As currently written, items described by Note 4 are NOT classified in Cat. 5, Part 2.  Rather, they may be classified elsewhere on the Commerce Control List or EAR99.  Note 4 says that Cat. 5, Part 2 does NOT apply to items whose primary function is NOT “information security”, computing, communications and networking. Stated positively, this generally means that Cat. 5, Part 2 controls items whose primary function is “information security”, computing, communications and networking, when they use cryptography.  Below are some examples of items that are meant to remain under Cat. 5, Part 2, followed by examples on how to make a Note 4 analysis, and then examples of items that are excluded from Category 5 Part 2 by Note 4.

Note 4 also requires that the cryptographic functionality is limited to supporting the primary function(s).

                                                                      Examples of Note 4 Analysis
Example 1: The vending machine

•    In this example a vending machine can send encrypted communications in order to report that it has run out of soda. The main purpose of this item is to sell drinks, and the cryptographic functionality is there purely to enable it to fulfill this main purpose more efficiently. Such an item would be considered outside of Cat. 5, Part 2 per Note 4.
•    In this case the primary function is the obvious or main purpose of the item. It can also be thought of as the function which is not there to support other functions.
•    In this analysis you would look at the main purpose that the vending machine would be used for. The vending machine is not mainly for “information security, computing, communications, or storing information; and/or networking; and the cryptographic functionality of the item is just to support the main purpose of vending sodas, so the item would not be in Cat. 5, Part 2, per Note 4.

Example 2: The learning laptop

•    A child’s laptop that access the internet securely and only to a specified site for literacy based learning would be considered outside of Cat. 5, Part 2, per Note 4. Its primary function is specific to literacy training and would not be considered a computing item like a general purpose laptop would.  A general purpose computer that implements cryptography such as a laptop or desktop computer would be in Cat. 5, Part 2 because its main function is to provide general purpose computing.
•    A general purpose laptop or desktop computer may be used in multiple applications and provides a general set of features, whereas the learning laptop is an application specific item specifically designed with a set of functions targeted to a certain end use (literacy training).

Example 3: Wireless Chip


•    Another example is a communications chip that implements cryptography for secure Wi-Fi connections within a cell phone. This item would be in Cat. 5, Part 2 because it is a general purpose communications chip.  However, a chip designed for a utility meter with features that allow it to wirelessly interface securely only with specific utility meter readers could be outside of Cat. 5, Part 2, per Note 4 because it provides specific communication between a meter and reader.


Example 4: The App


•    Yet another example could be an app on a phone used for chatting or instant messaging using text, images and video.  An app such as this would be in Cat. 5, Part 2 because it provides communications. However, an app designed for your local car shop to securely communicate between you and your mechanic about the status of your vehicle repair or maintenance would be considered outside of Cat. 5, Part 2, per Note 4. The app is using communications only in the context of vehicle repair.


Examples of items that are excluded from Cat. 5, Part 2 by Note 4

© BIS 2016