The regulation of dual-use goods under “the prism of the Ukrainian crisis”.

Highlighting the dual-use goods framework under
the prism of the Ukrainian crisis.

Friedrich Nietzsche’s “Beyond Good and Evil” lays down a rule that can be closely assimilated to the problem of dual-use goods: “There are no moral phenomena, only a moral interpretation of phenomena.” ¹⁾Friedrich Nietzsche, Beyond Good and Evil, chap.4, p.125
Reflection on this legal concept is consubstantial with the practice adopted by the European Union to govern it, and there’s no doubt that current events demonstrate the European Commission’s need to adapt. And therein lies the intrigue of this paper: how does the Ukrainian crisis bring dual-use goods (DUGs) back into the spotlight? Are the decisions adopted by the EU in line with Alain Lambert’s maxim that “a crisis is an historic opportunity to dare a Copernican administrative revolution”?²⁾Alain Lambert, Il faut libérer l’administration de la norme en cette période de crise (Interview, Acteurs publics, April 7, 2020) or do they illustrate the difficulties created by the constant mutations of technology?

For those unfamiliar with the concept, the current context, or both, a preliminary review of the situation is essential.
Surprising as it may seem, the qualification BDU is the common denominator of microchips, nuclear reactors, drones and even plants. According to Article 2 of Regulation ( EU ) 2021 /821 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfers in respect of dual-use items, the latter are defined as follows: “products, including software and technology, which may have both civilian and military uses; they include goods which may be used for the design, development, manufacture or use of nuclear, chemical or biological weapons or their means of delivery, including all goods which may both be used for non-explosive purposes and be involved in any way in the manufacture of nuclear weapons or other nuclear explosive devices.”³⁾Article 2 of Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfers in relation to dual-use items (recast), which entered into force on 9 September 2021, repealed Council Regulation (EC) 428/2009 of 5 May 2009, which previously governed the matter.
In this way, BDUs create a dichotomy in the purpose for which the same object can be used, in the sense that a navigation system can serve both the tourist confused by Roman alleyways, and the remote control of military missiles.

This latest example is set against the backdrop of Europe’s current invasion of Ukraine by Russian troops, which began on February 24, 2022. Over time, EU member states and others adopted numerous sanctions in unison, one of which is of particular interest to us. In fact, the Luxembourg government, like all other
other European governments, must now comply with regulations ( EU ) 2022/328 & 2022/428 as regards Russia, and regulation ( EU ) 2022/325 as regards Belarus. These regulations, intensifying sanctions begun in 2014 when Crimea was attacked ⁴⁾Council Regulation (EU) No 833/2014 of July 31, 2014 concerning restrictive measures with regard to destabilizing Russian actions in Ukraine In particular, they extend the ban on the sale, supply or direct or indirect export of dual-use goods and technologies, or goods that could contribute to military build-up, to any natural or legal person, regardless of nationality, in Russia or for use in Russia. As a reminder, these regulations, consisting of a multitude of restrictions, are based on article 207-2 of the Treaty on the Functioning of the European Union. ⁵⁾”The European Parliament and the Council, acting by means of regulations in accordance with the ordinary legislative procedure, shall adopt the measures defining the framework within which the common commercial policy is implemented.”; Art.207(2) TFEUThis is the key to shaping trade policy in line with the principles and objectives of the European Union’s external action. In other words, the aim is to strike a balance between commercial interests and security requirements.

A hot topic in the world of legal tech, it so happens that the restriction of BDUs, through regulation 2021/821, was extended to those with the potential to violate human rights and/or being in the field of cyber-surveillance.⁶⁾Art 5 & 9 of regulation ( EU ) 2021/821. As a result, the aim is now to prevent certain surveillance and intrusion technologies exported from the EU from contributing to the violation of untouchable human rights. More specifically, two new EU general export authorization regimes were established: one for cryptographic goods⁷⁾Art.12.1.d of regulation ( EU ) 2021/821 and a second for intra-group technology transfers. The reasons 7 for these precautions were set out in recital 8 of the regulation. First comment on the definition of cyber-surveillance property, defined as “property designed […] specifically for…”⁸⁾Art.2 (20) of Regulation ( EU ) 2021/821. Here, a strictly semantic interpretation might suggest that we’re talking about an asset for which cyber-surveillance is the only use, and not just one of many. Firstly, this would have the effect of excluding goods diverted from their main purpose, and therefore applying a double regime for those not included in the appended list. The corollary is that the introduction of a dual system runs counter to the objective of simplifying the BDU system.

