used to generate, install and instruct intrusion software.
The initial wording of the 2013 amendment was criticised for being overly broad, and thus having (unintended) chilling effects on the security industry and security research.Footnote 35 Many security experts feared that technical attributes used to define this control class would imprudently control equipment, software and expertise used for essential cyber security processes. For example, according to the initial terms, when ‘exploit’Footnote 36 researchers identify vulnerability in the software platforms of foreign vendors, they are prohibited from notifying those vendors of the identified risks unless they first obtain export licenses for the export of such technology. The use of many defensive security products such as penetration testing products, auto-updating antivirus programs and forensic exploit toolkits would also be subject to Wassenaar controls. As examined below, several revisions were made to meet these concerns of the IT security community. Many US technology companies in particular lobbied their government for renegotiation of intrusion software-related controls.Footnote 37
a) Conceptualising the scope of covered items
Intrusion software is specially designed or modified to avoid detection by ‘monitoring tools’ or to defeat ‘protective countermeasures’ in order to execute code safely on a computer or network-capable device.Footnote 38 It also needs to show software implementations performing either of the following functions:
(a) the extraction of data or information, from a computer or network-capable device, or the modification of system or user data; or (b) the modification of the standard execution path of a program or process in order to allow the execution of externally provided instructions.
In response to concerns that this definition inhibited ordinary means of software implementation, a technical note was later added to exclude the following from control: debuggers, Software Reverse Engineering tools, Digital Rights Management software, and asset tracking or recovery software that is installed by manufacturers, administrators or users. Intrusion software can be installed through a range of channels, such as a vulnerability that allows an attacker to covertly install it on the device, and phishing attacks that convince a user to open a disguised executable file or otherwise authorise the installation of a seemingly legitimate application.
The defined class of intrusion software is not itself a controlled item. Wassenaar controls apply only to the systems, equipment, components, software and technologies that have certain relations with intrusion software.
(i) Control categories 4.A.5 and 4.D.4
The controlled class of items has two parts: one covers systems, equipment, and components (4.A.5) or software (4.D.4) specially designed or modified ‘for the generation, command and control, or delivery of’ intrusion software.Footnote 39 A technical note containing exclusion criteria is added to limit the scope of 4.D.4 application. Wassenaar controls do not apply to software specially limited to provide ‘software updates or upgrades’ authorised by the owner or administrator of the system receiving them (as defined in 4.D.4).
(ii) Control category 4.E.1.c
The second sub-category of intrusion software-related control is technology ‘necessary for the development’ of intrusion software (4.E.1.c).Footnote 40 The meaning of ‘development’ encompasses a range of processes including design, design research and analyses, assembly and testing of prototypes.Footnote 41 Providing technical assistance also falls within the 4.E.1.c scope of development, which encompasses forms of instruction, training, and consulting services which involve the transfer of essential technical information such as blueprints, plans, engineering designs, manuals and instructions. The development and testing of advanced intrusion software is a complex process that often requires site visits, specialised installation procedures and technical support from highly skilled experts. While some surveillance companies offered network analysis, on-site installation of hardware, and software and technical training for local staff, others demonstrated needs assessments and integration design that were necessary to set up intrusion software infrastructure in those countries.Footnote 42
In 2017, several technical notes were added to reshape the scope of application of 4.E.1.c.Footnote 43 Wassenaar States relaxed control parameters for essential cyber security tools that inappropriately fell within the meaning of initial cyber amendment. Upon revision, 4.E.1.c no longer applies to necessary technical assistance and research activities in the process of ‘analyzing, identifying, reporting or communicating’ software vulnerability. ‘Exchanging information on a cyber security incident’ with individuals or organisations responsible for addressing such an incident is also excluded.
b) General exemptions
General exemptions are specified in the General Software Note and the General Technology Note. By exempting certain types of items, these provisions prevent Wassenaar controls from being imposed in an overly broad manner. The General Software Note carves out software that is ‘available to the public’ at retail and can be installed by the user without ‘substantial support from the vendor’, as well as software ‘in the public domain’ that is freely available upon its further dissemination.Footnote 44 The General Technology Note offers two exemption rules that apply to the items laid out in 4.E.1.c: technologies that are ‘in the public domain’ or for ‘basic scientific research’.
3. IP Network Communications Surveillance Systems—5.A.1.j-based Controls
Along with the (ab)use of intrusion software, IP network surveillance received a great deal of attention during the 2013 Plenary Meeting. ‘IP network communications surveillance’ was added as a new control class under Category 5, Part 2.Footnote 45 IP network surveillance is generally conducted through Internet traffic analysis systems that classify and collect communications data flowing in and out of a network. The covered items are ‘systems or equipment, specially designed components’ that satisfy all of the conditions stipulated in 5.A.1.j. This control class carries two sub-provisions and one decontrol note.Footnote 46 In addition, exemption provisions in the General Software and Technology Notes also apply to the class of IP network communications surveillance.
a) Technical attributes of the controlled items
The provided definition of ‘IP network communications surveillance’ is straightforward, but extremely narrow. First, according to the first sub-provision (5.A.1.j.1), the covered items perform all of the following three functions on ‘a carrier class IP network’:
(a) Analysis at the application layer (Layer 7 of Open Systems Interconnection (OSI) model (ISO/IEC 7498-1); (b) Extraction of selected metadata and application content (e.g. voice, video, messages and attachments); and (c) Indexing of extracted data.
In view of function (a), the covered items operate at the seventh layer in the OSI model called the ‘application layer’, which concerns networking processes at the application level. The OSI model divides communications data into seven abstract layers and standardises protocols into groups of networking functionality to ensure interoperability within the communication system regardless of the technology type, vendor and model used. Layer 7 is the uppermost layer that interacts with end users directly.Footnote 47 Function (a) carves out IP network surveillance products that work at layers other than Layer 7. This requirement is problematic as its focus is primarily on traditional Internet communications via web and email. Some experts argue that this narrows the scope of 5.A.1.j merely on network surveillance conducted through analysis of the ‘content’ of Internet communications, and items such as ‘monitoring of statistical information on the use of particular applications, blocking of sites, or tracking what IP addresses a user exchanges traffic with’ may not be covered under the current language.Footnote 48
Functions (b) and (c) concerning ‘extraction’ and ‘indexing’ further narrow down the scope of the 5.A.1.j control class: the covered technology retrieves metadata and application content in the traffic and at the same time, stores them for the purpose of indexing. Since these functions need to be carried out on the carrier class IP network, which is used to refer to ‘national grade IP backbone’, 5.A.1.j excludes detection and prevention systems operating at the same layer but includes smaller networks such as local area networks or other types of communications network that have limited data processing capacities.
