United States: Encryption Regulations 65 Fed. Reg. 62, 600 (Oct. 19, 2000)

The United States maintains a comprehensive system of export controls over hardware, software and technology pursuant to various laws. Exports of civilian and "dual use" (not principally for military use) items must comply with the Export Administration Act of 1979, as amended, and Export Administration Regulations thereunder, which are administered by the Bureau of Export Administration, U.S. Department of Commerce. U.S. export control requirements have been steadily relaxed during the past decade as the U.S. perspective of the geopolitical situation has changed from a U.S. vs. USSR cold war (sometimes referred to by U.S. export control policymakers as an "East-West" conflict) to a U.S. vs. terrorist countries (sometimes referred to as a "North-South" conflict). Although the U.S. continues to impose specific controls on the export of most encryption items, these controls were substantially relaxed in regulatory amendments issued in January and October, 2000. The following powerpoint presentation highlights the U.S. encryption control regulations currently in effect with a focus on the practical business needs of our Silicon Valley clients.

• Bureau of Export Administration (Department of Commerce)
• Office of Defense Trade Controls (Department of State)
• Office of Foreign Assets Control (Department of the Treasury)

• Physical Shipment
• Electronic/Internet Transfer
• "Deemed Export"
• Technology
• Source Code

1. Destinations
2. End-Uses
3. End-Users

• Function
• Authentication
• Digital Signature
• Data Compression
• Geographic
• Canada

Grandfathering

• Previously Reviewed and Authorized
• Classification and License Exception ENC
• Encryption Licensing Arrangement
• Export License
• Exception
• U.S. Subsidiaries

• Prerequisite - Prior Authorization
• Pre-Export Corporate Certification to BXA
• No Further Review

Austria, Australia ,Belgium, Czech Republic, Denmark, Finland, France, Germany, Greece Hungary, Ireland, Italy, Japan, Luxembourg, Netherlands, New Zealand, Norway, Poland, Portugal, Spain, Sweden, Switzerland and United Kingdom

• ENC Country Group
• Other Countries
• Exception: "Retail" Items

• Generally Available to Public
• Easy to Install and Use
• Hard to Change Crypto Functionality
• Examples
• Non-Programmable Encryption Chips
• Client-Server Applications, e.g., SSL-Based

• "Decontrolled" to 5A992/5D992/5E992
• Self-Classification Authorized
• Notification Requirement
• Ceilings n56-Bits Encryption Algorithm
• 512-bits Asymmetric Key Exchange Algorithm

• License Exception "ENC"
• Encryption Licensing Arrangement "ELA"
• Export License

• Hardware and Software
• No Limit on Key Length
• "Retail" Products

• "Open Cryptographic Interface" - Allows Easy Insertion of Crypto Function
• Eligible for License Exception ENC to End-Users in "ENC Country Group"

• General Rule - License Required
• Exceptions
• ENC Country Group
• U.S. Foreign Subsidiaries

Application Procedures

• No Review for U.S. Foreign Subsidiaries
• Classification and ENC Authorization Request
• ENC Country Group - Immediate
• Other Countries - 30-Day Rule

Reporting Requirements

• Semi-Annually
• Aug. 1
• Feb. 1
• BXA - Email (crypt@bxa.doc.gov)
• NSA - Regular Mail
• Identification of
• Quantity Shipped

• Foreign Government End-Users or Otherwise Ineligible for "ENC"
• Application Procedure
• Post-Export Reporting

• Technical Assistance by "U.S. Persons" - Non- ENC Country
• "Crypto With a Hole" - Non-ENC Country
• Ineligible for "ENC" or "ELA"

The U.S. encryption export controls highlighted in the above presentation are complex. These controls are based on the "capability" as distinguished from the intended "use" of the cryptographic item. However, the requisite compliance effort generally is not difficult or costly, and the Bureau of Export Administration can be quite helpful.