Workstations

When viewing controlled goods on a computer screen, assessed personnel must take measures to guard those screen from the sight of non-assessed persons.

In a cubicle or room, the screen must be positioned such that no one entering the area can view it. This can be easily achieved by positioning the screen so it faces away from the entrance. If a non-assessed person needs to step around the desk, turn the monitor off or blank the screen. If an operator must leave a cubicle or room, they need to check any controlled goods back in and log out. Of course, everyone must keep their password secure and only reveal it to an assessed supervisor or the designated official.

When traveling, assessed personnel must only use a laptop or mobile device when alone in a hotel room using a secure virtual private network (VPN) that was setup by an assessed person in the IT department. Using a device in public could allow non-assessed people to see the screen. This  can include hotel lobbies, restaurants, parks, beaches, subways, aircraft or any other place where there is a danger of someone viewing controlled goods.

Reading the Export Control List for Controlled Goods

The Canadian Export Control List contains restrictions on items that can be exported from or handled within Canada. This can include items as diverse munitions, lumber and peanut butter. It consists of eight groups and is organized in outline form. To determine if goods or technologies are subject to the list, you must start with the most general levels of the outline that pertain to the goods or technologies in question and work down the list. The Export Control List also contains cross references and notes that can affect whether or not an item is subject to any regulations.

The Control Export List is harmonized with the United States International Trade in Arms Regulations (ITAR). Of the eight groups, the Controlled Goods Directorate only regulates three; Group 2 – Munitions, Group 5 – Miscellaneous Goods and Technology (Item 5504 only) and Group 6 – Missiles and Rockets. Other groups are subject to different regulations.

The details of the list must be examined. Assume you have a World War II era military armoured vehicle built in 1944. A 50 calibre machine is mounted in the vehicle. It’s barrel is plugged so that it cannot be fired. You want to drive it in a Remembrance Day parade and you want to know if it is a controlled good. In looking at the list under Group 2, Munitions, we find:

2-6, Ground vehicles and components

Beneath 2-6 is 2-6.a, Ground vehicles and components therefor, specially designed or modified for military use.

Within that is 2-6.b, Other ground vehicles and components, as follows.

This breaks down to 2-6.b.1, 2-6.b.1.a and so forth. Each level gives specifications and exemptions. These specifications and exemptions must be analysed. There may also be notes that give further specifications or exemptions and cross references to other items. Consider this extract for 2-6, Ground vehicles and components, from the Control Export List:

—————————————————————————————————-

2-6. Ground vehicles and components, as follows:

N.B.:
For guidance and navigation equipment, see 2-11.

a. Ground vehicles and components therefor, specially designed or modified for
military use;

Technical Note:
For the purposes of 2-6.a. the term ground vehicles includes trailers.

b. Other ground vehicles and components, as follows:

1. Vehicles having all of the following:

a. Manufactured or fitted with materials or components to provide ballistic protection to level III (NIJ 0108.01, September 1985, or comparable national standard) or better;

b. A transmission to provide drive to both front and rear wheels simultaneously, including those vehicles having additional wheels for load bearing purposes whether driven or not;

c. Gross Vehicle Weight Rating (GVWR) greater than 4,500 kg; and

d. Designed or modified for off-road use;

2. Components having all of the following:

a. Specially designed for vehicles specified in 2-6.b.1.; and

b. Providing ballistic protection to level III (NIJ 0108.01, September 1985, or comparable national standard) or better.

N.B.:

See also 2-13.a.

Note 1:

2-6.a. includes:

a. Tanks and other military armed vehicles and military vehicles fitted with mountings for arms or equipment for mine laying or the launching of munitions specified by 2-4.;

b. Armoured vehicles;

c. Amphibious and deep water fording vehicles;

d. Recovery vehicles and vehicles for towing or transporting ammunition or weapon systems and associated load handling equipment.

