14th Annual Advanced Forum on Global Encryption, Cloud & Cyber Export Controls - WEB

EARN CLE CREDITS

May 15–16, 2024 | Canopy by Hilton San Francisco SoMa, San Francisco

14th Annual Advanced Forum on

GLOBAL ENCRYPTION, CLOUD & CYBER EXPORT CONTROLS

FIRESIDE CHAT Lee Licata Deputy Section Chief for National Security Data Risk U.S. Department of Justice

The Country’s Only Comprehensive, Practical Event of Its Kind

Session Highlights for 2024

Connect and Benchmark With:

U.S. Cloud Computing, AI and its Potential China Intersection: The AI EO and Potential Ways Forward

ç Amazon

ç Google

The Multi-Jurisdictional Cloud and End-Use Controls Landscape: Comparing U.S., EU, Canada and German Cloud Regulatory Efforts

ç Oracle

ç Leonardo DRS

ç Ericsson (Sweden)

ç Microsoft

Unlocking EAR Treatment of Software Releases and Access Information Transfers: 734.15 / 734.19 and the Encryption Nexus

ç FRA - Försvarets radioanstalt (Sweden)

ç NetApp

The Advanced Semiconductor Rule and Your Encryption Compliance Roadmap in Practice: Implementing Mission-Critical 2023 Rule Updates

ç Rolls-Royce (UK)

ç Service Now

Quantum Computing and Safeguarding Export-Controlled Encrypted Data: Quantum-Safe Cryptography for the Age of Quantum Computing Implementation of the Latest Wassenaar Arrangement Decisions: Streamlining the Information Security Control List

ç McKinsey & Company (Israel) ç Bloomberg LP ç Qualcomm ç Dell Technologies ç IBM

Associate Sponsor

REGISTER NOW

Exhibitor

AmericanConference.com/Encryption • 888 224 2480

ç URSA Inc.

ç VIAVI ç Flex ç Cadence Design Systems ç Bentley Systems ç Bloomberg LP ç Center for Security and Emerging Technology (CSET)

a C5 Group Company Business Information in a Global Context

DISTINGUISHED FACULTY FIRESIDE CHAT Lee Licata Deputy Section Chief for National Security Data Risk U.S. Department of Justice

CONFERENCE CO-CHAIRS Michelle Aragon Senior Manager, Trade Compliance Leonardo DRS Roszel C. Thomsen II Partner Thomsen and Burke LLP

DISTINGUISHED FACULTY Per Sundstrom Head of Trade Compliance Technology Ericsson (Sweden) Andrea Popa Senior Director, Global Trade Compliance NetApp Zvonimir Bandic Vice President, CPU R&D Cadence Design Systems Jacob Feldgoise Data Research Analyst Center for Security and Emerging Technology (CSET) Lillian Norwood Senior Manager, Global Trade Compliance Amazon

Hector Rivera Director, Export and Sanctions Compliance Qualcomm Technologies Inc.

Doron Hindin Associate General Counsel, International Trade McKinsey & Company (Israel)

Brian Falbo Senior Counsel Dell Technologies LLC

Bob Bowen Export and Trade Compliance Counsel Service Now

Winnie Luk Director, Global Export Classification Oracle Joseph Stone Senior Export Controls Manager, IT & Digital Rolls-Royce (UK) Matt Silverman Global Trade Director and Senior Counsel VIAVI Michael Miller Trade Manager, Global Trade Compliance, Empowered Official Flex Tansie Taylor Iwafuchi Senior Manager, Export Controls, Global Trade Compliance Microsoft Thoth V. Weeda Compliance Counsel Bentley Systems Dr. Torbjörn Gustafsson Crypto Mathematician FRA - Försvarets radioanstalt (Sweden)

Yvonne Brye-Vela Data Security and Privacy Google; Adjunct Professor San Francisco State University Jai Singh Arun Head of IBM Quantum Safe Product Management & Strategy IBM David Kovar Founder and Chief Executive Officer URSA Inc. Inna Sanamyan Financial Regulatory Counsel Bloomberg LP Brian J. Egan Partner Skadden, Arps, Slate, Meagher & Flom LLP Yan Luo Partner Covington & Burling LLP (China) Alan Martin Hayes Senior Counsel OpenAI

