Billing Code: 3510-33-P

DEPARTMENT OF COMMERCE

Bureau of Export Administration

15 CFR Parts 732, 734, 740, 742, 743, 748, 750, 752, 770, 772, and 774

[Docket No. 980911233-8233-01]

RIN: 0694-AB80

Encryption Items

AGENCY: Bureau of Export Administration, Commerce.

ACTION: Interim rule.

SUMMARY:	This interim rule amends the Export Administration Regulations (EAR) by clarifying controls on the export and reexport of encryption items (EI) controlled for "EI" reasons on the Commerce Control List. This rule incorporates public comments on an interim rule published in the Federal Register on December 30, 1996, and implements new licensing policies for general purpose non-recoverable non-voice encryption commodities or software of any key length for distribution to banks and financial institutions in specified countries.

EFFECTIVE DATE: This rule is effective: (DATE OF PUBLICATION).

FOR FURTHER INFORMATION CONTACT: James Lewis, Office of Strategic Trade and Foreign Policy Controls, Bureau of Export Administration, Telephone: (202) 482-0092.

BACKGROUND:

On December 30, 1996, the Bureau of Export Administration (BXA) published in the Federal Register (61 FR 68572) an interim rule that exercises jurisdiction over, and imposes new combined national security and foreign policy controls on, certain encryption items that were on the United States Munitions List, consistent with Executive Order (E.O.) 13026 and pursuant to

the Presidential Memorandum of that date, both issued by President Clinton on November 15, 1996.

BXA received comments from 45 commenters, and the comments fall into three broad categories: general concerns and objections to the policy embodied in the regulations; recommendations for specific changes or clarifications to the regulations that are consistent with the broad encryption policy implemented in the December 30 rule; and recommendations for additional changes to encryption policy.

Suggestions for changes to clarify existing policy

A number of commenters provided specific suggestions for changes or clarifications which are consistent with the intent of the policy and which would streamline or improve the regulations. Many of these suggestions are implemented in this rule, such as clarifying that the tools of trade provisions of License Exception TMP and License Exception BAG apply globally and clarifying that anti-virus software does not require a license for export.

Several commenters asked the Department of Commerce to adopt exemptions to license requirements which were available for encryption exporters under §123.16(b)(2) and (b)(9) of the International Traffic and Arms Regulations (ITAR), such as those which allowed the export of components to a U.S. subsidiary or which allowed the export of spare parts and components without a license for an already approved sale. This rule adds these new provisions under License Exception TMP, making them applicable to encryption controlled items as well as other items eligible for TMP treatment.

Two commenters asked that the regulations clarify that the ITAR licensing policy for equipment specially made for and limited to the encryption of interbanking transactions had not changed with the transfer of jurisdiction of encryption products to the Department of Commerce. This interim rule clarifies that this equipment is not subject to EI controls.

Several commenters recommended a number of changes to the Key Escrow Product and Agent criteria found in Supplement Nos. 4 and 5 part to 742 of the EAR. These recommendations were to simplify the criteria, and to modify some of the specific prescriptions to allow for greater flexibility and variation on the part of exporters. Many commenters found the criteria too bureaucratic and legalistic to help advance U.S. encryption policy goals, while others noted that the criteria were still overly focused on key escrow and not consistent with the broader approach to key recovery found elsewhere in the regulation. Several commenters also encouraged the administration to make clear that it had moved beyond key escrow to key recovery in its policy. One commenter focused on weaknesses and omissions found in the key escrow product and agent criteria found in Supplement Nos. 4 and 5 to part 742 of the EAR, and provided suggested additions to the criteria to make them more consistent with emerging business practices. The criteria specified in Supplement Nos. 4 and 5 were discussed extensively with industry prior to publication of the December 30 interim rule, and the rule reflects these discussions. However, BXA continues to look for ways to streamline the criteria, and will address revisions in a future regulation.