In addition, the second sub-provision (5.A.1.j.2) attaches two more conditions that further frame the scope of 5.A.1.j application. The covered items are designed to perform the following:
(a) Execution of searches on the basis of ‘hard selectors’, and (b) Mapping of the relational network of an individual or of a group of people.
There is a broad spectrum of network surveillance tools, many of which conduct Internet traffic analysis in a way that satisfies the terms of the first sub-provision. Among them, there is a fairly large group of products with the ability to search personally identifying information based on ‘hard selectors’ such as names, email and street addresses, phone numbers and affiliations.Footnote 49 In contrast, identifying the patterns and correlation of extracted data in the traffic for ‘mapping’ is a highly sophisticated function that is used only in limited kinds of surveillance products such as the products specifically marketed for intelligence activities.
However, many experts warn that this definition is too narrow to cover many other network surveillance systems that should have been regulated by the Wassenaar Arrangement.Footnote 50 These systems are designed to intercept communications and conduct high performance Internet traffic analysis. They have also been reported as being deployed in repressive contexts. It is fair to say that the current Wassenaar controls on network communications surveillance systems are targeted at an inadequately narrow class of products. The under-inclusiveness of 5.A.1.j.2 creates a critical regulatory loophole.
IV. Three Regulatory Approaches to Governing Export Controls of Cyber Surveillance Technology—A Comparative Analysis
Part IV identifies a global regulatory divergence among national, regional and international approaches to governing the export of cyber surveillance technology. The cyber amendments to Wassenaar have affected subsequent dual-use export reforms in many parts of the world, including the US, China, and the EU. However, as discussed in each sub-section, they show different forms and degrees of Wassenaar implementation concerning cyber surveillance technology. The legislative backgrounds against which their export control laws have developed for the regulation of emerging technologies (including cyber surveillance technology) also vary significantly. Moreover, export controls are increasingly leveraged in a way to strengthen their positions in ongoing power struggles at the intersection of global trade, technology and security. This further affects the ways in which they create and use export controls to achieve a broader national and regional agenda.
Notably, all three jurisdictions have undergone extensive rebuilding of their own export control frameworks. The timing of the adoption of US Export Control Reform Act (ECRA)Footnote 51 and the proposed modernisation of the EU Dual-Use RegulationFootnote 52 have coincided with the development of the Export Control Law of the People's Republic of China (中华人民共和国出口管制法, ECL) which is the first omnibus export control law for China.Footnote 53 Based on the analysis of these three legal systems, Part IV shows that their approaches to export controls of cyber surveillance technology are only becoming more divergent, and may lead to a significant erosion of the global norms governing the use and transfer of emerging technologies.
A. The New Face of US Technology Export Regulation
Since August 2009, the US export control regime has been subject to an extensive inter-agency review under the Export Control Reform Initiative launched by the Obama administration.Footnote 54 This Initiative sought to develop a single control list, create a more coordinated export control enforcement, establish a single licensing agency and a single IT system for license processing. Under the Trump administration, many parts of the initial reform plan were redesigned in a way that changes the regulatory foundation of US export controls. The traditional narrative of the US export control regime has been modified especially in the export of certain types of technologies.
In recent years, competition between the US and China over technological supremacy has intensified as China quickly builds capabilities in many advanced technology sectors under its long-term State-directed industrial planning strategy.Footnote 55 In the midst of growing tension between the two sides, the US government took extensive legislative action aimed at targeting China's growing technological and commercial prowess. The ECRA of 2018 and the recent expansion of the Entity List were clearly adopted in a context where the US is seeking to prevent a group of specific Chinese firms from acquiring certain types of vital technologies originating from US citizens and companies.Footnote 56 US export control measures are increasingly used as a protectionist tool to reinvigorate domestic industry concerning ‘emerging and foundational technologies’ and to guard its dominance against growing foreign actors in the global technology market, specifically by controlling access to the US technology market, and providing a policy blueprint for friendly States to follow.
While the new system under the ECRA is still in the process of updating and implementing regulations that will clarify the scope of new control classes, it is clear that the fate of export restrictions on cyber surveillance technology will be subject to this new scheme. Meanwhile, it remains to be seen whether and to what extent the new Biden administration will adhere to this regulatory stance introduced by the preceding administration.
1. The US Export Control Regime and the Wassenaar Arrangement
The US export control regime consists of different statutes and operates under several licensing and enforcement bodies. The Export Administration Regulations (EAR) provide the main legal framework for controlling exports of dual-use and less sensitive military items.Footnote 57 They contain the Commerce Control List (CCL) and implement the Export Controls Act (ECA) at a practical level regarding certain types of controlled technologies.Footnote 58 The CCL is a list of controlled items as well as foreign persons and end-uses ‘that are determined to be a threat to the national security and foreign policy of the United States’. The Bureau of Industry and Security (BIS) in the Department of Commerce (DOC) is mandated to establish the CCL and carry out export licensing and enforcement functions based on EAR rules.
The US has been at the centre of creation, development and global implementation of international export control mechanisms such as the Wassenaar Arrangement and their multilateral approach to non-proliferation. It is a long-standing stance of the US that most items listed in the CCL are controlled in accordance with its commitments to four major multilateral control regimes including the Wassenaar Arrangement.Footnote 59 Based on those internationally agreed lists, the relevant executive bodies have complied and updated the US control lists. The effectiveness of the EAR-based control has been enhanced by it being ‘maintained as part of [the] multilateral control arrangement’ and almost all items on Wassenaar list are incorporated in the CCL. EAR states that the US dual-use control scheme is ‘consistent with the United States’ international obligation’ as a Wassenaar member.Footnote 60
Regarding the domestic implementation of cyber amendments, BIS has maintained the same position. Upon the adoption of amendments at Wassenaar, BIS submits its own amendment proposal along with a newly compiled control list adopting Wassenaar amendments, but occasionally with some modifications to fit within the existing CCL scheme. BIS then launches a review process inviting various stakeholders, including industry actors and civil society groups, to provide comments on the implications of the amendments for national security, economic and foreign policy interests of the US.
