by Sanjay Jose Mullick

The Obama administration has taken the first step in export control reform by easing the pathway for U.S. companies to export certain encryption items.

The First Export Control Reform

On June 25, the U.S. Department of Commerce’s Bureau of Industry and Security issued new regulations governing export controls on encryption. This rulemaking represents the first formal example of the president’s initiative to reform U.S. export controls by concentrating regulation on the most sensitive items.

The new regulations reflect a recognition that encryption is ubiquitous in today’s high-tech world and cannot be completely regulated. These rules also attempt to address the need for U.S. companies to be able to get to market quickly, to foster the competitiveness of U.S. industry. However, they do not accomplish a complete de-control of encryption, and the prior system will remain in place for many products.

Although the regulations have been published as an interim final rule with a request for comments, they likely reflect the prevailing framework for regulating encryption exports going forward. Let’s take a look at some of the key elements of the new rules and how they will impact exporters.

Company-Based Framework

The new rules move away from a regulatory approach based on disclosure of the technical characteristics of the product to be exported to one focused on the profile of the company that will be making the exports.

Encryption Registration

When President Obama first announced the export control reform initiative, he stated that he wanted to change the export authorization process for encryption items “from 30 days to 30 minutes” and the new rules accomplish that. Specifically, for “less sensitive” encryption items, and for mass market items, the prior requirement to submit a technical questionnaire to BIS for it to conduct a product review has been replaced with one whereby the exporting company submits an online “encryption registration.” The encryption registration consists of contact information, an overview of the company and an identification of what categories apply to the company’s products.

Once the registration is submitted to BIS, the agency immediately issues a registration number, and the company becomes authorized to export encryption products such as local area network products, small routers and mass market items. For these products, companies no longer have to submit a technical questionnaire response with information about the product’s encryption algorithms and no longer have to wait 30 days to obtain authorization to export to key markets such as China and India.

Under the prior rules, it was often a good business practice for companies to make available to their customers, distributors and other business partners the classifications BIS issued pursuant to ENC review requests. This was because when BIS classified a product, other companies could rely on that classification as authority to make their own exports of the product, even if that company had not submitted the classification. Under the new rules, BIS has indicated that an exporter may rely on a producer’s encryption registration (to export that producer’s encryption product) without itself having to file a distinct encryption registration.

Classification Report

The company registration requirement is coupled with a requirement for the company to file an annual self-classification report. The report consists of a listing of the encryption items the company has self-classified and exported. Specifically, the report consists of the following six elements: (i) product name; (ii) model/series/part number; (iii) primary manufacturer; (iv) export control classification number; (v) encryption authorization type, e.g., ENC; and (vi) item type selector, e.g., gateway, modem or virtual private network. The report can be filed by e-mail.

One aspect of License Exception ENC many companies have disliked has been the requirement to file semi-annual reports. Although not a requirement that impinged export authorization, that reporting requirement could pose an administrative burden because it required capturing several information fields for all the applicable transactions, and doing so in a way that they could be retrieved and converted into a spreadsheet. For certain encryption items, that reporting requirement no longer applies and has been replaced with the more streamlined annual self-classification report.

Two Key Developments

Although the general easing of export controls on encryption items is important, there are two developments that are particularly key because they extend the useful scope of License Exception ENC and entirely de-control a class of items, respectively.

Encryption Technology Included

One of the limitations of License Exception ENC had been that, as to several countries, it did not authorize exports of certain “technology” necessary for manufacturing, development or testing of encryption items. This would be relevant, for example, if a company were co-developing a product with a business partner overseas and needed to exchange certain technical specifications on encryption or engage in related technical discussions. Under the prior rule, the commodity and software could be exported under License Exception ENC, but the related technology had to wait for the longer approval of an export license, delaying product development.

The new rules now grant export authorization to items classified as ECCN 5E002 after submission of a classification request, either immediately or after 30 days, depending on the country. In now extending License Exception ENC to encryption technology, this one form of export authorization is enough to proceed with all tracks of product development, i.e., the commodity itself and now also both the related software and technology. Depending on the country, the authorization may not extend to encryption technology for more sensitive items, such as for cryptanalytic items, those with an open cryptographic interface and for “non-standard cryptography” (discussed further below). Notably, the authorization also does not extend at all to certain countries typically involved in offshore manufacture and software development. For example, although India is included, China and Russia are excluded.

