E9-24697. Encryption Simplification Rule: Final

AGENCY:

Bureau of Industry and Security, Commerce.

ACTION:

Final rule.

SUMMARY:

The Bureau of Industry and Security (BIS) published the interim final rule entitled “Encryption Simplification” on October 3, 2008 (73 FR 57495). This rule finalizes that rule, corrects errors published in the October 3, 2008 interim final rule, and resolves inconsistencies in that rule identified by the public.

DATES:

Effective Dates: This rule is effective October 15, 2009.

ADDRESSES:

Written comments on this final rule may be sent by e-mail to [e-mail]. Include “Encryption rule” in the subject line of the message. Comments may also be submitted by mail or hand delivery to Sharron Cook, Office of Exporter Services, Regulatory Policy Division, Bureau of Industry and Security, Department of Commerce, 14th St. & Pennsylvania Avenue, NW., Room 2705, Washington, DC 20230, ATTN: Encryption rule; or by fax to [phone].

FOR FURTHER INFORMATION CONTACT:

For questions of a general nature contact Sharron Cook, Office of Exporter Services, Regulatory Policy Division at [phone] or e-mail: [e-mail].

For questions of a technical nature contact: The Information Technology Division, Office of National Security and Technology Transfer Controls at 202-482-0707 or e-mail: C. Randall Pratt at [e-mail].

SUPPLEMENTARY INFORMATION:

Background

BIS published the interim final rule entitled “Encryption Simplification” on October 3, 2008 (73 FR 57495). This rule removed section 744.9 of the EAR, which set forth requirements for authorization from BIS for U.S. persons to provide technical assistance (including training) to foreign persons with the intent to aid a foreign person in the development or manufacture outside the United States of encryption commodities or software that, if of U.S.-origin, would be “EI” controlled under ECCNs 5A002 or 5D002. Section 744.9 was added to the EAR in 1996 when jurisdiction over dual-use encryption items was transferred from the Department of State to the Department of Commerce. However, other parts of the EAR that referred to section 744.9 were inadvertently not removed. Therefore, this rule removes these references in § 730.5(d), § 734.5(c), § 736.2(b)(7)(ii), and § 744.1(a)(1). In addition, other corrections are made to harmonize with revisions made in the “Encryption Simplification” rule published on October 3, 2008. Some of the revisions in this rule are the results of requests for clarification from the public on the October 3 encryption simplification rule.

Part 730

The last sentence in paragraph (d) of section 730.5 is removed, because it makes reference to technical assistance in section 744.9, which was removed by the October 3 encryption simplification rule.

Part 734

Section 734.4 is amended to revise paragraphs (b)(1) and (b)(2) in order to harmonize with the October 3 encryption simplification rule and corrections thereto. Paragraph (b)(1)(iv) is added to conform with the clarifications in this correction by making it clear that section 740.17(b)(4) is a separate authorization. Paragraph (b)(2) is revised to simply state that all items classified under ECCNs 5A992, 5D992, or 5E992 are eligible for consideration under the de minimis rules. Paragraph (c) of section 734.5 is removed because it refers to technical assistance in section 744.9, which was removed by the October 3 encryption simplification rule.

Part 736

Paragraph (b)(7)(ii) of section 736.2 is removed and reserved, because it refers to technical assistance in section 744.9, which was removed by the October 3 encryption simplification rule.

Part 738

Paragraph (a)(2)(ii)(B) of section 738.4 is amended by removing a reference to the mass market review requirements in section 742.15(b) for 5A992 and 5D992, and replacing it with an instruction that the export may be executed under the No License Required (NLR) principle unless the License Requirement section refers the reader to another section of the EAR. E.g., in ECCN 5A002 the License Requirement section not only refers the reader to the Commerce Country Chart in Supplement No. 1 of part 738, but it also refers the reader to section 742.15 of the EAR to determine license requirements.