The implementation process for the 2012 cyber amendment (5.A.1.f) adding mobile communications interception equipment such as IMSI catchers went smoothly.Footnote 61 Under the old rules, devices for mobile communications interception used to be restricted only in two specific circumstances: when such equipment was specially designed or modified for military use or when such equipment included a cryptanalytic functionality. In implementing 5.A.1.f, new rules were introduced to control the export of interception devices that do not necessarily fit into either of those two categories. This update to BIS Rule was to ‘harmonize’ national export control practice with the Wassenaar list.Footnote 62
In contrast, this was not the approach for the 2013 cyber amendment. In July 2015, BIS published the first Proposed Rule to incorporate intrusion software-related items and IP network surveillance systems into the CCL.Footnote 63 It received an unprecedented number of public comments on the Proposed Rule, virtually all of which were negative. There was a strong backlash from IT industry and security experts especially about intrusion software-related items.Footnote 64 Critics feared that the language used by Wassenaar and BIS could lead to ‘unintended capture’, with a high risk of restricting legitimate cyber defence strategies and other key security processes such as vulnerability disclosure and incident response, and that these controls would lead to an extensive financial licensing burden for security companies.Footnote 65 The Proposed Rule was retracted. Instead, BIS followed up with a plan to introduce additional amendments to Wassenaar ‘in order to minimize the negative impact of the intrusion software-related entries would have’.Footnote 66 This was to hold on to its commitment to regulate cyber surveillance tools through a multilaterally coordinated control mechanism.
As a result of US negotiation efforts during the 2016 and 2017 Wassenaar Plenary, a number of changes and some clarification of technical terms were made to intrusion software controls.Footnote 67 As discussed earlier, intrusion software-related controls no longer apply to vulnerability disclosure or cyber incident response. Another decontrol rule has been added for software implementations involving certain types of software updates or upgrades. In 2018, BIS finalised a new regulation updating the CCL as part of the implementation of the remaining cyber amendments. The new version is still under review, signalling ‘a retreat by the US government from asserting control over those tools’.Footnote 68 While BIS’ regular CCL updates have incorporated the most up-to-date version of the Wassenaar lists, the two control classes created as a result of the 2013 amendment have not been included in the CCL.
2. Leveraging export controls to win the geopolitical, economic and technology race—The advent of the ECRA era and its impact on the US Technology Export Regulation
Notwithstanding failed attempts to add intrusion software-related items and IP network surveillance systems to the CCL, it is likely that there will be a new channel of leveraging export controls to govern cyber surveillance technology (possibly) including those two control classes. As mentioned earlier, ECRA was passed under the auspices of the National Defense Authorization Act for Fiscal Year 2019 in the midst of escalating US–China competition over commercial and technological dominance in the ICT sector.Footnote 69 This authorisation gives the President a broad range of constitutional authority to govern export control activities. Under Part I of ECRA titled ECA, an ‘interagency process’ is created to identify and regulate the new category of ‘emerging and foundational technologies’ that are not otherwise specified in the existing list.Footnote 70 This is to update the US technology export regulation ‘without impairing national security or hampering the ability of the US commercial sector to keep pace with international advances in emerging fields’.Footnote 71
As authorised under ECRA, BIS establishes controls on ‘the export, re-export or in-country transfer’ of these emerging and foundational technologies subject to US jurisdiction, whether by US persons and corporations, or foreign entities.Footnote 72 BIS may also impose interim controls on relevant technologies on a case-by-case basis.Footnote 73 ECRA's application is extraterritorial; regardless of their business locations, non-US companies are subject to ECRA when re-exporting US-originated goods and technologies. Even non-US made products may be subject to ECRA control if their usage of controlled technologies originating from the US exceeds a certain threshold.
In November 2018, BIS published an Advanced Notice of Proposed Rulemaking (ANPRM) for the ‘Review of Controls for Emerging Technologies’ and invited public comments to develop criteria for identifying 14 categories of technologies.Footnote 74 Six of the 14 categories listed by BIS replicate some of the ten technology industries prioritised by ‘Made in China 2025’. One of these new BIS categories is ‘Advanced surveillance technologies’, and this could encompass a plethora of surveillance tools including items enumerated in the cyber amendments to Wassenaar. Most recently in January 2020, the first in a series of BIS Rules setting out licensing requirements for emerging technologies was published. This Interim Rule regulates certain types of ‘geospatial imagery software’ utilised in artificial intelligence and machine learning applications.Footnote 75
The ECRA scheme re-conceptualises the nature of the US export control system with respect to certain types of critical technologies. A group of ‘commodity, software and technology’Footnote 76 that would fall under ‘emerging technologies’ need to be deemed ‘essential to the national security’.Footnote 77 There is no additional clarification about how to determine what is considered essential to national security and no proper legislative guidance on identifying specific national security concerns that the ECRA control aims to address. The class of emerging technologies seems to cover a broad range of technologies even including items that may be only remotely related to the protection of national security. According to the ANPRM list, ‘emerging technologies’ are not required to have the distinctive features of military or dual-use items that traditionally invoke export control measures. Neither would items such as brain modelling, computer vision and speech and audio processing (under the category of ‘machine learning technology’) or adaptive camouflage and functional textiles (under the category of ‘advanced materials’) be traditionally conceived as having national security implications.
