Dual use goods

peter_paul

I was wondering if any of you have experience with CAD data in the cloud concerning Dual use goods.

I like the way Onshape enables collaboration and sharing. I can see many benefits for the future. 

However I am also worried. Our company makes products that fall under export restrictions. This also includes CAD data.

Without any safeguards in place an unsuspecting user could violate an export restriction. As a result the company might be fined for the violation.

It would be a shame that user would not be allowed use a tool like Onshape because of this.

What are you thoughts on this subject?

traveler_hauptman

This is a really good point. I guess at minimum one would need a guarantee from onshape that instances of the server and storage and backup of the data are limited to the relevant region.

Stating the obvious, Onshape is a USA company and could probably most easily field personnel for export restricted operations in the USA. For users in other jurisdictions, it would be more complicated.

For those in the USA, It may be as simple as paying a premium.... since onshape can use govcloud

However I'd imagine that until there is a critical mass of users, it would need to be through an enterprise subscription....



 

dan_shore

Thanks for the post. With respect to geographic restrictions, using Onshape probably leaves you less vulnerable than installed CAD software. This is because of our full-cloud deployment, in which your CAD data lives in one place from which it is accessed by you and only those collaborators you choose. Previously, CAD collaboration has relied on emailing files and/or storing multiple copies and versions in different locations -- which greatly decrease your control over your data, and thus greatly increase the prospect of non-compliance.

traveler_hauptman

"Dan Shore"  I get what you are saying, but it's a national security legal requirement about who has virtual or physical access to the data and not a judgement call. The penalties are pretty severe. 

Generally the dual use technical data cannot cross any borders and servers/data must not be able to be accessed by foreign nationals.  This is the simplified version; in fact data can cross borders and can be accessed by foreign nationals in specific cases. Different nations have their own version of this and their own list of who can share what with who.

Cloud providers tend to cross borders  as needed (the point of the cloud is that it is everywhere) and this is why Amazon has a separate service for providing cloud services that are for export restricted computing and data storage (for the USA).

There is a lot of seemingly benign technical data that gets classified as dual use and a lot of small contractors dealing with it. I expect this question will come up occasionally. It's probably worth having one of the Onshape people look into it (maybe someone from the legal team) and add it to the FAQ.

I'm guessing the answer is "Unfortunately Onshape is not able to serve this segment of the market at this time." 

lougallo

@Peter_Paul We have plans to have many more controls for use cases like this.  Downloading/exporting are functions many will want to control as the sharing model grows.  We have indeed thought about this and hope to have more granular controls in the near future.  

peter_paul

I did some research on the subject and I found some interesting texts on the subject.

I will post them here for reference.

Export_Controls_Alert_08_04_2011.pdf
http://tinyurl.com/z4kzg3s 

EXPO_STU(2015)535000_EN-1.pdf
http://tinyurl.com/zu7d7ma

What I can conclude on dual usage. The exporter is usually the party responsible for controlling the information.
Onshape is not the exporter in context of dual use goods.

For proper control measures will have to implemented at the company where the data is generated not at Onshape.
Onshape can only provide "tools" to help control of information.

Some of these tools could be.

Access options based on location.
The ability to add custom legal messages when links are shared to third parties. (This will not prevent information flow. But more meant to control and inform third parties.)

Anyone have other suggestions ?