(c) Notwithstanding paragraphs (a) and (b) of this section, note that encryption software controlled under ECCN 5D002 for "EI" reasons on the Commerce Control List (refer to Supplement No. 1 to part 774 of the EAR) remains subject to the EAR (refer to Sec.740.13 of the EAR for release under license exception treatment).

This License Exception authorizes exports and re-exports of operation technology and software; sales technology and software; software updates (bug fixes); and "mass market" software subject to the General Software Note; and non-commercial encryption source-code. Note that encryption software is no longer subject to the General Software Note (see paragraph (d)(2) of this section).

(d) General Software Note: "mass market" software

(2) Software not eligible for this License Exception. This License Exception is not available for certain encryption software controlled under ECCN 5D002. (Refer to the Cryptography Note in Category 5 - part 2 of the Commerce Control List (CCL) for information on Mass Market Encryption commodities and software. Also refer to Sec.742.15(b)(1) and 748.3(b) of the EAR for information on item classifications for release from EI controls and NS controls).

(1) Encryption source code controlled under 5D002 which would be considered publicly available under Section 734.3(b)(3) and which is not subject to any proprietary commercial agreement or restriction is released from EI controls and may be exported or re-exported without review under License Exception TSU, provided you have submitted to BXA notification of the export, accompanied by the Internet address (e.g. URL) or copy of the source code by the time of export. Submit the notification to BXA and send a copy to ENC Encryption Request Coordinator (see Section 740.17(g)(5) for mailing addresses).

(2) Source code released under this provision remains of U.S. origin even when used or commingled with software or products of any origin, and any encryption product developed with source code released under this provision is subject to the EAR (see Section 740.17).

(3) The source code may be exported or re-exported to all destinations except Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria.

(a) Exports and re-exports of certain encryption commodities and software. As enumerated below, you may export and re-export encryption commodities and software including components (as defined in part 772) under License Exception ENC after classification by BXA (see paragraph (e) of this section). License Exception ENC does not apply if the encryption commodity or software provides an open cryptographic interface (as defined in part 772).

(b) Ineligible Destinations. No encryption item(s) may be exported or re-exported under this license exception to Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria.

(c) Retransfers. Retransfers of encryption items listed in paragraph (a) of this section to other end-users or end-uses are prohibited without prior authorization.

(d) Distributors and Resellers. U.S. or foreign distributors, resellers or other entities who are not original manufacturers of encryption commodities and software are permitted to use License Exception ENC only in instances where the export or re-export meets the applicable terms and conditions of Sec.740.17.

(f) Open cryptographic interfaces. License Exception ENC shall not apply to exports or re- exports of encryption commodities and software including components, if the encryption product provides an open cryptographic interface (as defined in part 772).

Licenses are required for exports and re-exports to all destinations, except Canada, for items controlled under ECCNs having an "EI" (for "encryption items") under the "Control(s)" paragraph. Such items include: encryption commodities controlled under ECCN 5A002; encryption software controlled under ECCN 5D002; and encryption technology controlled under ECCN 5E002. Refer to part 772 of the EAR for the definition of "encryption items".

The following licensing policies apply to items identified in paragraph (a) of this section. Except as otherwise noted, applications will be reviewed on a case-by-case basis by BXA, in conjunction with other agencies, to determine whether the export or re-export is consistent with U.S. national security and foreign policy interests. For subsequent bundling and updates of these items see paragraph (n) of Sec.770.2 of the EAR.

(n) Interpretation 14: Encryption commodity and software reviews. Classification of encryption commodities or software is required to determine eligibility for all licensing mechanisms. Note that subsequent bundling, patches, upgrades or releases, including name changes, may be exported or re-exported under the applicable provisions of the EAR without further technical review as long as the functional encryption capacity of the originally reviewed encryption product has not been modified or enhanced. This does not extend to products controlled under a different category on the CCL.

"Asymmetric algorithm". (Cat 5, part II) A cryptographic algorithm using different, mathematically-related keys for encryption and decryption. A common use of "asymmetric algorithms" is a key management.

Encryption Component. Any encryption commodity or software, including encryption chips, integrated circuits, application specific toolkits (including software development kits), executable or linkable modules which alone is incapable of performing complete cryptographic functions, and is designed or intended for use in or the production of another encryption item.