Ancillary Encryption De-Controlled

The new rules also entirely release from the encryption controls items where “the primary function or set of functions” is neither (i) information security, (ii) computing, (iii) information storage or transmission, nor (iv) networking, and where the cryptographic functionality is limited to supporting the primary function or set of functions. Such items now include gaming, household appliances, fire alarm systems, inventory management software and business process automation. Exporters should review the entire list carefully to see if it applies to their business.

BIS took a sizable step in this direction in October 2008 when it created the exception for items that perform only “ancillary cryptography.” Although that allowed those products to escape the review requirement, it was somewhat confusing because the products still were classified, e.g., under ECCN 5A002 and required License Exception ENC for export. The new rule allows such products to be classified as EAR99, so long as any other aspect of their functionality does not trigger a specific ECCN.

Limitations of the Changes

Alas, the new rules do not ease the regulatory burden on all encryption products. Upon a closer review, chip manufacturers and software developers may conclude the amended regulations do not provide the benefits they may seem to offer at first glance.

Encryption Components

Still subject to the traditional requirement to submit a one-time product review (now termed a classification request) and to file semi-annual product export reports are certain “encryption components” and “equivalent or related software,” including (i) chips, chipsets, electronic assemblies and field programmable logic devices; (ii) cryptographic libraries, modules, development kits and toolkits; and (iii) application-specific hardware or software development kits.

Depending on the encryption algorithm and key length, this means those involved in supplying OEMs with the encryption elements of even consumer-type items, as well as companies engaged in cross-border development of their own products, generally will still likely have to follow the prior procedure. As before, whether exports are authorized to commence upon registration of the classification request or are subject to the 30-day waiting period will depend on the countries involved.

BIS has also been reluctant to grant mass market treatment to components of mass market end-items, e.g., the chip going into a consumer smartphone as opposed to the smartphone itself. This is because such components may not necessarily be sold in the same way as the final product and, until incorporated into it, they theoretically could be used in other applications.

In the future, perhaps BIS might consider extending mass market treatment to such components and software upon a clear demonstration that they are specially designed to be used exclusively with mass market end-items. For now, however, the new regulations re-affirm that generally encryption components will themselves have to satisfy the tests of large sales volume and general retail availability to be able to qualify for mass market treatment.

Non-Standard Cryptography

Also still subject to the prior review and reporting requirement are encryption commodities, software and components that provide or perform “non-standard cryptography.” That term is defined as “any implementation of ‘cryptography’ involving the incorporation or use of proprietary or unpublished cryptographic functionality, including encryption algorithms or protocols that have not been adopted or approved by a recognized interna­tional standards body… and have not otherwise been published.”

Carving out use of encryption that is published is a fairly significant policy development, but it does not go as far as it may seem.

Previously, a fairly common stumbling block for industry was using publicly available algorithms like Advanced Encryption Standard without recognizing that their incorporation or implementation into proprietary products was deemed to create a new and distinct encryption product requiring ENC review. Focusing controls on “non-standard cryptography” may go a long way toward exempting those end-products from classification and waiting period requirements.

However, use of such algorithms and protocols can still be considered nonstandard cryptography if—though standard themselves—they are being modified or customized in a particular way. Companies will likely have to conduct careful internal review of how they are using encryption before concluding they are not using “nonstandard cryptography.”

These are concepts that are new even to the regulators, so at this stage the full range of their scope and applicability is not entirely clear. Instead, sorting out exactly what fits this criteria can be expected to be a focus of discussion over the coming months.

Restricted Items

License Exception ENC continues to contain a subsection previously called “ENC Restricted,” which covers items such as network infrastructure software, commodities and components. BIS has revised and updated that list and it should be reviewed carefully. It also imposes classification, waiting period and reporting requirements. This subcategory of encryption items is significant because, for certain countries, an export license is required in order to export to governmental customers.

