ÿWPC¢ ȃü†‰œC€Ö©|¤Þ¸tòÔ0—c7í¯G€Ö1°é¹3ÐòÑd öÔåtu “Ñ¥£*(Ž°zåJ#2e!Ž8õÄumMø÷¯Ó´âÊ¿¶uÃܬ‘§»?¹¸„=9"â>BöÕ“ŸHX³&´Z5¼Î“Š²v&Úá© ,¨qy=@óöq nq.41 Ò†BE²JkuÊ(ï3y˜5Ùù H”A,E~ô ÇäZf…XX¬ì—ø!_õKP€wHµøÀ€dr¥§óŽŽå’›f ¬&%ǘÜÕ?Ê <8­gά}(»Ž,8#ÆÏ›½«LÂbV%ñé~˜_Sð§ÿ³ùùoØñ[cÞ]ñ í%¸¹|µl…éÅ6œ=…9âb§ÿ ºæk±~Yzç¾-Œ<Çõ@[¶Ë'œãrA2û“;ˆlJ))ApŹKîtI£c íxÙE<ôiùd1°ðö²3£)- |h„`@iFUë?uq¹¸„3<¾ò¥G)f‘#„ŽÇªçûêmŸ˜ñ£wÐÌ*ä,N0 bÛ/B7 ÆA7o%Lè „j:à•6vÑy7þg†û'¤;´[#^#I1äÉ&û½VÎhçõO‘'€¤# ø UN %Q 0(W w@ 4¿ Ó â ê U ò 0~ U: 0DÊ  0P 1m^ 1mËËËËËËËËËËËË B888888888888888888888888888888888888888888888888888ÆU 0+Æœ 0‡bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb 0Céé 0v,˜HP LaserJet 4WINSPOOL,ü,,,,,ü0 (ÖÃ9 Z ‹6Times New Roman RegularX($¡¡ ˜™š›œEžŸ ¡Dp^–% 3|x¡'ô\ `V& ÿÿ8Document[8]Document Styleà0..àà8` ..` àÌ<þ6X9`("Courier 10cpi(3¯$©©Ý ƒ!ÝÝ  Ý((3/Q$««Ý ƒ!ÝÝ  ÝÔ d Ô' e37=CIQYag³³1.a.i.(1)(a)(i)1)a)# e37=CIQYag­­1.a.i.(1)(a)(i)1)a) d1, 2, 3,Level 1Level 2Level 3Level 4Level 5B?my21, 2, 3,Numbersà  àÚƒRÚ2Ú  Ú.Û€RÛa, b, c,Level 1Level 2Level 3Level 4Level 5V1êa2a, b, c,Lowercase LettersÚƒVÚÚ  Ú.Û€VÛà0 à(ÿÿ$òòÚ  ÚÚ  Úóó(-!2Vf$¤¤Ý ƒ!ÝÝ  ÝÓÓ€€€€€òòÚ  Ú0Ú  ÚóóÝ ƒ!ÝÝ  Ý›ÌÓC€  e'#CÓÑ8°ÑÑ8°ÑÑ7€ÑXXdðdÈ7ÑÓÓà  àà ` àà ¸ àà  àà h àà À àà  àà p àà È àÌà  àà ` àà ¸ àà  àà h àà À àà  àà p àÌà  àà ` àà ¸ àà  àà h àà À àà  àà p àà È àBilling€Code:€3510„33„PÌà  àà ` àà ¸ àà  àà h àà À àà  àà p àÌÌDEPARTMENT€OF€COMMERCEÌÌBureau€of€Export€AdministrationÌÌ15€CFR€Parts€740,€742,€743,€772€and€774ÌÌ[Docket€œNo.€9809„11233„8318„02›€]ÌÌRIN:€0694„AB80ÌÌEncryption€ItemsÌ€ÌAGENCY:€Bureau€of€Export€Administration,€Commerce.ÌÌACTION:€€Interim€œrule;€request€for€comments.›à  à€Ð È($' ÐÌSUMMARY:Ð ˆ,P(+ ЇœBackgroundÌÌThis›€interim€rule€amends€the€Export€Administration€Regulations€(EAR)€for€exports€and€reexportsÏof€€encryption€commodities€and€software€to€U.S.€subsidiaries,€insurance€companies,€health€andÏmedical€end„users,€on„line€merchants€and€foreign€commercial€œfirms.€€This›€rule€implements€theÏœAdministrationððs›€initiative€to€update€it's€encryption€œpolicy,€and€will›€streamline€U.S.€encryptionÏexport€and€reexport€œcontrols.›€€ÌÌœDATES:€€This›€rule€is€effective:€œDecember€31,€1998.›€€Comments€must€be€received€on€or€beforeÏœMarch€1,€1999.›ÌœÌADDRESSES:€Written€comments€on€this€rule€should€be€sent€to€Nancy€Crowe,€Regulatory€PolicyÏDivision,€Bureau€of€Export€Administration,€Department€of€Commerce,€P.O.€Box€273,ÏWashington,€DC€20044.€€Express€mail€address:€Nancy€Crowe,€Regulatory€Policy€Division,ÏBureau€of€Export€Administration,€Department€of€Commerce,€14th€Street€and€Pennsylanvia€Ave,ÏN.W.,€Room€2705,€Washington,€DC€20230.€ÌÌFOR›€FURTHER€INFORMATION€CONTACT:€James€Lewis,€Office€of€Strategic€Trade€andÏForeign€Policy€Controls,€Bureau€of€Export€Administration,€Telephone:€(202)€482„0092.à Ð à€Ð ø%À!$ ÐœÌ̛Р˜+`'* ÐœSUPPLEMENTARY€INFORMATION:›ÌÌœOn›€September€16,€1998,€the€Administration€announced€a€series€of€steps€to€update€its€encryptionÏpolicy€in€a€way€that€meets€the€full€range€of€national€interests.€€These€steps€will€promoteÏelectronic€commerce,€support€law€enforcement€and€national€security,€and€protect€privacy.€€TheyÏalso€further€streamline€exports€and€reexports€of€key€recovery€productsò ò,ó ó€and€other€recoverableÐ ˜ `  Ðencryption€products,€which€allow€for€the€recovery€of€plaintext,€and€permit€exports€and€reexportsÏof€encryption€of€any€key€length€(with€or€without€key€recovery)€to€several€industry€sectors.€€ThisÏinterim€rule€amends€the€EAR€for€exports€and€reexports€of€encryption€commodities€and€softwareÏto€U.S.€subsidiaries,€insurance€companies,€health€and€medical€end„users,€on„line€merchants€andÏforeign€commercial€firms.€Specifically,€this€rule€amends€the€EAR€in€the€following€ways:ÌÌà  à1.€€€In€ðð740.8,€Key€Management€Infrastructure,€removes€the€key€recovery€agentÏrequirements€for€License€Exception€KMI€eligibility€for€exports€and€reexports€of€recovery€Ïencryption€commodities€and€software.€€Further,€key€recovery€commitment€plans€and€the€sixÏmonth€progress€reviews€are€eliminated€and€exporters€are€no€longer€required€to€name€or€submit€toÏBXA€additional€information€on€a€key€recovery€agent€prior€to€export.€€The€products€may€beÏexported€or€reexported€under€License€Exception€KMI€after€a€technical€review.€€Note€also€that€56„¼bit€products€supported€by€a€KMI€plan€that€have€been€classified€after€a€technical€review€and€areÏeligible€under€License€Exception€KMI€are€now€eligible€for€export€and€reexport€under€LicenseÏException€ENC€(see€ðð740.17(a)(3)€of€the€EAR).€€ÌÐ ˜+`'* Ðà  à2.€€Also€in€ðð740.8,€œ€removes€and€adds€to€newly€created€License€Exception€ENC€the›Ïparagraphs€concerning€financial„specific€encryption€commodities€and€software€and€generalÏpurpose€encryption€commodities€and€software€for€banks€and€financial€œinstitutions.›€This€transferÏwill€simplify€the€use€of€License€Exceptions€for€encryption€commodities€and€œsoftware›€and€createsÏno€change€in€œpolicy.›ÌÌà  à3.€€In€part€740,€creates€new€License€Exception€ENC€by€adding€ðð740.17,€EncryptionÏcommodities€and€software.€€This€new€License€Exception€is€divided€into€two€significant€parts:€aÏglobal€category€including€the€use€of€License€Exception€ENC€for€exports€and€reexports€ofÏencryption€commodities€and€software€to€all€destinations,€except€Cuba,€Iran,€Iraq,€Libya,€NorthÏKorea,€Sudan€and€Syria;€and€a€country€specific€category€permitting€the€use€of€License€ExceptionÏENC€for€exports€and€reexports€of€encryption€commodities€and€software€to€countries€listed€inÏSupplement€No.€3€to€part€740.