03-15189. Export Administration Regulations: Encryption Clarifications and Revisions

AGENCY:

Bureau of Industry and Security, Commerce.

ACTION:

Final rule.

SUMMARY:

This rule amends the Export Administration Regulations (EAR) to clarify when encryption commodities and software may be given de minimis treatment, when short-range wireless devices incorporating encryption may be given mass market or retail treatment, and to provide guidance on when exporters are required to submit encryption review requests. It also expands the authorizations according to which travelers departing the United States may take encryption for their personal use, and clarifies that specially designed medical equipment and software are not controlled as encryption or “information security” items under the EAR. Finally this rule implements changes to the Wassenaar Arrangement List of dual-use items (agreed upon in the September 2002 meeting and finalized in December 2002) that eliminate from Export Control Classification Number (ECCN) 5A002 certain types of “Personalized smart cards” and equipment specially designed and limited to controlling access to copyright protected data.

EFFECTIVE DATE:

June 17, 2003.

FOR FURTHER INFORMATION CONTACT:

Norman LaCroix, Acting Director, Information Technology Controls Division, Office of Strategic Trade and Foreign Policy Controls, Bureau of Industry and Security, U.S. Department of Commerce at [phone].

SUPPLEMENTARY INFORMATION

 

Background

This rule amends § 734.4(b) to clarify the de minimis eligibility of encryption items controlled for National Security (“NS”) or Anti-Terrorism (“AT”) reasons under the Export Administration Regulations (EAR), subject to the applicable notification or review requirements described in § 740.13(e) and § 742.15(b). As with other encryption items no longer subject to “EI” controls (such as items classified under Export Control Classification Numbers (ECCNs) 5A992, 5D992 or 5E992), this rule clarifies that ECCN 5D002 encryption source code that would be considered publicly available under § 734.3(b)(3) of the EAR (and the corresponding object code) is eligible for de minimis treatment once exporters have complied with the applicable notification requirement that releases such ECCN 5D002 software from “EI” controls.

This rule also updates License Exception BAG and the Related Control notes to ECCN 5A002 relative to the Wassenaar Arrangement List of dual-use items, and in several sections of the EAR clarifies existing instructions related to encryption commodities and software pre-loaded onto laptops, handheld devices, computers or other equipment. This rule also adds a “checklist” on encryption and other “information security” functions to Supplement 5 to part 742 of the EAR, to help exporters more fully consider and identify controlled encryption and “information security” components within their products, when making classification decisions and assessing whether an encryption review by BIS is required.

Consistent with the standing export control agreement among Wassenaar Arrangement member nations, this rule also adds a nota bene (“NB”) immediately following Note 1 in Category 5 part II that clarifies that commodities and software specially designed for medical end-use that incorporate encryption items listed in Category 5 part II are not controlled by Category 5, part II of the Commerce Control List. This rule thus clarifies that a commodity or software product that is specially designed for medical end-use is classified as EAR99, even if the medical product incorporates another product, part or component that would otherwise be classified as 5A002, 5D002, 5A992 or 5D992.

This rule expands the scope of License Exception BAG by allowing U.S. citizens or permanent resident aliens of the United States to export encryption commodities and software for their personal use to any destination except Country Group E:1. Persons other than U.S. citizens or permanent resident aliens of the United States (except nationals of countries listed in Country Group E:1 of Supplement No. 1 to part 740 who are not U.S. citizens or permanent resident aliens of the United States) may also take such commodities and software as accompanying baggage for their personal use to any destination except Country Group E:1. This rule updates the provisions in 740.14(d) for “unaccompanied baggage” by permitting shipments of personal use encryption commodities and software subject to “EI” controls to the same destinations that are permitted for CB, MT, NS and NP controlled items.