New Regulatory Architecture

In issuing the new encryption regulations, BIS indicated it would continue to review the rules, and certainly the real process of export control reform has only just begun. What these regulations do accomplish is the creation of a new architecture for regulating encryption that recognizes the reality that today encryption is a pervasive technology.

U.S. companies have to be able to develop products, consult with partners and service customers abroad swiftly to be able to compete effectively in a globalized world. At the same time, the speed at which technology can be deployed across borders places a greater strain on the systems that help safeguard national security.

As BIS consults with industry, this new framework should enable it to respond more quickly to market trends by more readily shifting items from a category of greater control to one of lesser control, calibrating the focus of export control resources on higher priority areas.

Sanjay Jose Mullick

International Trade

+1.202.663.8786

sanjay.mullick@pillsburylaw.com

Sanjay Mullick is a Washington-based member of Pillsbury’s International Trade practice, where he advises clients on export issues concerning encryption software and technology and on designing and implement­ing export control compliance programs.

The rule expands the availability of License Exceptions TMP and BAG but does not authorize any new release of technology. Any technology exported under the new rule may only be released to persons who may receive that same technology pursuant to other provisions of the EAR which means it will still be subject to restrictions applicable to technology exports and reexports.

The rule makes several changes to Section 740.9 which amends the “tools of trade” and the definition of U.S. persons which are applicable to export and report certain technology. Restrictions have also been added to prevent unauthorized export or reexport of technology which will require U.S. employers to demonstrate and document the reasons why the technology is needed by employees in business activities which are abroad. There will also be an additional requirement and guidance for the return or disposal of the technology, which will include an illustrative list of examples of technology that exists in a format that could facilitate a subsequent release of technology.

Section 740.14 amends the tools of trade provision which will authorize the export or reexport of certain technology to U.S. persons for use in the trade, occupation, employment, vocation, or hobby of the traveler or members of the U.S. person’s household, provided that they are U.S. persons, who are traveling or moving. The rule also provides a specific definition the above mentioned U.S. persons.

This rule also specifies certain restrictions applicable to the exports and reexports of certain types of encryption technology. The encryption technology will be controlled under ECCN 5E002 and will not be authorized under the new “tools of trade” and the new U.S. persons tools of trade will not authorize the export or reepxort of ECCN 5E002 technology to any destination found in the Country Group E:1 of Supplement No. 1 to part 740.

More information:

Federal Register Notice

If you didn’t make it to Update 2006, it turns out that the only thing you missed was the posh reception including sushi, crab cakes, and free drinks. You get all of the substance of the presentations here because Scott Gearity wrote a live report from the Commerce Department’s annual Update conference on October 16-17, 2006. Note the time stamp at the beginning of each point below.
–John Black

I have selected the key points (in my opinion) from Scott’s blog. (If you want to read the whole thing, go to his website, www.exportcontrolblog.com.)

Update Day 1: ENCRYPTION

Update Day 1: CHINA CONTROLS

Update Day 1: STATE DEPARTMENT EXPORT CONTROLS

Courtesy Doug Jacobson of International Trade Law News, here’s his summary of this morning’s deemed export breakout session:

Department of State Export Controls and Licensing, Ann Ganzer, Director of Office of Defense Trade Controls Policy

—Provided an overview of DDTC. The ITAR is an illustration of what is controlled. “We believe that we control things that have not been invented yet.”

—Licenses — Going electronic. Had a wake for Ellie Net on Friday. D-Trade licenses get processed first. First, look at applicant first. Exporting is a privilege not a right. Look at end-user and end-use. Look at foreign policy. What impact on country seeking equipment, etc. Look at human rights impact on other countries.

—DOD reviews 1/3 of applications. Staffed to other agencies, such as NASA. But DDTC makes final decision.

—Congressional notifications. When required, DDTC does not notify Congress when it is not in session. This impacts the licensing timetable.

—Deemed exports under State… DDTC looks at all citizenships held.

—DDTC Venezuela sanctions not in accordance with BIS. Working on revising ITAR, but should assume in section 126.1. [Editor’s Note: Hmmm, compliance by assumption. Assume the ITAR means things it doesn’t say. I guess this is nothing new. —JB]

—DDTC processed 70K applications in FY 2006. Greg Suchan noted 10,000 case backlog will it ever get fixed? “always hopeful”. Like filling a bathtub with drain open. Have a few new people, but are new. Take time to train. Times are decreasing.