2 | LINKEDIN International Trade & Economic Sanctions: Legal, Regulatory, and Compliance Professionals

Christopher Timura Partner Gibson Dunn & Crutcher LLP Melissa Duffy Partner Fenwick & West Ajay Kuntamukkala Partner Hogan Lovells John W. Boscariol Partner McCarthy Tétrault LLP (Canada) Stephan Mueller Partner Oppenhoff (Germany) Lothar Determann Partner Baker & McKenzie LLP Per Sundstrom Head of Trade Compliance Technology Ericsson (Sweden) Cristina Brayton-Lewis Partner White & Case LLP Alison Stafford Powell Partner Baker & McKenzie LLP Shiva Aminian Partner Akin Gump Strauss Hauer & Feld LLP

#GlobalEncryption #GlobalTrade #ACIConferences

PRE-CONFERENCE WORKSHOPS TUESDAY, MAY 14, 2024 WORKSHOP A

9:00 am–12:30 pm (Registration opens at 8:30 am)

Appreciated the workshops and the depth of information along with the topics covered.

Trade Control Specialist, The Boeing Company

WORKSHOP B

1:30 pm–5:00 pm (Registration opens at 1:00 pm)

Updating Your U.S. Encryption Compliance Roadmap: Classification, Licensing, Reporting, and a Primer on October 2023 Semiconductor Rule

Operationalizing Clouds as Data Infrastructure Amid Complex Export Controls: Navigating Complex Data Outsourcing Needs, Creating Strategic Service Contracting Relationships

Microphone-alt Andrea Popa, Senior Director, Global Trade Compliance, NetApp

Microphone-alt Zvonimir Bandic, Vice President, CPU R&D, Cadence Design Systems

Inna Sanamyan, Financial Regulatory Counsel, Bloomberg LP Per Sundstrom, Head of Trade Compliance Technology, Ericsson (Sweden) Melissa Duffy, Partner, Fenwick & West This session is designed both for attendees new to encryption controls and for those who would like an in-depth refresher before the more advanced discussions of the main program. Take part in this practical and interactive working group as experts discuss the current state of U.S. encryption controls—with a focus on building and maintaining strong protocols to ensure compliance.

In addition to ample time for questions and discussion, benefit from speaker-prepared reference materials for your work after the conference. Topics will include: • Proactive coordination with product development teams » Who to contact and where to look toward mapping out your classification and licensing strategy • Timing and planning of product classification reviews » Utilizing early product analysis and evaluating intended use • Overview of encryption classification rules under the EAR and ITAR • Managing deemed exports and controls around software and technology • Encryption reporting and export licensing requirements: EAR licensing requirements and exceptions, managing export license conditions and scoping limitations on encryption products

Christopher Timura, Partner, Gibson Dunn & Crutcher LLP Cloud service providers can help export compliance and IT leaders set up for success—for instance, improving deployment speed and ensuring future flexibility. But how should IT and export-controls compliance teams work together to prepare data to be outsourced? Where do export controls and IT intersect? This workshop will examine best practices from a variety of industry perspectives.

• Materiality assessments prior to any outsourcing decision (which activities should be considered as material, and in what areas) • Security of export-controlled data and systems: Obligations for the provider to protect the confidentiality of the outsourced information and key checks to be performed by the institution prior to outsourcing that should be included in outsourcing agreements » Encrypting controlled data prior to sending it to the cloud and requiring the cloud vendor to use encryption technology • Location of data and data transfers between controllers and processors » Retaining visibility of any data subcontracting arrangements • Supply chain outsourcing: Ensuring that service levels and oversight are not affected • Negotiating robust contractual provisions, including access and audit rights in outsourcing agreements • Contingency plans: Exiting cloud outsourcing without affecting export-controlled data

• Overview of October 2023 advanced computing export controls and intersection with encryption controls