Note 2:

Modification of a ground vehicle for military use specified by 2-6.a. entails a structural, electrical or mechanical change involving one or more components that are specially designed for military use. Such components include:

a. Pneumatic tyre casings of a kind specially designed to be bullet-proof;

b. Armoured protection of vital parts, (e.g., fuel tanks or vehicle cabs);

c. Special reinforcements or mountings for weapons;

d. Black-out lighting.

Note 3:

2-6. does not apply to civil vehicles designed or modified for transporting money or valuables.

Note 4:

2-6. does not apply to vehicles that meet all of the following:

a. Were manufactured before 1946;

b. Do not have items specified by the Group 2 – Munitions List and manufactured after 1945, except for reproductions of original components or accessories for the
vehicle; and

c. Do not incorporate weapons specified in 2-1., 2-2. or 2-4. unless they are inoperable and incapable of discharging a projectile.

—————————————————————————————————-

2-6 provides specifics as to what kind of vehicle is considered a controlled good. 2-6.b.1 states that all of the sub items (a thru d) must be true for a vehicle to be considered controlled. Obviously, there are civilian vehicles that have all wheel drive and are used off road that are not subject to the regulations unless they also provide ballistic protection and are heavier than 4,500 kg in weight.

2-6 cross-references other items in the list, 2-1 (Smooth-bore weapons with a calibre of less than 20 mm), 2-2 (Smooth-bore weapons with a calibre of 20 mm or more), 2-4 (Bombs, torpedoes, rockets, missiles, other explosive devices), 2-11 (Electronic equipment, “spacecraft” and components) and 2-13 (Armoured or protective equipment, constructions and components).

All of the notes and cross references must be examined as well as the main items. Specifications can list operating temperatures, tolerances and performance measures. An item may list a number of sub items with the phrase “all of the following”, in which case every sub item must apply for the parent item to be true. In other cases the item may state “any of the following”, in which case the parent item is true if any of the sub items are true.

When you walk through the list for the armoured vehicle you want to drive in the parade, you see that 2-6.a stipulates vehicles specifically designed for military use are controlled goods, but you don’t stop there.

2-6.b.1 shows four specifications, a, b, c, and d. All four must be true for 2-1.b.1 to be true. Let us assume that the armour plating on the vehicle does provide ballistic protection to level III (NIJ 0108.01, September 1985, or comparable national standard) or better. We also see that it has a transmission designed to work all of the wheels simultaneously, has a weight greater than 4,500 kilograms and is designed for off road access. All four specifications are true. The vehicle is still a candidate to be considered a controlled good. If we were examining a commercial SUV that did not have armour or weighed less than 4,500 kilograms 201.b.1 would be false.

2-6.b.2 pertains to components for a vehicle to support the four specifications in 2-6.b.1 and does not apply to the vehicle.

If we stopped here, it would seem that the vehicle is a controlled good and you will not be able to drive it in the parade. But, you don’t stop here and refer to the notes and cross references.

Note 1 states that tanks, armoured vehicles, amphibious vehicles, and recovery vehicles capable of towing ammunition are subject to the restrictions. That doesn’t help your case. Note 2 concerns modifying vehicles for military use. That does not apply here. Note 3 is an exemption for civilian vehicles that transport valuables, such as armoured cars. That does not apply either.

Note 4 states that the regulations do not apply to vehicles that meet three criteria; a) were manufactured before 1946, b) do not have items specified by the Group 2 – Munitions List and manufactured after 1945, except for reproductions of original components or accessories for the vehicle; and c) Do not incorporate weapons specified in 2-1., 2-2. or 2-4. unless they are inoperable and incapable of discharging a projectile.

The vehicle was built before 1946. The machine gun is an accessory to a vehicle and its barrel has been plugged so it cannot fire rounds. Because you researched all of the notes and cross references, you now know you can drive your vehicle in the parade.

If goods and technologies are of U.S. origin, the U.S. ITAR may also apply. It is organized into parts, sections and categories that cover not only restricted items but the regulations for possessing and exporting them. As with the Control Export List, the ITAR is in outline form with narrowing degrees of specifications that define when an item is or is not subject to the regulations. Part 121 is a list of goods similar to the Export Control List.