€€This€new€License€Exception€allows€the€following€exports€andÏreexports€of€encryption€commodities€and€software€that€are€classified€under€ECCNs€5A002€andÏ5D002,€after€a€technical€review€that€considers€the€cryptographic€functionality€of€the€product:ÌÌà  àà ` àa.€Exports€and€reexports€of€encryption€commodities,€software€and€technology,Ïincluding€source€code€of€any€key€length€are€also€eligible€under€this€license€exception€to€U.S.Ïsubsidiaries€for€internal€company€proprietary€use€to€all€destinations€except€Cuba,€Iran,€Iraq,ÏLibya,€North€Korea,€Sudan€and€Syria.€€Encryption€chips,€integrated€circuits,€toolkits,€executableÏor€linkable€modules,€which€can€modify€or€enhance€the€cryptographic€functionality€(e.g.,€theÏconfidentiality€€algorithm,€key€space€and€key€exchange€mechanism)€or€incorporate€theÐ ˜+`'* Ðcryptographic€function€in€another€item€are€eligible€for€license€exception€ENC€only€for€export€toÏU.S.€subsidiaries.€€Note€that€exports€toò ò€ð ðó óstrategic€partnersò òððó ó€of€U.S.€companies,€such€asÐ à Ðsubcontractors€and€joint€ventures,€will€be€considered€favorably€under€a€license€when€the€end„useÏis€for€the€protection€of€U.S.€company€proprietary€information.ò ò€ó óFor€the€purposes€of€thisÐ Ø   Ðregulation,€consideration€as€a€ð ðstrategic€partner,ðð€as€defined€in€part€772,€should€not€be€deemed€toÏalter€or€affect€any€legal€relationship€that€might€otherwise€exist€between€the€relevant€parties.ÌÌà  àà ` àb.€Encryption€commodities,€including€mass€market€and€non„mass€marketò ò,€ó óandÐ X  Ðnon„mass€market€software€incorporating€symmetric€algorithms€with€key€lengths€up€to€andÏincluding€56„bits,€such€as€DES€or€equivalent€(such€as€RC2,€RC4,€RC5€and€CAST)€to€allÏdestinations€except€Cuba,€Iran,€Iraq,€Libya,€North€Korea,€Sudan€and€Syria.€€Encryption€œchips,›Ïintegrated€circuits,€toolkits€and€executable€or€linkable€modules€are€not€authorized€for€exportÏunder€License€Exception€ENC€and€will€require€a€license€or€an€Encryption€LicensingÏArrangement.€€Note€that€subsequent€bundling,€updates€or€releases€may€be€exported€andÏreexported€under€applicable€provisions€of€the€EAR€without€a€separate€technical€review€as€long€asÏthe€functional€encryption€capacity€of€the€originally€reviewed€encryption€commodities,€includingÏmass€market€and€non„mass€market,€and€non„mass€market€software€has€not€been€modified€orÏenhanced.€ÌÌà  àà ` àc.€Authorizes€insurance€companies€to€receive€general€purpose€encryptionÏcommodities€and€software€of€any€key€length€that€have€been€classified€after€a€technical€review.€ÏThis€change€corresponds€with€the€addition€of€insurance€companies€to€the€definition€of€financialÐ ˜+`'* Ðinstitutions€in€part€772.€€With€this€change,€exports€and€reexports€of€general€purpose€encryptionÏcommodities€and€software€are€eligible€under€License€Exception€ENC€to€financial€institutionsÏ(including€insurance€companies)€in€all€destinations€listed€in€Supplement€No.€3€to€part€740,€and€toÏbranches€of€these€entities€located€worldwide€except€countries€that€support€international€terrorismÏ(Cuba,€Iran,€Iraq,€Libya,€North€Korea,€Sudan€and€Syria).ÌÌà  àà ` àd.€Encryption€commodities€and€software€of€any€key€length€to€health€and€medicalÏend„users€in€all€destinations€listed€in€Supplement€No.€3€to€part€740.€€Exports€and€reexports€ofÏsuch€commodities€and€software€are€not€eligible€under€License€Exception€ENC€to€non„U.S.Ïbiochemical€and€pharmaceutical€manufacturers€and€non„U.S.€military€health€and€medicalÏentities.€Licenses€for€such€entities€will€be€considered€on€a€case„by„case€basis.Ì€à  àÐ Ø  Ðà  àà ` àe.€€Encryption€commodities€and€software€of€any€key€length€for€on„line€merchantsÏin€all€destinations€listed€in€Supplement€No.€3€to€part€740.€€Such€commodities€and€software€mustÏbe€limited€to€client„server€applications€(e.g.,€Secure€Socket€Layer€(SSL)€based€applications)€orÏapplications€specially€designed€for€on„line€transactions.€End„use€is€limited€to€the€purchase€or€saleÏof€goods€and€software;€and€services€connected€with€the€purchase€or€sale€of€goods€and€software,Ïincluding€interactions€between€purchasers€and€sellers€necessary€for€ordering,€payment€andÏdelivery€of€goods€and€software.€€No€other€end„uses€or€customer€to€customer€communications€orÏtransactions€are€allowed.€€Foreign€on„line€merchants€or€their€separate€business€units€who€areÏengaged€in€the€manufacturing€and€distribution€of€items€or€services€controlled€on€the€U.S.ÏMunitions€List€are€excluded.€€Foreign€government€end„users€also€are€excluded€from€this€LicenseÐ ˜+`'* ÐException.ÌÌExamples€of€permitted€end„uses€under€License€Exception€ENC€for€on„line€merchants€includeÏbuying€and€selling€goods€and€software€through€an€electronic€medium,€which€may€involve€theÏordering€of,€and€payment€for€goods€and€software;€placing€and€receiving€orders;€pricing,Ïconfiguration,€validation€and€ordering€of€products;€obtaining€copies€of€invoices;€reviewingÏshipping€schedules;€notification€of€shipments€or€changes;€and€placing€reservations€andÏpurchasing€airline€tickets.€€It€allows€for€contract€manufacturers€to€directly€access€demand€andÏinventory€information;€direct€purchasing€with€trading€partners;€approval€functions€forÏrequisitions€which€require€approval;€and€on„line€catalogue€purchases,€and€the€electronicÏexchange€of€purchase€or€sales€information€by€multiple€trading€partners.€€It€does€not€include€suchÏend„uses€as€general€purpose€messaging,€collaborative€research€projects€(e.g.,€collaborativeÏengineering),€data€warehousing,€remote€computing€services€or€electronic€communicationsÏservices.