Encryption Policy

On June 6, 2002, the Bureau of Industry and Security (BIS) published a rule (view text version) amending the Export Administration Regulations (EAR) to reflect changes made to the Wassenaar Arrangement List of dual-use items and to update and clarify other provisions of the EAR pertaining to encryption export controls.

Mass market encryption commodities and software with symmetric key lengths exceeding 64 bits that are classified under Export Control Classification Numbers (ECCNs) 5A992 and 5D992 may be exported and reexported No License Required (NLR), following a 30-day review by the Bureau of Industry and Security (BIS). This rule updates Category 5 -- part II (Information Security) of the Commerce Control List (CCL), and will also allow equipment controlled under ECCN 5B002 to be exported and reexported under License Exception ENC.

The fact sheet summarizes the major policy changes that were implemented on June 6, 2002.

The current policy changes are in response to the Wassenaar agreements established in December of 2000, advances in technology and the need to give U.S. industry better access to these global markets, while continuing to ensure essential protections for national security.

Export Administration Regulations (EAR)

The Government Printing Office (GPO) provides online access to the EAR (15 C.F.R. Parts 730-774), including the sections specific to the export of encryption items.

06/06/02 Regulations - implementing the Administration's encryption policy which clarifies many existing EAR policies on encryption, expands ENC to include 5B002 and expands NLR to include >64 bit "mass market" end products after a 30 day BIS review.

10/19/00 Regulation - implements the Administration's encryption policy announced July 17, 2000; mainly affects exports to the European Union and additional trading partners.

1/14/00 Regulation - implements the White House's update to encryption policy announced on September 16, 1999; mainly broadens the use of License Exception ENC.

12/31/98 Regulation - implements the Vice President's update to encryption export policy announced on September 16, 1998; mainly affects exports to certain sectors.

9/22/98 Regulation - makes certain changes to encryption export rules relating to banks and financial institutions and finance specific products.

12/30/96 Regulation - transfers jurisdiction over export controls on commercial encryption from the State Department to the Commerce Department.