U. S. Bureau of Industry and Security - Encryption - Changes to Mass Market Provisions

Home >Policies and Regulations >Encryption > Changes to Mass Market Provisions

Changes to Mass Market Provisions

Under this encryption rule, mass market encryption commodities and software remain subject to the EAR; however, almost all mass market items may now be exported immediately without a 30 day wait under 742.15(b) of the EAR. Lower strength mass market items continue to be self-classifiable without registration; however, this rule is amended so that the limiting key lengths are now specified for asymmetric and elliptic curve algorithms.

Higher strength mass market items required encryption review prior to export under the former rule. This rule removes the review requirement for most such higher strength items and renames the review requirement as a classification requirement. Exporters are required to register with BIS before exporting encryption items under 742.15(b).

Mass market encryption items not identified by paragraph (b)(3) of 742.15 are immediately exportable paragraph (b)(1) after submission of an encryption registration or after confirming that the manufacturer-producer has submitted an encryption registration. Section 742.15(b) does not authorize export or reexport to, or provision of any service in any country listed in Country Group E:1 in Supplement No. 1 to part 740 of the EAR.

Lower strength mass market items: Mass market commodities and software with symmetric key lengths less than or equal to 64 bits for symmetric algorithms, or if there are no symmetric algorithms then 768 bits for asymmetric algorithms or 128 bits for elliptic curve algorithms, are not controlled under 5A002 or 5D002 and may be self-classified as 5A992 or 5D992. Such mass market hardware and software, as well as mass market items with short range wireless functionality described by Section 742.15(b)(4), may be exported and reexported under the symbol NLR (No License Required) without mass market classification request, encryption registration and self-classification reporting requirements.

Higher strength mass market items not identified in Section 742.15(b)(3): Mass market commodities and software, except certain mass market items identified in Section 742.15(b)(3), with key lengths greater than or equal to 64 bits for symmetric algorithms, or, if no symmetric algorithms, then 768 bits for asymmetric algorithms, or 128 bits for elliptic curve algorithms no longer require an encryption review prior to export or reexport. This rule amends Section 742.15(b) of the EAR by establishing a new procedure for encryption registration and annual self-classification reports for most mass market items. Paragraph 742.15(b)(1)has been revised to accommodate the new registration procedure and to authorize exports and reexports of less sensitive mass market encryption items following an encryption registration with subsequent submission of an annual self-classification report. Such mass market items are classified as 5A002 or 5D002 but may be self-classified as 5A992 or 5D992 after encryption registration under the symbol NLR (No License Required). They may be exported or reexported immediately after an encryption registration has been filed by the producer or exporter under the symbol NLR (No License Required). The producer or exporter of such items must file an annual self-classification report identifying the items that have been exported.
Higher strength mass market items identified in Section 742.15(b)(3): Mass market commodities and software identified in Section 742.15(b)(3) including mass market encryption components (chips, electronic assemblies, crypto libraries), toolkits, development kits, and non-standard crypto items, require classification by BIS prior to export or reexport. These classification requests are similar to the previously required encryption reviews. Thirty days after these classification requests have been submitted with all required documentation, and after an encryption registration has been filed by the producer or exporter, the items identified by Section 742.15(b)(3) may be exported or reexported.

Other mass market encryption items: Exports of items described under section 742.15(b)(4) will continue to be authorized without registration or classification request; however, this rule makes it clear that section 742.15(b)(4) does not apply to any short range wireless commodities or software that would still be classified under an ECCN in Category 5 even if the short-range wireless encryption functionality were removed.

Section 742.15(b)	Old	New
(b)(1)	Procedures for requesting mass market review.	Mass market items in the old (b) are now under the new (b)(1) except for items identified by the new (b)(3)
(b)(2)	Mass market provisions	Removed and reserved.
(b)(3)	Mass market commodities and software specifically identified including short-range wireless items (now (b)(4)), wireless PAN (now self-classifiable under related control notes) and ancillary (now Note 4).	Specified commodities, software and components requiring classification prior to export. Mass market encryption components (chips, electronic assemblies, crypto libraries), toolkits, development kits, and non-standard crypto items Includes authorization for immediate exports and reexports to Supplement No. 3 countries.
(b)(4)	Commodities or software that activate or enable cryptography (now under (b)(3))	Short range wireless items excluded from review requirements previously under paragraph (b)(3). Export from abroad of foreign products developed with U.S. origin components

Exporters who have received completed encryption commodity classification determinations prior to publication of this rule do not need to resubmit their items for a new determination. They are covered by the grandfather provision set forth in paragraph 742.15(d).