—Punted brokering questions.

—Aircraft Parts — Does ITAR part ever lose its ITAR identity? Section 38(f) requires congressional notification to remove from USML. If aircraft part, needs to be removed from USML before migrating to commercial. Easier to use commercial components on military aircraft, rather than the reverse.

—Item on USML does not lose its character. Used QRS-11 as example. Three CJs held that QRS-11 was on USML. “Bomb in a suitcase is still a bomb, not a suitcase.” QRS-11 carve-out for stand-by instruments. Carve out for FPAs in night vision. Carve out for personal protection gear.

—Providing USML item to foreign person in US would require a license. Transfer of title can be an export. [Editor’s Note: The ITAR says transfer of tech data and aircraft, vessel or satellite to foreign person in the US is an export, but it does not say the transfer of other defense articles to foreign persons in the US is an export. —JB]

—Best not to contact licensing officers, contact Response Team. [Editor’s Note: But make sure you don’t get a wrong interpretation of the ITAR from the RT. —JB]

—Due diligence on buying and selling ITAR within US. Depends on case. Confirming registration is good. Depends on who you are selling to though.

—Voluntary disclosures — Concerned about companies that do not submit VSDs.

—Freight forwarders and export licenses — if FF can fulfill requirements of exporter under ITAR, they can apply for and obtain a license. However, if a FF can’t open the package then they can’t apply for a license.

—Whether to release licenses to a customer is the exporter’s decision.

—Example of an item that is first used for military, but not subject to ITAR. For example, an aircraft part that was first used by military while waiting for FAA certification.

—DDTC considers all citizenships when reviewing licenses. Thus, if person holds Chinese citizenship, prohibits exports of USML items to China and Chinese nationals.

—DDTC wants to get the word out. Has long-relationship with SIA, but interested in working with other organizations.

—10% increase in CJs in 2006. Total of 364. Expect companies to do their own CJs, but consult with DDTC in gray areas or where you can’t figure it out. Working with groups to develop best practices in CJs.

—DDTC has been successful on keeping aircraft parts from Iran’s military.

—President Bush has only waived sanctions on China three time. Very rare. Examples included bomb disposal equipment and chemical weapons destructions equipment.

Update Day 2: ENFORCEMENT PLENARY

Update Day 2: INTERNATIONAL PERSPECTIVES ON EXPORT CONTROLS

Update Day 2: A SYSTEMATIC APPROACH TO CLASSIFICATION

Update Day 2: FOREIGN POLICY CONTROLS AND SANCTIONS

Update Day 1: DEEMED EXPORT

Once again courtesy Doug Jacobson of International Trade Law News, here is a write-up of today’s deemed export breakout:

—Congress authorized an increased budget for deemed export compliance activities, which resulted in an increase in BIS deemed export staff from three to six.

—BIS received 840 deemed export applications in FY 2006. BIS approved most applications received and less than 1% were denied. Almost 60% of the deemed export licenses received were for PRC foreign nationals, followed by India (13%), Iran (7%), Russia and Germany (2% each) and UK (1%).

—While some applications languish, most deemed export licenses are processed in 40 days (down from 70+ days a few years ago)).

—Technology that is publicly available is classified as EAR99 and is not subject to licensing requirement in most cases (exceptions are Cuban-born nationals or prohibited uses). Take a look at the Q&As on BIS website regarding “use” technology issues. [Editor’s Note: Publicly available technology is not really classified as EAR99 and it is exportable to Cuba and Cuban nationals without a license. –JB]

—In the May 31, 2006 FR notice, BIS reaffirmed existing policy with respect to third-country nationals. The existing policy is based on most recent established citizens or permanent residence. U.S. citizens, green card holders, are not subject to deemed export licensing requirements.

—Scope of “fundamental research” also remains unchanged. Fundamental research exclusion based on technology that is ordinarily shared with scientific community. May be instances where preexisting controlled technology may be used and therefore deemed export requirements may come into play. Certain controlled fundamental research that is protected (placing a box around the research or technology), may be subject to the EAR. See the BIS advisory opinion on patents on research.

