ÿWPCC €¯¤—5ÌO_LkÂî1]Uˆ'i’–š§®$^¥G'‹:gGö˜Þ(Á¡væ»N#M“PË…‰¡Céiæ‡ý\¾tLâ.æ쯲IïÕŸ5‰¯ƒã\™Ñ´k)p¼í°gýF¶®Ì»\?WHŸ!##H¢rPa‘:BlNûÞ¾>â×éÃ…ôUg¯0¼¶çÈd óÞúN‰ Dé&öqÜ .÷S"q°RxàkU÷ˆJtÏr·³ÌH8¯ÔÁæ‘О6Øú*IXi¼Oz²Ø›W㧜\ñÌ0Ca~׺Ëõ¯ƒ˜^#3|üý-uîà©…¤tcäÑ”˜§ßfêk\<# óI5Áœ®ìÞHyñ!Ç2¿irƒG#jتœpÐs2!Íýâ ô0ê²çàZ¿#n €D_ÿÍ'cgCE’‡Áy²ò¤ÿpÃç­Áj ŒL ©Ù|g Ý“PIj5)‰‹“H™žHdyXp0D™EîºÉáç&f¼ Ï Lü:³®Ü3„ËÔ²÷’·9Çâ]¿âu|¿iåJˆ5nžXL&¸CáYv|•&,­\W6 ”Ìv•Ý§¾HŠÛ€`ìí$ ŸeˆnÙ!p=Ž¤# ø UN %Q 0(W w@ 4¿ Ó â ê U:ò ò U , , , , , , 1mL 1m¹ ¹ ¹ ¹ ¹ ¹ ¹ ¹ ¹ ¹ ¹ ¹ B&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&ÆC 0                                                                               0CŠŠ 0v͘HP LaserJet Series IIHPPCL,ðhhð,0 (ÈhH  Z ‹6Times New Roman RegularX($¡¡ áâãäåæçèéê}|5%3|xê<þ6X9`("Courier 10cpi'ô\ `' e37=CIQYag³³1.a.i.(1)(a)(i)1)a)# e37=CIQYag­­1.a.i.(1)(a)(i)1)a) d1, 2, 3,Level 1Level 2Level 3Level 4Level 5B?my21, 2, 3,Numbersà  àÚƒRÚ2Ú  Ú.Û€RÛ(ÿÿ$òòÚ  ÚÚ  Úóó(-!2Vf$¤¤Ý ƒ!ÝÝ  ÝÓÓ€€€€€òòÚ  Ú0Ú  ÚóóÝ ƒ!ÝÝ  Ý›ÓC€  e'#CÓÑ8°ÑÑ8°ÑÑ7€`XXdìdÈ7ÑÓÓà  àœà ` àà ¸ àà  àà h àà À àà  àà p àBilling€Code:€3510„33„PÐ 8 ÐÌÌDEPARTMENT€OF€COMMERCEÌÌBureau€of€Export€AdministrationÌÌ15€CFR€Parts€732,€734,€740,€742,€743,€748,€750,€752,›€770,€772,€and€774ÌÌ[Docket€œNo.€980911233„8233„01]›ÌÌRIN:€œ0694„AB80ÌÌEncryption€ItemsÌ€ÌAGENCY:€Bureau€of€Export€Administration,€Commerce.ÌÌACTION:€€Interim€rule.à  à€Ð #X" ÐÌSUMMARY:à ` àThis€interim€rule€amends€the€Export€Administration€Regulations€(EAR)€byÐ @'#& Ðclarifying€controls€on€the€export€and€reexport€of€encryption€items€(EI)€controlled€for€ð ðEIðð€reasonsÏon€the€Commerce€Control€List.€€This€rule€incorporates€public€comments€on€an€interim€ruleÐ ð*¸&* Ðpublished€in€the€òòFederal€Registeróó€on€December€30,€1996,€and€implements€new€licensing€policiesÐ 8 Ðfor€general€purpose€non„recoverable€non„voice€encryption€commodities€or€software€of€any€keyÏlength€for€distribution€to€banks€and€financial€institutions€in€specified€countries.€ÌÌEFFECTIVE€DATE:€This€rule€is€effective:€(òòDATE€OF€PUBLICATIONóó).Ð ˜ ` ÐÌFOR€FURTHER€INFORMATION€CONTACT:€James€Lewis,€Office€of€Strategic€Trade€andÏForeign€Policy€Controls,€Bureau€of€Export€Administration,€Telephone:€(202)€482„0092.à Ð à€Ð  è  ÐÌBACKGROUND:ÌÌOn€December€30,€1996,€the€Bureau€of€Export€Administration€(BXA)€published€in€the€òòFederalÐ €H ÐRegisteróó€(61€FR€68572)€an€interim€rule€that€exercises€jurisdiction€over,€and€imposes€newÐ X  Ðcombined€national€security€and€foreign€policy€controls€on,€certain€encryption€items€that€were€onÏthe€United€States€Munitions€List,€consistent€with€Executive€Order€(E.O.)€13026€and€pursuant€to€Ìthe€Presidential€Memorandum€of€that€date,€both€issued€by€President€Clinton€on€November€15,Ï1996.ÌÌBXA€received€comments€from€45€commenters,€and€the€comments€fall€into€three€broad€categories:Ïgeneral€concerns€and€objections€to€the€policy€embodied€in€the€regulations;€recommendations€forÏspecific€changes€or€clarifications€to€the€regulations€that€are€consistent€with€the€broad€encryptionÏpolicy€implemented€in€the€December€30€rule;€and€recommendations€for€additional€changes€toÐ ð*¸&* Ðencryption€policy.