There is another indication that the US export control system is going through a significant change with regard to technology exports. While ECRA does not provide a clear definition of emerging technologies, BIS and other relevant agencies involved in the ECRA's new interagency process need to consider three factors in developing the class of emerging technologies: ‘development’ of emerging technologies in foreign countries, ‘the effect export controls may have on the development’ of such technologies in the US, and ‘the effectiveness of export controls on limiting the proliferation’ of emerging technologies in foreign countries.Footnote 78 These factors depend on where the key US industrial actors in respective sectors of emerging technologies stand in the global market as compared to their foreign competitors, especially based in China. The same administrative and legislative attempts targeting Chinese technology companies are also found in a series of EAR amendments in 2019 and 2020 that have added Huawei Technologies and nearly a hundred of its non-US affiliates to the Entity List due to ‘activities contrary to the national security or foreign policy interests’ of the US.Footnote 79
ECRA allows the US government to define controlled technologies in a unilateral manner without seeking any multilateral alignment strategy. The US regulatory stance on dual-use export control has become more inward-looking than ever. Its concerns about losing technological and commercial dominance in the global technology market are evident in the terms of recently introduced reform regarding technology export regulation. It is also problematic that ECRA gives excessive discretion to the DOC, especially its implementation agency for export controls, BIS. BIS has an authority to unilaterally designate certain technologies for ECRA control. There are no clear standards which guide BIS in removing or revising items contained in its technology categories. Technically, BIS can remove or revise existing controls on such items ‘as appropriate’.Footnote 80 It can even determine ‘whether national security concerns warrant continued unilateral export controls’ over the new control class of emerging technologies.Footnote 81 With the passage of ECRA, the US might show greater determination to impose export restrictions on cyber surveillance technology, albeit at the risk of a broad range of cyber surveillance items being subject to controls based on ambiguous and unpredictable standards under the ECRA scheme.
B. The Future of Chinese Export Controls on Cyber Surveillance Technology—The ‘Made in China 2025’ and the ‘Military-Civil Fusion’ Strategy as a Guiding Spirit
The past several years represent a pivotal period for the Chinese export control regime: China has developed and passed its first omnibus export control law, the ECL. With regard to technology export regulation, the ECL shows Chinese attempts to (legally) enable tit-for-tat regulatory response to similar technology export controls that are already adopted or could be introduced by the US under the ECRA scheme. Many terms in the 2018 US law are used in the equivalent Chinese legislation. As some observers explain, China has refined and strengthened its export control law in part to counter recent US export control measures targeting Chinese-based technology companies.Footnote 82
As the ECL only provides the key principles of an export control system, and sets out procedures for export licensing and enforcement, many parts of this new scheme will have to be clarified by the subsequent implementation of regulations. There is no reference to an ECRA-like category of ‘emerging and foundational technologies’ or to a specific technology sector such as cyber surveillance technology as in the case of the EU Dual-Use Regulation. The future of Chinese export controls on equipment, software and expertise involving cutting-edge surveillance technology will be shaped under ‘Made in China 2025’ and its core strategy called ‘civil-military integration’ (军民融合 or translated as ‘military-civil fusion (MCF)’).Footnote 83
1. The Chinese Export Control Regime and its relationship with the Wassenaar Arrangement
Up until the mid-1990s, China imposed export restrictions on ad hoc basis without any legal parameters. It gradually adopted laws and regulations to control the export of strategically sensitive items, beginning with certain types of chemicals, biological agents, missiles and missile-related items, and nuclear-related materials and technologies.Footnote 84 The current Chinese regime consists of a patchwork of multiple laws and administrative regulations.Footnote 85
The Chinese government has made efforts to consolidate existing export control-related laws. Most importantly, the ECL underwent three rounds of drafting, which finally took effect from December 2020. The Ministry of Commerce (MOFCOM) submitted the first draft of the ECL in June 2017, and the second draft was released by the Standing Committee of National People's Congress (NPC) in December 2019.Footnote 86 A third draft was passed into law by the NPC on 17 October 2020.Footnote 87 The enacted legislation consisting of 49 provisions across five chapters revises the MOFCOM version in part and creates a more centralised system for the licensing, investigation and enforcement of export controls. State Council and the Central Military Commission (CMC) undertake the role of State Export Control Administrative Departments (SECADs).Footnote 88 They are also empowered to designate specific government agencies for ECL implementation.Footnote 89 The ECL is significantly shorter than the export control laws of the US and the EU, leaving many terms and conditions of the controlled items and licensing procedures to be determined by implementing regulations.
The Chinese export control regime has maintained an interesting relationship with multilateral control instruments including the Wassenaar Arrangement. Among those four key agreements, China has only joined the NSG. While it is not unprecedented for China to highlight its commitment to international non-proliferation standards,Footnote 90 there has been no legal recognition of such commitment. Nevertheless, the Chinese lists of controlled items largely correspond with international control lists covering various nuclear, biological, chemical and missile-related items. China has largely aligned its export control measures with Wassenaar.Footnote 91 China seems to perceive that global standard-setting and cooperation to restrict controlled items is essential to (or at least not contrary to) its national security interests, yet the Chinese implementation of the Wassenaar Arrangement is superficial.
The ECL explicitly recognises China's commitment to multilateral export control regimes.Footnote 92 This inclusion alone will not alter its reluctance to join multilateral control agreements. Despite its ever-growing presence in the production, development, and sale of cyber surveillance technology, China remains formally outside the Wassenaar mechanism.
2. China's first omnibus Export Control Law—key features
This section focuses on the four aspects in the new Chinese rules under the ECL. Export controls are applied to items that are either enumerated in the control lists, or as unlisted items under special circumstances as defined by a ‘catch-all’ provision. The ECL identifies eight classes of items that are subject to export restrictions.Footnote 93 Controlled items are characterised as ‘dual-use items, military, nuclear or other goods, technologies, services, and items relating to the maintenance of national security and national interests, and performance of anti-proliferation and other international obligations’.Footnote 94 The ECL also clarifies that ‘technical information and other data related to the items’ fall under the definition of controlled item.Footnote 95
The first three classes are simply defined.Footnote 96 With respect to items under the ‘defending national security and national interests’, the government can impose an embargo, prohibit their transfers to specific destinations, individuals or entities, and apply temporary controls for up to two years.Footnote 97 The final wording differs from prior drafting by including a specific reference to ‘national interest’, thereby allowing the furtherance of a broader political agenda and interests through the ECL. The catch-all provision extends the scope of controls to the items which are not listed, but may ‘endanger national security or national interests’, be used in the ‘design, development, production or use’ of WMDs and their means of delivery, or be used for ‘terrorist purposes’.Footnote 98 This represents a broadening of the provision compared to original drafts, namely by offering the SECADs a practically unencumbered discretion to determine items that endanger national security, or could be used for terrorist purposes. Meanwhile, pursuant to Article 18, the ECL introduces a separate category similar to the Entity List under the US export control scheme.Footnote 99 The SECADs can place specific ‘importers’ and ‘end users’ on this Article 18-based restriction list, if they violate ‘the management of end users and end uses,’ ‘endanger national security or national interests,’ or use controlled items ‘for terrorist purposes’.Footnote 100
Second, the ECL introduces new concepts in defining what constitutes an ‘export’ for the Chinese regime. Importantly, the concepts of US style ‘deemed export’ and ‘re-export’ are added. Pursuant to the ECL's broad understanding of ‘export’, both Chinese and foreign nationals and entities can be the exporting parties. ‘Export’ typically means any transfer of controlled items, including cross-border supply of products and technology transfer from the territory of the People's Republic of China (PRC). Added to this definition, any provision of items to foreign organisations and individuals by Chinese citizens and legal entities will now also constitute controlled exporting activities, irrespective of where the transfer occurs.Footnote 101 This part is similar to a ‘deemed export’ under US law and may have a significant impact on foreign technology companies that maintain a substantial business presence in China. ‘Re-export’ controls may apply when foreign persons and legal entities export Chinese-originated controlled items or foreign-made products containing ‘a certain percentage of the value’ of Chinese-originated controlled content from one foreign jurisdiction to another.Footnote 102 Accordingly, the re-export controls expand the extraterritorial scope of ECL's application.