ÌÌà  à4.€€In€Supplement€No.€3€to€part€740,€adds€Czech€Republic€and€United€States€to€the€list€ofÏcountries€to€clarify€that€branches€of€Czech€Republic€and€U.S.€banks€and€financial€institutions,Ïlocated€worldwide€except€in€countries€that€support€international€terrorism€(Cuba,€Iran,€Iraq,ÏLibya,€North€Korea,€Sudan€and€Syria)€may€receive€general€purpose€encryption€commodities€andÏsoftware€limited€to€secure€business€financial€communications€or€transactions€and€financialÏcommunications€or€transactions€between€the€bank€and/or€financial€institution€and€its€customers.€ÏSupplement€No.€3€is€also€amended€to€reflect€the€licensing€policy€for€exports€and€reexports€ofÐ ˜+`'* Ðrecoverable€encryption€commodities€and€software€to€commercial€entities€located€in€certainÏcountries€and€subsidiaries€of€commercial€entities€headquartered€in€certain€countries,€whereverÏlocated,€except€Cuba,€Iran,€Iraq,€Libya,€North€Korea,€Sudan€and€Syria.ÌÌà  à5.€€In€ðð742.15,€revises€the€licensing€policy€for€exports€and€reexports€of€encryption€itemsÏas€follows:€€ÌÌà  àà ` àa.€€Removes€the€business€and€marketing€plan€requirement€for€exports€of€non„¼recovery€56„bit€DES€or€equivalent€encryption€items.ÌÌà  àà ` àb.€€Authorizes€upgrades€of€40„bit€mass„market€encryption€software€that€hasÏalready€been€classified€after€a€technical€review€and€released€from€EI€controls.€€Such€softwareÏmay€be€upgraded€to€56„bits€for€the€confidentiality€algorithm€without€an€additional€technicalÏreview.ÌÌà  àà ` àc.€€Makes€certain€encryption€commodities€eligible€for€mass„market€treatment.ÌÌà  àà ` àd.€€For€exports€and€reexports€of€general€purpose€encryption€commodities€andÏsoftware€of€any€key€length€that€are€not€eligible€under€License€Exception€ENC,€insuranceÏcompanies€are€now€eligible€to€receive€such€products€under€an€Encryption€LicensingÏArrangement.€€This€is€consistent€with€the€addition€of€insurance€companies€to€the€definition€of€Ïfinancial€institutions€in€part€772.€€Such€encryption€commodities€and€software€will€receiveÐ ˜+`'* Ðfavorable€consideration€when€the€end„use€is€limited€to€secure€financial€communications€orÏtransactions,€provided€that€there€are€no€concerns€about€the€country€or€specific€end„user.ÌÌà  àà ` àe.€€€For€exports€and€reexports€of€encryption€commodities€and€software€of€any€keyÏlength€not€eligible€under€License€Exception€ENC,€such€commodities€and€software€will€generallyÏbe€approved€under€an€Encryption€Licensing€Arrangement€to€all€health€and€medical€end„users,Ïexcept€non„U.S.€biochemical€and€pharmaceutical€manufacturers€and€non„U.S.€military€health€andÏmedical€entities,€in€all€destinations€except€Cuba,€Iran,€Iraq,€Libya,€North€Korea,€Sudan€and€Syria.̛̜Ìà  àà ` àf.€€For€exports€and€reexports€of€encryption€commodities€and€software€of€any€keyÏlength€not€eligible€under€License€Exception€ENC,€such€commodities€and€software€will€generallyÏbe€approved€under€an€Encryption€Licensing€Arrangement€to€on„line€merchants€in€all€destinationsÏexcept€Cuba,€Iran,€Iraq,€Libya,€North€Korea,€Sudan€and€Syria.€€The€end„use€is€limited€to€theÏpurchase€or€sale€of€goods€and€software;€and€services€connected€with€the€purchase€or€sale€ofÏgoods€and€software€including€interactions€between€purchasers€and€sellers€necessary€for€ordering,Ïpayment€and€delivery€of€goods€and€software.€€No€other€end„uses€or€customer„to„customerÏcommunications€or€transactions€are€allowed.€ÌÌà  àà ` àg.€€Exports€and€reexports€of€recoverable€encryption€commodities€and€software€ofÏany€key€length€for€use€by€commercial€entities€will€generally€be€approved€under€an€EncryptionÏLicensing€Arrangement€to€destinations€listed€in€Supplement€No.€3€to€part€740€for€the€protectionÐ ˜+`'* Ðof€company€proprietary€information.€€Such€encryption€commodities€and€software€will€alsoÏgenerally€be€approved€for€export€and€reexport€to€worldwide€foreign€subsidiaries€of€commercialÏfirms€headquartered€in€certain€countries,€except€to€subsidiaries€located€in€Cuba,€Iran,€Iraq,€Libya,ÏNorth€Korea,€Sudan€and€Syria.ÌÌNote€that€any€country€or€end„user€prohibited€in€the€past€from€receiving€encryption€commoditiesÏand€software€under€a€specific€Encryption€Licensing€Arrangement€is€reviewed€on€a€case„by„caseÏbasis,€and€may€be€considered€by€BXA€for€eligibility€under€future€Encryption€LicensingÏArrangement€requests.€€All€other€exports€and€reexports€of€encryption€items€are€reviewed€on€aÏcase„by„case€basis€under€a€license€application.€€€ÌÌà  à6.€€Also€in€ðð742.15,€clarifies€the€reporting€requirement€for€exports€to€certain€end„users.ÌÌà  à7.€€In€part€772,€revises€the€definition€of€financial€institution€to€include€the€meaning€ofÏinsurance€company€and€adds€definitions€for€business€unit,€health€and€medical€end„user,€on„lineÏmerchant,€recoverable€commodities€and€software,€strategic€partner€(of€a€U.S.€company),€and€U.S.Ïsubsidiary.€€Also€clarifies€that€such€definitions€only€apply€to€encryption€items.ÌÌBXA€will€in€the€near€future€update€these€regulations€to€reflect€changes€to€encryption€controls€inÏthe€Wassenaar€Arrangement€and€to€address€public€comments€on€the€September€22,€1998€rule€(63ÏFR€50516)€that€implemented€new€licensing€policies€for€banks€and€financial€institutions.€ÌÐ ˜+`'* ÐRulemaking€Requirements̜ԇ XÑXXXÔÔ#†XÑXX XÑË=#ÔÔ‡ XÑXXXÑÔÌà  à1.€€This€interim€rule€has€been€determined€to€be€significant€for€purposes€of€E.€O.€12866.ÌÌà  à2.