Problems with the Export Control Bill

Ross Anderson

UPDATE - on the 18th April, we persuaded the House of Lords to defeat the government by 150 votes to 108 and insert an academic freedom amendment into the bill. The debate is here, and the text of the amendments is here.

The government beat back our amendment in the Commons, but finally on the 23rd July accepted an agreed compromise amendment that severely restricts the ability of ministers to make export regulations that interfere with scientific research, material being published, or material already in the public domain. The debate is here, and the text of the amendment is here:

The Lord Sainsbury of Turville to move, That this House do not insist on their amendment No.10 to which the Commons have disagreed, but do propose the following amendments in lieu thereof

After clause 6, insert the following new Clause

"Protection of certain freedoms

(1) The Secretary of State shall not make a control order which has the effect of prohibiting or regulating any of the following activities- the effect of interfering with-

(a) the communication of information in the ordinary course of scientific research,

(b) the making of information generally available to the public, or

(c) the communication of information that is generally available to the public,

unless the interference by the order in the freedom to carry on the activity is necessary (and no more than is necessary).

(2) The question whether any such interference is necessary shall be determined by the Secretary of State by reference to the circumstances at the time the order is made and having considered the reasons for seeking to control the activity in question and the need to respect the freedom to carry on that activity."

Sainsbury's speech makes clear that any decision by the Secretary of State to impose such a power can be reviewed by a court on the merits. So we won - and FIPR's efforts were nicely acknowledged by both the Conservative and Liberal Democratic front benchers.

The Export Control Bill, which is presently before Parliament (the Hansard report starts here and comes to the point here), has serious implications for academic freedom. One of its goals is to extend export controls on armaments from physical goods to intangibles such as software. However, the powers are so widely drawn that they give ministers the power to review and suppress any scientific papers prior to publication. They also give ministers the power to license foreign students - not just at British universities, but students taught by British nationals anywhere in the world.

Section 2, on `transfer controls', says that `The Secretary of State may by order make provision for ... the imposition of transfer controls in relation to technology of any description. For this purpose `transfer controls', in relation to any technology, means the prohibition or regulation of its transfer:-

The penalty is up to ten years' jail, and ministers are also allowed by section 6 to `amend, repeal or revoke, or apply (with or without modification) provisions of any Act or subordinate legislation.' Even by the standards of the `Henry VIII' powers seen in some recent Acts, this is extreme.

The first draft of the proposals surfaced in 1998 in a white paper, following the arms-to-Iraq scandal. Until then, Britain's arms export control laws covered only physical equipment; by comparison, US law enabled the authorities to ban electronic exports too. This meant in practice that researchers in Britain (and most other countries) could distribute software containing cryptographic routines freely, while our US counterparts could not. The US government lobbied for other countries to fall in line, and the Export Bill is the result. (Following opposition to the initial white paper from the Trade and Industry Select Committee, it was promoted by a roundabout route - by first promoting it as a European agreement, then excusing the bill as a European obligation.) Curiously, this is happening just as the USA is abandoning many controls on intangible exports, after some high profile prosecutions of activists ran into trouble. So it looks like the positions will now be reversed: Americans will be able to export software more or less freely while Britons will labour under a licensing regime.

But that's not all. The UK proposals are very much more severe than anything experienced in America, and they affect much more than just cryptography. The list of technologies whose export `electronically' would become subject to licensing is set out by international treaty (though the DTI could add extra items if it wished). The relevant treaty, known as the Wassenaar Arrangement, covers most of the subjects of interest to scientific and technological researchers, whether directly or through the tools we use.

For example, two of my research students use a focussed ion beam workstation to modify semiconductor chips. This machine is export controlled. What that means today is that the University has to get approval to buy one, and again several years later when we dispose of it. In future, we may need individual licences for my students to use it (one of them is Russian, the other Korean). They may also need to get a licence whenever they share a program they have written for the machine with another foreign national, or anyone overseas. As one of them is employed on an EU contract with French, Danish and Belgian collaborators, there could be even more forms to fill.

The proposed law would have effects right across science, technology and medicine. For example, teaching medicine to a foreign national would appear to require a licence; many of the core curriculum subjects, such as bacteriology, virology, toxicology, biochemistry and pharmacology are central to a chemical and biological weapons programme (indeed South Africa's programme was set up and run by PW Botha's personal physician). Other problematic subjects include not just nuclear physics and chemistry but also aerodynamics, flight control systems, navigation systems, and even computational fluid dynamics.

The new law would cover most of our research in computer science (fast networks, high performance computing, neural networks, real-time expert systems, hardware and software verification, reverse engineering, computer security, cryptography) and could even force a rewrite of lecture course and project material. The Department of Engineering would be hit by the listing of numerically controlled machine tools and fibre winding equipment, robots, optical amplifiers, software radios and aero engine control systems, as well as many lasers, gyros, accelerometers and similar components. The restrictions that previously only applied to physical hardware objects will be extended to the software used to design, test, control or operate them, or to integrate them into larger systems.