In the Related Control notes to ECCN 5A002, the previous restriction to “one-time” copy control of copyright protected audio/video data has been removed. Likewise, as is now the case for such playback audio/video data, software that is subject to the EAR but not specified on the Commerce Control List (i.e., items that are classified as EAR99) remains classified EAR99 when copy protected. Lastly, Related Control note (a) is amended and divided into two sub-paragraphs.

Although the Export Administration Act expired on August 20, 2001, Executive Order 13222 of August 17, 2001 (66 FR 44025, August 22, 2001), as extended by the notice of August 14, 2002 (67 FR 53721, August 16, 2002), continues the Regulations in effect under the International Emergency Economic Powers Act.

Rulemaking Requirements

1. This final rule has been determined to be not significant for purposes of E.O. 12866.

2. Notwithstanding any other provision of law, no person is required to respond to, nor shall any person be subject to a penalty for failure to comply, with a collection of information subject to the requirements of the Paperwork Reduction Act, unless that collection of information displays a currently valid Office of Management and Budget Control Number. This rule involves a collection of information subject to the Paperwork Reduction Act of 1980 (44 U.S.C. 3501 et seq.). This collection has been approved by the Office of Management and Budget under control number 0694-0088, “Multi-Purpose Application,” which carries a burden hour estimate of 45 minutes for a manual submission and 40 minutes for an electronic submission.

3. This rule does not contain policies with Federalism implications as that term is defined under E.O. 13132.

4. The provisions of the Administrative Procedure Act (5 U.S.C. 553) requiring notice of proposed rulemaking, the opportunity for public participation, and a delay in effective date, are inapplicable because this regulation involves a military and foreign affairs function of the United States (5 U.S.C. 553(a)(1)). Further, no other law requires that a notice of proposed rulemaking and an opportunity for public comment be given for this interim rule. Because a notice of proposed rulemaking and an opportunity for public comment are not required to be given for this rule under the Administrative Procedure Act or by any other law, the analytical requirements of the Regulatory Flexibility Act (5 U.S.C. 601 et seq.) are not applicable. Therefore, this regulation is issued in final form. Although there is no formal comment period, public comments on this regulation and on proposals to further update the encryption provisions of the EAR are welcome on a continuing basis. Comments should be submitted to Sharron Cook, Office of Exporter Services, Bureau of Industry and Security, Department of Commerce, PO Box 273, Washington, DC 20044.

List of Subjects

15 CFR Part 734

• Administrative practice and procedure
• Exports
• Foreign trade
• Reporting and recordkeeping requirements

15 CFR Parts 740 and 748

• Administrative practice and procedure
• Advisory committees
• Exports
• Foreign trade
• Reporting and recordkeeping requirements

15 CFR Parts 742, 770, and 774

• Exports
• Foreign trade

Accordingly, parts 734, 740, 742, 748, 770, and 774 of the Export Administration Regulations (15 CFR parts 730-799) are amended as follows:

PART 734—[AMENDED]

1. The authority citation for part 734 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 13020, 61 FR 54079, 3 CFR, 1996 Comp. p. 219; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; notice of November 9, 2001, 66 FR 56965, 3 CFR, 2001 Comp., p. 917; notice of August 14, 2002, 67 FR 53721, August 16, 2002.

2. Section 734.4 is amended by revising paragraph (b) to read as follows:

§ 734.4

De minimis U.S. content.

(a) * * *

(b) There is no de minimis level for foreign-made items that incorporate U.S.-origin items controlled for “EI” reasons under ECCN 5A002, 5D002 or 5E002 on the Commerce Control List (Supplement No. 1 to part 774 the EAR). However, exporters may, as part of an encryption review request, ask that software controlled for EI reasons under ECCN 5D002 and eligible for export under the “retail” or “source code” provisions of license exception ENC, and parts and components controlled under ECCN 5A002, be made eligible for de minimis treatment. The review of de minimis eligibility will take U.S. national security interests into account. Other encryption items controlled for NS or AT reasons under ECCNs 5D002, 5A992, 5D992, and 5E992 are not eligible for de minimis treatment, unless exporters have complied with the applicable notification or review requirements described in § 740.13(e), § 742.15(b)(1), and § 742.15(b)(2) of the EAR. Encryption items controlled by ECCN 5A992, 5D992, or 5E992 and described in § 742.15(b)(3) of the EAR are not subject to these notification or review requirements.