Part 740

Section 740.17(b)(1)-(3): paragraph (b) is changed for clarity, transparency, and simplification of language authorizing export after review. Authorization language to Supplement 3 countries under the subparagraphs of (b)(1) was complex and confusing to exporters. Under the reorganization of License Exception ENC, there is no need to exclude exports to countries listed in Supplement 3 from authorization under paragraphs (b)(2) and (b)(3). Such exclusions are removed here. Once a review has been submitted, Paragraph (b)(1)(i) is intended to authorize immediate export to the Supplement 3 countries of all encryption items (except “cryptanalytic items” to “government end-users”). After the review is complete, all items except technology and Open Cryptographic Interfaces (OCIs) are authorized by paragraphs (b)(2), (b)(3), or (b)(4). As the language has been revised, four sets of authorization language will cover almost all items authorized for export and reexport. The four authorizations will be:

(a) and (b)(1)(i) technology and OCI;

(a) and (b)(2) ENC restricted commodities and software;

(a) and (b)(3) ENC unrestricted commodities and software; and

(b)(4) ENC commodities and software as described.

Prior to the implementation of this final rule, paragraph (b)(4) authorized immediate export under (b)(2) or (b)(3) for source code and key length limited items. However, with the authorization under (b)(4), it was no longer clear that (b)(2) items were not authorized for immediate export to “government end-users” outside the Supplement 3 countries. The added language implemented by this rule makes clear that this continues to be true. Products that would not be authorized for permanent export to certain “government end-users” should not be authorized for temporary export to those end-users.

This rule revises section 740.17(b)(1)(i) of the EAR to remove the phrase “(excluding source code),” because BIS has received a number of inquires from the public who are confused by this phrase appearing in this paragraph. This paragraph describes exports and reexports to government end-users and non-government end-users located in a country listed in Supplement No. 3 of section 740.17 of the EAR that are eligible for License Exception ENC once a review request is registered with BIS, including commodities and software that are pending review (under section 742.15(b)) for mass market treatment (ECCNs 5A992.c and 5D992.c). Encryption source code is not eligible for such mass market treatment. This is what the phrase “(excluding source code)” refers to. Although this phrase only refers to software that is pending review for mass market treatment (under section 742.15(b)), and thus does not pertain to any other License Exception ENC-eligible encryption source code (e.g., as described in section 740.17(b)(2)(ii)), it has nonetheless proven confusing and so is being removed.

This rule revises section 740.17(b)(4) to fix an incorrect citation and clarify concerning what is authorized by each subsection of paragraph (b)(4). Paragraph (b)(4) should contain specific authorization language like all other License Exception ENC paragraphs. The addition of the introductory sentence accomplishes this. The second sentence makes it clear that paragraph (b)(4)(ii) does not authorize subsequent export from the United States of the foreign developed products.

This rule adds text to sections 740.17(b)(4)(ii) and 742.15(b)(2) to provide clarification to the regulated community that foreign products developed with or incorporating U.S.-origin encryption source code authorized for export under License Exception TSU (section 740.13(e)) that are subject to the EAR are also excluded from review requirements and that after a mass market review request is submitted, there is no waiting period for export to certain end-users as authorized by sections 740.17(a) and 740.17(b)(1)(i), or for certain encryption items as authorized by section 740.17(b)(1)(ii).

This rule also makes slight editorial corrections to sections 740.9(c)(3), 740.13(d)(2), 740.17(b)(2)(ii) and 740.17(e)(1)(i)(C).

Part 742

The second sentence in paragraph (b)(1) of section 742.15 is revised and the fourth sentence removed to conform to the new mandatory SNAP-R procedures (published August 21, 2008, effective October 20, 2008, 73 FR 49323) for submission of review requests.

Supplement No. 6 to part 742 “Guidelines for Submitting Review Requests for Encryption Items” is amended by removing the fourth and fifth sentences of the introductory paragraph to harmonize with the new mandatory SNAP-R procedures (published August 21, 2008, effective October 20, 2008, 73 FR 49323) for submission of review requests. This rule adds text to introductory paragraph (a), which was inadvertently omitted in the October 3 rule, explaining that appropriate technical information must accompany the review request. This language was in the introductory paragraph to Supplement 6 prior to the October 3 publication. The intent was to move it to paragraph (a) where it would be more visible. Instead it was inadvertently removed. Also, paragraph (c)(6) is corrected to refer to ECC (elliptic curve cryptography), as opposed to ECCN (Export Control Classification Number).

Part 744

The fifth sentence in paragraph (a)(1) of section 744.1 of the EAR is removed, because it refers to section 744.9, which was removed by the October 3 encryption simplification rule.