The ITAR applies when items are being imported to Canada from the U.S. or are of U.S. origin and are being exported from Canada to a third country. Goods and technologies not of U.S.  origin may be specified in the Canadian Export Control List but are not subject to the ITAR.

When American companies or universities export goods and technologies subject to the ITAR , they must ensure that the Canadian company or university receiving the goods or technology is registered with the Controlled Goods Directorate when they apply for an export license from the American government. The American government can approve the export as is or impose special conditions beyond what is stipulated in either the ITAR or the Export Control List. If additional restrictions are stipulated, the American organization can file an appeal, but the Canadian organization has no jurisdiction in the American process and must either accept the conditions or loose the contract.

Look to the big picture when protecting controlled goods

Guarding controlled goods and technologies extends beyond the obvious. A small detail that seems unimportant can lead to serious compromises.

Imagine that you are in charge of shipping a controlled item to a decommissioned military base. If the designated official has drawn up an effective security plan and you have been trained to use it, you will know not to discuss the item in emails, when speaking with unassessed persons or at conferences. You might think this is all that's required to protect the controlled goods.

But, safeguarding controlled items and technology extend beyond physical considerations. You might be out in public and someone mentions an old decommissioned military base outside of town and you say, “Oddly enough, we just shipped some items up there.” You haven’t said anything directly about controlled goods, still, agents of an unfriendly power who learn about the shipment might be able to deduce several things. They may know what types of products your company manufactures and be able to produce a short list showing likely controlled goods in question. Knowing that the item is being shipped to an abandoned base indicates activity might be restarting there. If, for instance, your company produces military grade inertial movement units (IMU) and the agents have learned that a company that manufactures high resolution cameras is shipping some kind of item to the same base, They could deduce that the base is being reactivated to support or conduct aerial espionage and bears observation. Even a single piece of information can add to a foreign power’s knowledge, such as the size of a food order being sent to the base that could indicate the number of persons who will shortly be assigned there.

Security clearances and assessments alone cannot be the only deciding factor when sharing information, even within a company, a government department or between departments. The person receiving the item or technology must have a need to know it. Those who do not need to use the goods or technology to do their job cannot be allowed to possess them. The more people who become exposed to controlled goods, the greater the possibility of a breach. The designated official must keep a list of who needs to possess each controlled goods and to make that clear to everyone  involved.

Controlled Goods Training is Vital


Before anyone can possess controlled goods or technologies, he or she must undergo security training or a security briefing. This is so important that the Controlled Goods Regulations stipulates training and briefing programs must be included in the security plan for an organization to register with the Controlled Goods Directorate.
controlled_goods_1_web
The designated official is responsible for providing training programs and security briefings. Training programs will be delivered to persons who will possess, examine or transfer controlled goods on an ongoing basis. This can include board members, officers, employees, contractual workers and temporary workers, whether they have been assessed by the designated official or have been exempted by the Controlled Goods Directorate. Visitors who have been exempted by the Controlled Goods Directorate and are authorized to access controlled goods and/or controlled technologies will receive a security briefing prior to the visit. Assessed and exempt persons will not be allowed to access controlled goods until they have completed a training program or security briefing.

Security training includes general regulations as well as items specific to an organization. It covers such areas as the processes of becoming assessed, threats and risks, physical security, IT security, receiving controlled goods, sending controlled goods, reporting and handling security breaches, access to printed and electronic material, storing controlled goods, using controlled goods and escorting visitors. The training program will also discuss specific locations and situations where controlled goods are kept at a site.

Security briefings will inform the visitor of the importance of safeguarding controlled goods, restrictions on discussing controlled goods accessed during the visit and fines and penalties for compromising controlled goods. Security briefings also cover the unique location and controlled goods involved, the degree of access and any conditions placed on the visit.

The training program and security briefing are subject to inspection at any time by the Controlled Goods Directorate.