—Deemed Export Advisory Committee (DEAC). Purpose of the DEAC is to base policy on collaboration with affected communities. DEAC met for first time last Thursday. Program is only chartered for one year and is expected to make its recommendation by next Fall. Will meet several times over the next few months to get various perspectives and comments. Meeting will be published in FR in advance.

Update Day 1: CENSUS FOREIGN TRADE STATISTICS REGULATIONS

Update Day 2: OFAC

Doug Jacobson of International Trade Law News reports from today’s OFAC breakout session:

Dennis Wood, OFAC’s Assistant Director for Compliance, Outreach and Implementation, opened the program by providing some interesting quotes
from the bible, the U.K. Government and others on compliance-related issues.

—He also noted that OFAC has authority to “visit” companies and that such outreach activities will continue.

—Dennis mentioned the ABN AMRO enforcement case which led to the imposition of an $80 million penalty on the bank. In that case OFAC partnered with a number of other regulatory agencies to impose a multitude of penalties. He predicts that future fines will be increased as a result of inter-agency efforts to address compliance failures.

—After donning an OFAC jacket, Dennis turned the podium over to Hans Huber, a member of OFAC’s compliance and outreach division.

—OFAC jurisdiction is broad and applies to U.S. citizens and permanent resident aliens located anywhere in the world or any individual physically located in the U.S., such as a Chinese national located in the U.S. With respect to companies, the issue of foreign subsidiaries is often the most problematic. Such decisions are made on a case-by-case basis, but OFAC could always take action against the U.S. parent if the subsidiary is beyond the reach of U.S. jurisdiction.

—Next, Hans discussed the comprehensive sanctions on Cuba, Iran and Sudan. Hans noted that his PowerPoint slide discussing comprehensive sanctions sent someone to jail as a result of an indirect export to Iran. When OFAC conducted a search of the target company, they found a copy of Hans’ presentation which noted that Iran was a prohibited destination.

—Next, Susan Hutner of OFAC’s licensing division was introduced. She started by talking about Sudan, which changed dramatically on Friday. The Darfur Peace and Accountability Act restricts the President from lifting current sanctions and restricts OFAC from implementing certain sanctions on Southern Sudan. The new executive order issued by President Bush reimposed sanctions on the Government of Sudan. It also prohibits all transactions by U.S. persons relating to Sudan’s petroleum or petrochemical industries, including, but not limited to, oilfield services and oil or gas pipelines. The problematic issue is that transshipments through Northern Sudan are still restricted, which further complicates transactions. Continue to watch OFAC’s website for more information.

—Regarding the Palestinian Authority (PA), there are a number of general licenses that authorize certain transaction with the PA. Sanctions are not territorial, but apply to transactions with the PA (the government of West Bank and Gaza).

— Allison Cooper, Chief of OFAC’s investigation unit, discussed some compliance-related horror stories that led to enforcement actions. The common theme in each of theme will be a systemic breakdown in compliance. She also discussed some red flags, such as making sure that Iranian flag vessels are not involved in the shipment. She noted that most of the issues arose as a result of the payment for goods. Many of the enforcement actions also relate to subsidiaries of U.S companies.

—Regarding penalties and consequences, Hans noted that the proposed penalty is going to be the statutory maximum or the value of the goods. OFAC will take into account aggravating and mitigating factors.

—Regarding effective compliance strategies, the foundation to compliance is to screen the parties to the transaction. If you have a screening hit, the exporter has to do the necessary due diligence to determine if the hit is the intended target or not. For example, Hans noted that Cuba City, Wisconsin is not a prohibited destination.

— Scott Gearity, www.exportcontrolblog.com

Among the office number changes and snappy turns of a phrase like “this rule corrects a citation error in Sec. 762.1(a)(4) by revising the reference to Sec. 734.2(b)(7) to read Sec.  736.2(b)(7),” there is a mention of the office Commerce continues to insist on calling the “ENC Encryption Request Coordinator.” Elsewhere in the rule BIS refers to this mysterious place as “that organization.”