* * * * *

PART 740—[AMENDED]

3. The authority citation for part 740 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; sec. 901-911, Pub. L. 106-387; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; notice of August 14, 2002, 67 FR 53721, August 16, 2002.

4. Section 740.9 is amended by revising paragraph (a)(2)(i) to read as follows:

§ 740.9

Temporary imports, exports, and reexports (TMP).

* * * * *

(a) * * *

(2) * * *

(i) Tools of trade. Usual and reasonable kinds and quantities of tools of trade (commodities and software) for use by the exporter or employees of the exporter in a lawful enterprise or undertaking of the exporter. Eligible tools of trade may include, but are not limited to, such equipment and software as is necessary to commission or service goods, provided that the equipment or software is appropriate for this purpose and that all goods to be commissioned or serviced are of foreign origin, or if subject to the EAR, have been legally exported or reexported. The tools of trade must remain under the effective control of the exporter or the exporter's employee (see part 772 of the EAR for a definition of “effective control”). All tools of trade may accompany the individual departing from the United States or may be shipped unaccompanied within one month before the individual's departure from the United States, or at any time after departure. No tools of the trade may be taken to Country Group E:2 (see Supplement No.1 to part 740) or Sudan. For exports under this License Exception of laptops, handheld devices and other computers and equipment loaded with encryption commodities or software, refer to item interpretation 13 in § 770.2 of the EAR.

* * * * *

5. Section 740.14 is amended by revising “items” in the last sentence of paragraph (b)(4) to read “commodities and software” and by revising paragraphs (d) and (f) to read as follows:

§ 740.14

Baggage (BAG).

* * * * *

(d) Special provision: unaccompanied baggage. Individuals departing the United States may ship unaccompanied baggage, which is baggage sent from the United States on a carrier other than that on which an individual departs. Crew members of exporting carriers may not ship unaccompanied baggage. Unaccompanied shipments under this License Exception shall be clearly marked “BAGGAGE.” Shipments of unaccompanied baggage may be made at the time of, or within a reasonable time before or after departure of the consignee or owner from the United States. Personal baggage controlled for chemical and biological weapons (CB), missile technology (MT), national security (NS), encryption items (EI) or nuclear nonproliferation (NP) must be shipped within 3 months before or after the month in which the consignee or owner departs the United States. However, commodities controlled for CB, MT, NS, EI or NP may not be exported under this License Exception as unaccompanied baggage to Country Groups D:1, D:2, D:3, D:4, or E:1. (See Supplement No. 1 of this part).

* * * * *

(f) Special provisions: encryption commodities and software subject to EI controls on the Commerce Control List. (1) A U.S. citizen or permanent resident alien of the United States as defined by 8 U.S.C. 1101(a)(20) may use this license exception to export or reexport encryption commodities and software to any destination not in Country Group E:1 of Supplement No. 1 of this part.

(2) A person other than a U.S. citizen or permanent resident alien of the United States as defined by 8 U.S.C. 1101(a)(20) (except a national of a country listed in Country Group E:1 of Supplement No. 1 of this part who is not a U.S. citizen or permanent resident alien of the United States) may also use this license exception to export or reexport encryption commodities and software to any destination not in Country Group E:1 of Supplement No. 1 of this part.

6. Section 740.17 is amended by revising paragraph (b)(3)(iii)(H) to read as follows:

§ 740.17

Encryption Commodities and Software (ENC).

