Memorandum submitted by Dr Ross Anderson,
University of Cambridge
LETTER FROM DR ROSS ANDERSON TO MR PETER
MANDELSON, MP, SECRETARY OF STATE FOR TRADE AND INDUSTRY
I would like to congratulate you on your conference
speech and welcome your commitment to removing the barriers to
the growth of the information economy.
I would therefore like to draw your attention
to a policy proposal that if implemented would be a serious hindrance
to science and technology. This is the White Paper which proposes
to extend export licensing to intangibles, on which your predecessor
invited comments by the end of this month.
I understand that this is an MoD initiative,
whose consequences for our science base have not been considered
carefully enough, and I hope that I can be of assistance in helping
formulate a better approach. I have experience of both worlds;
before becoming a computer science academic I worked on projects
ranging from nuclear weapon delivery systems, through the inertial
navigation equipment for the Tornado and Sea Harrier, to encryption
systems for automatic teller machine networks. The Committee of
Vice Chancellors and Principals therefore asked me to prepare
a short paper, which I enclose; you may also have received copies
from other sources in higher education.
The gist of this analysis is that the proposed
regulations would impose very wide licensing requirements on university
departments of science, technology and medicine. The majority
of our research students, being foreign nationals, would appear
to require personal export licenses in order to get access to
high-tech equipment they use routinely in their work. The proposed
requirements are likely to result in a considerable waste of time
and of public money, and will give enormous scope for acrimony.
They will also impose significant costs on our high-tech industries
and harm our collaboration with them (including collaborations
funded by the DTI). Their effect will be to undermine the DTI's
relationship with the UK science and technology community.
To this paper I would like to add a few further
Firstly, it would be dangerous to use export
controls as the primary means of stopping proliferation of weapon
technology. For over 250 years, the main terrorist threat to the
UK has come from people who carry British passports. UK-based
threats to friendly countries have often involved our citizens,
as in British Arabs fronting the purchase of submersible attack
craft for the PLO. So we must retain the traditional controls:
we must continue to be able to account positively for all fissile
materials, and to use official secrets legislation and contract
conditions to control the sale of military equipment developed
with MoD funds.
Secondly, it is politically very risky to use
export controls to forbid UK nationals to repeat facts that are
in the public domain, on the grounds that the audience may include
foreign nationals. The Foreign Office wants to stop UK universities
teaching even the basic chemistry of mustard gas, despite its
having been in the public domain for generations. This would serve
no national security purpose, but it would risk giving the press
an opportunity to ridicule DTI ministers. It might also open up
challenges to export law based on the European Convention on Human
Thirdly, the export licensing system is designed
to deal with a small number of applications from well known principals,
such as GEC, Hunting and British Aerospace. It relies on the personal
contacts that officials have built up over the years with managers
in these companies. Having experience of both worlds, I do not
see how the system could cope with a flood of applications from
outsiders such as university lecturers. It is unlikely that officials
would have the engineering expertise to assess applications thoroughly,
and the number of licences that were refused in patently ludicrous
circumstances would rise sharply. This is also likely to lead
to ministerial embarrassment, and to legal challenge.
I am reassured to hear that there is no time
available for legislation in the next session of Parliament, and
we therefore have time to get this right. I would like to suggest
a meeting of interested parties to see if we can find a better
way forward. Over the last few weeks, I have acted as a liaison
between the university world and trade bodies such as the Defence
Manufacturers' Association and the Federation of Electronic Industries,
and will be happy to help arrange such a meeting.
29 September 1998
EXPORT LICENSING OF INTANGIBLES
The Government proposes, in a recent white paper,
to bring "intangible exports" within the export licensing
regime. This will have highly unpleasant effects on universities
and on the UK science base generally. For example, it will become
an offence to give foreign nationals (including colleagues and
students) access to a list of software and other technology in
electronic form, or to impart a narrower range of technologies
"relevant to weapons of mass destruction and long range missiles"
orally or by demonstration. Previously, only the export of material
goods was covered by the regulations. The White Paper may be found
It is important that the academic community
make its objections known by 30 September to the responsible minister,
the Rt Hon Peter Mandelson, and through whatever other channels
as may be available.
The proposed regulations would have their most
severe effect on science, technology and medicine. For example,
the teaching of medicine to a foreign national would appear to
require a licence; many of the core curriculum subjects, such
as bacteriology, virolgy, toxicology, biochemistry and pharmacology
are central to a chemical and biological weapons programme (indeed
South Africa's programme was set up and run byP W Botha's personal
physician). Other subjects where "oral export" could
be problematic include not just nuclear physics and chemistry
but also aerodynamics, flight control systems, navigation systems,
and even computational fluid dynamics.
The broader list of technologies whose export
"electronically" would become subject to licensing is
set out by international treaty (though the DTI could no doubt
add extra items if it wished). The relevanttreaty, known as the
Wassenaar agreement, covers most of the subjects of interest to
scientific and technological researchers, whether directly or
through the tools we need to use; see the list at http://jya.com/wa/watoc.htm.