Part 772

Exporters have been confused by the Nota Bene to the “personal area network” (PAN) definition. This rule deletes some of the text in that note for clarity. In one of the deleted sentences, the words “enterprise” and “long range” in the absence of a specific 30 meter range limitation could be read to include intermediate-range devices. What is authorized by section 740.17(b)(4)(iii) are certain “PAN” items with nominal operating ranges not exceeding 30 meters. This rule deletes other text where the language could also be misunderstood to describe items clearly not eligible for section 740.17(b)(4)(iii) treatment. “PAN” items are not necessarily eligible for section 740.17(b)(4)(iii). Eliminating the confusing examples should help the public understand why a “data capable wireless telephone”, for example, is not eligible for section 740.17(b)(4)(iii) self-classification.

In addition, this rule revises the Nota Bene for the term “ancillary cryptography” by making editorial clarifications, as well as adding a footnote to clarify that for the purpose of this definition, the term `transportation systems' does not include any Automatic Identification System (AIS)/Vessel Traffic Service (VTS). Secure AIS/VTS and their maritime applications are not considered “ancillary cryptography”.

Supplement No. 1 to Part 774—Commerce Control List

ECCN 5B002 is amended by adding License Exception ENC to the License Exception section to clarify that this ECCN may be considered for License Exception ENC eligibility.

ECCN 5E002 is amended by adding License Exception ENC to the License Exception section to clarify that this ECCN may be considered for License Exception ENC eligibility.

ECCN 5E992 is amended by inserting “according to the General Technology Note” into the heading to more clearly define the scope of this ECCN.

Although the Export Administration Act expired on August 20, 2001, the President, through Executive Order 13222 of August 17, 2001, 3 CFR, 2001 Comp., p. 783 (2002), as extended by the Notice of August 13, 2009 (74 Fed. Reg. 41,325 (August 14, 2009)), has continued the Export Administration Regulations in effect under the International Emergency Economic Powers Act.

Rulemaking Requirements

1. This final correction rule has been determined to be significant for purposes of Executive Order 12866.

2. Notwithstanding any other provision of law, no person is required to respond to, nor shall any person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.) (PRA), unless that collection of information displays a currently valid Office of Management and Budget (OMB) Control Number. This rule involves two collections of information subject to the PRA. One of the collections has been approved by OMB under control number 0694 0088, “Multi Purpose Application,” and carries a burden hour estimate of 58 minutes for a manual or electronic submission. The other collection has been approved by OMB under control number 0694-0104, “Commercial Encryption Items Under the Jurisdiction of the Department of Commerce,” and carries a burden hour estimate of 7 hours for a manual or electronic submission. Send comments regarding these burden estimates or any other aspect of these collections of information, including suggestions for reducing the burden, to Jasmeet Seehra, OMB Desk Officer, by e-mail at [e-mail] or by fax to [phone]; and to the Office of Administration, Bureau of Industry and Security, Department of Commerce, 14th and Pennsylvania Avenue, NW., Room 6622, Washington, DC 20230.

3. This rule does not contain policies with Federalism implications as that term is defined under Executive Order 13132.

4. The provisions of the Administrative Procedure Act (5 U.S.C. 553) requiring notice of proposed rulemaking, the opportunity for public participation, and a delay in effective date, are inapplicable because this regulation involves a military and foreign affairs function of the United States (5 U.S.C. 553(a)(1)). Further, no other law requires that a notice of proposed rulemaking and an opportunity for public comment be given for this final rule. Because a notice of proposed rulemaking and an opportunity for public comment are not required to be given for this rule under the Administrative Procedure Act or by any other law, the analytical requirements of the Regulatory Flexibility Act (5 U.S.C. 601 et seq.) are not applicable. Therefore, this correction regulation is issued in final form. Although there is no formal comment period, public comments on this regulation are welcome on a continuing basis. Comments should be submitted to Sharron Cook, Office of Exporter Services, Bureau of Industry and Security, Department of Commerce, 14th and Pennsylvania Ave., NW., Room 2705, Washington, DC 20230.