* * * * *

(b) * * *

(3) * * *

(iii) * * *

(H) Short-range wireless components and software that do not qualify as mass market. Commodities and software that would not otherwise be controlled under Category 5 (telecommunications and “information security”) of the Commerce Control List, but which are controlled under ECCN 5A002 or 5D002 only because they incorporate components or software that provide short-range wireless encryption functions (e.g., with an operating range typically not exceeding 100 meters), may be exported or reexported under the retail provisions of License Exception ENC, without review or reporting.

* * * * *

PART 742—[AMENDED]

7. The authority citation for part 742 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 18 U.S.C. 2510 et seq.; 22 U.S.C. 3201 et seq.; 42 U.S.C. 2139a; sec. 901-911, Pub. L. 106-387; sec. 221, Pub. L. 107-56; E.O. 12058, 43 FR 20947, 3 CFR, 1978 Comp., p. 179; E.O. 12851, 58 FR 33181, 3 CFR, 1993 Comp., p. 608; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; notice of November 9, 2001, 66 FR 56965, 3 CFR, 2001 Comp., p. 917; notice of August 14, 2002, 67 FR 53721, August 16, 2002.

8. Section 742.15 is amended by revising the first two sentences of paragraph (b) (1), and revising paragraph (b)(3)(ii) to read as follows:

§ 742.15

Encryption items.

* * * * *

(b) * * *

(1) Notification requirement for specified encryption items. You may export or reexport encryption items controlled under ECCN 5A992, 5D992 or 5E992 and identified in paragraphs (b)(1)(i) and (b)(1)(ii) of this section to most destinations without a license (NLR: No License Required), provided that you have submitted to BIS, by the time of export, the information described in paragraphs (a) through (e) of Supplement No. 6 of this part. For notifications submitted under paragraph (b)(1)(i) of this section, you must also provide specific information describing how your products qualify for mass market treatment under the criteria in the Cryptography Note (Note 3) of Category 5, Part 2, of the Commerce Control List (Supplement No. 1 to part 774 of the EAR). * * *

* * * * *

(3) * * *

(ii) Mass market short-range wireless commodities or software. Mass market commodities or software that would not otherwise be controlled under Category 5 (telecommunications and “information security”) of the Commerce Control List, but which are controlled under ECCN 5A992 or 5D992 only because they incorporate components or software that provide short-range wireless encryption functions (e.g., wireless products with an operating range typically not exceeding 100 meters).

* * * * *

9. Part 742 is amended by adding a new Supplement No. 5 to read as follows:

SUPPLEMENT NO. 5 TO PART 742—CHECKLIST ON ENCRYPTION AND OTHER “INFORMATION SECURITY” FUNCTIONS

1. Does your product perform “cryptography”, or otherwise contain any parts or components that are capable of performing any of the following “information security” functions? (Mark with an “X” all that apply)

a. __ encryption

b. __ decryption only (no encryption)

c. __ key management/public key infrastructure (PKI)

d. __ authentication (e.g., password protection, digital signatures)

e. __ copy protection

f. __ anti-virus protection

g. __ other (please

explain) :__________

h. __ NONE/NOT APPLICABLE

2. For items with encryption, decryption and/or key management functions (1.a, 1.b, 1.c above):

a. What symmetric algorithms and key lengths (e.g., 56-bit DES, 112/168-bit Triple-DES, 128/256-bit AES/Rijndael) are implemented or supported?

b. What asymmetric algorithms and key lengths (e.g., 512-bit RSA/Diffie-Hellman, 1024/2048-bit RSA/Diffie-Hellman) are implemented or supported?

c. What encryption protocols (e.g., SSL, SSH, IPSEC or PKCS standards) are implemented or supported?

d. What type of data is encrypted?

3. For products that contain an “encryption component”, can this encryption component be easily used by another product, or else accessed/re-transferred by the end-user for cryptographic use?

PART 748—[AMENDED]

10. The authority citation for part 748 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; notice of August 14, 2002, 67 FR 53721, August 16, 2002.