€€Ô#†XÑXX XÑ >#ÔNotwithstanding€any€other€provision€of€law,€no€person€is€required€to€respond€to,€norÐ ¸ € Ðshall€any€person€be€subject€to€a€penalty€for€failure€to€comply€with€a€collection€of€information,Ïsubject€to€the€requirements€of€the€Paperwork€Reduction€Act,€unless€that€collection€of€informationÏdisplays€a€currently€valid€Office€of€Management€and€Budget€Control€Number.Ô‡ XÑXXXÑÔ€This€rule€containsÐ X  Ðcollections€of€information€subject€to€the€Paperwork€Reduction€Act€of€1980€(44€U.S.C.€3501€òòetÐ 8 Ðseq.óó).€€These€collections€have€been€approved€by€the€Office€of€Management€and€Budget€underÐ à Ðcontrol€numbers€0694„0088,€Ô#†XÑXX XÑ<@#ÔÔ‡ XÑXXXÑÔð ðMulti„Purpose€Application,ðð€which€carries€a€burden€hour€estimateÐ øÀ Ðof€52.5€minutes€per€submission;Ô#†XÑXX XѦA#ÔÔ‡ XÑXXXÑÔ€and€0694„0104,€ð ðÔ#†XÑXX XÑcB#ÔÔ‡ XÑXXXÑÔCommercial€Encryption€Items€TransferredÐ Ø  Ðfrom€the€Department€of€State€to€the€Department€of€Commerce.ðð€€The€Department€has€submittedÏto€OMB€an€emergency€request€for€approval€of€the€changes€to€the€collection€of€information€underÏOMB€control€number€0694„0104.€€Comments€on€collection€0694„0104€will€be€accepted€untilÏÔ#†XÑXX XѹB#ÔMarch€1,€1999Ô‡ XÑXXXÑÔ.€€€€€Ð X  ÐÌIt€will€take€companies€15€minutes€to€complete€each€certification.€€It€will€take€companies€15Ïminutes€to€complete€notifications.€€For€reporting€under€License€Exception€KMI,€it€will€takeÏcompanies€1€hour€to€complete€KMI€reporting.€€For€reporting€under€License€Exception€ENC,€itÏwill€take€companies€4€hours€to€complete€ENC€reporting.ÌÔ#†XÑXX XÑXD#ÔÔ‡ XÑXXXÑÔÐ ˜+`'* Ðà  à3.€Ô#†XÑXX XÑF#ÔÔ‡ XÑXXXÑÔ€€€Ô#†XÑXX XÑgF#ÔÔ‡ XÑXXXÑÔThis€rule€does€not€contain€policies€with€Federalism€implications€sufficient€to€warrantÐ 8 Ðpreparation€of€a€Federalism€assessment€under€E.O.€12612.ÌÔ#†XÑXX XѬF#ÔÔ‡ XÑXXXÑÔÌà  à4.€€The€provisions€of€the€Administrative€Procedure€Act€(5€U.S.C.€553)€requiring€notice€ofÏproposed€rulemaking,€the€opportunity€for€public€participation,€and€a€delay€in€effective€date,€areÏinapplicable€because€this€regulation€involves€a€military€and€foreign€affairs€function€of€the€UnitedÏStates€(Sec.€5€U.S.C.€553(a)(1)).€€Further,€no€other€law€requires€that€a€notice€of€proposedÏrulemaking€and€an€opportunity€for€public€comment€be€given€for€this€interim€final€rule.€€BecauseÏa€notice€of€proposed€rulemaking€and€an€opportunity€for€public€comment€are€not€required€to€beÏgiven€for€this€rule€under€5€U.S.C.€or€by€any€other€law,€the€requirements€of€the€RegulatoryÏFlexibility€Act€(5€U.S.C.€601€òòet€seq.óó€)€are€not€applicable.Ð øÀ ÐÌà  àHowever,€because€of€the€importance€of€the€issues€raised€by€these€regulations,€this€rule€isÏissued€in€interim€form€and€comments€will€be€considered€in€the€development€of€final€regulations.€ÏAccordingly,€the€Department€of€Commerce€encourages€interested€persons€who€wish€to€commentÏto€do€so€at€the€earliest€possible€time€to€permit€the€fullest€consideration€of€their€views.€ÌÌà  àThe€period€for€submission€of€comments€will€close€March€1,€1999.€€The€Department€willÏconsider€all€comments€received€before€the€close€of€the€comment€period€in€developing€finalÏregulations.€€Comments€received€after€the€end€of€the€comment€period€will€be€considered€ifÏpossible,€but€their€consideration€cannot€be€assured.€€The€Department€will€not€accept€publicÏcomments€accompanied€by€a€request€that€a€part€or€all€of€the€material€be€treated€confidentiallyÐ ˜+`'* Ðbecause€of€its€business€proprietary€nature€or€for€any€other€reason.€€The€Department€will€returnÏsuch€comments€and€materials€to€the€persons€submitting€the€comments€and€will€not€consider€themÏin€the€development€of€final€regulations.€€All€public€comments€on€these€regulations€will€be€aÏmatter€of€public€record€and€will€be€available€for€public€inspection€and€copying.€€In€the€interest€ofÏaccuracy€and€completeness,€the€Department€requires€comments€in€written€form.€€CommentsÏshould€be€provided€with€5€copies.ÌÌà  àOral€comments€must€be€followed€by€written€memoranda,€which€will€also€be€a€matter€ofÏpublic€record€and€will€be€available€for€public€review€and€copying.ÌÌà  àThe€public€record€concerning€these€regulations€will€be€maintained€in€the€Bureau€ofÏExport€Administration€Freedom€of€Information€Records€Inspection€Facility,€Room€4525,ÏDepartment€of€Commerce,€14th€Street€and€Pennsylvania€Avenue,€N.W.,€Washington,€D.C.Ï20230.€€Records€in€this€facility,€including€written€public€comments€and€memoranda€summarizingÏthe€substance€of€oral€communications,€may€be€inspected€and€copied€in€accordance€withÏregulations€published€in€part€4€of€Title€15€of€the€Code€of€Federal€Regulations.€€Information€aboutÏthe€inspection€and€copying€of€records€at€the€facility€may€be€obtained€from€Henry€Gaston,€BureauÏof€Export€Administration€Freedom€of€Information€Officer,€at€the€above€address€or€by€callingÏ(202)€482„5653.ÌÌThe€reporting€burden€for€this€collection€is€estimated€to€be€approximately€815€hours,€including€theÏtime€for€gathering€and€maintaining€the€data€needed€for€completing€and€reviewing€the€collectionÐ ˜+`'* ЇÌof€information.€€Comments€are€invited€on:€(a)€whether€the€collection€of€information€is€necessaryÏfor€the€proper€performance€of€the€functions€of€the€agency,€including€whether€the€informationÏshall€have€practical€utility;€(b)€the€accuracy€of€the€agency's€estimate€of€the€burden€of€theÏproposed€collection€of€information;€(c)€ways€to€enhance€the€quality,€utility,€and€clarity€of€theÏinformation€to€be€collected;€and€(d)€ways€to€minimize€the€burden€of€the€collection€of€Ìinformation€on€respondents,€including€through€the€use€of€automated€collection€techniques€orÏother€forms€of€information€technology.