List of Subjects

15 CFR Part 730

• Administrative practice and procedure
• Advisory committees
• Exports
• Reporting and recordkeeping requirements
• Strategic and critical materials

15 CFR Part 734

• Administrative practice and procedure
• Exports
• Inventions and patents
• Research Science and technology

15 CFR Parts 738 and 772

• Exports

15 CFR Part 740

• Administrative practice and procedure
• Exports
• Reporting and recordkeeping requirements

15 CFR Part 742

• Exports
• Terrorism

15 CFR Part 744

• Exports
• Reporting and recordkeeping requirements
• Terrorism

15 CFR Part 774

• Exports
• Reporting and recordkeeping requirements

Accordingly, parts 730, 734, 738, 740, 742, 744, 772, and 774 of the Export Administration Regulations (15 CFR parts 730-774) are amended as follows:

PART 730—[AMENDED]

1. The authority citation for part 730 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 10 U.S.C. 7420; 10 U.S.C. 7430(e); 22 U.S.C. 287c; 22 U.S.C. 2151 note; 22 U.S.C. 3201 et seq.; 22 U.S.C. 6004; 30 U.S.C. 185(s), 185(u); 42 U.S.C. 2139a; 42 U.S.C. 6212; 43 U.S.C. 1354; 46 U.S.C. app. 466c; 50 U.S.C. app. 5; 22 U.S.C. 7201 et seq.; 22 U.S.C. 7210; E.O. 11912, 41 FR 15825, 3 CFR, 1976 Comp., p. 114; E.O. 12002, 42 FR 35623, 3 CFR, 1977 Comp., p. 133; E.O. 12058, 43 FR 20947, 3 CFR, 1978 Comp., p. 179; E.O. 12214, 45 FR 29783, 3 CFR, 1980 Comp., p. 256; E.O. 12851, 58 FR 33181, 3 CFR, 1993 Comp., p. 608; E.O. 12854, 58 FR 36587, 3 CFR, 1993 Comp., p. 179; E.O. 12918, 59 FR 28205, 3 CFR, 1994 Comp., p. 899; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 12947, 60 FR 5079, 3 CFR, 1995 Comp., p. 356; E.O. 12981, 60 FR 62981, 3 CFR, 1995 Comp., p. 419; E.O. 13020, 61 FR 54079, 3 CFR, 1996 Comp., p. 219; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13099, 63 FR 45167, 3 CFR, 1998 Comp., p. 208; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; E.O. 13224, 66 FR 49079, 3 CFR, 2001 Comp., p. 786; E.O. 13338, 69 FR 26751, May 13, 2004; Notice of August 13, 2009, 74 FR 41,325 (August 14, 2009); November 10, 2008, 73 FR 67097 (November 12, 2008).

§ 730.5

[Amended]

2. Section 730.5 is amended by removing the last sentence in paragraph (d).

PART 734—[AMENDED]

3. The authority citation for part 734 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 13020, 61 FR 54079, 3 CFR, 1996 Comp., p. 219; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of August 13, 2009, 74 FR 41,325 (August 14, 2009); November 10, 2008, 73 FR 67097 (November 12, 2008).

4. Section 734.4 is amended by:

a. Revising paragraphs (b)(1)(ii), and (b)(1)(iii);

b. Adding a new paragraph (b)(1)(iv); and

c. Revising paragraph (b)(2) and the note to paragraph (b) to read as follows:

§ 734.4

De Minimis U.S. Content.

* * * * *

(b) * * *

(1) * * *

(ii) Authorized for License Exception ENC by BIS after a review pursuant to § 740.17(b)(3) of the EAR;

(iii) Authorized for License Exception ENC by BIS after a review pursuant to § 740.17(b)(2), and the foreign made product will not be sent to any destination in Country Group E:1 in Supplement No. 1 to part 740 of the EAR; or

(iv) Authorized for License Exception ENC pursuant to § 740.17(b)(4).

(2) U.S. origin encryption items classified under ECCNs 5A992, 5D992, or 5E992.

Note to paragraph (b):

See supplement No. 2 to this part for de minimis calculation procedures and reporting requirements.

* * * * *

§ 734.5

[Amended]

5. Section 734.5 is amended by removing paragraph (c).

PART 738—[AMENDED]

6. The authority citation for part 738 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 10 U.S.C. 7420; 10 U.S.C. 7430(e); 22 U.S.C. 287c; 22 U.S.C. 3201 et seq.; 22 U.S.C. 6004; 30 U.S.C. 185(s), 185(u); 42 U.S.C. 2139a; 42 U.S.C. 6212; 43 U.S.C. 1354; 46 U.S.C. app. 466c; 50 U.S.C. app. 5; 22 U.S.C. 7201 et seq.; 22 U.S.C. 7210; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of August 13, 2009, 74 FR 41,325 (August 14, 2009).