ÌÌòòSuggestions€for€changes€to€clarify€existing€policyóóÐ øÀ ÐÌA€number€of€commenters€provided€specific€suggestions€for€changes€or€clarifications€which€are€Ïconsistent€with€the€intent€of€the€policy€and€which€would€streamline€or€improve€the€regulations.€€€ÏMany€of€these€suggestions€are€implemented€in€this€rule,€such€as€clarifying€that€the€tools€of€tradeÏprovisions€of€License€Exception€TMP€and€License€Exception€BAG€apply€globally€and€clarifyingÏthat€anti„virus€software€does€not€require€a€license€for€export.€€Ì€€ÌSeveral€commenters€asked€the€Department€of€Commerce€to€adopt€exemptions€to€licenseÏrequirements€which€were€available€for€encryption€exporters€under€ðð123.16(b)(2)€and€(b)(9)€of€Ïthe€International€Traffic€and€Arms€Regulations€(ITAR),€such€as€those€which€allowed€the€exportÏof€components€to€a€U.S.€subsidiary€or€which€allowed€the€export€of€spare€parts€and€componentsÏwithout€a€license€for€an€already€approved€sale.€€This€rule€adds€these€new€provisions€underÏLicense€Exception€TMP,€making€them€applicable€to€encryption€controlled€items€as€well€as€otherÏitems€eligible€for€TMP€treatment.ÌÌTwo€commenters€asked€that€the€regulations€clarify€that€the€ITAR€licensing€policy€for€equipmentÏspecially€made€for€and€limited€to€the€encryption€of€interbanking€transactions€had€not€changedÏwith€the€transfer€of€jurisdiction€of€encryption€products€to€the€Department€of€Commerce.€€ThisÏinterim€rule€clarifies€that€this€equipment€is€not€subject€to€EI€controls.€Ð ˜+`'* ЇSeveral€commenters€recommended€a€number€of€changes€to€the€Key€Escrow€Product€and€AgentÏcriteria€found€in€Supplement€Nos.€4€and€5€part€to€742€of€the€EAR.€€These€recommendations€wereÏto€simplify€the€criteria,€and€to€modify€some€of€the€specific€prescriptions€to€allow€for€greaterÏflexibility€and€variation€on€the€part€of€exporters.€€Many€commenters€found€the€criteria€tooÏbureaucratic€and€legalistic€to€help€advance€U.S.€encryption€policy€goals,€while€others€noted€thatÏthe€criteria€were€still€overly€focused€on€key€escrow€and€not€consistent€with€the€broader€approachÏto€key€recovery€found€elsewhere€in€the€regulation.€€Several€commenters€also€encouraged€theÏadministration€to€make€clear€that€it€had€moved€beyond€key€escrow€to€key€recovery€in€its€policy.ÏOne€commenter€focused€on€weaknesses€and€omissions€found€in€the€key€escrow€product€andÏagent€criteria€found€in€Supplement€Nos.€4€and€5€to€part€742€of€the€EAR,€and€provided€suggestedÏadditions€to€the€criteria€to€make€them€more€consistent€with€emerging€business€practices.€€TheÏcriteria€specified€in€Supplement€Nos.€4€and€5€were€discussed€extensively€with€€industry€prior€toÏpublication€of€the€December€30€interim€rule,€and€the€rule€reflects€these€discussions.€€However,€ÏBXA€continues€to€look€for€ways€to€streamline€the€criteria,€and€will€address€revisions€in€a€futureÏregulation.€€€€€ÌÌSeveral€commenters€expressed€concerns€over€the€longer€processing€time€required€for€licenses€atÏthe€Department€of€Commerce.€€Some€commenters€€noted€that€the€involvement€of€Departments€ofÏEnergy€and€State,€the€Arms€Control€and€Disarmament€Agency€and€other€agencies€which€did€notÏreview€license€applications€for€encryption€products€submitted€to€the€Department€of€State€addedÏunnecessary€levels€of€review€and€caused€unwarranted€delays.