REGISTER NOW

AmericanConference.com/Encryption • 888 224 2480

a C5 Group Company Business Information in a Global Context

DAY ONE WEDNESDAY, MAY 15, 2024 7:30

Registration and Continental Breakfast

8:45

Co-Chairs’ Opening Remarks Microphone-alt Michelle Aragon, Senior Manager, Trade Compliance, Leonardo DRS Roszel C. Thomsen II, Partner, Thomsen and Burke LLP 9:00

FIRESIDE CHAT

The Bulk Sensitive Data EO and the Global Encryption, Cloud and Cyber Controls Nexus Lee Licata Deputy Section Chief for National Security Data Risk U.S. Department of Justice 9:45

The Future of U.S. Cloud Computing, AI and its Potential China Intersection: The AI EO and Potential Ways Forward for Managing U.S. Technology Security and Export Risks Microphone-alt Jacob Feldgoise, Data Research Analyst, Center for Security and Emerging Technology (CSET)

Lillian Norwood, Senior Manager, Global Trade Compliance, Amazon Alan Martin Hayes, Senior Counsel, OpenAI Shiva Aminian, Partner, Akin Gump Strauss Hauer & Feld LLP • The AI EO: Cloud-specific details, including cloud” Infrastructure as a Service” provisions » Impact of Chinese Generative AI Rules on U.S. AI regulatory efforts • When Chinese users can still access controlled chips (ECCN 3A090) through clouds services and how to address this • Anticipating U.S. government restrictions on sale of cloud services to China 10:45

Extended Networking Break

11:15

CASE STUDY

A Behind the Scenes Look at Implementing the Advanced Semiconductor Rule and Strengthening Compliance Microphone-alt Bob Bowen, Export and Trade Compliance Counsel, Service Now Melissa Duffy, Partner, Fenwick & West Per Sundstrom, Head of Trade Compliance Technology, Ericsson (Sweden) • Implementing licensing requirements • Updating licensing policies and Temporary General Licenses • Gap analysis: Strengthening compliance programs to make sure legal, engineering, and trade compliance are all in the loop with new controls 11:45

HYPOTHETCIAL SCENARIOS

Putting Your Encryption Compliance Roadmap into Practice: How to Resolve the Most Complex Advanced Semiconductor Classification and October 2023 Rule Challenges Microphone-alt Hector Rivera, Director, Export and Sanctions Compliance, Qualcomm Technologies Inc. Brian Falbo, Senior Counsel, Dell Technologies LLC • Applying licensing requirements for items controlled under ECCNs 5A002 or 5D002 that meet or exceed the performance parameters of the new ECCNs 3A090 or 4A090 • Applying licensing requirements for mass market encryption hardware and software items controlled under ECCNs 5A992 or 5D992 • Restrictions on US persons activities: US persons (citizens, permanent residents, asylees, and refugees) that support the development or production of integrated circuits (IC’s) in China now requires a license » What kind of ICs are involved? » What ECCNs are relevant? » Are any license exceptions available?

• New foreign direct product rules focused on otherwise uncontrolled foreign-origin content for advanced computing and supercomputer-related applications in China » Expanded “Entity List FDP Rule” (§ 734.9(e)(2) » New “Supercomputer FDP Rule” (§ 734.9(i) » New “Advanced Computing FDP Rule” (§ 734.9(h)

4 | LINKEDIN International Trade & Economic Sanctions: Legal, Regulatory, and Compliance Professionals

#GlobalEncryption #GlobalTrade #ACIConferences

12:45

Networking Luncheon

2:00

The Multi-Jurisdictional AI and Cloud Computing Controls Landscape: Contrasting EU, Canadian, and German Cloud Computing Regulatory Efforts and the Key Differences with U.S. Requirements Microphone-alt John W. Boscariol, Partner, McCarthy Tétrault LLP (Canada) Stephan Mueller, Partner, Oppenhoff (Germany) Lothar Determann, Partner, Baker & McKenzie LLP Alison Stafford Powell, Partner, Baker & Mckenzie LLP • The EU AI Act: » The changes it will require from AI companies: How soon will they take effect? » How the Act divides its rules on the level of risk an AI systema » Will the Act stifle technological innovation?