Third, compared to the initial draft submitted by MOFCOM, the ECL imposes heavier compliance requirements on the part of exporters and makes a significant increase in the penalty for non-compliance.Footnote 103 It is mandatory for exporters to submit end-user statements and end-use certificates when applying for an export licence.Footnote 104 They need to be issued by end users or the competent government authorities where end users are located, rather than the importing entities, as stated in the initial draft. Exporters may also maintain ‘internal export compliance review system’.Footnote 105 After the issuance of a licence, exporters need to conduct a review of end users and the actual use of the exported items, and ‘immediately report’ any change to the competent authorities if they become aware there may be such a change.Footnote 106 When changing the stated end-user or end-use, the end-users are required to obtain approval from the relevant Chinese government authorities. Under the 2019 draft, exporters face higher fines and enhanced penalties, and the provision for penalty mitigation in the case of voluntary disclosure of certain offences has been deleted.Footnote 107 For example, fines for ‘export without licence’ have been raised tenfold from the initial sum of RMB 50,000. Exporters transacting with any entities that are blacklisted by the authority would need to pay five to ten times or ten to 20 times greater fines depending on the size and features of illegal business revenues.
Finally, one of the significant changes in the final legislation from prior drafts is the direct consideration given to ‘reciprocal’ retaliatory measures under the ECL. Pursuant to Article 48, the ECL authorises reciprocal measures in the event that the Chinese Government believes another country or region ‘abuses export control measures to endanger the national security and national interests of the PRC’.Footnote 108 The addition of explicit provisions enabling such reciprocal measures shows the influence of ongoing competition between the US and China in the technology sector upon export control reform.
3. Export controls on cyber surveillance technology under the ECL scheme
Issued by State Council in 2015, the ‘Made in China 2025’ Notice sets targets for higher levels of ‘domestic production and innovation’ of high-end goods, value-added services and emerging technologies.Footnote 109 It also specifies targets that Chinese companies in prioritised sectors need to achieve in terms of their domestic and international market shares.Footnote 110 Ramping up cyber capabilities is extensively discussed in this context as an industrial priority and a key to military modernisation.Footnote 111
‘Made in China 2025’ has played a critical role for the development of the cyber surveillance technology industry in China. The rapid growth of this sector is a result largely of the government's military-civil fusion (MCF) strategy, which was introduced as a project to modernise military hardware in the 1990s and elevated to a national strategy as one of the initiatives pursued under the ‘Made in China 2025’ Notice.Footnote 112 MCF incentivises the civilian sector to enter the defence market by supporting relevant industrial actors with tax reductions and other financial subsidies. It encourages commercial and defence sectors to combine resources to develop dual-use technologies for greater efficiency and growth, ‘with a particular emphasis on assimilating private innovation into the defense industrial base’.Footnote 113 Against this background, various Chinese technology companies have become an integral part of the defence market, and advanced surveillance technology is one of the key sectors that produces a wide variety of products and expertise having both industrial and military utility.
On its face, ‘Made in China 2025’ is a nationwide industrial planning strategy adopted to stimulate domestic development of prioritised technology sectors, and to maintain a competitive edge over strategic competitors. Its guidelines shape the business activities of a range of industrial actors (eg producers, developers and the exporters) in these sectors. The implications of ‘Made in China 2025’ are more than industrial. This top-down industrial goal-setting statement serves to dictate the legislative and administrative narrative justifying the imposition of tighter controls on the transfer of Chinese-originated cutting-edge technologies. What China seeks to achieve through the adoption of the ECL is one of these examples. As examined above, the ECL (legally) enables the government to impose tit-for-tat export control measures, and, with ECL's extraterritorial application, implements the spirit of ‘Made in China 2025’ overseas. As with the US Entity List, the ECL also creates a formal procedure to blacklist certain importers and end-users as a result of, for example, actions against ‘endangering national security’.Footnote 114
Many terms in the 2018 US law are similarly used in the equivalent Chinese legislation. More than half of ten key technology sectors selected for prioritised government support in the ‘Made in China 2025’ list replicate those on the US BIS list of emerging technologies. There is a possibility that Chinese technology export regulation will become more aggressive and targeted towards users and exporters of certain origins, particularly the US.
C. Strengthening the Human Rights Dimension in the Export Regulation of Cyber Surveillance Technology—EU Reform after an Impasse
The EU's export control regime for dual-use goods and technologies has undergone an extensive multi-year revision. Unlike in the US and China, the EU export control reform was initiated by revelations in the early 2010s that EU-originated surveillance products and expertise had been sold to and used by authoritarian regimes.Footnote 115 This legislative background developed in the Arab Spring context aptly explains the human rights orientation of subsequent reform proposals. The EU's reformative angle in this regard is often described as ‘rights-based export controls’, ‘people-centered security’ or the ‘human security approach’.Footnote 116
After prolonged negotiations between the European Commission, Parliament, and Council, compromise over the text of the proposed amendments was finally reached in November 2020. There was broad agreement among Member States that the EU should be a more accountable actor in the global trade in cyber surveillance technology, however division arose over the extent to which human rights considerations should be invoked as an explicit justification to restrict the export of cyber surveillance items. Some preferred a more limited amendment to the existing export control legislation. As examined below, this division is also found in the different reform proposals delivered by those three EU institutions. The Council's negotiating mandate rejected almost all amendment proposals that could broaden the scope of controls on cyber surveillance technology beyond what was already agreed at Wassenaar.