7. Section 738.4 is amended by revising paragraph (a)(2)(ii)(B) to read as follows:

§ 738.4

Determining whether a license is required.

(a) * * *

(2) * * *

(ii) * * *

(B) If no, a license is not required based on the particular Reason for Control and destination. Provided that General Prohibitions Four through Ten do not apply to your proposed transaction and the License Requirement section does not refer you to any other part of the EAR to determine license requirements. For example, any applicable review requirements described in § 742.15(b) of the EAR must be met for certain mass market encryption items to effect your shipment using the symbol “NLR.” Proceed to parts 758 and 762 of the EAR for information on export clearance procedures and recordkeeping requirements. Note that although you may stop after determining a license is required based on the first Reason for Control, it is best to work through each applicable Reason for Control. A full analysis of every possible licensing requirement based on each applicable Reason for Control is required to determine the most advantageous License Exception available for your particular transaction and, if a license is required, ascertain the scope of review conducted by BIS on your license application.

* * * * *

PART 740—[AMENDED]

8. The authority citation for part 740 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 22 U.S.C. 7201 et seq.; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of August 13, 2009, 74 Fed. Reg. 41325 (August 14, 2009).

§ 740.9

[Amended]

9. Section 740.9 is amended by revising the citation “742.15(b)(2)” to read “742.15(b)” in paragraph (c)(3).

10. Section 740.13 is amended by revising the last two sentences of paragraph (d)(2) to read as follows:

§ 740.13

Technology and Software—Unrestricted (TSU).

* * * * *

(d) * * *

(2) Exclusions. * * * (Once such mass market encryption software has been reviewed by BIS and released from “EI” and “NS” controls pursuant to § 742.15(b) of the EAR, it is controlled under ECCN 5D992.c and is thus outside the scope of License Exception TSU.) See § 742.15(b) of the EAR for exports and reexports of mass market encryption products controlled under ECCN 5D992.c.

* * * * *

11. Section 740.17 is amended by:

a. Removing the phrase “(excluding source code)” from paragraph (b)(1)(i);

b. Revising paragraph (b)(1)(ii);

c. Revising the introductory paragraph to (b)(2);

d. Removing the phrase “encryption source code that is not otherwise eligible” and adding the phrase “encryption source code is not otherwise eligible” in its place in paragraph (b)(2)(ii);

e. Removing the phrase “Supplement No. 3 to this part or” in paragraph (b)(3);

f. Adding a new first sentence to paragraph (b)(4) introductory text;

g. Revising paragraph (b)(4)(ii); and

h. Adding a comma after “open cryptographic interface”, and removing the phrase “exported to a foreign developer” and adding the phrase “to a foreign developer” in its place in paragraph (e)(1)(i)(C).

The revisions and additions read as follows:

§ 740.17

Encryption Commodities, Software and Technology (ENC).

* * * * *

(b) * * *

(1) * * *

(ii) Export and reexport to countries not listed in Supplement No. 3 of this part. License Exception ENC authorizes the export and reexport of the following commodities and software (except certain exports and reexports to “government end-users” as further described in paragraph (b)(2) of this section, or any “open cryptographic interface” item):

* * * * *

(2) Review required with 30 day wait (non-“government end-users” only). Thirty (30) days after your review request is registered with BIS in accordance with paragraph (d) of this section and subject to the reporting requirements in paragraph (e) of this section, License Exception ENC authorizes the export or reexport of the following commodities and software to “government end-users” located or headquartered in a country listed in Supplement 3 to this part, and also to non-“government end-users” located in a country not listed in Country Group E:1 of Supplement No. 1 to part 740 of the EAR:

* * * * *

(4) Items excluded from review requirements. License Exception ENC authorizes the export and reexport of the commodities and software described in this paragraph (b)(4) without review (for encryption reasons) by BIS, except that paragraph (b)(4)(ii) of this section does not authorize exports from the United States of foreign products developed with or incorporating U.S.-origin encryption source code, components, or toolkits.