For example, a physicist doing research in single-electron
memories may use an electron beam litho machine to make prototypes,
and this equipment is on the list as it can also be used to fabricate
masks for military semiconductors. Existing regulations merely
control the physcial export of the machine, and so do not intrude
much; but the new regulations will mean that all the researchers
who need access to its software (which is all of them) will need
to be UK nationals or have personal export licences.
The proposed regulations would cover most of
our research in computer science (fast networks, high performance
computing, neural networks, real-time expert systems, hardware
and software verification, reverse engineering, computer security,
cryptography) and could even force a rewrite of lecture course
and project material. The Department of Engineering would be hit
by the listing of numerically controlled machine tools and fibre
winding equipment, robots, optical amplifiers, software radios
and aero engine control systems, as well as many lasers, gyros,
accelerometers and similar components. The restrictions that previously
only applied to physcial hardware objects will be extended to
the software used to design, test, control or operate them or
to integrate them into larger systems.
There will be a very severe impact on collaborative
research across national boundaries, including the EU funded research
which now accounts for a large proportion of our science base.
Such collaboration necessarily involves many intangible exchanges
of technology. Recently, for example, I worked with scientists
in Norway and Israel to develop a candidate encryption algorithm
for a US government competition. This involved sending over 400
emails back and forth, many containing fragments of source code.
The DTI has confirmed to me that in future such exchanges will
require a licence.
As three-quarters of Cambridge's research students
in science and technology are foreign nationals, licensing will
have a significant impact on the research base. The added delays
and uncertainty involved in export licence applications will add
to the pressures on departments; and it remains to be seen whether
the licences would be sufficiently broadly phrased to support
current ways of working, in which researchers move at will from
one topic to another, and form ad hoc collaborations to tackle
The proposed regulations will also have an adverse
impact on undergraduates, particularly blind and deaf students
who require course materials in (controlled) electronic form rather
than (uncontrolled) paper form. As more and more course material
comes to incorporate software and other electronic components,
the number of students affected will increase until it includes
essentially all foreign nationals studying in the School of Technology.
Not all student collaborations are closely supervised: for example,
our second year computer science undergraduates undertake group
projects in teams of six or seven, and several of these projects
in an average year will not only incorporate controlled technology
but also have foreign nationals on the team. To prevent unlawful
technology transfers, we would have to introduce tiresome administrative
measures or greatly restrict the choice of project topic.
The effect on the many high-tech companies in
Cambridge would also be severe. These companies, many of them
set up in collaboration with members of University departments,
produce all sorts of intangible yet potentially licensable products,
ranging from software for GSM phones, network computers and engine
controllers, through designs for ATM switches and other chips.
The likely effect on "Cambridge plc"
can be inferred from the effects of US export regulations on a
UK multinational (the USA is the only major country that controls
intangible exports at the present time). This company uses supercomputers
in mineral exploration, and the effect of the regulations is that
it cannot construct the global data network that it wants: the
US government fears that this might allow a Kazakh or Burmese
employee to have access to controlled software. A senior manager
described the result as "having to implement US foreign policy
on every machine on my network". If he also had to implement
UK foreign policy, operations would grind to a halt whenever there
was a clash. Placing such burdens on industry would seriously
affect our collaborative research projects with them.
There may well be legal challenges to the policy.
Opponents will argue that it fails the test of proportionality,
especially since the proposed controls were clearly not required
during the Cold War. They will argue that while one may well decide
to curtail long-established academic liberties because something
bad has happened, it is excessive to do so because a bad thing
might happen, but hasn't. Although it may in theory be possible
for a rogue government to acquire harmful know-how by sending
students to British universities, we have not seen any evidence
that it occurs in practice.
Even in the absence of legal challenges, requiring
academics to get licenses to do their work when they had previously
been left to get on with it will give rise to furious protests,
and will lead to widespread contempt for the DTI. There will be
attempts to make licenses conditional on academic bahaviour: a
senior civil servant informed the author that we had better drop
our opposition to the so-called "voluntary vetting"
scheme whereby some universities agree to forward details of third
world applicants for technology PhD places to the security services,
who then advise them (for example) not to let Pakistanis or Chinese
do doctorates in computer security. Cambridge and Oxford have
always refused to participate, taking the view that the FO can
if it wishes always refuse a visa. Bringing the academic community
inside the arms export licensing system will cause such disputes
to proliferate and fester. In the long run, creating a mechanism
that can be used by DTI civil servants to punish individual academicswithout
due process or the possibility of appealwill seriously
impair academic freedom.
Even if academic freedom is not considered to
be the DTI's problem, the effects of the proposed policy on the
credibility of the export control regime should be considered.
A government concerned about proliferation via academic channels
should seek the support and cooperation of academics rather than
passing a law certain to antagonise them.
The Secretary of State for Trade and Industry
has publicly expressed his intention to exercise much closer personal
control over British science (Research Fortnight, 5/8/98). The
main obstacle to this at present is the low regard in which the
DTI is held by most academic researchers. The present proposals
will deepen that and entrench it rather than helping to rebuild
trust and respect.