Against this backdrop of war, the intensification of restrictions on these technologies is well and truly confirmed. In a twitter release dated March 28, the Ukrainian State Service for Special Protection of Communications and Information ( SSSCIP ), declared that the incumbent operator Ukrtelecom was the victim of a major Russian cyber-attack⁹⁾https://twitter.com/dsszzi/status/1508528209075257347?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1508528209075257347%7Ctwgr%5E%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fwww.01net.com%2Factualites%2Floperateur-historique-ukrainien-a-ete-victime-d-une-cyberattaque-sans-precedent-2055695.html. This cyber-attack was only the continuation of many others since the beginning of the conflict, such as the breakdown of the KA-SAT satellite network of the American company Via-Sat, or of energy groups such as Ukrenergo¹⁰⁾https://www.franceculture.fr/emissions/les-enjeux-des-reseaux-sociaux/reseaux-sociaux-duvendredi-25-mars-2022. In addition, French journalists had warned the Ukrainian services to strengthen their cyber-security measures, after having remotely infiltrated the cameras installed in Kiev police cars¹¹⁾https://www.ladepeche.fr/2022/03/03/guerre-en-ukraine-des-cameras-de-la-police-etaientaccessibles-sans-mot-de-passe-alertent-des-journalistes-francais-10145756.php.

These BDUs relating to cyber-surveillance are of crucial importance in a context of conflict, which is why regulation 2021/821 introduced a “catch-all” clause¹²⁾Art.4 of regulation ( EU ) 2021/821 establishing an obligation of vigilance for the exporter. If the BDU is not listed in the appendix, or if it has not yet been authorized, the BDU must be questioned as to whether it is appropriate to export it. In this way, the exporter also plays a role in assessing whether or not a use involves internal repression or a serious violation of human rights. This duty incumbent on the BDU exporter is further evidenced by a second innovation: the implementation of an internal compliance program.¹³⁾Art.23 of regulation ( EU ) 2021/821This is characterized by a series of effective, appropriate and proportionate internal procedures to ensure compliance with member state and EU export control regulations on dual-use goods. By way of illustration, this system includes similar processes in the United States¹⁴⁾”The elements of an Effective Export Compliance Program”, U.S Department of commerce Bureau of Industry and Security ( BIS ) or China¹⁵⁾”Guiding Opinions on Establishing Internal Compliance Programs for Export Control by Exporters of Dual use Items”, China’s Ministry of Commerce ( MOFCOM ).

The armed conflict dimension leads to its own set of principles and assorted exemptions if we take a closer look at BDU’s export restrictions against Russia. The general ban on dual-use goods and technologies laid down in the regulations adopted during the conflict is tempered by a number of exceptions. Article 2 ( 3 ) of regulation 2022/328 sets out a very precise list of exemptions to this prohibition. These include, for example, exports for “humanitarian and health emergency” purposes, “medical or pharmaceutical” purposes, or to ensure “cyber-security and information security for natural and legal persons, entities and organizations in Russia, with the exception of its public authorities and enterprises directly or indirectly controlled by them”. The other exemption is the principle of the grandfather clause, recalled in a FAQ¹⁶⁾Question and Answers: fourth package of restrictive measures against Russia, Brussels, 15 March 2022, European Commission of the European Commission dated March 15, 2022, relating to the sanctions imposed on Russia. This clause extends the export of BDUs under pre-existing contracts, subject to a case-by-case review to verify that there are no reasonable grounds to believe that the export would benefit a military end-user, or that the item in question could have a military end-use.

The adaptation of the BDU export regime is currently caught in a vice of problems.
On the one hand, these same goods take on forms that are sometimes more difficult to apprehend, thanks to technological advances around the world. On the other hand, the armed conflict means that even the slightest BDU can be seen as potentially favourable to the advance of Russian troops into Ukrainian territory. This conceptual schizophrenia can be seen, for example, in one of the exemptions provided for export bans. Article 2 ( 3 ) of regulation 2022/328 thus provides for the following exceptions: “the temporary export of articles intended for use by the news media” in its point b, and goods related “to use as consumer communication devices” in its point e. The camp defines the use and dissemination of knowledge, immaterial goods such as information, addressed to Russian persons, as “deemed exports” requiring restrictions, or even outright bans. The logic is therefore as follows: a war inexorably generates an over-interpretation of the initial BDU regime. So anything can be used in a war, especially when it’s going on. The drastic angle thus evolves according to the intention of the parties involved, and exports to a partner country of the day before can be just as regrettable if it becomes an enemy tomorrow.
Some pointed the finger at the emphasis on human rights to govern the property law regime¹⁷⁾M. Kanetake, The EU’s dual-use export control and human rights risks: the case of cyber surveillance technology Europe and the World: A law review, 2019, Volume 3, Issue 1, [https://
www.scienceopen.com/hosted- document ?doi=10.14324/111.444.ewlj.2019.14]. to the detriment of the concept of military utility, but the current context belies this suspicion.