Several commenters expressed concerns over the longer processing time required for licenses at the Department of Commerce. Some commenters noted that the involvement of Departments of Energy and State, the Arms Control and Disarmament Agency and other agencies which did not review license applications for encryption products submitted to the Department of State added unnecessary levels of review and caused unwarranted delays. BXA is continuing to work with other reviewing Departments and Agencies to ensure expeditious review of encryption license applications. Many commenters noted that the requirements for a Department of Commerce license were substantially greater than what was required at the Department of State. The Department of Commerce, for example, requires an end-use certificate to be obtained for some destinations before approving an export; the Department of State did not and exporters question the need for this change. Other commenters noted that the Department of State licensing system was more flexible and faster for approvals of distribution and manufacturing arrangements. The Department of Commerce has no equivalent licenses, but is reviewing the possibility of such licenses. Many oral comments received since the close of the comment period note that unlike the Department of State, the Department of Commerce does not allow licenses to be amended, so that if an exporter has, for example, a license which allows him to ship to thirty countries and wishes to add one more, the Department of Commerce requires submission of an entire new license while the Department of State was content with a simple letter noting the requested change. This rule will now allow the addition of countries to an Encryption Licensing Arrangement by letter. BXA understands industry concerns about the license process under the EAR, and continues to look for ways to streamline the process.

Additional recommendations for changes to encryption policy

A number of commenters asked that the Administration revisit a number of decisions made in the course of the development of the encryption policy as reflected in the December 30 interim rule.

Several asked that we reconsider and liberalize the treatment of Cryptographic Application Program Interface. Others questioned the addition of "defense services" controls similar to that contained in the ITAR (which prohibits U.S. persons from assisting foreign entities from developing their own indigenous encryption products). Several commenters objected to the structure of License Exception KMI for non-recoverable 56 bit products, with its requirement for a review every six months. Other commenters also called for a reversal of the decision to exempt transferred encryption items from normal Department of Commerce regulatory practices. Finally, several commenters recommended that the licensing criteria and License Exceptions applicable to other dual-use items be fully applicable to encryption products, such as considerations of foreign availability, the de minimis content exclusion, public domain treatment and the use of License Exceptions. This rule focuses on clarifications to existing encryption policy.

Based on public comments to the December 30 interim rule, this interim rule specifically makes the following changes:

- In §§ 732.2(d) and 732.3(e)(2), makes editorial corrections to clarify that encryption items controlled for "EI" reasons under ECCNs 5A002, 5D002 and 5E002 are not eligible for De Minimis treatment.

- In §734.2, clarifies that downloading or causing the downloading of encryption source code and object code in Canada is not controlled and does not require a license.

- In §740.6, clarifies that letters of assurance required for exports under License Exception TSR may be accepted in the form of a letter or any other written communication from the importer, including communications via facsimile.

- §740.8 is also amended by adding a new paragraph to authorize, after a one-time technical review, exports and reexports under License Exception KMI of non-recoverable financial-specific encryption software (which is not eligible under the provisions of License Exception TSU for mass market software, such as SET or similar protocols) and commodities of any key length that are restricted by design (e.g., highly field-formatted with validation procedures, and not easily diverted to other end-uses) for financial applications to secure financial transactions, for end-uses such as financial transfers or electronic commerce. No business and marketing plan to develop, produce, or market encryption items with recoverable features is required. Such exports and reexports are eligible to all destinations except Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria. Conforming changes are also made in §742.15.

- §740.8 is also amended to authorize, after a one time review, exports and reexports under License Exception KMI of general purpose non-recoverable non-voice encryption commodities or software of any key length for distribution to banks and financial institutions (as defined in part 772 of the EAR) in destinations listed in new Supplement No. 3 to part 740, provided the end-use is limited to secure business financial communications or transactions or financial communications/transactions between the bank or financial institution and its customers. No customer to customer communications or transactions are permitted. Software and commodities that have already received a one-time technical review through a classification request or have been licensed for export under an Encryption Licensing Arrangement or a license are eligible for export to banks and financial institutions under License Exception KMI without an additional one-time technical review. Note that no business or marketing plan is required. Conforming changes are also made in §742.15. Software and commodities that have already been approved under an Encryption Licensing Arrangement to banks in specified countries may now be exported or reexported to other banks and financial institutions in those countries under the same Encryption Licensing Arrangement.

- In §740.9, removes the reference to Country Group D:1. With this change, commodities and software are eligible for export under the tools of trade provisions of License Exception TMP to all destinations except countries listed in country group E:2 or Sudan. This also clarifies that encryption software controlled for EI reasons under ECCN 5D002 may be pre-loaded on a laptop and temporarily exported under the tools of trade provisions of License Exception TMP to most countries, including those listed in Country Group D:1.

- Also in §740.9, adds a new paragraph (a)(2)(ix) to authorize under License Exception TMP the export of components, parts, tools or test equipment exported by a U.S. person to its subsidiary, affiliate or facility in a country in Country Group B that is owned or controlled by the U.S. person, if the components, part, tool or test equipment is to be used for manufacture, assembly, testing, production or modification, provided that no components, parts, tools or test equipment or the direct product of such components, parts, tools or test equipment are transferred or reexported to a country other than the United States from such subsidiary, affiliate or facility without a license or other authorization from BXA.