€€BXA€is€continuing€to€work€withÏother€reviewing€Departments€and€Agencies€to€ensure€expeditious€review€of€encryption€licenseÐ ˜+`'* Ðapplications.€€Many€commenters€noted€that€the€requirements€for€a€Department€of€CommerceÏlicense€were€substantially€greater€than€what€was€required€at€the€Department€of€State.€€TheÏDepartment€of€Commerce,€for€example,€requires€an€end„use€certificate€to€be€obtained€for€someÏdestinations€before€approving€an€export;€the€Department€of€State€did€not€and€exporters€questionÏthe€need€for€this€change.€€Other€commenters€noted€that€the€Department€of€State€licensing€systemÏwas€more€flexible€and€faster€for€approvals€of€distribution€and€manufacturing€arrangements.€€TheÏDepartment€of€Commerce€has€no€equivalent€licenses,€but€is€reviewing€the€possibility€of€suchÏlicenses.€€Many€oral€comments€received€since€the€close€of€the€comment€period€note€that€unlikeÏthe€Department€of€State,€the€Department€of€Commerce€does€not€allow€licenses€to€be€amended,€soÏthat€if€an€exporter€has,€for€example,€a€license€which€allows€him€to€ship€to€thirty€countries€andÏwishes€to€add€one€more,€the€Department€of€Commerce€requires€submission€of€an€entire€newÏlicense€while€the€Department€of€State€was€content€with€a€simple€letter€noting€the€requestedÏchange.€€This€rule€will€now€allow€the€addition€of€countries€to€an€Encryption€LicensingÏArrangement€by€letter.€€BXA€understands€industry€concerns€about€the€license€process€under€theÏEAR,€and€continues€to€look€for€ways€to€streamline€the€process.ÌÌòòAdditional€recommendations€for€changes€to€encryption€policyóóÐ 8"  ÐÌA€number€of€commenters€asked€that€the€Administration€revisit€a€number€of€decisions€made€in€theÏcourse€of€the€development€of€the€encryption€policy€as€reflected€in€the€December€30€interim€rule.ÌSeveral€asked€that€we€reconsider€and€liberalize€the€treatment€of€Cryptographic€ApplicationÏProgram€Interface.€€Others€questioned€the€addition€of€€ð ðdefense€servicesðð€controls€similar€to€thatÐ ˜+`'* Ðcontained€in€the€ITAR€(which€prohibits€U.S.€persons€from€assisting€foreign€entities€fromÏdeveloping€their€own€indigenous€encryption€products).€€Several€commenters€objected€to€theÏstructure€of€License€Exception€KMI€for€non„recoverable€56€bit€products,€with€its€requirement€forÏa€review€every€six€months.€€Other€commenters€also€called€for€a€reversal€of€the€decision€to€exemptÏtransferred€encryption€items€from€normal€Department€of€Commerce€regulatory€practices.€ÏFinally,€several€commenters€recommended€that€the€licensing€criteria€and€License€ExceptionsÏapplicable€to€other€dual„use€items€be€fully€applicable€to€encryption€products,€such€asÏconsiderations€of€foreign€availability,€the€òòde€minimisóó€content€exclusion,€public€domain€treatmentÐ X  Ðand€the€use€of€License€Exceptions.€€This€rule€focuses€on€clarifications€to€existing€encryptionÏpolicy.ÌÌBased€on€public€comments€to€the€December€30€interim€rule,€this€interim€rule€specifically€makesÏthe€following€changes:ÌÌÌà  à„€In€ðððð€732.2(d)€and€732.3(e)(2),€makes€editorial€corrections€to€clarify€that€encryptionÏitems€controlled€for€ð ðEIðð€reasons€under€ECCNs€5A002,€5D002€and€5E002€are€not€eligible€for€òòDeÐ 8"  ÐMinimisóó€treatment.