Now, you know, I know, and the American people know that the National Security Agency exists.  It’s not a secret any more.  They have a website.  Nor is it classified that NSA plays a vital role in formulating US export controls on encryption.  Former BIS undersecretary Bill Reinsch noted it all the way back in 1998.  Brian Nilsson mentioned discussions with NSA at a Regulations and Procedures Technical Advisory Committee (RPTAC) meeting in 2001.  Peter Lichtenbaum thanked Norm Lacroix for working with them just last year.  In December, BIS even spilled the beans by pointing out in the last encryption reg that the ENC Encryption Request Coordinator has a @nsa.gov email address.  So what’s with the pseudonym?

Not mentioned by BIS is that NSA is no longer accepting documents via fax.  Their old number (301) 688-8183 is no longer in service and no one seems to be distributing the new one.

INTRODUCTION

US rules on the export of encryption technology have been changing on the average of every 8 months, beginning in December of 1996. The only constant has been that the rules have been overwhelmingly confusing and ambiguous. The latest go-round of changes happed on June 6, 2002.  (Please note that the export regulations governing the export of encryption technology consist of general rules and myriad exceptions to these rules. Therefore, the following should be viewed as an overview and your particular situation should be analyzed with reference to the actual regulation. Such exotica as source code, beta-test software, open cryptographic application programming interfaces, etc, are beyond the scope of this article.

LEGAL AUTHORITY

The US has the legal authority to control the export of encryption technology under the Export Administration Act . The regulations that implement this law are called the Export Administration Regulations (“EAR”). You can view the regs on-line at http://www.bis.doc.gov. If you are primarily interested in crypto exports you will want to look at section 740.17. This section will reference other sections, but the bulk of the specific rules regarding encryption will be here.

PLAYERS

The Bureau of Export Administration (BIS) is the primary agency you need to deal with if you want to get export approval for your encryption products. However, the National Security Agency is heavily involved in the process, so you will often need to deal with them.

CLASSIFYING YOUR ENCRYPTION PRODUCTS

ECCNs 5A992, 5D992 and 5E992

Certain products that use encryption technology for limited functions fall under 5A992 (hardware) or 5D992 (software). These products are generally of the following nature:

–Authentication

–Access Control Systems

–Digital Signature

–Some Smart Cards

–Some cell phones and components

Other products also fall within these two ECCNs namely:

–Products that use 56-bit DES or comparable algorithm and key exchange under 512

–Products that use 64-bit symmetric algorithms for data confidentiality and are “mass market”

–Products that use symmetric algorithms of any key length for data confidentiality and are “mass-market.”

ECCNs 5A002, 5B002, 5D002

If your product uses encryption and is not covered by the above-mentioned categories, then it is likely caught by 5A002 (hardware), 5B002 (test and production equipment) and 5D002 (software). Technology to make items covered by 5A002, 5B002 or 5D002 is covered by 5E002. Products covered by these ECCNs may be exported in many cases using License Exception ENC. Exports not allowed under ENC need an individual license or Encryption Licensing Arrangement.

EXPORTING ITEMS CLASSIFIED AS 5A992, 5D992 or 5E992

If you make a product that uses encryption (regardless of key length) for limited functions like user authentication, access control, digital signature, or banking you can “self-classify” and ship under No License Required (NLR.)

For products using symmetric algorithms with 64-bit key lengths or less or asymmetric algorithms of 512 bits or less, a simple notification to BIS and NSA is all that is needed to be able to ship under NLR.

If you think you qualify for the exemption for strong crypto “mass market” products, you must file a “review request” to see if BIS agrees with you. The definition of mass market is taken from the Cryptography Note of the regulations:

a. Generally available to the public by being sold, without restriction, from stock at retail selling points by means of any of the following:

1. Over-the-counter transactions;

2. Mail order transactions;

3. Electronic transactions; or

4. Telephone call transactions;

b. The cryptographic functionality cannot be easily changed by the user; and

c. Designed for installation by the user without further substantial support by the supplier.

BIS and NSA have stated that they are going to be “strict” when considering requests to classify strong encryption products as “mass market.” Specifically, they want proof that the product is sold in a computer store like CompUSA.