The designated official will review the training and security briefing programs periodically to ensure they continue to meet the security needs for safeguarding controlled goods and/or controlled technologies and reflect any regulatory or legislative changes.

The designated official will maintain a log containing the date, names and signatures of the authorized person(s) who have received training and the security official who conducted the training. This log will be kept in a secure container such as a locked filing cabinet or a password protected electronic volume or file. Likewise, the designated official will maintain a log that contains the date, names and signatures of visitors who have received a security briefing and the security official who conducted the briefing. As with training records, this log will be kept in a secure container such as a locked filing cabinet or a password protected electronic volume or file. Access to these records will be restricted to the designate official and authorized person.

Training is ongoing. It will be delivered both to new employees and temporary workers who require access to controlled goods and periodically to those persons authorized to examine or possess controlled goods and/or controlled technologies in order to reinforce the information provided during the initial training and advise of any changes in the security plan or Controlled Goods Regulations. The period for refresher retaining should not exceed six months.

Personnel who understand how to properly possess, examine or transfer controlled goods and/or technologies will be able to make informed decisions to protect these items and preserve security.

Audits Are A Vital Tool For Designated Offficials

You’ve done your threat and risk assessment, identified the controlled goods in your organization, written your security plan and registered with the Controlled Goods Directorate. Some designated officials might think their jobs are finished and all they have to do is assess new personnel. That might be the case if we lived in a world where nothing changed, but we don’t.

You’re organization’s controlled goods program is fluid. To deal with this, internal audits need to be conducted. Not only are they mandated by the controlled goods regulations, they are a valuable tool that allows the DO to verify the state of the local program.

In addition, audits offer a chance to evaluate the effectiveness of the current security plan and make recommendations for corrective action as required. Such corrections may be necessary when the regulations change, when the environment changes, when it is evident that the security plan no longer meets the needs of the organization or if a part of the security plan is found to be flawed.

Audits begin with an examination of the records the DO is required to keep. These include records pertaining to assessments and exemptions to make certain all relevant information has been gathered such as biographical data, background history, reference contact, criminal background checks and credit reports. Other records include verification of contractor registration with the controlled goods directorate, records of visitors, training and security briefing records, records of transfer in and out of the facility, the current physical location of each controlled good, records of the destruction of controlled goods and records of security breaches with the initial report, contact with the Controlled Goods Directorate, the corrective actions and their follow ups.

The DO then needs to go into the field and cross reference the documents with the actual state of personnel and controlled goods. Security measures, physical and electronic, need to match the security plan. Those measures must also be evaluated for their effectiveness. Records of assessed or exempt personnel need to be checked with the actual personnel possessing controlled goods to make certain these people are still with the organization and to detect if there are non-assessed or non-exempt persons working with controlled goods. The DO must make certain the physical location of controlled goods match the documentation and that they have not been moved to a different location, shipped out of the facility or destroyed without proper records. The audit can also reveal controlled goods that have been introduced without the proper documentation. This can occur when someone orders an item without informing the DO or without realizing it is controlled. The DO must become familiar with the purpose and requirements of all manufacturing and research projects to anticipate where controlled goods might be introduced.

Whenever a discrepancy is detected, a corrective action must be initiated, assigned for repair, and followed up to make certain it was accomplished and that it had the intended effect. If a security breach is discovered, such as non-assessed persons handling controlled goods, it must be recorded and the Controlled Goods Directorate notified immediately.

Audits need to be conducted on a periodic basis. This might be yearly, biyearly or some other period depending on the needs of the organization. The DO might want to conduct a full audit each time or break up the audit by type of information (personnel vs. material), department, project or facility and stagger these throughout the year.

Audits are the most important tool a designated official has to monitor and adjust the health of a controlled goods program.

Universities may need to accesss controlled goods and technologies

Universities sometimes have a need to examine, possess and/or transfer controlled goods and technologies. This will almost always occur in applied research projects rather than undergraduate studies.

There are three factors to consider; public domain, general research and applied research.