€€Comments€regarding€these€burden€estimates€or€any€otherÏaspect€of€the€collection€of€information,€including€suggestions€for€reducing€the€burdens,€should€be€Ìforward€to€Nancy€Crowe,€Regulatory€Policy€Division,€Office€of€Exporter€Services,€Bureau€ofÏExport€Administration,€Department€of€Commerce,€P.O.€Box€273,€Washington,€D.C.€20044,€andÏDavid€Rostker,€Office€of€Management€and€Budget,€OMB/OIRA,€725€17th€Street,€NW,ÌNEOB€Rm.€10202,Washington,€D.C.€20503.Ô#†XÑXX XÑ’G#ԛР¸€ ÐÌList€of€SubjectsÌÌ15€CFR€Parts€740€and€743ÌÌà  àAdministrative€practice€and€procedure,€Exports,€Foreign€trade,€Reporting€andÏrecordkeeping€requirements.ÌÌ15€CFR€Parts€742,€772€and€774Ð ˜+`'* Їà  àExports,€foreign€trade.ÌÌà  àAccordingly,€15€CFR€Chapter€7,€Subchapter€C,€is€amended€to€read€as€follows:ÌÌÝ‚SmyÿÝÝ  ÝÝ‚SmyZÝà  àÚƒRÚ1Ú  Ú.Û€RÛÝ  Ý€€The€authority€citation€for€15€CFR€parts€740€and€772€continues€to€read€as€follows:݃SmyZ0ZÝŒÌŒÝ  ÝòòÌà  àAuthorityóó:€50€U.S.C.€app.€2401€òòet€seqóó.;€50€U.S.C.€1701€òòet€seqóó.;€E.O.€12924,€59€FR€43437,Ð x@  Ð3€CFR,€1994€Comp.,€p.€917;€Executive€Order€13026€(November€15,€1996,€61€FR€58767);€NoticeÏof€August€17,€1998€(63€FR€55121,€August€17,€1998).Ô‡ XMXXXÑÔò òÐ 8 ÐÔ#†XÑXX XM\#ÔÌó óÝ‚SmyÿÝÝ  ÝÝ‚Smy{\Ýà  àÚƒRÚ2Ú  Ú.Û€RÛÝ  Ý€€The€authority€citation€for€15€CFR€part€742€continues€to€read€as€follows:݃Smy{\–\݌РøÀ ÐŒÝ  ÝÌò òà  àó óòòAuthorityóó:€50€U.S.C.€app.€2401€òòet€seqóó.;€50€U.S.C.€1701€òòet€seqóó.;€18€U.S.C.€2510€òòet€seqóó.;€22Ð ¸€ ÐU.S.C.€3201€òòet€seqóó.;€42€U.S.C.€2139a;€€E.O.€12058,€43€FR€20947,€3€CFR,€1978€Comp.,€p.€179;Ð ˜` ÐE.O.€12851,€3€CFR,€1993€Comp.,€p.€608;€E.O.€12924,€59€FR€43437,€3€CFR,€1994€Comp.,€p.€917;ÏE.O.€12938,€3€CFR,€1994€Comp.,€p.€950;€E.O.€13020,€3€CFR,€1996€Comp.€p.€219;€E.O.€13026,€3ÏCFR,€1996€Comp.,€p.€228;€Notice€of€August€17,€1998€(63€FR€55121,€August€17,€1998).Ô‡ XMXXXÑÔò òÐ 8"  ÐÌó óÔ#†XÑXX XM_#ÔÝ‚SmyÿÝÝ  ÝÝ‚Smyë_Ýà  àÚƒRÚ3Ú  Ú.Û€RÛÝ  Ý€€The€authority€citation€for€15€CFR€part€743€continues€to€read€as€follows:݃Smyë_`݌Рø%À!$ ÐŒÝ  ÝÌà  àòòAuthorityóó:€50€U.S.C.€app.€2401€òòet€seqóó.;€50€U.S.C.€1701€òòet€seqóó.;€E.O.€12924,€59€FR€43437,Ð ¸)€%( Ð3€CFR,€1994€Comp.,€p.€917;€Notice€of€August€17,€1998€(63€FR€55121,€August€17,€1998).Ð ˜+`'* ЇÝ‚SmyÿÝÝ  ÝÝ‚SmyÜaÝà  àÚƒRÚ4Ú  Ú.Û€RÛÝ  Ý€€The€authority€citation€for€15€CFR€part€774€continues€to€read€as€follows:݃SmyÜa÷aÝŒÌŒÝ  ÝÌòòà  àAuthorityóó:€50€U.S.C.€app.€2401€òòet€seqóó.;€50€U.S.C.€1701€òòet€seqóó.;€10€U.S.C.€7420;€10Ð øÀ ÐU.S.C.€7430(e);€18€U.S.C.€2510€òòet€seqóó.;€22€U.S.C.€287c;€22€U.S.C.€3201€òòet€seqóó.;€22€U.S.C.€6004;Ð Ø   ÐSec.€201,€Pub.€L.€104„58,€109€Stat.€557€(30€U.S.C.€185(s));€30€U.S.C.€185(u);€42€U.S.C.€2139a;Ï42€U.S.C.€6212;€43€U.S.C.€1354;€46€U.S.C.€app.€466c;€50€U.S.C.€app.€5;€E.O.€12924,€59€FRÏ43437,€3€CFR,€1994€Comp.,€p.€917;€Executive€Order€13026€(November€15,€1996,€61€FR€58767);€ÏNotice€of€August€17,€1998€(63€FR€55121,€August€17,€1998).òòÐ X  ÐóóÐ  8 ÐPART€740€„€[AMENDED]ÌÌÝ‚SmyÿÝÝ  ÝÝ‚Smy[eÝà  àÚƒRÚ5Ú  Ú.Û€RÛÝ  Ý€€Section€740.8€is€amended:݃Smy[eveÝŒÌŒÝ  ÝÌà  àà ` àa.€€By€revising€the€section€title;ÌÌà  àà ` àb.€€By€revising€paragraph€(b);ÌÌà  àà ` àc.€€By€removing€paragraph€(d);€andÌÌà  àà ` àd.€€By€redesignating€paragraph€(e)€as€paragraph€(d)€to€read€as€follows:ÌÌðð740.8€Key€management€infrastructure€(KMI)ÌÌÌ(a)€*€€€€€*€€€€€*ÌÌ(b)€€òòEligible€commodities€and€softwareóó.€€(1)€Recovery€encryption€commodities€and€software€ofÐ $à" Ðany€key€length€controlled€under€ECCNs€5A002€and€5D002€that€have€been€classified€after€aÏtechnical€review€through€a€classification€request.€€Key€escrow€and€key€recovery€commodities€andÏsoftware€must€meet€the€criteria€identified€in€Supplement€No.€4€to€part€742€of€the€EAR.ÌÐ ˜+`'* Ðà  àà ` à(2)€€For€such€classification€requests,€indicate€ð ðLicense€Exception€KMIðð€in€block€9Ïon€Form€BXA„748P.€€Submit€the€original€request€to€BXA€in€accordance€with€ðð748.3€of€the€EARÏand€send€a€copy€of€the€request€to:ÌÌà  àà ` àà ¸ àà  àAttn:€KMI€Encryption€Request€CoordinatorÌà  àà ` àà ¸ àà  àP.O.€Box€246Ìà  àà ` àà ¸ àà  àAnnapolis€Junction,€MD€20701„0246ÌÌà  àÌÓ  Ó*€€€€€*€€€€€*€€€€€*€€€€€*ÌÓìjÓÌÌÝ‚SmyÿÝÝ  ÝÝ‚Smy$kÝà  àÚƒRÚ6Ú  Ú.Û€RÛÝ  Ý€€Part€740€is€amended€by€adding€a€new€ðð740.17€to€read€as€follows:݃Smy$k?kÝŒÌŒÝ  ÝÌÌÌðð740.17€Encryption€commodities€and€software€(ENC).ÌÌ(a)€òòExports€and€reexports€of€encryption€commodities€and€software€to€all€destinations€exceptÐ ø%À!$ ÐCuba,€Iran,€Iraq,€Libya,€North€Korea,€Sudan€and€Syriaóó.Ð Ø' #& ÐÌà  à(1)€òòFinancial„specific€encryption€commodities€and€software€of€any€key€lengthóóòò.€€óóÐ ˜+`'* Ðà  àà ` àÌà  àà ` à(i)€òòScopeóó.€You€may€export€and€reexport€financial„specific€encryption€commoditiesÐ à Ðand€software€(which€are€not€eligible€under€the€provisions€of€License€Exception€TSU€for€massÏmarket€software€such€as€SET€or€similar€protocols)€of€any€key€length€that€are€restricted€by€designÏ(e.g.,€highly€field„formatted€with€validation€procedures,€and€not€easily€diverted€to€other€end„uses)Ïfor€financial€applications€to€secure€financial€communications/transactions€for€end„uses€such€asÏfinancial€transfers,€or€electronic€commerce.ÌÌà  àà ` à(ii)€òòEligible€commodities€and€softwareóó.€€Encryption€commodities€and€software€ofÐ 8 Ðany€key€length€classified€under€ECCNs€5A002€and€5D002€after€a€technical€review€(seeÏparagraph€(c)€of€this€section).€These€commodities€and€software€must€be€specifically€designed€andÏlimited€for€use€in€the€processing€of€electronic€financial€(commerce)€transactions,€whichÏimplements€cryptography€in€specifically€delineated€fields€such€as€merchantððs€identification,€theÏcustomerððs€identification€and€address,€the€merchandise€purchased€and€the€payment€mechanism.