What items require an encryption classification?
What items require an encryption classification?
Items described in License Exception ENC - 740.17(b)(2) and (b)(3), and items described in the Mass Market provision - 742.15(b)(3), require submission of an encryption classification request to BIS before export.
License Exception ENC
The following descriptions of items still require an encryption classification request under License Exception ENC:
Items described in 740.17(b)(2) include:
- Network infrastructure commodities, software, and components as described in 740.17(b)(2)(i)(A)
- Encryption source code that would not be eligible for export or reexport under License Exception TSU because it is not publicly available as that term is used in 740.13(e)(1) of the EAR
- Commodities, software, and components that have been designed, modified, adapted or customized for “government end-user(s)”
- Commodities, software, and components with cryptographic functionality that has been modified or customized to customer specification
- Commodities, software, and components with cryptographic functionality or “encryption component” that is user-accessible and can be easily changed by the user
- Commodities and software for quantum cryptography
- Commodities and software that have been modified or customized for computers classified under ECCN 4A003
- Commodities and software that provide penetration capabilities that are capable of attacking, denying, disrupting or otherwise impairing the use of cyber infrastructure or networks;
- Public safety / first responder radio (P25 or TETRA)
- cryptanalytic items
- “Cryptographic items"
- "Open Cryptographic Interface" items
- Encryption technology classified under ECCN 5E002
After an encryption classification submission has been made via SNAP-R and subject to the reporting requirements in paragraph 740.17(e), all items under 740.17(b)(2), except cryptanalytic items, may be immediately exported to countries listed in Supplement No. 3 to Part 740.
There is a 30-day wait while the encryption classification is pending before exports of (b)(2) items may be made outside of the countries listed in Supplement No. 3 to Part 740.
A license will be required for exports to “government end user(s)” outside the countries listed in Supplement No. 3 to Part 740.
In addition:
- Cryptanalytic items require a license for export to any “government end user” anywhere except Canada.
- “Non-standard” technology (5E002), cryptanalytic technology (5E002), and open cryptographic interface items may be exported only to end users located or headquartered in Supplement 3 countries using License Exception ENC.
- Other 5E002 technology may be exported after review to any non-"government
end-user" not located in a country listed in
Country Group D:1 or E:1.
Items described in 740.17(b)(3) include:
- Chips, chipsets, electronic assemblies and field programmable logic devices;
- Cryptographic libraries, modules, development kits and toolkits, including for operating systems and cryptographic service providers (CSPs);
- Application-specific hardware or software development kits implementing cryptography.
- Items that provide or perform “non-standard cryptography”
- Items that provide or perform vulnerability analysis, network forensics, or computer forensics as described in 740.17(b)(3)(iii) (these items are subject to the reporting requirements in paragraph 740.17(e))
After an encryption classification submission has been made via SNAP-R, and subject to the reporting requirements in paragraph 740.17(e), all items under 740.17(b)(3), except cryptanalytic items, may be immediately exported to countries listed in Supplement No. 3 to Part 740.
There is a 30 day wait while the encryption classification is pending before exports of (b)(3) items may be made outside of the countries listed in Supplement No. 3 to Part 740.
Mass Market
The following descriptions of items still require a mass market encryption classification request under the Encryption Mass Market provision:
Items described in 742.15(b)(3) include commodities and software that meet Note 3 to Category 5, Part 2 and are:
- Chips, chipsets, electronic assemblies and field programmable logic devices;
- Cryptographic libraries, modules, development kits and toolkits, including for operating systems and cryptographic service providers (CSPs);
- Application-specific hardware or software development kits implementing cryptography.
- Mass market encryption commodities, software and components that provide or perform “non-standard cryptography” as defined in Part 772 of the EAR.
Once a mass market classification request is accepted in SNAP-R, you may export and reexport the encryption commodity or software under License Exception ENC as ECCN 5A002 or 5D002, whichever is applicable, to any end-user located or headquartered in a country listed in Supplement No. 3 to Part 740 as authorized by 740.17(b) of the EAR, while the mass market classification request is pending review with BIS.
Thirty-days (30-days) after the submission of a classification request to BIS, Section 742.15(b)(3) authorizes exports and reexports of the mass market items submitted for classification, using the symbol “NLR”, provided the items qualify for mass market treatment and are classified by BIS under ECCNs 5A992 or 5D992.
| | | | | | |