11. Section 748.3 is amended by adding a sentence to the end of paragraph (a), and revising (d) to read as follows:

§ 748.3

Classification requests, advisory opinions, and encryption review requests.

(a) Introduction. * * * A review of the questions provided in Supplement No. 5 to part 742 of the EAR may assist in determining whether you must submit an encryption review request (see paragraph (d) of this section) for your particular item.

* * * * *

(d) Review requests for encryption items. A Department of Commerce review of encryption items transferred from the U.S. Munitions List consistent with Executive Order 13026 of November 15, 1996 (3 CFR, 1996 Comp., p. 228) and pursuant to the Presidential Memorandum of that date may be required to determine eligibility under License Exception ENC or for release from “EI” controls. Refer to Supplement No. 5 to part 742 of the EAR for questions that provide initial guidance in determining whether you must submit an encryption review request for your item. Refer to Supplement No. 6 to part 742 of the EAR for a complete list of technical information that is required for encryption review requests. Refer also to § 742.15(b) of the EAR for instructions regarding mass market encryption commodities and software. Refer to § 740.17 of the EAR for the provisions of License Exception ENC.

12. Part 748, Supplement No. 1 is amended by revising the paragraph labeled “Block 5” to read as follows:

SUPPLEMENT NO. 1 TO PART 748-BIS-748P, BIS-748P-A; ITEM APPENDIX, AND BIS-748P-B; END USER APPENDIX; MULTIPURPOSE APPLICATION INSTRUCTIONS

* * * * *

Block 5: Type of Application. Export. If the items are located within the United States, and you wish to export those items, mark the Box labeled “Export” with an (X). Reexport. If the items are located outside the United States, mark the Box labeled “Reexport” with an (X). Classification. If you are requesting BIS to classify your item against the Commerce Control List (CCL), mark the Box labeled “Classification Request” with an (X). Encryption Review. If you are requesting encryption review under License Exception ENC (§ 740.17 of the EAR) or “mass market” encryption provisions (§ 742.15(b)(2) of the EAR), mark the Box labeled “Classification Request” with an (X). Special Comprehensive License. If you are submitting a Special Comprehensive License application in accordance with the procedures described in part 752 of the EAR, mark the Box labeled “Special Comprehensive License” with an (X).

* * * * *

13. Part 748, Supplement No. 2 is amended by adding a new paragraph (r) immediately following paragraph (q) and reading as follows:

SUPPLEMENT NO. 2 TO PART 748—UNIQUE LICENSE APPLICATION REQUIREMENTS

* * * * *

(r) Encryption review requests. Enter, in Block 9 (Special Purpose) of the BIS-748P, “License Exception ENC” if you are submitting an encryption review request for License Exception ENC (§ 740.17 of the EAR) or “mass market encryption” if you are submitting an encryption review request under the mass market encryption provisions (§ 742.15(b)(2) of the EAR). If you seek an encryption review for another reason, enter “encryption—other”.

PART 770—[AMENDED]

14. The authority citation for part 770 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; notice of August 14, 2002, 67 FR 53721, August 16, 2002.

15. Section 770.2 is amended by revising paragraph (m) to read as follows:

§ 770.2

Item interpretations.

* * * * *

(m) Interpretation 13: Encryption commodities and software controlled for EI reasons. Encryption commodities and software controlled for EI reasons under ECCNs 5A002 and 5D002 may be pre-loaded on a laptop, handheld device or other computer or equipment and exported under the tools of trade provision of License Exception TMP or the personal use exemption under License Exception BAG, subject to the terms and conditions of such License Exceptions. This provision replaces the personal use exemption of the International Traffic and Arms Regulations (ITAR) that existed for such software prior to December 30, 1996. Neither License Exception TMP nor License Exception BAG contains a reporting requirement. Like other “information security” “software”, components, “electronic assemblies” or modules, the control status of encryption commodities and software is determined in Category 5, part 2 even if they are bundled, commingled or incorporated in a computer or other equipment. However, commodities and software specially designed for medical end-use that incorporate an item in Category 5, part 2 are not controlled in Category 5, part 2. See Note 1 to Category 5, part 2 (“Information Security”) of Supplement No. 1 to Part 774 (the Commerce Control List) of the EAR.

