Does Wassenaar Arrangement on the transfers of arms and dual-use goods and technologies apply to security training? Does the Wassenaar Arrangement on the transfers of conventional arms and dual-use goods and technologies apply to IT security training? Does it apply to IT security training on exploitation techniques? Is it applicable to institutions or individuals?
Yes, it arguably includes technical training according to the List of Dual-Use Goods and Technologies and Munitions List (Wa-List (14) 2). Exploitation, as used in your question, can take many forms of course. First, take a look at the definition of technology for GTN and both lists1: Technology is defined as information. The information can take the form of technical assistance. Technical assistance may take the form of training. Now we need to look to see if "exploitation" is on any of the lists and then if technology for exploitation is included. The best I can find is at on the Dual Use List - Category 4 - Computers: 4.E.1.c "Technology" for the "development" of "intrusion software". Note that technology appears in quotes. This means that the term takes on the meaning defined in the List of Definitions (found on p. 201 of Wa-List (14) 2). I also think that "Intrusion software" as defined (page 212) comports with what you call exploitation. There are probably others, but we need to know more about what you mean by exploitation. For now I think this is enough. If you need more, I think that more answers will come from really understanding the definitions and how the defined words and phrases are used in the Wa-List. 1Technology Specific information necessary for the "development", "production" or "use" of a product. The information takes the form of 'technical data' or 'technical assistance'. Controlled "technology" for the Dual-Use List is defined in the General Technology Note and in the Dual-Use List. Controlled “technology” for the Munitions List is specified in ML22. Technical Notes. 1. 'Technical data' may take forms such as blueprints, plans, diagrams, models, formulae, tables, engineering designs and specifications, manuals and instructions written or recorded on other media or devices such as disk, tape, read-only memories. 2. 'Technical assistance' may take forms such as instruction, skills, training, working knowledge, consulting services. 'Technical assistance' may involve transfer of 'technical data'.
No, it does not. There is indeed a 2-year guarantee for all goods, but "goods" is defined to be a "tangible movable item" according to Directive 1999/44/EC Article 1, subsection 2(b). In less legalese, a physical item; software doesn't count. While there has been discussion about extending this protection to software, I'm not aware of this having been done yet. Even if it were, determining whether goods are "faulty" ultimately comes down to whether it conforms to the contract of sale (Article 2). I think it's likely that vendors in this area would put a disclaimer for unforeseen security vulnerabilities, or something to that effect.
I can't comment on tactical considerations, but legally there is nothing preventing submitting a Subject Access Request to support litigation. The case law has developed (and been somewhat inconsistent) over the years, culminating with the &quot;no other purpose&quot; rule being clarified by the Court of Appeal in Dawson-Damer v. Taylor Wessing LLP, [2017] EWCA Civ 74 by saying that... ...a SAR would not be invalid if it had been made with the collateral purpose of assisting with litigation. Delivering the leading judgment, Arden LJ noted (at paragraph 107) that the EC Data Protection Directive “makes it clear that the rights given by the Directive are to protect fundamental rights conferred by EU law. We have been shown nothing in the DPA or the Directive which limits the purpose for which a data subject may request his data, or provides data controllers with the option of not providing data based solely on the requester’s purpose”. Source and further reading
To answer the last part of the question: Jurisdiction would be where the copied media is being producted and where it is being consumed/sold. Moving media from one jurisdiction with ineffectual protections to another jurisdiction is part of product piracy. The scheme you suggest might shield the company producing the counterfeit goods, leaving the importers holding the bag. If the importers and manufacturers are controlled by the same person, courts in jurisdictions with strong protection might hold that person liable for the whole criminal enterprise. There is a widespread assumption that the internet is 'beyond national laws.' That is wrong. Enforcement may be difficult in some cases, but the laws apply. If you try to make profits by skirting the edges of law, you need really good, really professional legal advice.
As written, your question seems to ask for legal advice in a specific case. That would be off-topic. If you are asking strictly as a hypothetical: In germany, there is supposed to be the Bestellerprinzip for services of a real state agent (whoever retains the agent pays the fees). This was clarified in the Gesetz zur Regelung der Wohnungsvermittlung as changed in 2015. Landlords and real estate agents are frequently trying to get around it, but getting the legal construction of the contracts wrong would mean a substantial fine.
In the UK and USA (and I imagine other jurisdictions) there have been laws that explicitly provide for orders obliging entities to (A) provide access or information and (B) keep the order secret. For example, in the USA the Stored Communications Act, Fair Credit Reporting Act and Right to Financial Privacy Act authorise the FBI to issue National Security Letters (Wikipedia, EFF, EPIC, Lawfare). These are an administrative subpoena, without prior approval from a judge, for meta-information (e.g. phone numbers dialed or email recipients addressed but not the content) of communications relevant to national security investigations. They typically contain a non-disclosure requirement prohibiting the recipient of the NSL from disclosing its existence or the FBI's demands. There have been challenges on First Amendment grounds to the non-disclosure aspect but, so far as I'm aware, they have all ultimately failed. Some of their non-disclosure requirements may eventually expire under other laws. In response, so-called 'warrant canaries' (Wikipedia) have been developed (and gone a bit further than the original idea) - these are intended to allow entities to relatively passively warn of such an order having been received if not the detail of the order. However, they can be legally risky in that they might be seen by a court as trying to circumvent the non-disclosure requirement and therefore breaking it.
It seems that your friend is taking part in a multi-level marketing scheme. However, this does not necessarily exclude a pyramid or snow ball scheme. Both can be illegal in Germany and Switzerland under the respective unfair business practices codes, because the systems do not rely on the sales of goods and services, but on the continuous recruitment of further sales persons. To clarify whether your friend's system is illegal, you could report the scheme to the competent watchdogs. In Germany the "Zentrale zur Bekämpfung unlauteren Wettbewerbs" in Bad Homburg is recommendable. As the company is operating from Switzerland, German law not be applicable without more. Therefore also contacting the Swiss authorities may be advisable. This seems to be the "Staatssekretariat für Wirtschaft SECO" in Bern.
There are two cases to distinguish: information that the other party does not want to give without court order, and information that the other party may not give without court order. Only the former case matters, of course, since the latter by definition requires a court order. So, if the other party is legally capable of giving the information, but it's commercially not sensible for them, then you'll need to sweeten the deal. And that's business, not a legal question anymore. In other words: there's no legal instrument that's at the same time equal to a court order but also different from one. When you need a court order, there's no alternative to a court order.