ESD Alliance Webinar on Export Control with Cadence's Larry Disenhof

Recently the ESD Alliance organized a webinar on Understanding Export Regulations Affecting the Electronic System Design Ecosystem. This was presented by Larry Disenhof who is both the chair of the ESD Alliance Export  Committee and is a long-serving member in Cadence’s Government and Trade Compliance group.

I learned a lot at the event, it was somewhat like drinking from a firehose. You might think that if you are not in legal then you don't need to know any of this, but apart from the general interest aspects, there are man traps lurking in all these regulations that you might step on. For example, you might need an export license to let someone have access to the source code of a project...and this is true even if that person is the person who wrote all the code!

I hope it is obvious, but nothing in this blog post constitutes legal advice. If you need legal advice, "get a trade attorney" as Larry said a few times during the webinar.

He started with history:

• In the 1950s to 1990s export restrictions focused mostly on “cold war” concerns such as controlling weapons of mass destruction
• 1990s rules were somewhat relaxed as the U.S. policy changed from every export needing an export license, to companies needing to understand the regulations and determine what and where they could ship license-free; applying for a license only for specific technologies or end-uses of dual-use items (that could be used for commercial or military ends)
• After 9/11 anti-terrorism became a focus of control on end-use and destination, in addition to control of WMD.
• 2019 Economic competition and unilateral restrictions were added to the reasons for export control
• 2021 Increasing concerns with human rights (in Europe too) are being added to the reasons for export control

Some of these moves being implemented or discussed will potentially drive R&D out of the US. One example of this was the RISC-V Foundation moving their headquarters from US to Switzerland. The US has to be careful about implementing unilateral restrictions on US goods since it might just push them offshore (so they stop being US goods).

Most countries have a single organization that handles all of this, but the U.S. has many organizations along with turf wars:

• EAR – Commerce Department, Dual Use, Entity List
• ITAR – State Department, Munitions, Debarment List
• OFAC – Treasury Department, Sanctions & SDN list
• DoE – Nuclear related controls
• CFIUS – Multi-agency review of foreign investments
• White House – Executive orders
• Congress – FIRRMA, ECRA, Legislative Embargo

This is the current level of control. EDA is considered “dual use” products. Controls are regulated through the Commerce Department. EDA software up through tapeout is at a low-level control (AT is anti-terrorism), classified under the Export Commodity Control Number (ECCN) of 3D991. But there are different classifications for different types of products (e.g. IC vs packaging vs PCB tools). The reality is that IC tools are regarded as ECCN 3D991, but the ECCN language does not explicitly state this, and if an engineer reads 3D991 today they will think EDA is not defined here. A proposal/request has been made to Commerce to update the language to include a specific reference to EDA and Packaging software since Commerce has classified the products under 3D991. 

EDA has had low levels of control for 30 years. AT-level controls means these products cannot be sold to sanctioned destinations such as Cuba, Iran, North Korea, Syria, and now Crimea, or to listed prohibited parties or for end-uses such as WMD, and until 2020 that was effectively the extent of controls.

IP may or may not be more strictly controlled based on what it does or its technology (USB controller is fine, but high-speed analog mixed-signal might be controlled). Hardware required to produce a chip (semiconductor equipment) is subject to more restrictive national security control, requiring export licenses to more countries such as China and Russia. The final chip will be classified depending on what it is designed to do.

The controls themselves have been changing and are affecting EDA and some traditional customers, and this is where we need to pay more attention.

One change over the last few years is that the agencies beyond Commerce have become aware of EDA, IP, electronics, and semiconductor manufacturing equipment. Larry's summary: 

OFAC never used to affect our life that much, but today this Treasury department has a whole list of sanctions and several apply to electronics. This changed with Russia due to the invasion of Crimea 7 years ago, which led to increased sanctions. Some Russian entities were added to the restricted lists. There is a broad embargo on Crimea. These Russian sanctions have been the model for sanctions programs since the mid-2010s. They are very fragmented. For example, there is a sanction of providing credit terms. It is also hard to know who is covered since if a customer is owned or controlled 50% or more by a sanctioned company, the subsidiary is also sanctioned.

