Where Industry and Security Intersect
What's New | Sitemap | Search
EAR citations on this page may be found in the
December 9, 2004 Encryption Rule on the
Government Printing Office Web site.
To receive written authorization from the Bureau of Industry and Security (BIS) to export your encryption items under License Exception ENC, you must submit an encryption review request to BIS and the ENC Encryption Request Coordinator. It is important that you read all of the instructions below before submitting a review request. This guidance is designed to help you apply for eligibility to export under License Exception ENC, and should be used in conjunction with the relevant portions of the Export Administration Regulations (EAR), which can be found on the Government Printing Office Web site.
Section 740.17 is the principal regulatory reference for License Exception ENC and Supplement No. 6 to Part 742 provides specific details on what information to include with a review request for encryption items. In addition, Section 742.15 explains the licensing policy for encryption items subject to the EAR and Supplement No. 1 to Part 748 provides general information on submitting encryption review requests and other multipurpose applications.
Use the BIS 748P multipurpose application form to apply for License Exception ENC. To order forms you may submit a request by fax at (202) 219-9179 or call the Outreach and Educational Services Division at (202) 482-4811 or our Western Regional Office at (949) 600-0144, or you can use the Internet order form found on this Web site. If you are submitting a request for more than one item, you must also obtain form BIS 748P-A, which is an item appendix, and follow the instructions for Block 22 for each additional item. You may include up to six items. Alternatively, instead of submitting a paper application form, you can apply over the Internet by using BIS's Simplified Network Application Process Redesign (SNAP-R). Follow the instructions on SNAP-R to add items electronically.
The form must be typed. When applying for License Exception ENC, please follow the instructions below as appropriate in lieu of the instructions in Supplement 1 to Part 748 in completing the blocks.
Block 5 Mark the classification request box. This is extremely important. DO NOT mark export or reexport. If you do, the application will be returned to you.
Block 9 Indicate the phrase "License Exception ENC" in this block. This is used to route the application to an appropriate licensing officer in BIS. If you fail to use this phrase, the application will be delayed.
Blocks 14-15 Be sure the information in these blocks is complete and correct, because this is where BIS will send the official confirmation document. If both blocks are filled in, the official document will be sent to the individual or entity identified in Block 15.
Block 22(a) For software, enter "5D002." For hardware, enter "5A002." For test, inspection and production equipment enter "5B002." For technology, enter "5E002" (only applicable for exports/reexports to countries listed in Supplement 3 to Part 740).
Block 22(j) Provide a brief technical description including the basic purpose of the encryption product and the type of encryption used (e.g., 128-bit RC4 for secure e-mail, 2048-bit RSA for key exchange). Please DO NOT type "see letter of explanation" or "see brochure". The information identified in this block is entered directly into the BIS license application database, and will be printed on the official confirmation document issued by BIS. A brief technical description is essential.
Block 24 In preparing your application, review the criteria (§740.17(b)(2)(iii)) used to determine those encryption items that are not eligible under the license exception to "government end-users" outside the countries listed in Supplement No. 3 to part 740, but that are nevertheless eligible for export or reexport to other end-users under §§ 740.17(a), 740.17(b)(1) (no review required), and 740.17(b)(2). Encryption commodities and software that are not addressed in §740.17(b)(2) and that do not provide an Open Cryptographic Interface (OCI) are eligible not only for the provisions of §§ 740.17(a) and 740.17(b)(1), but also for the provisions of §740.17(b)(3). In block 24, indicate the provisions that you believe are applicable to your review request:
Reminder: You should include a letter of explanation with your review request describing the applicable category (i.e., restricted to non-government end-users under §740.17(b)(2) or "unrestricted" and thus eligible to both government and non-government end-users under §740.17(b)(3)) that you believe describes your product, and why. Use BIS Form 748P-A, Item Appendix, if you have more than one item. Repeat block 22 for each additional item you are requesting LE ENC Review.
Supporting documents, such as technical specifications, must accompany the completed BIS 748P form. The supporting documents must contain the information requested in Supplement No. 6 to Part 742, including enough information for BIS to verify the encryption functionality of the item (e.g., encryption algorithms and key sizes used, what type of data is encrypted). In addition, the supporting documents should also address the specific provisions of License Exception ENC for which you are applying (e.g. § 740.17(b)(2) or (b)(3)). Carefully review the provisions of License Exception ENC, particularly Section 740.17(d) (this describes how to initiate the review) and Supplement No. 6 to Part 742 (this describes the technical information you are required to submit). Be sure to include your application control number (e.g., Z999999) on your support documents.