Ð $à" ÐÌà  à„€In€ðð734.2,€clarifies€that€downloading€or€causing€the€downloading€of€encryption€sourceÏcode€and€object€code€in€Canada€is€not€controlled€and€does€not€require€a€license.ÌÐ ˜+`'* Ðà  à„€In€ðð740.6,€clarifies€that€letters€of€assurance€required€for€exports€under€LicenseÏException€TSR€may€be€accepted€in€the€form€of€a€letter€or€any€other€written€communication€fromÏthe€importer,€including€communications€via€facsimile.ÌÌà  à„€ðð740.8€is€also€amended€by€adding€a€new€paragraph€to€authorize,€after€a€one„timeÏtechnical›€review,€exports€and€reexports€under€License€Exception€KMI€of€œnon„recoverableÏfinancial„specific€encryption€software€(which€is€not€eligible€under€the€provisions€of€LicenseÏException€TSU€for€mass€market€software,€such€as€SET€or€similar€protocols)€and€commodities€ofÏany€key€length€that€are€restricted€by€design€(e.g.,€highly€field„formatted€with€validationÏprocedures,€and€not€easily€diverted€to€other€end„uses)€for€financial€applications€to€secureÏfinancial€transactions,€for€end„uses€such€as€financial€transfers€or€electronic€commerce.€€NoÏbusiness€and€marketing€plan€to€develop,€produce,€or€market€€encryption€items€with€recoverableÏfeatures€is€required.€€Such€exports€and€reexports€are€eligible€to€all€destinations€except€Cuba,€Iran,ÏIraq,€Libya,›€North€Korea,€Sudan€and€Syria.€€Conforming€changes€are€also€made€in€ðð742.15.ÌÌà  àœ„€€ðð740.8›€is€also€amended€to€œauthorize,ò ò€ó óafter€a€one€time€review,€exports€and€reexports›Ð X  Ðœunder€License€Exception€KMI€of›€general€purpose€œnon„recoverable€non„voice€encryptionÏcommodities€or€software€of€any€key€length€›for€distribution€to€banks€and€financial€œinstitutions€(asÏdefined€in€part€772€of€the€EAR)€in›€destinations€œlisted›€in€new€Supplement€No.€3€to€part€740,Ïprovided€the€end„use€is€limited€to€secure€œbusiness€financial›€œcommunications€or€transactions›€œor›Ïfinancial€œcommunications/transactions›€between€the€bank€œor›€financial€institution€and€itsÏcustomers.€€No€customer€to€customer€communications€or€transactions€are€permitted.€€œSoftware›Ð ˜+`'* Ðand€commodities€that€have€already€received€a€œone„time€technical€review€through€a€classificationÏrequest€or€have€been€licensed€for€export€under€an€Encryption€Licensing€Arrangement€or€a€licenseÏare€eligible€for€export€to€banks€and€financial€institutions€under€License€Exception€KMI€withoutÏan€additional€one„time€technical€review.€€Note€that€no€business€or€marketing€plan€is€required.€ÏConforming€changes€are€also€made€in€ðð742.15.€€Software€and€commodities€that€have€alreadyÏbeen€approved€under€an€Encryption€Licensing€Arrangement€to€banks€in€specified€countries€mayÏnow€be€exported€or€reexported€€to€other€banks€and€financial€institutions€in€those€countries€underÏthe€same€Encryption€Licensing€Arrangement.€ÌÌà  à„€In€ðð740.9,€removes€the€reference€to€Country€Group€D:1.€€With€this€change,€commoditiesÏand€software€are€eligible€for€export€under€the€tools€of€trade€provisions€of€License€ExceptionÏTMP€to€all€destinations€except€countries€listed€in€country€group€E:2€or€Sudan.€›€This€œalso€clarifies›Ïthat€encryption€software€controlled€for€EI€reasons€under€ECCN€5D002€may€be€pre„loaded€on€aÏlaptop€and€temporarily€exported€under€the€tools€of€trade€provisions€of€License€œException€TMP›€toÏmost€countries,€including€those€listed€in€Country€Group€œD:1.