Anything in the public domain is exempt from controlled goods regulations. The Controlled Goods Directorate defines the public domain as:

Information which is published and which is generally accessible or available to the public through sales at newsstands, through subscriptions that are available without restriction to any individual who desires to obtain or purchase the published information, through second class mailing privileges granted by the Canadian or U.S. Governments, at libraries open to the public or from which the public can obtain documents, through patents available at any patent office, through unlimited examination at a conference, meeting seminar trade show or exhibition, generally accessible to the public in Canada or the United States, through public release (i.e., unlimited examination) in any form after approval by the cognizant Canadian or U.S. Government department or agency and through general research in science and engineering at accredited institutions of higher learning in Canada or the United States where the information is ordinarily published and shared broadly in the scientific community. Such research will not be considered general research if the institution or its researchers accept other restrictions on the publication of scientific and technical information resulting from the project or activity, or the research is funded by the Canadian or U.S. Government and specific access and dissemination controls that protect information resulting from the research are applicable.

Undergraduate studies are clearly in the public domain as the courses are drawn from standard texts and resources and presented in a public university forum. It is possible, though, for an undergraduate student to become involved in a research project along with graduate students.

There are two types of research, general research and applied research. The Controlled Goods Directorate defines general research as:

Experimental or theoretical work undertaken principally to acquire new knowledge of the fundamental principles of phenomena or observable facts, not primarily directed towards a specific practical aim or objective. It does not include applied research and is subject to the following restrictions:

• The research is conducted without an application in mind
• The sponsor has no control over publication
• No material goods are transferred

That is to say, research that seeks only knowledge and not the creation something specific. General research projects are exempt from the controlled goods regulations, but they can lose their exemption if, as in the definition of public domain, the university has accepted restrictions on publication or the project is funded by the government which has placed access and dissemination controls on it. If either of these conditions apply, the general research project is no longer exempt from the regulations.

The second kind of research is applied research. The Controlled Goods Directorate defines this as:

A systematic study to gain knowledge or understanding necessary to determine the means by which a recognized and specific need may be met toward the goal of producing useful materials, devices and systems or methods, including design, development and improvement of prototypes and new processes to meet specific requirements.

That is to say, a project that attempts to build something tangible, such as a helicopter rotor or an encryption algorithm to decode the military band of a GPS satellite.

It is this type of research, usually conducted in partnership with industry or government that has the potential of encountering controlled goods and/or technologies. The designated official must investigate and monitor these types of projects for possible inclusion of controlled goods. If such items or technologies are present, the project must be included in the scope of the security plan.

ITAR and Controlled Goods Restrictions on Canadian Dual Nationals is Lifted

Before 2011, Canadian businesses and universities dealing with ITAR related controlled goods and technologies, referred to as “defense articles” by the U.S., had a serious problem. Employees, researchers, students and others who held dual nationality with specific U.S. restricted countries were not allowed to access these items and had to be removed from projects dealing with them. These countries are listed in ITAR §126.1 and include “…Belarus, Cuba, Eritrea, Iran, North Korea, Syria, and Venezuela. This policy also applies to countries with respect to which the United States maintains an arms embargo (e.g., Burma, China, and the Republic of the Sudan)…”

One of the provisions of the controlled goods regulations is that Canadian firms and universities dealing with ITAR items and technologies are required to follow all of the ITAR specifications and any associated export licenses. In this case, it wasn’t that the U.S. government was just forbidding the shipment of their defense articles to restricted countries. They were prohibiting any citizen of these countries from possessing defense articles, including persons holding dual nationality with Canada and one of the restricted countries. This caused outrage among dual national employees and was seen both as a discriminatory insult and a threat to their career paths by excluding them from important projects. Some barred employees sued their employers, claiming violations of the Charter of Rights and Freedoms. This left Canadian employers in a difficult position. If they violated the ITAR restrictions and allowed dual nationals of restricted countries access, they faced losing the controlled goods or technologies. If they removed these individuals from the projects, they risked legal action.

