Data encryption technology is embedded in a wide-range of electronic products such as mobile devices and healthcare technologies. It is also important for a wide-array of services requiring security and privacy such as financial transactions and healthcare. But this is bigger than that and it will soon impact the proposed easing of U.S. sanctions on Cuba.
When it comes to sharing U.S. this form of U.S. technology with other countries, so long as certain security and other policy requirements are met in the third country, an overwhelming majority of the products and services that include high-end encryption technology can be exported from the United States to just about anywhere in the world. However, there are restrictions and certain countries, such as Cuba, are way behind the technology curve. They also cannot be trusted to do right with it.
As the Obama Administration and the Congress debate U.S.-Cuba policy, as well as ongoing efforts to reform U.S. export control laws, it will be interesting to see how these two issues intersect. The Cuban economy is in shambles because decades of Communist Party central planning are finally starting to take a toll. Raul Castro desperately needed an economic lifeline, so he turned to the United States to, among other things, ease the sanctions so that they can revitalize moribund sectors of the economy with U.S. knowhow and money. This is especially true of Cuba’s basically non-existent digital economy.
The most optimistic data point on Internet access in Cuba states that just 25% of the island’s population of 10 million has access to the world wide web. I think figure is much lower. Then there is the issue of control. Cuba ranks up there with North Korea and Iran with respect to Internet censorship. Web use is highly regulated and policed by the security services. According to Freedom House, the Cuban government controls the “legal and institutional structures that determine who has access to the internet and how much access will be permitted” and, unless you’re a Communist Party official or high-ranking government functionary, Internet access remains a luxury, out of reach of an overwhelming majority of Cubans. If you harbor any animus toward the government, Internet access can be a death sentence.
For example, dissidents and resistance leaders are routinely denied access to the web as well as devices that can connect to the outside world. Recall the outrage by U.S. politicos that favor easing sanctions on Cuba when it became public that the United States was helping Cuban access Twitter? If you remember anything about this post, remember this: telecommunications services and devices in Cuba are controlled by the police state and used as weapons against its people.
I’m representing an independent Christian church movement in Cuba before an international organization and can attest first-hand to state-sponsored monitoring and intimidation via ETECSA, the Cuban government-owned telecommunications company. Communicating with our client has been a real challenge. Phone calls are interrupted and cut off.
While they they have found ways to connect to the web and send us e-mail, it takes days to receive a response because they do not have ready access to a computer connected to the web. This case, currently under review by the Inter American Commission on Human Rights details, in part, how ETECSA has been using telecommunications equipment to violate the fundamental human rights of these churches and church leaders.
What does all this mean for U.S. telecommunications companies seeking to sell products and services to Cuba? As far as encryption and related export control matters, a great deal depends on the technology or service being provided. Your compliance and legal division will most certainly check the Commercial Control List (CCL) and the Export Administration Regulations (EAR) to ensure that certain encryption technology or services that include controlled encryption technologies are not exported to Cuba without prior U.S. government authorization.
Since the Cuban government owns everything in Cuba, the Cuban government remains the “end-user” for items exported to Cuba. And although Cuba came off the state sponsors of terrorism list, Cuba, in my book, remains a terrorist and cyber threat to the United States. I suspect the EAR and the CCL will reflect as much, even if it does not say so explicitly.
Even after the January 16, 2015 publication of the new Treasury and Commerce regulations, Cuba remains subject to a comprehensive economic embargo and, as such, exporters still need to secure U.S. government approval to export many encryption commodities, software and technology to Cuba (for the wonks and lawyers reading this, Cuba is on the following Country Group lists on Supplement No. 1 to Part 15 CFR 740: D:2, D:3, D:5 and E:2).
Pursuant to the revised Encryption Export Controls released on June 25, 2010 (Fed. Reg. 36,482) that eased certain restrictions, there remain many high-end items and services that cannot be exported to Cuba. This is going to be the case, or should be, for some time because, among other things, Cuba lacks the necessary controls and data infrastructure as well as resources, to secure data flows.
This weakness will impact the sale and export of higher end medical equipment. This may also likely impact credit card transactions (Cuba cannot guarantee data security) and other technologies that ease money flow to and from the U.S. financial system. One independent lawyer told me that Cuban officials are paranoid about allowing credit card transactions in Cuba (something that was first proposed during the Bush Administration) because they may have to give up some of its much coveted secrecy about how they do business.
Contact the Commerce Department, Bureau of Industry and Security (BIS) before even attempting to send any products to Cuba that have encryption technology uses or capabilities. Why do I recommend this? Because the Cuban government owns everything on that island: Cubtabaco, Modelo Brewery, Havan Club, Havana Shipyards, EGREM (music), Cupet (oil & gas), ETECSA (telecom), Infomed (telecom), GAESA, CIMEZ (owns hundreds of companies in Cuba), Cubanacan, Gaviota, and the list goes on and on.
If you do not know the Cuban system or the market, find someone who does and who will provide you unvarnished and frank advice about how to navigate that system. And, even if you believe that you qualify to export items to Cuba pursuant to the new SCP exception, you’ll need to also check the encryption controls if the product or service you plan on providing involves encryption controls. For example. I’ve read a few stories about companies that want to work with “independent” computer programmers in Cuba, for example. Be judicious and check with a U.S. lawyer.
While the Congress and the Obama Administration grapple with policy questions related to Cuba this summer, rather than tinker with Helms-Burton (as certain proposals seek to do), they should consider adding a human rights qualifier to certain technology exports to Cuba, especially on all exports to ETECSA, as has been the case for many years on medical exports:
“Applications to export medicines and medical devices as defined in part 772 of the EAR will generally be approved, except … [i]f there is a reasonable likelihood that the item to be exported will be used for purposes of torture or other human rights abuses …,” See 15 C.F.R. 746.2 (b)(1)(ii), et seq.
This minor amendment to the regulations would be consistent with similar restrictions in place toward Iran (See the Comprehensive Iran Sanctions Accountability and Divestment Act of 2010, et. seq.) and, more importantly, would help advance U.S. interests as well as ensuring that U.S. telecommunications technology and services go to help the Cuban people, not the police state.
The encryption and cyber restrictions found in U.S. export control laws and regulations, over the long- and near-term, will hit Cuba in their two most important money-making ventures: tourism and healthcare. If Cuba wants access to the latest and greatest U.S. technology and services, the EAR will soon, if it has not done so already, deliver to Communist Party planners a much-needed dose of reality.
The good news is that Cuba’s best days are ahead of them. The regime will not be in power much longer. A new generation of leaders will guide Cuba out of this mess that the Communist Party, and those who support them, have put Cuba in for decades. And American companies and American taxpayers will be ready to help.