The annual update of the EU dual-use export control list has now come into force. Coincidentally, further revisions have recently been agreed internationally and should be brought into effect in the EU at this time next year. This brief highlights both the main changes now in force and those to be expected next year.
Updates now in force
The changes to the EU dual-use export control list (Annexes I and IV of Council Regulation 428/2009) implement updates to the lists of the international Export Control Regimes (the Wassenaar Arrangement, Missile Technology Control Regime, Australia Group and the Nuclear Suppliers Group) agreed during 2015. These include:
- deletion of controls on some seals, gaskets, valve seats, bladders and diaphragms (1A001c);
- addition of the chemical Diethylamine to 1C350;
- addition of two new viruses: SARS-related coronavirus and Reconstructed 1918 influenza virus (1C351). Several viruses were renamed and the controls on biological equipment were reviewed;
- updates of the control on laser measuring systems (2B006b1c2&3);
- a new control for electronic equipment that can perform high-speed analogue-to-digital conversions (4A003e);
- structural changes in the section Information Security (Category 5 Part 2) including: a new General “Information Security” Note; the deletion of the note on the control status of information security equipment (Note 1); new control entries 5A003 (non-cryptographic information security) and 5A004 (cryptanalytics) have been broken out from the previous 5A002; the renumbering and deletion of many sub-controls; and the deletion of the control on non-cryptographic information and communications technology security systems and devices that have been evaluated and certified by a national authority;
- amendments to controls on inertial measurement equipment (7A003a1, 2 & 3);
- a new control for software for the operation or maintenance of 7A117 guidance sets (7D104);
- the deletion of controls on underwater still cameras (8A002e);
- controls on gel propellant rocket motors have been added to the liquid rocket engine control (9A105).
Changes to be brought into force in late 2017
During the course of 2016, the Export Control Regimes continued to review their lists and agreed on further updates. These include in particular the results of a three-year review process by the Nuclear Suppliers Group. All these are likely to be adopted into the EU Dual-Use Control List in late 2017. The following highlights the main changes in each Regime.
The Wassenaar Agreement agreed on a number of changes including:
- electronic components (non-volatile memories) able to withstand extreme environmental conditions;
- clarification of controls on biological and radioactive agents;
- revision of the concept and use of "technology";
- clarification of the controls relating to intrusion software, in a new note explaining that the technology controls do not apply to ‘vulnerability disclosure’ or ‘cyber incident response’ activities. It is understood that these changes are intended to address the concerns of the US government and industry that the controls related to intrusion software – which have not yet been adopted by the US – were too broadly-defined and could affect a wide range of legitimate cyber security activities;
- restructuring of the controls on Information Security (Category 5 Part 2) to create a set of ‘positive’ controls (in place of the current complex list of decontrols), to improve its ease of use and clarity while maintaining its current scope. It is understood that work to improve the text will continue in 2017;
- the relaxation of controls for lasers used in industry, digital computers and voice coding equipment, with revised performance thresholds taking into account the rapidly evolving performance of civil market products.
It is understood that there was extensive discussion of proposals for new controls of digital forensic/investigative tools. These might cover both equipment and software designed to extract raw data from computing or communications devices whilst circumventing any security measures. But this was not agreed and discussion is intended to continue in 2017.
Nuclear Suppliers Group
The Part 1 and Part 2 Guidelines and their Annexes have been subject to an extensive review. The resulting, updated control lists were published in November 2016.
The changes in Part 1 (the Trigger List) include:
- clarification and greater precision in the control on software transfers, including software Especially Designed or Prepared (EDP) for the nuclear fuel-cycle;
- clarification of the counting procedure for exporting special fissionable material to a given recipient country within the reporting period of 12 months;
- specifying the lower sensitivity limit of controlled neutron flux detectors.
In Part 2 (the Dual-Use List), updates include:
- clarification of the scope of controls on machine tools for grinding (1.B.2.c);
- clarification of the criteria for Dimensional inspection machines (1.B.3);
- clarification of the control on vacuum or other controlled atmosphere metallurgical melting and casting furnaces and related equipment, and the addition of controls to plasma torches and electron beam guns (1.B.7);
- modification of the parameter values for pressure transducers (3.A.7.c);
- clarification of the controls on centrifugal balancing machines (3.B.3).
A range of updates in the control lists on dual-use biological equipment and related technology and software and of the list of human and animal pathogens and toxins, including a number of changes to the names of viruses.
Missile Technology Control Group
Changes agreed in 2016 include:
- the introduction of controls on Ultra High Temperature Ceramic composite materials in a new Item 6.C.6.c;
- the expansion of controls on combustion chambers and nozzles in Item 3.A.10. to include those for gel propellant rocket motors.
The UK government’s Export Control Joint Unit has invited suggestions for changes to the Control Lists, including possible new decontrols, for discussion in the Export Control Regimes during the course of 2017. Ideas should be submitted by the end of January to email@example.com.