Cloud Computing

Cloud Computing – it’s all the rage! Seems like almost everyone is using it. This and digital data storage on remote servers are services that are being promoted as ways to reduce costs as well as to leverage computational capabilities and to facilitate digital data sharing. Generally speaking, cloud computing refers to the use and access of multiple server-based computational resources via a digital network such as the internet. Remote storage refers to services limited to storage and backup of digital data on a third-party server. A third-party server is something that is owned and maintained by someone other than UM.

Traditionally, Department of Commerce’s Bureau of Industry and Security (BIS) had advised the transmission and storage (outside of the U.S.) of technology or software controlled under the EAR constitutes an export or re-export. Therefore, such transmission or storage could potentially trigger a licensing requirement.  Due to the Export Control Reform initiatives and the ever-changing industry of “cloud computing and security”, the United States Government instituted changes for transmission of controlled data for institutions, private and government sectors.

On September 1, 2016, new rules adopted by the Department of Commerce’s Bureau of Industry and Security (BIS) that amended the Export Administration Regulations (EAR) that are now in effect. The EAR regulations updated treatment of electronically transmitted and stored technology and software. The most significant change under the new rules is the decontrol of sending, taking, and storing of certain encrypted technology or software. Under the new rule, sending, taking, or storing this type of technology or software will not constitute an export if the technology or software is:

• Secured using “end-to-end encryption”.
• Secured using cryptographic modules (hardware or software) compliant with Federal Information Processing Standards Publication 140-2 (FIPS 140-2) or its successors, supplemented by software implementation, cryptographic key management, and other procedures and controls that are in accordance with guidance provided in current U.S. National Institute for Standards and Technology publications, or other equally or more effective cryptographic means.
• Not intentionally stored in a military-embargoed country (Country Group D:5, per 15 CFR Supplement No. 1 to Part 740) or in the Russian Federation. Note: data in transit via the Internet is not deemed to be stored.  (Currently Russia and the “Group D:5” countries Afghanistan, Belarus, Burma (Myanmar), Central African Republic, China, Congo, Cote d’Ivoire, Cuba, Cyprus, Eritrea, Haiti, Iran, Iraq, Lebanon, Liberia, Libya, North Korea, Somalia, Sri Lanka, Sudan, Syria, Venezuela, Vietnam and Zimbabwe.) 
• The technology or software will not be in unencrypted form while between the originator and recipient or these parties’ respective “in-country security boundaries”.
• The means of decryption will not be provided to a third party.

Furthermore, the final rule of 2016, includes language which states that “access information,” such as decryption keys, passwords, or other information that allows access to encrypted data sent, taken, or stored under this provision, is subject to the same export control requirements that apply if the data were not encrypted. The EAR also contain an important limitation that releasing decryption keys or other access information that will permit a foreign person access to technology or technical data will constitute an export and be subject to the export control restrictions applicable to the foreign country in question. In addition to maintaining the requisite level of encryption, the university will need to establish ongoing data security practices to take advantage of this provision.

Such revisions make feasible a wider variety of cloud computing and cloud storage solutions, and significantly simplify associated compliance with export controls, relative to EAR controlled technology and software. However, the EAR also contain an important limitation that releasing decryption keys or other access information that will permit a foreign person access to technology or technical data will constitute an export and be subject to the export control restrictions applicable to the foreign country in question.

In addition to maintaining the requisite level of encryption, institutions will need to establish ongoing data security practices to take advantage of this provision. It is important to keep in mind that these changes do not apply to ITAR controlled technical data, with respect to which restrictions on the use of the cloud have not changed.  ITAR data may not be placed on shared infrastructure managed by non-US-Persons or alongside other organizations who do not have a license to export as defined in 22 CFR 120.17 and 22 CRF 120.13.

Don’t forget contractual obligations. In addition to the requirement to comply with U.S. export regulations, externally funded research and sponsored projects may contain contractual restrictions on the release of information that could include prohibition on the use of cloud computing services or third-party digital data storage. Failure to comply with contractual restrictions could result in a breach of contract and if the contract is federally funded, possible civil or criminal and penalties may be applied.

• If no other University resources are available to meet your needs, before entering into an agreement with the service provider, ask the following:
  
  • Where are the servers and routers located? (Get at minimum city, state, country)
  
  
  • Ask the provider to highlight in the agreement the measures they have in place to prevent unauthorized foreign nationals from accessing controlled technology and software wherever located.

* These are hypothetical questions and should not be considered absolute answers or legal advice. Each and every situation should be consulted individually with the appropriate representatives. This section is only meant to provide some additional guidance.