Foreign Government Entity (as applied to encryption items). A foreign government entity is (a) any government department, agency, or other entity performing governmental functions; e.g., Finance Ministry, Ministry of Defense, Ministry of Health, including governmental corporations, quasi-government agencies and State enterprises;;

(b) this term does not include the following public entities: utilities, banks, transportation, broadcast, non-research educational facilities, non-military health organizations and manufacturing or industrial entities, except those public manufacturing or industrial entities or their separate business units (as defined in part 772 of the EAR) who are engaged in the manufacture or distribution of items or services controlled on the Wassenaar Munitions List.

Open Cryptographic Interface. A mechanism which allows a customer or other party to insert cryptography without the intervention, help or assistance of the manufacturer or its agents, e.g., manufacturer’s signing of cryptographic code or proprietary interfaces.

"Symmetric algorithm". (Cat 5, part II) A cryptographic algorithm using an identical key for both encryption and decryption. A common use of "symmetric algorithms" is confidentiality of data.

Note 1: The control status of "information security" equipment, "software", systems, application specific "electronic assemblies", modules, integrated circuits, components, or functions is determined in Category 5, part 2 even if they are components or "electronic assemblies" of other equipment.

Note 2: Category 5 - part 2 encryption products, when accompanying their user for the user's personal use, are eligible for license exceptions TMP or BAG.

Note 3: Cryptography Note: ECCNs 5A002 and 5D002 do not control items that meet all of the following:

Related Controls: See also 5A992. This entry does not control: a.) "Personalized smart cards "where the cryptographic capability is restricted for use in equipment or systems excluded from control paragraphs b through f of this note. Note that if a "personalized smart card" has multiple functions, the control status of each function is assessed individually; b.) Receiving equipment for radio broadcast, pay television or similar restricted audience television of the consumer type, without digital encryption except that exclusively used for sending the billing or program-related information back to the broadcast providers c.) Portable or mobile radiotelephones for civil use (e.g., for use with commercial civil cellular radiocommunications systems) that are not capable of end-to-end encryption; d.) Equipment where the cryptographic capability is not user-accessible and which is specially designed and limited to allow any of the following: 1.) Execution of copy-protected "software"; 2.) Access to any of the following: a.) Copy-protected read-only media; or b.) Information stored in encrypted form on media (e.g., in connection with the protection of intellectual property rights) where the media is offered for sale in identical sets to the public; or 3.) One-time copying of copyright protected audio/video data; e.) Cryptographic equipment specially designed and limited for banking use or money transactions; f.) Cordless telephone equipment not capable of end-to-end encryption where the maximum effective range of unboosted cordless operation (i.e., a single, unrelayed hop between terminal and home basestation) is less than 400 meters according to the manufacturer's specifications.

Related Definitions: 1.) The term "money transactions" in paragraph e.) of Related Controls includes the collection and settlement of fares or credit functions. 2.) For the control of global navigation satellite systems receiving equipment containing or employing decryption (i.e., GPS or GLONASS) see 7A005.

a. Systems, equipment, application specific "electronic assemblies", modules and integrated circuits for "information security", and other specially designed components therefor:

Reason for Control: NS, AT

Control(s)Country Chart

NS applies to entire entryNS Column 1

AT applies to entire entryAT Column 1

Reason for Control: NS, AT, EI

Control(s)Country Chart

NS applies to entire entryNS Column 1

AT applies to entire entryAT Column 1

2. Note: The General Software Note does not apply to "software" controlled by Category 5 - part 2 ("Information Security"). For "software" controlled by Category 5, part 2, see Supplement No. 1 to part 774, Category 5, part 2, Note 3 - Cryptography Note.

(a) Requests for encryption items will be processed in thirty (30) working days from receipt of a properly completed request.

(b)(1) To submit a classification request for a technical review of commodities and software, you must provide the following information in a cover letter to the classification request:

(c)(1) To submit a classification request for a technical review of technology, you must provide the following information in a cover letter to the classification request:

(d) For all encryption items, ensure that the information provided includes brochures or other documentation or specifications (to include applicable cryptographic source code) related to the technology, commodity or software, as well as any additional information which you believe would assist the review process.

[end]

Please send any questions or comments to webmaster@eff.org