* * * * *

PART 774—[AMENDED]

Supplement No. 1 to Part 774 (The Commerce Control List)—[Amended]

16. The authority citation for part 774 continues to read as follows:

Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 10 U.S.C. 7420; 10 U.S.C. 7430(e); 18 U.S.C. 2510 et seq.; 22 U.S.C. 287c, 22 U.S.C. 3201 et seq., 22 U.S.C. 6004; 30 U.S.C. 185(s), 185(u); 42 U.S.C. 2139a; 42 U.S.C. 6212; 43 U.S.C. 1354; 46 U.S.C. app. 466c; 50 U.S.C. app. 5; sec. 901-911, Pub. L. 106-387; sec. 221, Pub. L. 107-56; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; notice of August 14, 2002, 67 FR 53721, August 16, 2002.

17. Supplement No. 1 to Part 774 (Commerce Control List), Category 5—Telecommunications and “Information Security”, following the heading II—“INFORMATION SECURITY” is amended by adding a new Nota Bene (“N.B.”) immediately following Note 1, and amending Export Control Classification Number (ECCN) 5A002 by revising the Related Controls paragraph of the List of Items Controlled section as set forth below:

SUPPLEMENT NO. 1 TO PART 774—THE COMMERCE CONTROL LIST

* * * * *

Category 5—Telecommunications and “Information Security”

* * * * *

Part II. “Information Security''

Note 1: * * *

N.B. to Note 1: Commodities and software specially designed for medical end-use that incorporate an item in Category 5, part 2 are not classified in any ECCN in Category 5, part 2.

* * * * *

A. SYSTEMS, EQUIPMENT AND COMPONENTS

5A002 Systems, equipment, application specific “electronic assemblies”, modules and integrated circuits for “information security”, as follows (see List of Items Controlled), and other specially designed components therefor.

* * * * *

List of Items Controlled

Unit * * *

Related Controls: See also 5A992. This entry does not control: (a) “Personalized smart cards”: (1) Where the cryptographic capability is restricted for use in equipment or systems excluded from control paragraphs (b) through (f) of this note; or (2) For general public-use applications where the cryptographic capability is not user-accessible and it is specially designed and limited to allow protection of personal data stored within. Note that if a “personalized smart card” has multiple functions, the control status of each function is assessed individually; (b) Receiving equipment for radio broadcast, pay television or similar restricted audience broadcast of the consumer type, without digital encryption except that exclusively used for sending the billing or program-related information back to the broadcast providers; (c) Portable or mobile radiotelephones for civil use (e.g., for use with commercial civil cellular radio communications systems) that are not capable of end-to-end encryption; (d) Equipment where the cryptographic capability is not user-accessible and which is specially designed and limited to allow any of the following: (1) Execution of copy-protected “software”; (2) Access to any of the following: (a) Copy-protected contents stored on read-only media; or (b) Information stored in encrypted form on media (e.g., in connection with the protection of intellectual property rights) where the media is offered for sale in identical sets to the public; or (3) Copying control of copyright protected audio/video data; (e) Cryptographic equipment specially designed and limited for banking use or money transactions; (f) Cordless telephone equipment not capable of end-to-end encryption where the maximum effective range of unboosted cordless operation (e.g., a single, unrelayed hop between terminal and home basestation) is less than 400 meters according to the manufacturer's specifications. These items are controlled under ECCN 5A992.

Related Definitions: * * *

Items: * * *

Dated: June 10, 2003.

James J. Jochum,

Assistant Secretary for Export Administration.