Sic Semper Technology

When Muammar Qaddafi’s reign ended last fall, Western forces discovered that Libyan security agents had for years used network surveillance technology (NST) manufactured by Amesys, a unit of French company Bull SA, to monitor e-mails sent to and from suspected rebels. Agents used the system to go after a Libyan journalist critical of the regime. The journalist was subject to years of interrogation and other harassment and was ultimately forced into hiding.

Authoritarian regimes in the Middle East have increasingly been turning to NSTs to find and then alter or block online content deemed threatening to their authority. Also identified by other names, such as filtering technology, tracking technology, and spyware, NST represents a significant advancement over prior electronic surveillance technology because it allows for instantaneous monitoring of vast amounts of data transmitted over a telecommunications network. Another benefit is that NST requires little or no human involvement.

The methods used to analyze and receive data may vary, but the various types of NSTs generally employ hardware and software components capable of scanning the data on the network to identify particular content.

|NSTs can be used to monitor almost any type of network-based data, including mobile phone communications, Web content, and e-mails. NSTs do have lawful purposes, such as gathering criminal evidence, locating distressed individuals after a disaster, and even online marketing research.

NSTs have existed in the form of surreptitious listening devices, such as the classic telephone wiretap, for a long time. Export control laws in many countries have long restricted the export of such devices, but these prohibitions have failed to keep up with the rapid evolution of communications technology. Those laws do not cover the new, more sophisticated, forms of monitoring devices. Thus, companies have generally been able to sell NSTs freely with few exceptions, such as when the sale was to a sanctioned country or individual.

That is changing. With remarkable speed, governments around the world are reacting to the ubiquitous use of NSTs by authoritarian regimes to further human rights abuses. These governments have taken steps to restrict the export of NSTs, and they are also more aggressively enforcing any applicable preexisting laws that restrict their export. As discussed ahead, significant recent changes have been implemented by the European Union (EU) and the United States government, among others.

In November 2011, the EU amended its general export authorization for telecommunications equipment to disallow the export of NSTs intended for use in violating human rights, democratic principles, or freedom of speech. This restriction is triggered when the exporter has been informed by its national government or is otherwise aware that the purchaser may use the NST at issue for those restricted purposes.

As a practical matter, this restriction requires NST exporters to conduct due diligence to determine the purchaser’s intended use for the NST. Among the due diligence steps is to check whether the purchaser is identified on any existing restricted lists issued by a national government, which may indicate that the purchaser would use the NST to violate human rights, democratic principles, or freedom of speech.

Widespread attention to the Arab Spring and the use of NSTs by repressive regimes prompted the EU to take additional action. In December 2011 and in January 2012, the EU imposed additional restrictions on NST exports to Syria specifically. The EU passed a similar measure imposing sanctions on Iran in March 2012.

Then, in April 2012, the EU parliament passed a resolution to improve the monitoring of NST exports to certain countries. The restriction also included a requirement that the export of services related to NSTs be monitored as well. The resolution followed formal requests by the EU parliament for an investigation into whether EU companies contributed to human rights violations by selling NSTs to countries such as Tunisia, Egypt, Syria, Bahrain, and Iran.

In the United States, comprehensive, preexisting sanctions against countries such as Iran and Syria should have prohibited NST exports to those countries. Unlawful sales of NSTs have still occurred, however, as highlighted by press reports, leading to a flurry of developments in the United States.

In the U.S. Congress, a bill (H.R. 3605) is pending in the U.S. House of Representatives that would impose a number of requirements related to Internet freedoms in foreign countries. Among other things, the bill would require that the U.S. government report on each foreign country’s Internet freedoms and designate any country that is responsible for a systematic pattern of substantial restrictions on the Internet as an “Internet-restricting” country.

Companies providing telecommunications services to these countries would have to complete an annual report disclosing their due diligence investigations. Such reports must make it clear that the countries receiving the technology have a demonstrated respect for human rights. The bill would also require that the U.S. government maintain a list of technologies that could be used for censorship or monitoring, and companies would be prohibited from exporting those technologies to any government on the “Internet-restricting countries” list.

In May 2012, the U.S. Senate passed an amended version of a House bill (H.R. 1905), which would require the U.S. government to impose sanctions on individuals and companies that transfer or facilitate the transfer of sensitive technologies to Iran or Syria, or provide services for such technologies. Potential penalties for these activities would include automatic denial of U.S. export licenses, ineligibility for U.S. government procurement contracts, and prohibitions on transfers of credit or payments through U.S. financial institutions. The House and Senate bills have differences that will have to be worked out in a conference committee. Once a single bill has been created, both houses will have a chance to vote the final bill up or down.

Meanwhile, an executive order signed by President Barack Obama in April 2012 achieves much of what the House and Senate bills aim to cover. The order, in part, blocks the U.S. property and interests in such property of any individual or group determined to have aided the Iranian or Syrian government in the acquisition or use of NSTs to commit human rights abuses. Although the order imposes a different type of sanction from those imposed by H.R.1905, the prohibitions are similar.

On the enforcement front, the U.S. government has been investigating and penalizing companies for unlawful exports of NSTs. For example, in December 2011, the Commerce Department’s Bureau of Industry and Security (BIS) took action against two parties, Waseem Jawad and Infotec, for allegedly selling NSTs to Syria in violation of U.S. sanction laws against that country. Relying on the NSTs’ serial numbers, the U.S. manufacturer, Blue Coat Systems, Inc., was able to confirm that its devices, allegedly exported by Jawad and Infotec, were being used by a telecommunications company located in Damascus, Syria. The parties are now subject to a license requirement—and thus rigorous U.S. government scrutiny—for the receipt of any export subject to U.S. jurisdiction.

The government is also conducting numerous probes into the sale of NSTs to repressive regimes by U.S. companies. For instance, BIS is investigating NetApp Inc.’s alleged sale of a multi-million dollar NST system to the Syrian government. According to reports, the government investigation was prompted by the company’s own discovery and internal investigation of the sale. The system, which was allegedly designed to intercept and catalog e-mails circulated through Syria, was purchased by Italian company Area SpA and, in turn, sold to the Syrian government. In addition, both BIS and the FBI are probing a major Chinese telecommunications firm, ZTE, and its U.S. subsidiary for selling $130.6 million worth of NST technology to Iran.

Given these aggressive enforcement actions, companies that deal in NSTs must ensure that their employees know the law and abide by it. Companies that fail to abide by export control laws may be subjected to government investigations that could result in severe penalties. And existing laws are likely to be enforced more aggressively, and perhaps even strengthened, given recent geopolitical events, particularly those related to the Arab Spring.

Companies should conduct comprehensive due diligence to help ensure compliance with those laws. Companies should, at a minimum, check restricted party lists issued by their national governments to ensure that a party to a transaction is not prohibited. (In the case of U.S. companies, for example, the Specially Designated Nationals list administered by the U.S. Department of Treasury’s Office of Foreign Assets Control should at least be checked.)

Companies should also consider obtaining signed statements from their custom­ers that certify the ultimate destination, end user, and end use of NST technology. Given the increased scrutiny of NST exports, many companies may opt to err on the side of caution and withhold the sale or export when doubt exists on where, by whom, or how the technology will be used. Although no amount of due diligence can guarantee full compliance, the above compliance steps can help companies avoid civil and criminal liability.

David Hardin is an international trade expert in Washington, D.C., and an attorney at the law firm Miller & Chevalier.