• Defining DIGITALEUROPE EU export control guidelines vs. U.S. requirements: » The definition of “export” when encrypted technology is sent outside of the EU

3:15

Managing the Business Impacts of the October 2023 U.S. Advanced Computing and Semiconductor Rule: Practical Insights on Encryption Compliance and Your Supply Chain Microphone-alt Winnie Luk, Director, Global Export Classification, Oracle Ajay Kuntamukkala, Partner, Hogan Lovells What are the short and long-term computing supply chain impacts of BIS’ October 2023 rule covering semiconductors and supercomputing technology? How do the 2023 updates raise the compliance bar? How do they impact encryption compliance? As with any complex and novel export control rule involving innovative technologies and supply chains, many anticipate that the new rules will likely have unintended consequences.

This panel of experts will address the future of the U.S. microelectronics sector and supply chain amid unprecedented regulatory change.

4:00

Compliance Due Diligence: Updating Your Program in Accordance with Your Organization’s Risk Profile Microphone-alt Joseph Stone, Senior Export Controls Manager, IT & Digital, Rolls-Royce (UK)

» The definition of software “exports” when the software is provided as a service (SaaS)

Matt Silverman, Global Trade Director and Senior Counsel, VIAVI

» Should an “export” occur when administrators (e.g., at a telecom, cloud service, or SaaS provider) have access to user data for purposes of providing, supporting, or maintaining the service?

Michael Miller, Trade Manager, Global Trade Compliance, Empowered Official, Flex

• Government of Canada cloud controls: » Performing security categorization: Attributing “High Watermark” risk profiles of cloud security

Cristina Brayton-Lewis, Partner, White & Case LLP • Gap analysis: Changes in DDTC/BIS insights into compliance monitoring » Working in silos versus working as a whole

» Cloud security control profile selections » Determining scope of security responsibility for various cloud service models » Performing security assessments • Germany:

3:00

» Road map for a written compliance plan to cultivate a culture of compliance • Touchpoint inventories: A holistic review of operations and where third-party data is stored and how it is screened • Working with verified entities – How much due diligence is enough?

» Pushback towards EU AI Act around “foundation models”

• Delve into certain components that companies have integrated within their current processes

» The BAFA guidance » Bitkom’s position

• Industry specific challenges – Semiconductor companies, telecommunication companies, aerospace companies, O&G, etc.

» BAFA guidance vs. EU Dual Use regulation

• How to manage your compliance program with remote employees

» Suggestions concerning potential coordination between ANS and Bitkom

5:00

Close of Day One

Networking Break

REGISTER NOW

AmericanConference.com/Encryption • 888 224 2480

a C5 Group Company Business Information in a Global Context

DAY TWO THURSDAY, MAY 16, 2024 8:45

11:15

Co-Chairs’ Opening Remarks

Unlocking EAR Treatment of Software Releases and Access Information Transfers: Navigating 734.15 / 734.19 and the Encryption Nexus

Microphone-alt Michelle Aragon, Senior Manager, Trade Compliance, Leonardo DRS Roszel C. Thomsen II, Partner, Thomsen and Burke LLP 9:00

Implementation of the Latest Wassenaar Arrangement Decisions: Global Efforts in Streamlining the Information Security Control List Microphone-alt Dr. Torbjörn Gustafsson, Crypto Mathematician, FRA - Försvarets radioanstalt (Sweden) • Ancillary encryption and the removal of a grey exception • Challenges with mixing exceptions for items and functions

Microphone-alt Bob Bowen, Export and Trade Compliance Counsel, Service Now Michelle Aragon, Senior Manager, Trade Compliance, Leonardo DRS In September 2023, BIS amended EAR provisions on the release of software and access to information related to software. These amendments have changed the EAR landscape related to the concept of release as that term applies to software and related access information. This panel will examine these changes and the impact that they have on software-related activities subject to the EAR. 12:15

Networking Luncheon

• Possible key limits on post quantum algorithms?