€ÏIt€does€not€allow€for€encryption€of€data,€text€or€other€media€except€as€directly€related€to€theseÏelements€of€the€electronic€transaction€to€support€financial€communications/transactions.€ÏNotwithstanding€the€provisions€of€paragraph€(c)(2)€of€this€section,€financial„specificÏcommodities€and€software€that€were€made€eligible€for€License€Exception€KMI€after€a€technicalÏreview€prior€œto›œ€December€31,€1998›€are€now€eligible€for€export€and€reexport€under€LicenseÏException€ENC€under€the€provisions€of€this€paragraph€(a)(1).€€ÌÌà  àà ` à(iii)€òòEligible€destinationsóó.€Upon€approval€of€your€classification€request,€you€mayÐ ˜+`'* Ðexport€and€reexport€under€License€Exception€ENC€financial„specific€encryption€commoditiesÏand€software,€as€defined€in€this€paragraph€(a)(1),€of€any€key€length€to€all€destinations€exceptÏCuba,€Iran,€Iraq,€Libya,€North€Korea,€Sudan€and€Syria.ÌÌà  àà ` à(iv)€òòReporting€requirementsóó.€€There€are€no€reporting€requirements.Ð ¸ € ÐÌÌÌÌà  à(2)€òòEncryption€commodities€and€software€of€any€key€length€for€U.S.€subsidiariesóó.€€Ð à Ðà  àÌà  àà ` à(i)€òòScopeóó.€€You€may€export€and€reexport€encryption€commodities€and€software€ofÐ Ø  Ðany€key€length€under€License€Exception€ENC€to€U.S.€subsidiaries€(as€defined€in€part€772€of€theÏEAR)€subject€to€the€conditions€of€this€paragraph€(a)(2).€€Note€that€distributors,€resellers€or€otherÏentities€that€are€not€manufacturers€of€the€encryption€commodities€and€software€are€permitted€toÏuse€License€Exception€ENC€for€U.S.€subsidiaries€only€in€instances€where€the€export€or€reexportÏmeets€the€terms€and€conditions€of€this€paragraph€(a)(2).ÌÌà  àà ` à(ii)€òòEligible€commodities€and€softwareóó.€€Encryption€commodities,€software€andÐ ø%À!$ Ðtechnology€of€any€key€length€classified€under€ECCNs€5A002,€5D002€and€5E002€after€a€technicalÏreview€(see€paragraph€(c)€of€this€section).€€This€includes€encryption€chips,€integrated€circuits,Ïtoolkits,€executable€or€linkable€modules,€source€code€and€technology€€to€U.€S.€subsidiaries€forÐ ˜+`'* Ðinternal€company€proprietary€use,€including€the€development€of€new€products.ÌÌà  àà ` à(iii)€òòEligible€destinations;€retransfersóó.€€You€may€export€and€reexport€underÐ øÀ ÐLicense€Exception€ENC€encryption€commodities,€software€and€technology€of€any€key€length€toÏU.S.€subsidiaries€for€internal€company€proprietary€use,€including€the€development€of€newÏproducts,€in€all€destinations€except€Cuba,€Iran,€Iraq,€Libya,€North€Korea,€Sudan€and€Syria.€€AllÏitems€developed€using€U.S.€encryption€commodities,€software€and€technology€are€subject€to€theÏEAR.€€For€exports€and€reexports€to€strategic€partners€of€U.S.€companies€(as€defined€in€part€772)Ïsee€ðð742.15(b)(8)€of€the€EAR.€€Retransfers€to€other€end„users€or€end„uses€are€prohibited€withoutÏprior€authorization.€ÌÌà  àà ` à(iv)€òòReporting€requirementsóó.€There€are€no€reporting€requirements.€Ð Ø  ÐÌà  à(3)€òòEncryption€commodities,€including€mass€market€and€non„mass€market,€and€non„massÐ ˜` Ðmarket€encryption€software€incorporating€symmetric€algorithms€with€key€lengths€up€to€andÏincluding€56„bits,€such€as€DES€or€equivalentóó.Ð X  ÐÌà  àà ` à(i)€òòScopeóó.€You€may€export€and€reexport€encryption€commodities,€including€massÐ $à" Ðmarket€and€non„mass€market€commodities,€and€non„mass€market€software€with€key€lengths€up€toÏand€including€56„bits,€such€as€DES€or€equivalent,€under€License€Exception€ENC€subject€to€theÏconditions€of€this€paragraph€(a)(3).€€For€information€concerning€the€technical€review€ofÏencryption€mass€market€commodities€and€mass€market€software€refer€to€ðð742.15(b)(1)€of€theÐ ˜+`'* ÐEAR.€€Note€that€encryption€mass€market€software€remains€eligible€under€License€ExceptionÏTSU.ÌÌà  àà ` à(ii)€òòEligible€commodities€and€softwareóó.€€(A)€Mass€market€and€non„mass€marketÐ Ø   Ðencryption€commodities€and€non„mass€market€software€having€symmetric€algorithms€with€keyÏlengths€up€to€and€including€56„bits,€such€as€DES€or€equivalent€(such€as€RC2,€RC4,€RC5,€andÏCAST)€which€are€classified€as€a€result€of€a€technical€review€(see€paragraph€(c)€of€this€section).€ÏThe€commodity€or€software€must€not€allow€the€alteration€of€the€cryptographic€functionality€byÏthe€user€or€any€other€program.€€Encryption€chips,€integrated€circuits,€toolkits€and€executable€orÏlinkable€modules€are€not€authorized€for€export€under€the€provisions€of€paragraph€(a)(3).ÌÌà  àà ` àà ¸ à(B)(òò1óó)€For€mass€market€and€non„mass€market€encryption€commodities€andÐ Ø  Ðnon„mass€market€encryption€software,€exporters€of€40„bit€or€less€encryption€commodities€andÏsoftware€which€have€been€made€eligible€for€License€Exception€KMI€or€License€Exception€TSUÏor€have€been€licensed€for€export€under€an€Encryption€Licensing€Arrangement€or€a€license€prior€toÏœDecember€31,€1998€will›€be€permitted€to€export€and€reexport€these€commodities€and€softwareÏunder€license€exception€ENC€with€increased€key€lengths€up€to€and€including€56„bits€for€theÏconfidentiality€algorithm,€with€key€exchange€mechanisms€including€symmetric€algorithms€withÏthe€same€or€double€key€length€authorized€for€the€confidentiality€algorithm,€and€asymmetricÏalgorithms€for€key€exchange€with€key€space€of€512,€768€or€up€to€and€including€1024€bits€withoutÏan€additional€technical€review,€€provided€that€there€is€no€other€change€in€cryptographicÏfunctionality.