* * * * *

(ii) Foreign products developed with or incorporating U.S.-origin encryption source code, components, or toolkits. Foreign products developed with or incorporating U.S.-origin encryption source code, components or toolkits that are subject to the EAR, provided that the U.S.-origin encryption items have previously been reviewed and authorized by BIS (or else authorized for export under License Exception TSU upon meeting the notification requirements of section 740.13(e) of the EAR, without need for further review) and the cryptographic functionality has not been changed. Such products include foreign-developed products that are designed to operate with U.S. products through a cryptographic interface.

* * * * *

PART 742—[AMENDED]

12. The authority citation for part 742 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 22 U.S.C. 3201 et seq.; 42 U.S.C. 2139a; 22 U.S.C. 7201 et seq.; 22 U.S.C. 7210; Sec 1503, Pub. L. 108-11, 117 Stat. 559; E.O. 12058, 43 FR 20947, 3 CFR, 1978 Comp., p. 179; E.O. 12851, 58 FR 33181, 3 CFR, 1993 Comp., p. 608; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Presidential Determination 2003-23 of May 7, 2003, 68 FR 26459, May 16, 2003; Notice of August 13, 2009, 74 Fed. Reg. 41,325 (August 14, 2009); November 10, 2008, 73 FR 67097 (November 12, 2008).

13. Section 742.15 is amended by:

a. Revising the second sentence and removing the fourth sentence in paragraph (b)(1); and

b. Adding a Note in parentheses after the first sentence in paragraph (b)(2).

The revision and addition read as follows:

§ 742.15

Encryption items.

* * * * *

(b) * * *

(1) Procedures for requesting review. * * * Review requests must be submitted to BIS in accordance with §§ 748.1 and 748.3 of the EAR. See paragraph (r) of Supplement No. 2 to part 748 of the EAR for special instructions about this submission. Submissions to the ENC Encryption Request Coordinator should be directed to the mailing address indicated in § 740.17(e)(1)(ii) of the EAR. BIS will notify you if there are any questions concerning your request for review (e.g., because of missing or incompatible support documentation). * * *

(2) Action by BIS. * * * (Note that once a mass market review request is submitted, there is no waiting period for export or reexport under License Exception ENC to certain end users as authorized by §§ 740.17(a) and (b)(1)(i), or for certain items as authorized by § 740.17(b)(1)(ii), while the mass market request is pending review with BIS.) * * *

* * * * *

14. Supplement No. 6 to part 742 is amended by:

a. Revising the introductory text;

b. Adding paragraph (a) introductory text; and

c. Revising the acronym “ECCN” to read “ECC” in paragraph (c)(6).

The revision and addition read as follows:

Supplement No. 6 to Part 742—Guidelines for Submitting Review Requests for Encryption Items

Review requests for encryption items must include all of the documentation described in this supplement and be submitted to BIS in accordance with §§ 748.1 and 748.3 of the EAR. To ensure that your review request is properly routed, insert the phrase “Mass market encryption”, “License Exception ENC” or “Other Encryption” (whichever is applicable) in Block 9 (Special Purpose) of the application form and place an “X” in the box marked “Classification Request” in Block 5 (Type of Application)—Block 5 does not provide a separate item to check for the submission of encryption review requests. Failure to properly complete these items may delay consideration of your review request.

In addition, you must send a copy of your review request and all support documents to: Attn: ENC Encryption Request Coordinator, 9800 Savage Road, Suite 6940, Fort Meade, MD 20755-6000.

If you intend to rely on the 30 day registration provisions of the regulations, express mail certification of these documents is needed.

(a) For all review requests of encryption items, you must provide brochures or other documentation or specifications related to the technology, commodity or software, relevant product descriptions, architecture specifications, and as necessary for the technical review, source code. In addition, you must provide the following information in a cover letter accompanying your review request:

* * * * *

PART 744—[AMENDED]

15. The authority citation for part 744 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 22 U.S.C. 3201 et seq.; 42 U.S.C. 2139a; 22 U.S.C. 7201 et seq.; 22 U.S.C. 7210; E.O. 12058, 43 FR 20947, 3 CFR, 1978 Comp., p. 179; E.O. 12851, 58 FR 33181, 3 CFR, 1993 Comp., p. 608; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 12947, 60 FR 5079, 3 CFR, 1995 Comp., p. 356; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13099, 63 FR 45167, 3 CFR, 1998 Comp., p. 208; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; E.O. 13224, 66 FR 49079, 3 CFR, 2001 Comp., p. 786; Notice of August 13, 2009, 74 FR 41,325 (August 14, 2009); November 10, 2008, 73 FR 67097 (November 12, 2008).