For all software, hardware and technology controlled by 5A992, 5D992 and 5E992 you can export to all countries except the terrorist countries, to all end-users except the bad guys under NLR and no reporting is required.

EXPORTING ITEMS CLASSIFIED AS 5A002, 5B002, 5D002 and 5E002

License Exception ENC is the authority that allows you to export most encryption products covered by ECCNs 5A002, 5B002, 5D002 and 5E002. However, before you can use this license exception, you usually need to submit a Commodity Classification request to the BIS/NSA. (If your shipments are confined to subsidiaries of US companies you don’t have to go through this step.) You also have to keep records of who you ship to because you need to report to BIS and NSA who you ship to every six months.  You can export products to any end-user under ENC in the following countries immediately upon filing a Commodity Classification Request.

Austria, Australia, Belgium, Czech Republic, Denmark, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Luxembourg, Netherlands, New Zealand, Norway, Poland, Portugal, Spain, Sweden, Switzerland, United Kingdom

If your product uses strong encryption but you want to sell outside these countries, you need to wait 30 days before shipping and you cannot ship to “government end-users” unless your product qualifies as a “retail” product. If it qualifies as a “retail product” it can go to any end-user in any country other than the bad countries under ENC. If it is not a “retail product” it can only go to non-government end-users under ENC. You will be informed when your Commodity Classification is complete if your product qualifies as retail.

Retail vs. Non-Retail

The concept of “retail” is similar to the concept of “mass-market” discussed previously. “Retail” products generally available to the public by being

(1) sold through retail outlets,

(2) specially designed for individual consumer use, OR

(3) which are or will be sold in large volume without restrictions through mail order, electronic or telephone sales.

However, these “retail” products CANNOT:

(a) allow the cryptographic functionality to be easily changed by the user,

(b) require substantial support to install and use

(c) be modified or customized for the customer and

(d) be designed to be used as network infrastructure products.

Examples of “retail” products are general purpose operating systems that don’t qualify as “mass-market”, chips designed for retail products, low end routers, firewalls and VPNs designed for the SOHO market, desktop applications that do not qualify as “mass-market”, low end servers and application specific servers, network and security management products designed for low end computers and products which contain short range wireless encryption software/components.

RECORDKEEPING

You need to keep records of whom you provide encryption products (i.e., controlled under ECCNs 5A002, 5B002, 5D002 or 5E002) to under license exception ENC. The reason why you need to do this is because you will need to send a report to the Bureau Industry and Security and the National Security Agency twice a year. (See Reporting section below.)

REPORTING

You are required to send in reports to the BIS and the NSA that contains information on who you ship to, and what kind of technical review the product has undergone. This is only necessary for products that are shipped under license exception ENC. Reports are required for shipments under ENC, EXCEPT in the following instances:

1. You are shipping to a subsidiary of a U.S. company

2. You are shipping to a US bank or financial institution or anyone that does business with them.

3. You are shipping weak crypto products (e.g., under 64-bits).

4. You are shipping a “retail” product to an individual consumer.

5. You are making the software available via free or anonymous download.

6. You are shipping single processor computers, laptops and hand-held devices that are pre-loaded or bundled with encryption software.

The reports are due according to the following schedule:

–For shipments made between January 1st and June 30th, the report is due on August 1st.

–For shipments made between July 1st and December 31st, the report is due on February 1st.

You need to prepare the report in an electronic format and send via e-mail or load onto disk and send to the mailing addresses below:

e-mail addresses:

crypt@bis.doc.gov

enc@ncsc.mil

OR

mailing addresses:

Bureau of Industry and Security

US Department of Commerce

Office of Strategic Trade and Foreign Policy Controls

14th Street and Pennsylvania Avenues

Room 2705

Washington, D.C. 20230

Attn: Encryption Reports

ENC Encryption Request Coordinator

9800 Savage Road

Suite 6131

Ft. Meade, MD 20755-6000

The report should identify:

–Company name and address,

–Contact person and contact information,

–Reporting period

–And for each product the report should include:

–Product name and license or CCATS number for the product

–Ship-to-parties name and addresses, and the quantities and dates of shipment for each

by Felice Laird, Export Strategies