1. Wassenaar implementation and the legislative process for the ‘Recast’ EU Dual-Use Regulation
EU Member States have maintained a common legal framework for export controls since the 1990s.Footnote 117 Centralising dual-use controls across the EU, Council Regulation (EC) No 428/2009 (‘Dual-Use Regulation’) was adopted under the Common Commercial Policy, one of the areas of exclusive EU competence.Footnote 118 It provides for the free transfer of dual-use items—with some exceptions—within the EU single market, and imposes various restrictions on the export, brokering, transit and transfer of dual-use items.
The current Dual-Use Regulation envisions several avenues for the imposition of export restrictions on cyber surveillance technology. Its dual-use control list corresponds with the lists maintained by various multilateral export control mechanisms, including the Wassenaar Arrangement.Footnote 119 In December 2014, the three control classes of the cyber amendment were added to Annex 1A of the Dual-use Regulation.Footnote 120 All the subsequent updates to the initial cyber amendment have been incorporated.Footnote 121 Pursuant to Article 8, States are also allowed to restrict dual-use items not specified in the list ‘for reasons of public security or human rights considerations’. In theory, (unlisted) surveillance items may thus be controlled nationally depending upon the manner and context in which they are transferred and deployed. Currently, at the EU level, the export of certain mobile telecommunications interception equipment, intrusion software-related items, and IP network surveillance systems are controlled in uniformity across all Member States, even without assessing their impact on public security or human rights within the meaning of Article 8.
The ill-controlled use and spread of cyber surveillance technology has been a driving force of the reform proposal for the Dual-Use Regulation.Footnote 122 The amendment process is subject to the ordinary legislative procedure involving a ‘trilogue’ among the European Commission, Parliament and Council.Footnote 123 In April 2014, the three institutions published a joint statement articulating how the EU should modernise the export control regime in order to ‘keep up with new threats and rapid technological changes’.Footnote 124 The 2014 joint statement urged the introduction of restrictions on certain ICT equipment, software, and expertise that can be used ‘in connection with human rights violations’ and in a way that undermines the EU's ‘security interests’.Footnote 125 The proposed reform also sought to enhance EU-wide uniformity across the application of domestic export control measures, and facilitate information sharing among Member States.
In September 2016, the European Commission published a proposal to ‘recast’ the Dual-Use Regulation.Footnote 126 The Commission's amendment proposal was submitted to the Parliament, which appointed the Committee for International Trade (INTA) to draft a set of amendments to the Commission's proposal. Following the adoption of INTA's final report containing 98 amendments to the proposal, the Parliament voted by an overwhelming majority to adopt them during a Plenary Session in January 2018.Footnote 127
2. Different views over the amendment of the EU Dual-Use Regulation—Implications for the export of cyber surveillance technology
The Commission's amendment proposal showed a regulatory turn to strengthen EU-wide export controls on cyber surveillance technology, and the core components of its proposal were largely endorsed by the Parliament. The proposed control scheme combines a list of items identified under a new control category called ‘cyber surveillance items’,Footnote 128 with a catch-all clause for such items that are not specifically listed but used in connection with serious human rights violations as identified by the competent bodies. However, these reform proposals were met by the Council's counterproposal rejecting many of substantive provisions relating to cyber surveillance technology and human rights.
There are three key areas of amendment addressed by the Commission and subsequently updated by the Parliament. First, a new control category was created for cyber surveillance items, with an ‘autonomous’ EU list introduced for cyber surveillance technology that emphasised its connection to serious human rights violations. While Article 2(1)(1)(b) defines the scope and meaning of cyber surveillance items, the Parliamentary amendment updates the Commission's version to some extent. It provides a number of technical attributes of the items that fall under the category of cyber surveillance items:
hardware, software and technology, which are specially designed to enable the covert intrusion into information and telecommunication systems and/or the monitoring, exfiltrating, collecting and analyzing of data and/or incapacitating or damaging the targeted system without the specific, informed and unambiguous authorization of the owner of the data.
It then clarifies specific manners and contexts in which the covered items may be used:
(…) and which can be used in connection with the violation of human rights, including the right to privacy, the right to free speech and the freedom of assembly and association or which can be used for the commission of serious violations of human rights law or international humanitarian law, or can pose a threat to international security or the essential security of the Union and its Members.
The Parliament's proposal is also in line with the Commission's position to create an autonomous list for cyber surveillance items. As Article 16(2)(b) states, the list shall be amended if it is ‘necessary due to risks that the export of cyber surveillance items may pose as regards the commission of serious violations of human rights or international humanitarian law or the essential security interests’.Footnote 129 Items such as data retention systems and digital forensics were newly added to Annex IB as ‘other items of cyber surveillance technology’. These items do not fall under the three categories incorporated into the dual-use list as a result of the EU's Wassenaar implementation in 2014.
Second, the human rights dimension is incorporated into Article 4(1), which creates a catch-all control for the export of non-listed items in certain situations. Article 4(1) was initially proposed as an ‘emergency brake’ to be applied for dual-use items in general,Footnote 130 but the Parliament's amendment reduced its scope to cyber surveillance items. Cyber surveillance items that are not listed in the Regulation may be subject to control if used:
in connection with violations of international human rights law or international humanitarian law in countries where serious violations of human rights have been identified by the competent bodies of the UN, the Council of Europe and the Union, or national competent authorities.
In addition, there must be ‘reason to suspect’ that these items ‘may be used for the purpose of directing or implementing such violations’ by the end-user. Regarding any of the uses that invoke the catch-all control on cyber surveillance items, Article 4(2) imposes ‘due-diligence’ obligations on the part of exporters.