§ 744.1

[Amended]

16. Section 744.1 is amended by removing the fifth sentence in paragraph (a)(1).

PART 772—[AMENDED]

17. The authority citation for part 772 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of August 13, 2009, 74 FR 41,325 (August 14, 2009).

18. In section 772.1 the definition for “ancillary cryptography” is amended by revising the Nota Bene (N.B.) and the definition for “personal area network” is amended by revising the Nota Bene to read as follows:

§ 772.1

Definitions of terms as used in the Export Administration Regulations (EAR).

* * * * *

“Ancillary cryptography”. * * *

N.B. Examples of commodities and software that perform “ancillary cryptography” are items specially designed and limited to: Piracy and theft prevention for software, music, etc.; games and gaming; household utilities and appliances; printing, reproduction, imaging and video recording or playback (but not videoconferencing); business process modeling and automation (e.g., supply chain management, inventory, scheduling and delivery); industrial, manufacturing or mechanical systems (including robotics, other factory or heavy equipment, and facilities systems controllers, such as fire alarms and HVAC); automotive, aviation and other transportation systems.^[1] Commodities and software included in this description are not limited to wireless communication and are not limited by range or key length.

* * * * *

“Personal area network”. * * *

N.B. “Personal area network” items include but are not limited to items designed to comply with the Institute of Electrical and Electronic Engineers (IEEE) 802.15.1 standard, class 2 (10 meters) and class 3 (1 meter), but not class 1 (100 meters) items. IEEE 802.15.1 class 2 and class 3 devices include hands-free headsets, wireless mice, keyboards and printers, bar code scanners and game console wireless controllers, as well as devices or software for transfer of files between devices using Object Exchange (OBEX).

* * * * *

PART 774—[AMENDED]

19. The authority citation for part 774 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 10 U.S.C. 7420; 10 U.S.C. 7430(e); 22 U.S.C. 287c, 22 U.S.C. 3201 et seq., 22 U.S.C. 6004; 30 U.S.C. 185(s), 185(u); 42 U.S.C. 2139a; 42 U.S.C. 6212; 43 U.S.C. 1354; 46 U.S.C. app. 466c; 50 U.S.C. app. 5; 22 U.S.C. 7201 et seq.; 22 U.S.C. 7210; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of August 13, 2009, 74 FR 41,325 (August 14, 2009).

20. In Supplement No. 1 to part 774 (the Commerce Control List), Category 5 Telecommunications and “Information Security”, Part 2 Information Security, Export Control Classification Number (ECCN) 5B002 is amended by revising the License Exception section to read as follows:

5B002 Information Security—test, inspection and “production” equipment.

* * * * *

License Exceptions

LVS: N/A

GBS: N/A

CIV: N/A

ENC: Yes for certain EI controlled equipment, see § 740.17 of the EAR for eligibility.

* * * * *

21. In Supplement No. 1 to part 774 (the Commerce Control List), Category 5 Telecommunications and “Information Security”, Part 2 Information Security, Export Control Classification Number (ECCN) 5E002 is amended by revising the License Exception section to read as follows:

5E002 “Technology” according to the General Technology Note for the “development”, “production” or “use” of equipment controlled by 5A002 or 5B002 or “software” controlled by 5D002.

* * * * *

License Exceptions

CIV: N/A

TSR: N/A

ENC: Yes for certain EI controlled technology, see § 740.17 of the EAR for eligibility.

* * * * *

22. In Supplement No. 1 to part 774 (the Commerce Control List), Category 5 Telecommunications and “Information Security”, Part 2 Information Security, Export Control Classification Number (ECCN) 5E992 is amended by revising the Heading to read as follows:

5E992 “Information Security” “technology” according to the General Technology Note, not controlled by 5E002.

* * * * *

Dated: October 7, 2009.

Matthew S. Borman,

Acting Assistant Secretary for the Bureau of Industry and Security.

Footnotes

1.  For the purpose of this definition, the term “transportation systems” does not include any Automatic Identification System (AIS)/Vessel Traffic Service (VTS). Secure AIS/VTS and their maritime applications are not considered “ancillary cryptography”.