The Government of Canada was long aware of this problem and had been in negotiations with the United States to find a solution. In 2011, the two parties reached an agreement. A new section was added to the ITAR, §126.18, effective May of 2011. It states, in part, “…nationality does not, in and of itself, prohibit access to defense articles…” This stipulates that the ability to examine, possess or transfer controlled goods is based solely on a person’s security assessment and removes the former restrictions on dual nationals, news that was enthusiastically received by both dual national employees and employers alike.

But, of course, there’s no free lunch. The new access comes with the price of increased diligence in security assessments conducted by designated officials.

According to ITAR §126.18, a foreign [Canadian] business that receives a defense article “…must have effective procedures to prevent diversion to destinations, entities or for purposes other than those authorized by the applicable export license or other authorization (e.g. written approval or exemption) in order to comply with the applicable provisions of the Arms Export Control Act and the ITAR.” This is accomplished by “A security clearance approved by the host nation government for its employees.” or “…a process to screen its employees and to have executed a Non-Disclosure Agreement that provides assurances that the employee will not transfer any defense articles [controlled goods] to persons or entities unless specifically authorized by the consignee or end-user.”

The Americans continue to be concerned about dual nationals of restricted counties. In making a security assessment, the designated official must consider “substantive contact” with any such country with respect to “”…travel to such countries, recent or continuing contact with agents, brokers and nationals of such countries, continued demonstrated allegiance to such countries, maintenance of business relationships with persons from such countries, maintenance of residence in such countries, receiving a salary or other continuing monetary compensation from such countries, or acts otherwise indicating a risk of diversion.” Substantive contact does not forbid the possession of ITAR regulated controlled goods, but a designated official must take these factors into account in conducting a security assessment and may return a negative assessment or place restrictions on a positive one because of the findings. ITAR §126.18 goes on to state, “… an employee who has substantive contacts with persons from countries listed in §126.1(a) shall be presumed to be a risk of diversion…”

As the “…host nation government for its employees…” the Canadian Controlled Goods Directorate has made changes to the regulations in the form of an Enhanced Security Strategy. As the directorate states, this was “developed in consultation with Canadian industry and other government stakeholders. The ESS is a more robust approach to meeting domestic industrial security needs and will be implemented through a phased-in approach over three years beginning October 1, 2011.” This effects applications for registration, security assessment applications for owners, authorized individuals, designated officials, officers, directors and employee as well as security assessment applications for temporary workers. These forms are more detailed in the data retrieved. There are enhanced consideration of foreign contacts, the use of a risk matrix assessment procedure and the requirement to conduct a criminal background check on all applicants whether they report criminal activity or not. These new rules apply to every applicant, not just those holding dual nationality.

Enhanced security requires more work on the part of a designated official and more expense for criminal background checks, but it allows dual nationals of restricted countries access to controlled goods and establishes a more secure environment to protect controlled goods in Canada.

Domestic Courier Services and Controlled Goods

The controlled goods regulations specifically state that persons who examine, possess or transfer controlled goods must either be assessed or exempted. It would seem to follow, therefore, that courier services transporting controlled goods or technologies would have to be registered with the Controlled Goods Directorate and its employees assessed by their designated official.

However, that is not the case. Companies can only become registered persons if they  demonstrate that they handle controlled goods as a part of their primary business. That is why cleaning services cannot become registered, even if their employees might work in an area where controlled goods are stored. In the case of the cleaning service, or other similar contractors, they must be escorted at all times and controlled goods stored safely away while they are working. As cleaning services generally work after hours, registered businesses and universities often hire permanent workers who are assessed by the organization’s designated official.

The Controlled Goods Directorate has taken a different stand In the case of domestic couriers. In conversations with Avidaid, they stated that as long as the courier only transports controlled goods and never stores them, they do not have to be registered. A package containing controlled goods or technologies could be picked up at a university in Ontario and delivered to a business in Alberta as long as it was never warehoused. Packages that are warehoused must be transported by a registered courier company or customs brokerage firm, as is the case when exporting items from Canada.