1:30

• The past and the future of OAM encryption

Quantum Safe Cryptography — Protecting Export-Controlled Data in the Era of Quantum Computing

9:45

Cloud Computing, End-Use Controls and Technology Transfers: Navigating the Grey Areas of 734.20/734.18 Exemptions and Beyond Microphone-alt Tansie Taylor Iwafuchi, Senior Manager, Export Controls, Global Trade Compliance, Microsoft

Thoth V. Weeda, Compliance Counsel, Bentley Systems The definition of “export” in the EAR and ITAR both include the concept of releasing technical data or technology to a foreign person in the U.S. as part of the definition of a “deemed export”, or the transfer of ownership or control of a technology to a foreign person. Interesting changes are proposed - §734.18 and 734.20 - to the EAR, and - §120.52 - to the ITAR, which would deal with transfers of technology and use of encryption. What’s behind these rules, what are the limitations, and how is industry is managing these exceptions?

10:45

Networking Break

Microphone-alt Jai Singh Arun, Head of IBM Quantum Safe Product Management & Strategy, IBM Yvonne Brye-Vela, Data Security and Privacy, Google; Adjunct Professor, San Francisco State University With quantum computers advancing rapidly, traditional security protocols face a significant threat as they can be easily compromised. In this session, we will explore the importance of quantum-safe cryptography to safeguard sensitive, export-controlled data in the age of quantum computing.

2:15

The Commercial Spyware EO and Finding the Right Balance Between Offensive and Defensive Cyber Security Policy Microphone-alt David Kovar, Founder and Chief Executive Officer, URSA Inc. Roszel C. Thomsen II, Partner, Thomsen and Burke LLP An offensive security strategy aims to preemptively identify and mitigate gaps and weaknesses within an organization’s digital infrastructure. Defensive cybersecurity involves a systematic and comprehensive approach to identifying vulnerabilities and weaknesses before they can be exploited.

With the Commercial Spyware EO in place, is the EO too defensive/restrictive, creating negative economic implications? How can the U.S. find the right defensive/offensive cyber-stance?

6 | LINKEDIN International Trade & Economic Sanctions: Legal, Regulatory, and Compliance Professionals

#GlobalEncryption #GlobalTrade #ACIConferences

3:00

Networking Break

3:15

Around the World in Encryption and Cyber Controls: The Latest Developments Coming Out of the EU, Russia, China, Japan and Israel PART ONE: China and Japan

Microphone-alt Yan Luo, Partner, Covington & Burling LLP (China) • China’s Commercial Encryption Regulations: Criteria inclusions for obtaining applicable certifications, qualifications, and licenses • Japan’s The Protection of Personal Information Act No. 57 of 2003 (APPI): Guidelines for specific sectors, including financial, medical and telecommunications

PART TWO: EU and Russia

Microphone-alt Brian J. Egan, Partner, Skadden, Arps, Slate, Meagher & Flom LLP (USA)

CONTINUING LEGAL EDUCATION CREDITS EARN CLE CREDITS

Accreditation will be sought in those jurisdictions requested by the registrants which have continuing education requirements. This course is identified as nontransitional for the purposes of CLE accreditation.

ACI certifies this activity has been approved for CLE credit by the New York State Continuing Legal Education Board.

ACI certifies this activity has been approved for CLE credit by the State Bar of California.

ACI has a dedicated team which processes requests for state approval. Please note that event accreditation varies by state and ACI will make every effort to process your request.

Questions about CLE credits for your state? Visit our online CLE Help Center at www.AmericanConference.com/Accreditation/CLE/

• EU proposals to require mass data scanning, compromising end-to-end encryption • Russia » Impact of encryption controls on Russia “exit” transactions » Availability of exemptions and licenses for encryption activities in Russia

PART THREE: Israel

Microphone-alt Doron Hindin, Associate General Counsel, International Trade, McKinsey & Company (Israel)

• The MOD Encryption Control Department's initial licensing processes • Government-private sector collaboration 4:30

AUDIENCE POLLING

Closing Roundtable Discussion: The Next Phase of Encryption, Cloud and Cyber Export Compliance for 2024 and Beyond This interactive, brainstorming session will take stock of the greatest compliance risks, emerging issues, and global regulatory dynamics that will impact compliance programs in the short, medium and long term.