As we see in the press, China has become a significant focus to the U.S. Government. This started with “China 2025”, the initiative to create a domestically independent semiconductor industry that has morphed into “military-civil fusion”. The US response has been multi-pronged to slow China from reaching parity, and includes:

• Entity List additions
• Military End User/Use Rule (MEUR)
  • Export prohibitions under the MEUR are tied to specific export classifications
  • EDA is subject to the MEUR and this requires due diligence reviews on all customers in China (and Russia, Venezuela and Burma)
• Communist Chinese Military Companies (CCMCs or “1237 entities”)
• Non-SDN Chinese Military-Industrial Complex Companies (NS-CMIC)
  • Regulations prohibit certain U.S. Person investments to listed companies
  • No export prohibitions but this is considered a red flag to be investigated for military end-use
• Chinese Military-Intelligence End Users Rule (MIEUR) Like the MEUR this regulation captures EDA and extends to China, Russia, Venezuela and Burma.
  • SDN-like full export prohibitions and requires due diligence of the customer for these uses

The entity list in March was 196 pages in March 2016, by January 2021 it was 434 pages. It is not all China, but Venezuela, Myanmar, Russia, and many other countries. There are 3 main reasons to be placed on the list:

• Acting against the US national security interests
• IP theft
• Human rights concerns.

In addition to Commerce and Treasury, we are seeing interest from the other agencies:

DoE (Department of Energy) doesn’t show on radar screen, but if you have to apply for export license they may have a seat at the table. They are aware of electronics, including EDA and IP. CFIUS has targeted electronics space as an area of interest subject to review of foreign investment in this ecosystem. Lots of regulations have first come out as executive orders, governed by treasury or EAR. Finally, Congress is involved. Certain Congress-people today believe EDA is a choke-point technology and that the Administration is not doing enough and so Congress should take over export regulations.

The latest concerns are that ECCN 3D003 was rewritten to target software “specially designed” for EUV lithography. Under discussion are proposed controls on 3nm process technology (GAA). One issue with these proposals is that most EDA software is node-agnostic and regulations need to be careful to avoid unintentional re-control of EDA capable of working at these levels but not specially designed for these nodes.

Sales are not the only concern in putting controls on EDA. The employee base becomes a driving concern. It is a “deemed export” when an employee from a foreign country requires access to technology, and if an export license is needed to ship to that country, a license will be required to transfer data to the individual who is a citizen of that country even if they are the ones creating it. If the legislators don’t get this right, we may have a lot fewer engineers in our pipeline. SEMI is so concerned it has bi-weekly update calls on this issue.

Q&A

Q: How do US export controls apply to companies headquartered in Europe and UK?
A: It is where the technology was developed, ownership does not matter. Likewise, products are not subject to the EAR (though may be subject to U.S. sanctions) when a U.S. company has a development team in India, and distributes that team’s products from outside the U.S.

Q: What happens if we make a mistake and accidentally sell?
A: Contact a trade attorney for guidance. Even if it’s an honest mistake, you’ll have to take a look at processes. Make a voluntary disclosure and all penalties will be half what they would otherwise be if they (the government) found it first. Need to make sure your processes will prevent it from happening again.

Q: What if a company gets an export license but later it ends up being used by someone's military?
A: Export license means the government is giving you permission based on facts at the time. So if you were factually correct no issue. There has been a big increase in entity lists capturing companies that were already customers of the electronics supply chain. The day they go on the list you had better be shutting them off until you have an export license (eg support organization shut off).

Q: What if technology is developed partially in US but mostly outside (eg one employee in US)? How is it determined if it is US technology?
A: “Get a trade attorney,” but look at the control level of the product. Is it controlled for national security reasons? At that level, there are de minimis rules. If more than 10% of a product is US content, then it needs an export license (to Cuba etc.) and the limit is 25% for China. One person is unlikely, but if you have teams it is more complex to calculate the U.S. content.

Q: Relative to open-source EDA tools, is that a solution? Does that make a difference?
A: I will say that the agencies are not happy that DARPA are creating open-source EDA since open-source is not going to be controlled technology since it will be coming from everywhere. This will push US companies offshore. Open source has its own issues. It is not as robust a product as you are going to buy from established companies, at least today.

Q: Educational institutions like universities, what should they consider?
A: Sponsored research is the key word (well, two). There is an exemption on US controls on fundamental research such as general instruction in your classroom. But sponsored research depends on what it is and what is the classification of that design and who has access to it. US universities have Iranian students, for example, and if you have an Iranian employee you need an export license. An Iranian student working on fundamental research does not require this unless they get attached to sponsored research.

Q: Canada and Mexico, are they treated differently due to NAFTA?
A: NAFTA is customs. From an export control point of view, both are foreign destinations and subject to low-level restrictions based on the ECCN of the product you are exporting. One thing I see is that there is a faster process to become a permanent resident in Canada vs getting a US green card. Chinese and Iranian nationals who have moved to Canada can take just 2-4 years to obtain Canadian permanent residency. Permanent residency of an individual determines the export restrictions to that person, so if they are Canadian permanent residents an export to that person is an export to Canada as opposed to their country of origin.

Sign up for Sunday Brunch, the weekly Breakfast Bytes email.

.