This Guidance does not create any privileges, benefits, or rights, substantive or procedural, enforceable by any individual, organization, party, or witness in any administrative, civil, or criminal matter.



1. What changes were made to the Wassenaar Arrangement list in 2017 for intrusion software and why were they made?

Based on the extensive public feedback on the May 2015 rule (80 FR 28853) that BIS proposed, the U.S. went back to Wassenaar in 2016 and 2017 to negotiate changes to the text in order to minimize the negative impacts the entries would have. The changes that were published are the result of those negotiations.

There are two changes that were made to the text. First, Notes were added to the entry for the “technology” for the “development” of “intrusion software”. The note clarifies that technology exchanged for vulnerability disclosure or cyber incident response purposes (as defined) are not controlled.

The second change is a Note added to the 4.D.4 control on the command and delivery platform for “intrusion software”. The note clarifies that software that provides software updates or upgrades are not controlled by the entry, as long as the software is not designed to update “intrusion software” or command and delivery platforms, or turn something into “intrusion software” or a command and delivery platform.


2. Does BIS believe these changes address all of the concerns that have been raised with these entries?

No. These are the changes that we have been able to get agreement on, at this time, with other Wassenaar Arrangement members and do not address all of the concerns raised. BIS considers these changes to be the first step in addressing the concerns.

3. Does the publication of these changes now mean that the U.S. is controlling these items? Do I need to start applying for export licenses?

No. The text that was published was the text that was agreed to by the Wassenaar Arrangement. In order for it to become law in the U.S. the U.S. government would need to publish a rule implementing these changes. Because no rule has been published yet, there are no new controls on these entries at this time.

4. What’s next?

We have not decided on a next step yet. There are a range of possible actions we could take, including returning to Wassenaar in 2018 to negotiate further changes to the text, publishing a rule to implement the text, or publishing a notice of inquiry or proposed rule for further comment.


© BIS 2020