›Ì€Ìà  à€€„€Also€in€ðð740.9,€adds€a€new€paragraph€(a)(2)(ix)€to€authorize€under€License€ExceptionÏTMP€the€export€of€œcomponents,›€parts,€tools€or€test€equipment€exported€by€a€U.S.€person€to€itsÏsubsidiary,€affiliate€or€facility€œin€a€country€in€Country€Group€B€that€is€owned›€or€controlled€by€theÏU.S.€person,€if€the€components,€part,€tool€or€test€equipment€is€to€be€used€for€manufacture,Ïassembly,€testing,€production€or€modification,€provided€that€no€components,€parts,€tools€or€testÏequipment€or€the€direct€product€of€such€components,€parts,€tools€or€test€equipment€are€transferredÐ ˜+`'* Ðor€reexported€to€a€country€other€than€the€United€States€from€such€subsidiary,€affiliate€or€facilityÏwithout€œa€license€or€other€authorization€from€BXA.Ì›€Ìà  à„€In€ðð740.11,€excludes€items€controlled€for€EI€reasons€from€eligibility€under€theÏInternational€Safeguards€provisions€of€License€Exception€GOV.Ì€Ìà  à„€In€ðð740.14,€clarifies€existing€provisions€of€License€Exception€BAG€œto€distinguishÏtemporary€from€permanent€exports€and›€imposes€a€restriction€on€the€use€of€BAG€for€exports€orÏreexports€of€EI„controlled€items€to€terrorist€supporting€destinations€or€by€œpersons€other›€than€U.S.Ïcitizens€and€permanent€residents.ÌÌà  àœ„›€€New€Supplement€No.€3€to€part€œ740›€is€added€to€list€the€countries€eligible€to€receiveÏunder€License€Exception€KMI€general€purpose€œnon„recoverable€non„voice€encryptionÏcommodities€or€software€of€any€key€length€for€distribution€to€banks€and€financial€institutions.€ÌÌà  à„€In€ðð742.15,€adds€40„bit€DES€as€being€eligible€for€consideration€under€the€15„dayÏreview,€for€mass„market€eligibility,€subject€to€the€additional€criteria€listed€in€Supplement€No.€6€toÏpart€742.ÌÌà  à„€In€ðð742.15(b)(1),€clarifies€that€subsequent€bundling,€updates€or€releases€may€beÏexported€and€reexported€under€applicable€provisions€of€the€EAR€without€a€separate€one„timeÏtechnical€review€so€long€as€the€functional€encryption€capacity€of€the€originally€reviewed€mass„Ð ˜+`'* Ðmarket€encryption€software€has€not€been€modified€or€enhanced.ÌÌà  à„€New€paragraph€(b)(4)€is€added€to€ðð742.15€to›€œauthorize›€exports€and€reexports€under€anÏEncryption€Licensing€Arrangement€of€general€purpose€non€œrecoverable,›€non„voice€encryptionÏcommodities€and€software€of€any€key€length€for€use€by€œbanks/financial›€institutions€as€defined€inÏpart€772€œof€the€EAR€in›€all€destinations€except€Cuba,€Iran,€Iraq,€Libya,€North€Korea,€Syria€andÏSudan.€€œNo€business€or€marketing€plan€is€required.€€Exports›€and€reexports€for€the€end„uses€toÏsecure€œbusiness›€financial€œcommunications€or›€between€the€bank€and/or€financial€œinstitution›€and€itsÏcustomers€will€receive€favorable€consideration.€€No€customer€to€customer€œcommunications€orÏtransactions›€are€eligible€under€the€Encryption€Licensing€Arrangement.Ì€Ìà  à„€In€Supplement€No.€4€to€part€742,€paragraph€(3),€revises€ð ðreasonable€frequencyðð€to€ð ðatÏleast€once€every€three€hoursðð€to€resolve€the€ambiguity€on€how€often€the€output€must€identify€theÏkey€recovery€agent€and€material/information€required€to€decrypt€the€ciphertext.