€€Exporters€must€certify€to€BXA€that€the€only€change€to€the€encryption€is€theÐ ˜+`'* Ðincrease€in€the€key€length€for€the€confidentiality€algorithm,€the€asymmetric€or€symmetric€keyÏexchange€algorithms€and€that€there€is€no€other€change€in€cryptographic€functionality.€€SuchÏcertifications€must€be€in€the€form€of€a€letter€from€senior€corporate€management€and€include€theÏoriginal€authorization€number€issued€by€BXAò ò,€ó óthe€date€of€issuance€and€the€information€identifiedÐ Ø   Ðin€paragraphs€(a)(2)(iii)€through€(v)€of€Supplement€No.€6€to€part€742€of€the€EAR.€€(If€thisÏinformation€was€submitted€previously,€then€only€identify€the€modifications).€€BXA€must€receiveÏsuch€certification€by€œñ ñMarch€31,€1999ñ ññ¡ñ[INSERT›€90›€DAYS›€FROM›€DATE›€OF›€PUBLICATION]ñ¡ñ›€and€prior€to€any€export€of€such€upgraded€product.€€€ÌÌà  àà ` àà ¸ àà  à(òò2óó)€The€certification€should€be€sent€to:€€Ð 8 ÐÌà  àà ` àà ¸ àà  àOffice€of€Strategic€Trade€and€Foreign€Policy€ControlsÌà  àà ` àà ¸ àà  àBureau€of€Export€AdministrationÌà  àà ` àà ¸ àà  àDepartment€of€CommerceÌà  àà ` àà ¸ àà  à14th€Street€and€Pennsylvania€Ave.,€N.W.Ìà  àà ` àà ¸ àà  àRoom€2705Ìà  àà ` àà ¸ àà  àWashington,€D.C.€20230€€ÌÌà  àà ` àà ¸ àà  àAttn:€Encryption€UpgradeÌÌà  àà ` àà ¸ àà  à(òò3óó)€A€copy€of€the€certification€should€be€sent€to:Ð Ø' #& ÐÌà  àà ` àà ¸ àà  àAttn:€ENC€Encryption€Request€CoordinatorÐ ˜+`'* Ðà  àà ` àà ¸ àà  àà h àà  àP.O.€Box€246Ìà  àà ` àà ¸ àà  àAnnapolis€Junction,€MD€20701„0246ÌÌà  àà ` àà ¸ à(C)€After€œñ˜ñMarch€31,€1999ñ˜ññ˜ñ›[INSERT€90€DAYS€FROM€DATE€OF€PUBLICATION]ñ˜ñ,›€any€increase€(upgrade)€in€the€confidentialityÏalgorithm€and€the€key€exchange€algorithm€must€be€reviewed€by€BXA€through€a€classificationÏrequest€(see€ðð748.3€of€the€EAR).€€In€Block€9€of€form€BXA„748P,€indicate€ð ðKey€LengthÏUpgrade.ððÌÌà  àà ` à(iii)€òòEligible€destinationsóó.€€License€Exception€ENC€is€available€for€exports€andÐ 8 Ðreexports€of€encryption€commodities€and€software€with€key€length€up€to€and€including€56„bits,Ïsuch€as€DES€or€equivalent€to€all€destinations€except€Cuba,€Iran,€Iraq,€Libya,€North€Korea,€SudanÏand€Syria.ÌÌà  àà ` à(iv)€òòReporting€requirementsóó.€€See€paragraph€(d)€of€this€section€for€reportingÐ ˜` Ðrequirements.ÌÌ(b)€òò€Exports€and€reexports€of€certain€encryption€commodities€and€software€to€countries€listed€inÐ 8"  ÐSupplement€No.€3€to€part€740€of€the€EARóó.Ð $à" ÐÌà  à(1)€òòGeneral€purpose€encryption€commodities€and€software€of€any€key€length€for€use€byÐ Ø' #& Ðbanks/financial€institutionsòòóó.€óó€Ð ¸)€%( ÐÐ ˜+`'* Ðà  àà ` à(i)€òòScopeóó.€You€may€export€and€reexport€general€purpose,€non„voice€encryptionÐ 8 Ðcommodities€and€software€of€any€key€length€to€banks€and€financial€institutions€(as€defined€in€partÏ772€of€the€EAR)€in€specified€destinations,€subject€to€the€conditions€of€this€paragraph€(b)(1).€ÏNote€that€distributors,€resellers€or€other€entities€who€are€not€manufacturers€of€the€encryptionÏcommodities€and€software€are€permitted€to€use€License€Exception€ENC€for€banks€and€financialÏinstitutions€only€in€instances€where€the€export€or€reexport€meets€the€terms€and€conditions€of€thisÏparagraph€(b)(1).ÌÌà  àà ` à(ii)€òòEligible€commodities€and€softwareóó.€General€purpose,€non„voice€encryptionÐ 8 Ðcommodities€and€software€of€any€key€length€classified€under€ECCNs€5A002€and€5D002€after€aÏtechnical€review€(see€paragraph€(c)€of€this€section).€€Note€that€software€and€commodities€thatÏhave€already€been€approved€under€an€Encryption€Licensing€Arrangement€to€banks€and€financialÏinstitutions€in€specified€countries€may€now€be€exported€or€reexported€to€other€banks€andÏfinancial€institutions€in€those€countries€under€the€same€Encryption€Licensing€Arrangement.ÌÌà  àà ` à(iii)€òòEligible€destinations;€retransfersóó.€Upon€approval€of€your€classificationÐ X  Ðrequest,€you€may€export€and€reexport€under€License€Exception€ENC€general€purpose,€non„voiceÏencryption€commodities€and€software,€as€defined€in€this€paragraph€(b)(1),€of€any€key€length€toÏbanks€and€financial€institutions€in€all€destinations€listed€in€Supplement€No.€3€to€this€part€and€toÏbranches€of€such€banks€and€financial€institutions€wherever€established,€except€Cuba,€Iran,€Iraq,ÏLibya,€North€Korea,€Sudan€and€Syria.€€End„use€is€limited€to€secure€business€financialÏcommunications€or€transactions€and€financial€communications/transactions€between€the€bankÐ ˜+`'* Ðand/or€financial€institution€and€its€customers.€€No€customer€to€customer€communications€orÏtransactions€are€allowed.€€Retransfers€to€other€end„users€or€end„uses€are€prohibited€without€priorÏauthorization.ÌÌà  àà ` à(iv)€òòReporting€requirementsóó.€€There€are€no€reporting€requirements.Ð ¸ € ÐÌà  à(2)€òòHealth€and€medical€end„usersóó.€€Ð x@  ÐÌà  àà ` à(i)€òòScopeóó.€€You€may€export€and€reexport€encryption€commodities€and€software€ofÐ 8 Ðany€key€length€under€License€Exception€ENC€to€health€and€medical€end„users€(as€defined€in€partÏ772€of€the€EAR)€in€specified€destinations,€subject€to€the€conditions€of€this€paragraph€(b)(2).€ÏNote€that€distributors,€resellers€or€other€entities€who€are€not€manufacturers€of€the€encryptionÏcommodities€and€software€are€permitted€to€use€License€Exception€ENC€for€health€and€medicalÏend„users€only€in€instances€where€the€export€or€reexport€meets€the€terms€and€conditions€of€thisÏparagraph€(b)(2).ÌÌà  àà ` à(ii)€òòEligible€commodities€and€softwareóó.€€Encryption€commodities€and€software€ofÐ 8"  Ðany€key€length€classified€under€ECCNs€5A002€and€5D002€after€a€technical€review€(seeÏparagraph€(c)€of€this€section).