- In §740.11, excludes items controlled for EI reasons from eligibility under the International Safeguards provisions of License Exception GOV.

- In §740.14, clarifies existing provisions of License Exception BAG to distinguish temporary from permanent exports and imposes a restriction on the use of BAG for exports or reexports of EI-controlled items to terrorist supporting destinations or by persons other than U.S. citizens and permanent residents.

- New Supplement No. 3 to part 740 is added to list the countries eligible to receive under License Exception KMI general purpose non-recoverable non-voice encryption commodities or software of any key length for distribution to banks and financial institutions.

- In §742.15, adds 40-bit DES as being eligible for consideration under the 15-day review, for mass-market eligibility, subject to the additional criteria listed in Supplement No. 6 to part 742.

- In §742.15(b)(1), clarifies that subsequent bundling, updates or releases may be exported and reexported under applicable provisions of the EAR without a separate one-time technical review so long as the functional encryption capacity of the originally reviewed mass-
market encryption software has not been modified or enhanced.

- New paragraph (b)(4) is added to §742.15 to authorize exports and reexports under an Encryption Licensing Arrangement of general purpose non recoverable, non-voice encryption commodities and software of any key length for use by banks/financial institutions as defined in part 772 of the EAR in all destinations except Cuba, Iran, Iraq, Libya, North Korea, Syria and Sudan. No business or marketing plan is required. Exports and reexports for the end-uses to secure business financial communications or between the bank and/or financial institution and its customers will receive favorable consideration. No customer to customer communications or transactions are eligible under the Encryption Licensing Arrangement.

- In Supplement No. 4 to part 742, paragraph (3), revises "reasonable frequency" to "at least once every three hours" to resolve the ambiguity on how often the output must identify the key recovery agent and material/information required to decrypt the ciphertext.

- In Supplement No. 4 to part 742, paragraph (6)(i), clarifies that the U.S. government must be able to obtain the key(s) or other material/information needed to decrypt all data, without restricting the means by which the key recoverable products allow this.

- In Supplement No. 6 to part 742 for 7-day mass-market classification requests, clarifies that a copy of the encryption subsystem source code may be used instead of a test vector to determine eligibility for License Exception TSU for mass market software.

- In §743.1, requires reporting under the Wassenaar Arrangement for items controlled under ECCNs 5A002 and 5D002 when exported under specific provisions of License Exception KMI. This is not a new reporting requirement, but replaces and narrows the scope of the reporting requirement under the Encryption License Arrangement for financial-specific commodities and software and general purpose non-recoverable non-voice encryption commodities and software of any key length for distribution to banks and financial institutions that are eligible for License Exception KMI.

- In §§ 748.9 and 748.10, clarifies a long-standing policy that no support documentation is required for exports of technology or software, and it removes the requirement for such support documentation for exports of technology or software to Bulgaria, Czech Republic, Hungary, Poland, Romania, or Slovakia. This rule also exempts from support documentation requirements all encryption items controlled under ECCNs 5A002, 5B002, 5D002 and 5E002. This conforms with the practice under the ITAR prior to December 30, 1996.

- In §750.7, allows requests to add countries of destination to Encryption Licensing Arrangements by letter.

- In §752.3, excludes encryption items controlled for EI reasons from eligibility for a Special Comprehensive License.

- In §770.2, adds a new interpretation to clarify that encryption software controlled for EI reasons under ECCN 5D002 may be pre-loaded on a laptop and exported under the tools of trade provision of License Exception TMP or the personal use exemption under License Exception BAG, subject to the terms and conditions of such License Exceptions.

- In part 772, adds new definitions for "bank", "effective control", "encryption licensing arrangement", and "financial institution".

- In Supplement No. 1 to part 774, Category 5 - Telecommunications and Information Security is amended by revising ECCN 5A002 to authorize exports of components and spare parts under License Exception LVS, provided the value of each order does not exceed $500 and the components and spare parts are destined for items previously authorized for export, and to clarify that equipment for the encryption of interbanking transactions is not controlled under that entry.

- Revises the phrase "up to 56-bit key length DES" where it appears to read "56-bit DES or equivalent", and makes other editorial changes.

Note that this rule does not affect exports or reexports authorized under licenses issued prior to the effective date