The Ukrainian crisis is also highly revealing of yet another export pitfall, of which BDUs are a part: the interconnection of the global market¹⁸⁾Civilian or Military? Addressing Dual-use Items as a challenge to the nuclear non-proliferation Regime // Justin Dunnicliff and Paulina Izewicz. The case of Iran’s nuclear program development exceeding the prohibitions set out in the 1974 Nuclear Suppliers Group (NSG) regime already illustrated the difficulty of monitoring BDU exports. The development of Iran’s nuclear arsenal took place through a process of “front countries” during exports. The idea is to find governments that have trade links with EU countries, but are less inclined to redistribute the BDU to an ill-intentioned country. In some cases, the countries to which exports are directed do not necessarily have the administrative capacity to exercise reliable control. The result is that member states depend on the attitude adopted by third countries regarding these delicate goods. The regulation sanctioning Russia does not, in principle, affect the exploration of controlled goods to be delivered to third countries, even if they transit through Russia. This means that there is a high risk of circumventing the regulation in question. In the midst of this conflict, the Commission has tried to prevent the detour of BDUs to Russia, for example by introducing contractual clauses with third countries so that they would be liable if the latter re-exported the items to Russia¹⁹⁾Question 43, FAQ.

Last but not least, the qualification of goods based on the cryptographic mechanism as BDUs subject to restricted export regimes also seems to be at the heart of this Ukrainian crisis. Following announcements that the Society for Worldwide Interbank Financial Telecommunication’s (SWIFT) international payment arrangements would be suspended, Pavel Zavalny, Chairman of the Russian Parliament’s Energy Committee, invited Russia’s allies in the last week of March to pay for Russian oil and gas in Bitcoin, in order to circumvent the aforementioned sanctions. However, these statements give rise to a number of reservations. It seems unlikely that there will be enough crypto-currency liquidity, on a global scale, to meet Russian needs.
Secondly, the European Union clearly stated on March 9, 2022²⁰⁾European Parliament resolution of 9 March 2022 on foreign interference in all EU democratic processes, including disinformation(2020/2268(INI))that the sanctions against Russia also apply to cryptocurrencies, which are classified as dual-use goods. So, technically, they cannot be used as loopholes to circumvent European decisions. It will therefore be particularly interesting to observe the positions taken by all the crypto-asset players over the coming days.

Conclusion

Sis vis pacem, para bellum (“If you want peace, prepare for war”) is the essential lesson to be learned from the current situation of the BDU regime in this historic conflict. The intrinsic criterion of a war is its freedom from established rules, a challenge to the legal order established in laws aimed at fundamental rights, just like international trade relations. A first warning of the interweaving of interstate exchanges coupled with the development of surveillance technologies came in 2012²¹⁾Sherpa, “AMESYS : un système de surveillance au service du régime de Kadhafi”, Actions juridiques, May 25, 2012, Asso-sherpa.org, https://www.asso-sherpa.org/amesys-systeme-desurveillance-
au- service-du-regime-de-kadhafi (March 28, 2017)., when the sale of the EAGLE device to Colonel Gaddafi fostered an authoritarian regime preventing the slightest movement of dissent. Examples of this in recent years are numerous, such as the American company Blue Coat, which sells systems that enable censorship by the Syrian and Burmese governments²²⁾V. Reporters Without Borders, Enemies of the Internet, Rapp. 2013, Special report
surveillance, Paris, Reporters sans frontières, 2013, p. 6-13, or the very recent case of the monitoring of Uyghurs in China²³⁾European Parliament resolution of December 17, 2020 on forced labor and the situation of the
Uyghurs in the Xinjiang Uyghur Autonomous Region,[https://www.europarl.europa.eu/doceo/document/TA-9-2020-0375_FR.html]. Time for ricin as the main concern of BDUs²⁴⁾Dilemmas of a dual-use technology toxins in medicine and warfare, Jonathan B. Tucker, Politics and the Life Sciences, February 1994 is now being overshadowed by the dematerialization of tools such as software, which are more decisive in determining the outcome of a conflict. The Ukrainian crisis has once again demonstrated the multipolar aspect of global political organization, and it’s easy to see why the UN has called for a global moratorium on better regulation of cyber-surveillance technology sales and transfers²⁵⁾https://news.un.org/fr/story/2021/08/1101612.
The credit given to BDUs must be extreme in times of peace, but what about in the dark hours when everything, in one way or another, is linked to war.

Mario Gheza