Ì€€Ìà  à„€In€Supplement€No.€4€to€part€742,€paragraph€(6)(i),€clarifies€that€the€U.S.€governmentÏmust€be€able€to€obtain€the€key(s)€or€other€material/information€needed€to€decrypt€all€data,€withoutÏrestricting€the€means€by€which€the€key€œrecoverable›€products€allow€this.ÌœÌà  à„€In€Supplement€No.€6€to€part€742€€for€7„day€mass„market€classification€requests,€Ïclarifies€that€a€copy€of€the€encryption€subsystem€source€code€may€be€used€instead€of€a€test€vectorÏto€determine€eligibility€for€License€Exception€TSU€for€mass€market€software.€Ð ˜+`'* Їà  à„€In€ðð743.1,€requires€reporting€under€the€Wassenaar€Arrangement€for€items€controlledÏunder€ECCNs€5A002€and€5D002€when€exported€under€specific€provisions€of€License€ExceptionÏKMI.€€This€is€not€a€new€reporting€requirement,€but€replaces€and€narrows€the€scope€of€theÏreporting€requirement€under€the€Encryption€License€Arrangement€for€financial„specificÏcommodities€and€software€and€general€purpose€non„recoverable€non„voice€encryptionÏcommodities€and€software€of€any€key€length€for€distribution€to€banks€and€financial€institutionsÏthat€are€eligible€for€License€Exception€KMI.€Ì›Ìà  à„€In€ðððð€748.9€and€748.10,€clarifies€a€long„standing€policy€that€no€support€documentationÏis€required€for€exports€of€technology€or€software,€and€it€removes€the€requirement€for€suchÏsupport€documentation€for€exports€of€technology€or€software€to€Bulgaria,€Czech€Republic,ÏHungary,€Poland,€Romania,€or€Slovakia.€€This€rule€also€exempts€from€support€documentationÏrequirements€all€encryption€items€controlled€under€ECCNs€5A002,€5B002,€5D002€and€5E002.€ÏThis€conforms€with€the€practice€under€the€ITAR€prior€to€December€30,€œ1996.ÌÌà  à„€In€ðð750.7,€allows€requests€to€add€countries€of€destination€to€Encryption€LicensingÏArrangements€by€letter.›ÌœÌà  à„€In€ðð752.3,€excludes€encryption€items€controlled€for€EI€reasons€from€eligibility€for€aÏSpecial€Comprehensive€License.Ìà  àÌà  à„€In€ðð770.2,€adds€a€new€interpretation€to›€clarify€that€encryption€software€controlled€for€EIÐ ˜+`'* Ðreasons€under€ECCN€5D002€may€be€pre„loaded€on€a€laptop€and€exported€under€the€tools€of€tradeÏprovision€of€License€Exception€TMP€or€the€personal€use€exemption€under€License€ExceptionÏBAG,€subject€to€the€terms€and€conditions€of€such€License€Exceptions.€€ÌÌà  à„€In€part€772,€adds€new€definitions€for€ð ðbankðð,€ð ðeffective€controlðð,€ð ðencryption€licensingÏarrangementðð,€œand€ð ðfinancial›€œinstitutionðð.›ÌÌà  à„€In€Supplement€No.€1€to€part€774,€Category€5€„€Telecommunications€and€InformationÏSecurity€is€amended€by€revising€ECCN€5A002€to€authorize€exports€of€components€and€spareÏparts€under€License€Exception€LVS,€provided€the€value€of€each€order€does€not€exceed€œ$500€andÏthe€components€and€spare€parts€are€destined€for€items€previously€authorized€for€export,›€and€toÏclarify€that€equipment€for€the€encryption€of€interbanking€transactions€is€not€controlled€under€thatÏentry.ÌÌà  à„€Revises€the€phrase€ð ðup€to€56„bit€key€length€DESðð€where€it€appears€to€read€ð ð56„bit€DESÏor€equivalentðð,€and€makes€other€editorial€changes.ÌÌœNote€that€this€rule€does€not€affect€exports€or€reexports€authorized€under€licenses€issued€prior€toÏthe€effective€date€