5:00

Close of Conference

hands-helping BECOME A SPONSOR With conferences in the United States, Canada, Latin America and Europe, the C5 Group of Companies: American Conference Institute, the Canadian Institute, and C5 Group, provides a diverse portfolio of conferences, events and roundtables devoted to providing business intelligence to senior decision makers responding to challenges around the world.

Don’t miss the opportunity to maximize participation or showcase your organization’s services and talent. For more information please contact us at: SponsorInfo@AmericanConference.com

MEDIA PARTNERS:

REGISTER NOW

AmericanConference.com/Encryption • 888 224 2480

a C5 Group Company Business Information in a Global Context

UPCOMING EVENTS

February 28–29, 2024 | Washington, DC

April 29–30, 2024 | Washington, DC

September 25–26, 2024 | Washington, DC

Fall 2024 | Washington, DC

C5 celebrates 40 years of excellence! We are thrilled to have provided exceptional conference experiences globally with our outstanding team, speakers, sponsors, partners, and attendees. To mark this milestone, we're launching a new logo which represents our commitment to innovation, growth, and excellence, represented by the five Cs of C5: Current, Connected, Customer-Centric, Conscientious, and Committed.

Looking back on 40 years, we are grateful for our achievements—hosting global conferences, uniting industry leaders, and supporting business growth. However, we are not done yet! We are committed to pushing boundaries and creating impactful experiences and we're excited for the next 40 years of success.

8 | LINKEDIN International Trade & Economic Sanctions: Legal, Regulatory, and Compliance Professionals

 Join Our Email List to Stay Connected SIGN UP TO RECEIVE EXCLUSIVE DISCOUNTS, OFFERS AND PROGRAM UPDATES AmericanConference.com/join-our-email-list/

#GlobalEncryption #GlobalTrade #ACIConferences

VENUE INFORMATION

ACCOMMODATIONS

Canopy by Hilton San Francisco SoMa

American Conference Institute is pleased to offer our delegates a limited number of hotel rooms at a negotiated rate. To take advantage of these rates, please contact the hotel directly and quote “ACI Global Encryption.”

250 4th Street, San Francisco, CA 94103

Please call 1-800-HILTONS to book your guestrooms.

Please note that the guestroom block cut-off date is April 26th. After that date OR when the room block fills, guestroom availability and rate can no longer be guaranteed.

WORRY FREE Registration

GUARANTEE

Book with confidence!

Register and pay to lock in your early rate and be eligible for a full refund until May 1, 2024.

If you are unable to attend for any reason, you will have the following options: y A full credit note for you, or a colleague to attend another event. y A full refund.

All cancellations and changes must be submitted to CustomerService@AmericanConference.com by May 1, 2024.

3 Ways to Register

PRICING

Conference Only

ONLINE:



 AmericanConference.com/Encryption

SAVE $200

CustomerService@AmericanConference.com



PHONE:

1-888-224-2480

REGISTRATION CODE:

Register & Pay by April 12, 2024

Register & Pay after April 12, 2024

B00-885-885L24.WEB

$2,195

$2,395

Bringing a Team?*

ADD-ONS: WORKSHOPS Workshop A: Updating Your U.S. Encryption Compliance Roadmap Workshop B: Operationalizing Clouds as Data Infrastructure Amid Complex Export Controls All program participants will receive an online link to access the conference materials as part of their registration fee.

Additional copies of the Conference Materials available for $199 per copy.

© American Conference Institute, 2024

EMAIL:

$600 each

1–3

No Discount

4–8

10% Conference Discount

9–12

15% Conference Discount

12+

Call 888-224-2480

CONFERENCE CODE:

885L24-SNF

Special Discount ACI offers financial scholarships for government employees, judges, law students, non-profit entities and others. For more information, please email or call customer service. * Team/group registrations must be from the same organization/firm and register together in one transaction.

To update your contact information and preferences, please visit https://www.AmericanConference.com/preference-center/.

Terms & conditions and refund/cancellation policies can be found at AmericanConference.com/company/faq/