In our newsflash dated 8th August 2014 we commented on the potential impact of the EU sanctions against Russia for IT companies.
On 12th September 2014, the EU extended the scope of the sanctions against Russia. According to European Council President, Herman Van Rompuy, the extended sanctions aim to promote a change of course in Russia's actions destabilising eastern Ukraine and are in response to the increasing inflows of fighters and weapons from Russia into the Eastern Ukraine and the aggression by Russian armed forces on Ukrainian soil.
This update reviews whether these extended sanctions will affect IT companies' business activities in Russia. As with the previous round of sanctions, the relevant restrictions that could have an impact on the operation of IT companies in Russia are the restrictions on "dual use" technologies.
The previous round of sanctions included a prohibition to sell, supply, transfer or export, directly or indirectly, dual-use items to any person in Russia where those items are or may be intended for military use or for a military end-user. This applies also to providing, directly or indirectly, technical assistance, brokering services, financing or financial assistance (e.g. grants, loans, export credit insurance, etc.) related to such dual-use items.
These restrictions had the effect that a potential military use or potential use in a military context did not automatically bring the IT product or services within the scope of the sanctions. The sanctions were only applicable where the items "are or may be intended for military use or for a military end user". Sales to a non- military end user or where the intention is clearly for non-military use were not caught by the EU sanctions.
Under the extended EU sanctions, the restrictions on activities relating to dual use items have been extended to any sale, supply, transfer or export to a list of entities identified in an Annex to the Regulation, irrespective of whether any military connection. The entities that are listed in the Annex are mainly weapons and armaments manufacturers[i], but it also includes JSC Sirius (provider of optoelectronics for civil and military purposes, including medical equipment), OJSC Stankoinstrument (a holding company with operations in electrical, machine-tool and fuel engineering) and OAO JSC Chemcomposite (materials for civil and military purposes).
The items that are regarded as being "dual use goods and technology" has not been changed in the extended sanctions. The list is defined by reference to an Annex to an EU Regulation[ii]. The list is extensive and complex, and includes sections dealing individually with electronics, computers, telecommunications and information security.
As with the previous round of sanctions, for most IT companies the most likely way in which they could become subject to the EU sanctions is through the use of encryption software. This includes where systems are designed or modified to use "cryptography" (other than authentication and digital signatures) which either use a "symmetric algorithm" with a key length in excess of 56 bits or an asymmetric algorithm in certain circumstances, or cryptanalytic functions, cryptographic techniques to generate the spreading code for "spread spectrum" systems, or cryptographic techniques to generate certain channelising codes, scrambling codes or network identification codes.
In passing, it should be noted that the scope of the extended EU and US sanctions is different. Updated US sanctions were also introduced on 12th September 2014 that could have an impact on IT companies. Directive 4 of Executive Order 13662 prohibits the provision, exportation, or reexportation, directly or indirectly, of goods, services (except for financial services), or technology in support of exploration or production for deepwater, Arctic offshore, or shale projects that have the potential to produce oil in the Russian Federation, or in maritime area claimed by the Russian Federation and extending from its territory, and that involve any person determined to be subject to this Directive, its property, or its interests in property.
This US Directive appears to have the effect of prohibiting the export of any technology (not just items that are classified as "dual use") that could support elements of oil production in Russia. As a result, companies that are seeking to export general IT products (software and hardware) for use in the Russian oil industry should be aware that they may be caught by the US sanctions. Companies that may be affected should take expert US legal advice in this area.
The full list of restricted entities is: JSC Sirius (optoelectronics for civil and military purposes);
OJSC Stankoinstrument (mechanical engineering for civil and military purposes);
OAO JSC Chemcomposite (materials for civil and military purposes);
JSC Kalashnikov (small arms);
JSC Tula Arms Plant (weapons systems);
NPK Technologii Maschinostrojenija (ammunition),
OAO Wysokototschnye Kompleksi (anti-aircraft and anti-tank systems);
OAO Almaz Antey (state-owned enterprise; arms, ammunition, research);
OAO NPO Bazalt (state-owned enterprise, production of machinery for the production of arms and ammunition).
[ii] See Regulation (EC) No. 428/2009