Third, the element of human rights assessment is integrated into the export licensing procedure for cyber surveillance items. The amendment proposal expands Article 14's licensing criteria by requiring States to take into account human rights situations in importing countries. Among six sub-provisions, there are three human rights-related considerations, two of which explicitly concern cyber surveillance technology. Namely, licensing authorities are required to consider ‘the occurrence of violations of human rights law, fundamental freedoms and international humanitarian law’ in the country of final destination as established by the UN, the Council of Europe, or the Union.Footnote 131 Member States also need to consider the ‘intended end-use’ of cyber surveillance items and assess the risk that those items, ‘will be diverted or re-exported under undesirable conditions or be diverted to unintended military end-use or to terrorism’.Footnote 132
For its part in the trilogue procedure, the Council adopted a negotiating mandate for reviewing the Dual-Use Regulation in July 2019. The Council's negotiating mandate shows a significant disagreement between the Council and the rest of institutions in the trilogue process.Footnote 133 Up until late 2020, it was unclear to what extent the key innovations proposed by the Commission and the Parliament would be accepted. First, the Council's mandate dismissed any references to creating an autonomous EU list for cyber surveillance items. Second, it rejected a human rights-based catch-all clause for unlisted cyber surveillance items (Article 4(1)), and the idea of due diligence obligations for exporters (Article 4(2)). Finally, the new requirement for human rights assessment was removed from export licensing criteria. Instead, the Council merely referred to the existing EU-wide policy commitment to consider human rights violations as one of the reasons for imposing export restrictions. In particular, the Council's mandate reinstated a reference to Common Position 2008/944/CFSP (‘Common Position’) containing human rights-related provisions concerning arms exports.Footnote 134 This move indicated a far more limited application of human rights than what was pursued by the proposed amendment passed by the Parliament.
Moreover, many Member States repeatedly expressed reluctance to go beyond what had been agreed multilaterally at Wassenaar.Footnote 135 They made it clear that the unilateral expansion of export controls on cyber surveillance items was unacceptable, and that until such a time comes, the EU should not work ‘in isolation’.Footnote 136 In other words, the EU control list should continue to be maintained through incorporating the control lists of international agreements, including the Wassenaar Arrangement. From another perspective, many researchers and stakeholders in EU-based technology companies expressed growing concern regarding self-inflicted damage. The human rights-oriented recast of the export control regime would create stricter restrictions on cyber surveillance technology, and with such an approach, the EU might lose business competitiveness over other leading States—especially the US and China. The proposed amendment, if adopted unchanged, would undermine innovation and disrupt supply chains in the cyber surveillance industry. As the US and China had gone through extensive rebuilding of export control rules concerning cutting-edge ICT, including cyber surveillance technology, it was argued it would not be wise for the EU to finalise the reform process and risk setting their position in stone.
3. Compromise reached—The prospect for the human rights-based approach to technology export regulation
Following extensive trilogue negotiations, a provisional agreement was finally reached on the ‘final compromise text’ in November 2020.Footnote 137 Overcoming significant differences among multiple amendment proposals, the proposed Dual-Use Regulation of 2020 achieves two goals with regard to cyber surveillance technology: enhancing the EU's capacity to regulate trade flows in a wider range of cyber surveillance items, and strengthening human rights considerations in the EU export licensing architecture. The compromise text subsequently received endorsement at the Ambassadors of the Member States meeting. The Parliament is expected to vote on the adoption of the agreed text at first reading in early 2021.
This section focuses on three important amendments agreed in the compromise text.Footnote 138 First, the term ‘cyber-surveillance items’ is now defined under dual-use items. According to Article 2(21), cyber-surveillance items means:
dual-use items specially designed to enable the covert surveillance of natural persons by monitoring, extracting, collecting or analysing data from information and telecommunication systems;
The new definition is simplified compared to wording suggested by the Commission's proposal and no longer defines specific manners and contexts in which the covered items may be used. The Commission also proposed to add ‘monitoring centres’ and ‘data retention systems or devices’ under a newly created group of controlled items (Annex IB). This category no longer remains in the compromise text. Except in the case of regular updates introduced in line with the EU's commitment to implementing Wassenaar, there is no change concerning cyber-surveillance items in the EU control list.
Second, Article 4a of the compromise text creates human rights-based catch-all controls for cyber-surveillance items that are not listed in the Dual-Use Regulation. Most of the proposed amendments suggested and updated by the Commission and the Parliament in this regard remain intact. The Council's position rejecting the creation of catch-all controls for cyber-surveillance items did not prevail. Relevant authorisation is required for the export of any cyber-surveillance items ‘not listed in Annex I’ to the regulation,Footnote 139
if the exporter has been informed by the competent authority that the items in question are or may be intended, in their entirety or in part, for use in connection with internal repression and/or the commission of serious violations of international human rights and international humanitarian law.
Under Article 4a, the exporter of non-listed cyber-surveillance items needs to conduct ‘due diligence findings’, and if the exporter is aware that those items ‘are intended, in their entirety or in part, for any of the uses’ described above, the exporter bears obligations to notify the competent authority, ‘which shall decide whether or not to make the export concerned subject to authorization’.Footnote 140 Due diligence obligations on the part of the exporter were among the amendment proposals rejected by the Council. This compromise not only strengthens human rights considerations in the export licensing process, but also shows a greater expectation for the role of the private sector (including commercial surveillance companies) in dealing with the risks posed by the proliferation and abuse of cyber surveillance technology. Interestingly, the amendment proposals suggested and updated by the Commission and the Parliament went further and clarified specific standards of due diligence exercise required for the exporter.Footnote 141
Finally, the compromise text strengthens reporting rules aimed at increasing transparency and information sharing regarding trade in dual-use items. Article 24(2) requires the Commission to produce a publicly available report detailing the actual implementation of the Dual-Use Regulation by Member States. Under the new sub-provisions introduced by the compromise text, this report has to include information on export authorisations (in particular the number and value of items by type and destination), denials, and prohibitions under the Regulation, and other information as required in Article 24(2). There is also an additional reporting requirement concerning the export of cyber-surveillance items. The report requires ‘dedicated information on authorisations, in particular on the number of applications received by items, the issuing Member State and the destinations concerned by these applications, and on the decisions taken on these applications’.