(a) Submit the original BIS Form 748P, 748P-A (if applicable) and support documents, in accordance with Sections 740.17 and 748.3(b) of the EAR, to BIS at the following address:
U.S. Department of Commerce
Bureau of Industry and Security
Office of National Security and Technology Transfer Controls (NSTTC)
14th Street and Pennsylvania Avenue, NW
Room 2705
Washington, D.C. 20230
Attn: "Application Enclosed"
BIS will not accept applications sent C.O.D. When the updated BIS electronic application submission system is implemented, you will be able to submit your support documents electronically, as attachments to the application. Until then, if you submit the forms electronically, either through SNAP-R or ELAIN, fax the supporting documents to BIS (fax number 202-219-9179 or -9182).
Reminder: To expedite processing you may send a complementary copy of your application to the Information Technology Controls Division (ITCD). You may fax your documents to ITCD at 202-501-0784, or mail them to the U.S. Department of Commerce, Bureau of Industry and Security, Information Technology Controls Division, Room 2093, 14th & Pennsylvania Ave., NW, Washington, D.C. 20230.
(b) A copy of the entire application (including forms and supporting documents) must also be express mailed to the following address (failure to comply will result in your review being delayed or possibly returned without action):
Attn: ENC Encryption Request Coordinator
9800 Savage Road, Suite 6940
Ft. Meade, MD 20755-6000
Semi-annual reporting to BIS (and a copy to the ENC Encryption Request Coordinator
at Ft. Meade, MD) is required for certain exports and exports under License
Exception ENC. See Section 740.17(e) for the specific requirements and instructions
on encryption reporting. BIS multipurpose forms are available for reporting
purposes.
BIS-742R (pdf)|
BIS-742S (pdf)
Encryption Items to U.S. Subsidiaries: Exports of encryption items under ECCNs 5A002.a.1, .a.2, .a.5, and .a.6, 5B002, 5D002 and 5E002 to certain foreign subsidiaries of U.S. companies (consult the definition of U.S. Subsidiary in Part 772), do not require review, provided the items are not sold or transferred outside the U.S. company or transferred to countries listed in Country Group E:1 in Supplement No. 1 to Part 740 or nationals of these countries. This provision includes source code and items that provide an Open Cryptographic Interface (OCI). See Section 740.17(b)(1) of the EAR.
Reminder: All items produced or developed by U.S. subsidiaries using encryption commodities, software or technology exported under this license exception provision are controlled encryption items of "U.S. origin". All such items are subject to the EAR and thus require review or separate authorization prior to sale or transfer outside the U.S. company.
Encryption Items to the European Union "license-free zone": Except for "cryptanalytic items" to "government end-users" (see definitions in Part 772 of the EAR), exporters may immediately export any encryption item (including source code, technology and OCIs) to government and non-government end-users located in the countries listed in Supplement No. 3 to Part 740 of the EAR, once a complete review request is registered with BIS and the ENC Encryption Request Coordinator. To be considered complete, a review request must contain the information requested in Supplement No. 6 to Part 742 of the EAR, even for exports to the EU "license-free zone".
However, encryption items and related technical assistance may be exported and reexported to private sector end-users headquartered in Canada or any country listed in Supplement No. 3 to part 740 for internal company use in the development of new products, without prior technical review. Please note that review is still required for the new products that are developed, before the products are transferred to others.
Reminder: All complete requests for review under License Exception ENC satisfy the review requirements for exports and reexports to the EU "license-free zone". You do not need to submit a separate review request for EU "license-free zone" treatment.
Use of "Publicly Available" Encryption Source Code: Encryption source code that would be considered publicly available under §734.3(b)(3) of the EAR (and the corresponding object code, if it is also made publicly available) does not require review under License Exception ENC for export and reexport. Instead, such "publicly available" encryption software may be exported and reexported under License Exception TSU once notification (or a copy of the source code) is provided to BIS and the ENC Encryption Request Coordinator. Refer to §740.13(e) for this provision of the EAR.Reminders:
1. Although §740.13(e) of the EAR does not authorize the export or reexport of "company proprietary" encryption source code (i.e., when the complete source code has not been made publicly available), such source code may be eligible for several provisions of License Exception ENC (e.g. §740.17(a), §740.17(b)(1) and §740.17(b)(2)).
2. Generally speaking, the provisions of License Exception ENC apply to all U.S.-origin "commercial" encryption products, including those that employ cryptography obtained (or derived) from publicly available sources.
Short-range Wireless Products: Certain products that incorporate short range wireless components or software do not require review or notification (see §740.17(b)(4)(ii)(A) and §742.15(b)(3)(ii) of the EAR). However, the short-range wireless components and software themselves require notification (e.g., if limited to 56-bit symmetric / 512-bit asymmetric encryption), review (e.g., under License Exception ENC) or licensing (e.g. if not authorized under License Exception ENC) for export or reexport.
Beta Test Encryption Software:
For exports of Beta Test Software, see "Notifications" under Guidance
56-bit Encryption Products: 56-bit encryption items (and encryption items with 512-bit asymmetric and 112-bit elliptic curve algorithms) do not require review under License Exception ENC. For guidance pertaining to such items, see "NLR" under Guidance.