Wassenaar Arrangement
A multilateral export control regime for conventional arms and dual-use goods, created in 1996, which added intrusion software and network surveillance to its lists in 2013.
The Wassenaar Arrangement was created in 1996 to succeed the coordinating committee that, during the Cold War, controlled exports of Western technology to the Soviet bloc. It brings together some forty states, which agree on lists of goods to control, conventional arms and dual-use goods, and each transposes them into national law; in the European Union, these lists are incorporated into the dual-use regulation. The arrangement creates no prohibition by itself: it harmonizes what each state subjects to licensing. In 2013, it added intrusion software and network surveillance systems to its lists, to regulate the trade in spying tools sold to authoritarian regimes. The text sparked controversy in the security community: broadly drafted, it risked subjecting penetration testing tools and vulnerability sharing between researchers to licensing, and its US implementation had to be revised. With Russia among the participants, the arrangement works by consensus, which has blocked its evolution since 2022. For insurance, it bears on the compliance of exporting cybersecurity companies, and on the boundary, central in cyber, between defensive tool and offensive weapon.
Textbook case: a French penetration testing start-up wants to sell its platform to a Gulf client. Its counsel checks whether the software falls under the Wassenaar-derived categories in the EU regulation; a license is required, and its liability insurer excludes sales made without one.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.