The application of human rights concerns to export controls has not been an alien concept in EU-wide practice. In fact, ‘respect for human rights’ was among the most frequently used assessment criteria when national licensing authorities of Member States denied export licenses for cyber-surveillance items.Footnote 142 Human rights-related abuse and risks are no longer a marginal consideration in regulating the export of sensitive dual-use goods and technologies.Footnote 143 With the adoption of the 2020 compromise text, the EU goes further by placing human rights considerations at the centre of decision-making for export controls of cyber-surveillance items. The proposed Regulation makes it clear that these items exported from the EU market ‘may be misused by persons complicit in or responsible for directing or committing serious violations of human rights or international humanitarian law’.Footnote 144 At different stages of export restrictions and licensing, strengthening human rights considerations is recognised as key to dealing with technological and security challenges posed by the proliferation of ICT-powered surveillance tools.
V. Conclusion
The Wassenaar Arrangement is a central platform of international cooperation for regulating dual-use items, and the cyber amendments to Wassenaar have created a multilateral mechanism designed to govern the use and transfer of cyber surveillance technology. Following severe criticism of the repressive use of cyber surveillance technology supplied by commercial surveillance firms, Wassenaar States reached an agreement to extend the scope of the Arrangement to cover certain types of surveillance tools. It was expected that such collective efforts to develop and coordinate export controls under a common legal framework would stop the kinds of abuse that made these companies (in)famous over the past decade. Notably, the realisation of this vision depends on regional and domestic implementation of the cyber amendments.
The US, China, and the EU have played a leading role in the production, sales and governance of cyber surveillance technology. They have used the Wassenaar Arrangement (at least) as a template to create and/or strengthen (new) export controls on cyber surveillance technology. However, based on the analysis of recent export control reforms in these three jurisdictions, Wassenaar implementation strategies concerning cyber surveillance technology have been far less successful than the cases of many other Wassenaar-listed items. In the US, the implementation process has long been delayed except in the case of certain mobile telecommunications interception. China seemed to perceive that global standard setting and cooperation to restrict the controlled items under the auspices of Wassenaar were essential to (or at least not contrary to) its national security interests, yet the Chinese implementation of the Wassenaar Arrangement is flimsy as it is not a party to Wassenaar. In the EU setting, the cyber amendments in their entirety have been incorporated into the EU export regulation framework, with EU lawmakers going far beyond what was agreed at Wassenaar.
The timing of the US ECRA and the proposed modernisation of the EU Dual-Use Regulation have coincided with the development of China's first omnibus export control law. As analysed in Part IV, their new export control rules and new control categories adopted as a result of nation (region)-wide reforms show a significant degree of regulatory divergence. All three jurisdictions aim to become a stronger and more autonomous regulatory entity in governing the use and transfer of cyber surveillance technology. In the US and Chinese settings, export controls are not just a traditional mechanism for the non-proliferation of sensitive dual-use items such as cyber surveillance technology, but have become a key front for political, commercial and security confrontations concerning emerging technologies, especially between these States.
The escalating G2 competition at the intersection of global trade, technology and security has affected the minds of policymakers in ongoing debates over export control challenges associated with cyber surveillance technology. To be more specific, with the advent of the ECRA era, the US technology export regulation is increasingly inward-looking and is overly permissive of the unilateral application of export controls.
The US focus on controlling the export of US-originated ‘emerging and foundational technologies’ indicates that with respect to cyber surveillance technology—which is one of the 14 categories in the ‘emerging’ technology list identified by the BIS—the US is no longer at the centre of creation, development and global implementation of the Wassenaar controls. Its concerns about losing technological and commercial dominance in the global technology market are also manifest in the terms of the ECRA adopted in 2018. In China, the ECL shows Chinese attempts to (legally) enable tit-for-tat regulatory responses to similar technology export controls adopted and/or possibly introduced by the US under its new export control law. Some of the most significant changes in the final legislation from prior ECL drafts broaden the scope of export control justifications that allow the furtherance of a broader political agenda of the government through the ECL.
In contrast, the EU's approach to the same matter is entirely different. The reform discourse for the EU Dual-Use Regulation has been framed so as to recognise the linkage between human rights violations and the repressive use of ICT-powered surveillance tools, as well as the importance of export control measures in breaking that linkage. After years of prolonged negotiations, the EU has successfully adopted new export control rules for cyber surveillance technology. These rules are explicitly built around human rights considerations. The proposed control scheme combines a list of items under the newly defined dual-use category of ‘cyber-surveillance items’, with a catch-all clause for such items that are not listed but used in connection with certain situations involving human rights violations. Such a progressive catch-all clause is absent in the Wassenaar terms. Moreover, the EU Member States have consistently strengthened a global coalition of democracies committed to adopt a more human rights-centred approach to governing the export of cyber surveillance technology. Nevertheless, it is unclear how the EU's collective regulatory turn will be received by the US and Chinese governments in the long run and how it will interact with export control reforms designed with different geopolitical, commercial and security agendas.
The surveillance industry is the ‘first line of defence’ to prevent the proliferation and abuse of cyber surveillance technology.Footnote 145 However, one cannot wholly rely on private surveillance companies to exercise self-regulation and conduct human rights risk assessments for certain end-uses and end-users of their products. It is not unprecedented that some of these companies circumvent controls by exploiting differences in national export controls and licensing procedures. They also relocate their businesses and/or change distribution channels to States having more lenient rules.Footnote 146 Therefore, States urgently need to revive administrative and legislative efforts to implement the Wassenaar controls on certain types of cyber surveillance technology.
It should be noted that there are no effective remedies for civilian victims in cases where State-led mass surveillance is conducted in connection with serious human rights violations. Given that the local justice system is not likely to provide any successful course of action for demanding accountability,Footnote 147 the export control mechanism could be one of the few avenues able to address their human rights concerns to some extent. Ideally, with respect to cyber surveillance technology, policymakers should integrate human rights considerations into the process of assessing the security risks associated with certain end-users and end-uses at different stages of export control licensing and enforcement. Making those surveillance products and expertise subject to an export control scheme will lead government authorities and private surveillance companies to act more responsibly in transferring cyber surveillance tools—many of which have fallen into the wrong hands.