There could be a severe impact on collaborative research across national boundaries, including the EU funded research which now accounts for a large proportion of our science base. Such collaboration necessarily involves many intangible exchanges of technology. In the late 1990s, for example, I worked with scientists in Norway and Israel to develop a candidate encryption algorithm which was a finalist in the Advanced Encryption Standard competition, run by the US government. This involved sending over 400 emails back and forth, many containing fragments of source code. The DTI has confirmed to me that in future such exchanges will require a licence.

As three-quarters of Cambridge's research students in science and technology are foreign nationals, licensing will have a significant impact on the research base. The added delays and uncertainty involved in export licence applications will add to the pressures on departments; and it remains to be seen whether the licences would be sufficiently broadly phrased to support current ways of working, in which researchers move at will from one topic to another, and form ad hoc collaborations to tackle particular problems.

The proposed regulations will also have an adverse impact on undergraduates, particularly blind and deaf students who require course materials in (controlled) electronic form. As more and more course material comes to incorporate software and other electronic components, the number of students affected will increase until it includes essentially all foreign nationals studying in the School of Technology. Not all student collaborations are closely supervised: for example, our second year computer science undergraduates undertake group projects in teams of six or seven, and several of these projects in an average year will not only incorporate controlled technology but also have foreign nationals on the team. To prevent unlawful technology transfers, we would have to introduce tiresome administrative measures or greatly restrict the choice of project topic.

The many high-tech companies in Cambridge would also be hit. These companies, many of them set up in collaboration with members of University departments, produce all sorts of intangible yet potentially licensable products, ranging from software for GSM phones, network computers and engine controllers, through designs for ATM switches and other chips. The likely effect can be inferred from the effects of US export regulations on a UK multinational (the USA is the only major country that controls intangible exports at the present time). This company uses supercomputers in mineral exploration, and the effect of the regulations is that it cannot construct the global data network that it wants; the US government fears that this might allow a Kazakh or Burmese employee to have access to controlled software. A senior manager described the result as `having to implement US foreign policy on every machine on my network'. If he also had to implement UK foreign policy, operations would grind to a halt whenever there was a clash. Placing such burdens on industry would seriously affect our collaborative research projects with them.

There may well be legal challenges to the bill. Opponents will argue that it fails the test of proportionality, especially since the proposed controls were clearly not required during the Cold War. They will argue that while one may well decide to curtail long-established academic liberties because something bad has happened, it is excessive to do so because a bad thing might happen, but hasn't. (Al-Qaida isn't an excuse, unless even basic aerospace engineering is to be reclassified as a technology relevant to weapons of mass destruction. Technology is no longer the focus of the challenge to the West; our superiority at that is unchallenged since the collapse of the Soviet Union.) Even in the absence of legal challenges, requiring academics to get licenses to do their work when they had previously been left to get on with it will give rise to protests, and will lead to confrontation with government.

I anticipate attempts to make licenses conditional on academic behaviour. A senior Foreign Office man informed me that Cambridge had had better drop its opposition to the so-called `voluntary vetting' scheme whereby some universities agree to forward details of third world applicants for technology PhD places to the security services, who then advise them (for example) not to let Pakistanis or Chinese do doctorates in computer security. Cambridge and Oxford have always refused to participate, taking the view that the FO can if it wishes always refuse a visa. The new bill provides ministers with the powers to make voluntary vetting compulsory.

Bringing the academic community inside the arms export licensing system will cause such disputes to proliferate and fester. In the long run, creating a mechanism that can be used by DTI civil servants to punish individual academics -- without due process or the possibility of appeal -- will seriously impair academic freedom.

Even if academic freedom is not considered to be the DTI's problem, the effects of the proposed policy on the credibility of the export control regime should be considered. A government concerned about proliferation via academic channels should seek the support and cooperation of academics rather than passing a law certain to antagonise them.

Unfortunately, the debate on the Bill has been dominated by attempts, sponsored by NGOs such as Amnesty, to tighten the licensing regime still further. Academic freedom has not so far found a voice. I very much fear that the only effect of these well-meaning interventions will be to harm our domestic liberties. There is no evidence that our government's `ethical foreign policy' has made it harder for large arms makers to get the export licences they seek, and there is no reason to believe that things will get any harder for them once this bill is passed. However, there is every reason to fear that universities will be a scapegoat, and that the DTI will gleefully create an empire of officials to oversee our foreign students, our international collaborations and our publications.

For these reasons, I've been promoting an amendment exempting research and teaching, which has been adopted by Universities UK and the Association of University Teachers. It was debated in the House of Lords here. The goal of our campaign is to get the government to adopt the amendment, and if they refuse, then to defeat them in a vote at the report stage of the bill.

This issue was first covered by the Independent on the 18th and 19th February. Subsequent coverage includes stories by the BBC on the 18th and 21st February, the Guardian, the Economist and the New Scientist. The story is now even getting coverage abroad; here, for example, is a recent story in Germany (and an English translation).