€ÌÌà  àà ` à(iii)€òòEligible€destinations;€retransfersóó.€€You€may€export€and€reexport€underÐ ¸)€%( ÐLicense€Exception€ENC€encryption€commodities€and€software€of€any€key€length€to€health€andÐ ˜+`'* Ðmedical€end„users€in€all€destinations€listed€in€Supplement€No.€3€to€this€part.€€Non„U.S.Ïbiochemical€and€pharmaceutical€manufacturers,€and€non„U.S.€military€health€and€medicalÏentities€are€not€eligible€to€receive€encryption€commodities€and€software€under€License€ExceptionÏENC€(see€ðð742.15€of€the€EAR€for€licensing€information€on€these€end„users,€as€well€as€additionalÏcountries).€End„use€is€limited€to€securing€health€and€medical€transactions€to€health€and€medicalÏend„users.€€No€customer€to€customer€communications€or€transactions€are€allowed.€€Retransfers€toÏother€end„users€or€end„uses€are€prohibited€without€prior€authorization.̀̀€à  àà ` à(iv)€òòReporting€requirementsóó.€€See€paragraph€(d)€of€this€section€for€reportingÐ 8 Ðrequirements€for€exports€under€this€License€Exception.ÌÌà  à(3)€òòEncryption€commodities€and€software€of€any€key€length€for€on„line€merchantsóó.Ð Ø  ÐÌà  àà ` à(i)€€òòScopeóó.€You€may€export€and€reexport€encryption€commodities€and€software€ofÐ ˜` Ðany€key€length€under€License€Exception€ENC€to€on„line€merchants€(as€defined€in€part€772€of€theÏEAR)€in€specified€destinations,€subject€to€the€conditions€of€this€paragraph€(b)(3).€€€End„use€isÏlimited€to:€the€purchase€or€sale€of€goods€and€software;€and€services€connected€with€the€purchaseÏor€sale€of€goods€and€software€including€interactions€between€purchasers€and€sellers€necessary€forÏordering,€payment€and€delivery€of€goods€and€software.€€No€other€end„uses€or€customer€toÏcustomer€communications€or€transactions€are€allowed.€€Foreign€on„line€merchants€or€theirÏseparate€business€units€(as€defined€in€part€772€of€the€EAR)€who€are€engaged€in€theÏmanufacturing€and€distribution€of€items€or€services€controlled€on€the€U.S.€Munitions€List€areÐ ˜+`'* Ðexcluded.€€Foreign€government€end„users€are€also€excluded€from€this€License€Exception.€€NoteÏthat€distributors,€resellers€or€other€entities€who€are€not€manufacturers€of€the€encryptionÏcommodities€and€software€are€permitted€to€use€License€Exception€ENC€for€on„line€merchantsÏonly€in€instances€where€the€export€or€reexport€meets€the€terms€and€conditions€of€this€paragraphÏ(b)(3).ÌÌÌ€€€à  àà ` à(ii)€òòEligible€commodities€and€softwareóó.€€Encryption€commodities€and€software€ofÐ X  Ðany€key€length€classified€under€ECCNs€5A002€and€5D002€after€a€technical€review€(seeÏparagraph€(c)€of€this€section).€€Such€commodities€and€software€must€be€limited€to€client„serverÏapplications€(e.g.€Secure€Socket€Layer€(SSL)€based€applications)€or€applications€speciallyÏdesigned€for€on„line€transactions€for€the€purchase€or€sale€of€goods€and€software;€and€servicesÏconnected€with€the€purchase€or€sale€of€goods€and€software,€including€interactions€betweenÏpurchasers€and€sellers€necessary€for€ordering,€payment€and€delivery€of€goods€and€software.€ÏNotwithstanding€the€provisions€of€paragraph€(c)(2)€of€this€section,€commodities€and€softwareÏthat€were€eligible€for€export€to€on„line€merchants€under€an€Encryption€Licensing€Arrangement€orÏlicense€prior€œtoñ™ñ€[INSERT€DATE€OF€PUBLICATION]ñ™ññ¡ñ›ñ¡ññ™ñ€December€31,€1998ñ™ñ›€are€now€eligible€for€export€and€reexport€under€LicenseÏException€ENC€under€the€provisions€of€this€paragraph€(b)(3).€€ÌÌà  àà ` à(iii)€€òòEligible€destinations;€retransfersóó.€€You€may€export€and€reexport€encryptionÐ Ø' #& Ðcommodities€and€software€under€License€Exception€ENC€to€on„line€merchants€in€all€destinationsÏlisted€in€Supplement€No.€3€to€this€part,€except€to€foreign€on„line€merchants€or€their€separateÐ ˜+`'* Ðbusiness€units€who€are€engaged€in€the€manufacturing€and€distribution€of€items€or€servicesÏcontrolled€on€the€U.S.€Munitions€List.€€Retransfers€to€other€end„users€or€end„uses€are€prohibitedÏwithout€prior€authorization.ÌÌà  àà ` à(iv)€€òòReporting€requirementsóó.€See€paragraph€(d)€of€this€section€for€reportingÐ ¸ € Ðrequirements€for€exports€under€this€License€Exception.ÌÌ(c)€òòTechnical€review€to€determine€eligibility€for€License€Exception€ENCóó.€€(1)€€You€may€initiate€aÐ X  Ðtechnical€review€required€by€paragraph€(a)€or€(b)€of€this€section€by€submitting€a€classificationÏrequest€for€your€product€in€accordance€with€the€provisions€of€€ðð748.3(b)€of€the€EAR.€€IndicateÏð ðLicense€Exception€ENCðð€in€Block€9:€Special€purpose,€on€form€BXA„748P.€€Submit€the€originalÏrequest€to€BXA€in€accordance€with€ðð748.3€of€the€EAR€and€send€a€copy€of€the€request€to:€ÌÌà  àAttn:€ENC€Encryption€Request€CoordinatorÌà  àP.O.€Box€246Ìà  àAnnapolis€Junction,€MD€20701„0246ÌÌà  à(2)€Commodities€and€software€that€have€been€made€eligible€for€License€Exception€TSUÏor€KMI€or€which€have€been€approved€for€export€under€an€Encryption€Licensing€Arrangement€orÏa€license€prior€œtoñšñ€[INSERT€DATE€OF€PUBLICATION]ñšññ¡ñ›ñ¡ññšñ€December€31,€1998ñšñ›€are€eligible€for€export€and€reexport€under€all€paragraphs€ofÏLicense€Exception€ENC,€except€paragraphs€(a)(1)€and€(b)(3)€of€this€section,€without€an€additionalÏtechnical€review,€provided€that€the€export€or€reexport€meets€all€the€terms€and€conditions€of€thisÐ ˜+`'* ÐLicense€Exception.€€€For€all€other€commodities€and€software,€a€technical€review€will€determineÏeligibility€for€License€Exception€ENC€by€reviewing€the€confidentiality€algorithm,€key€space,€andÏkey€exchange€mechanism.€€€ÌÌà  à(3)€For€export€and€reexport€of€encryption€commodities€and€software€under€paragraphÏ(a)(3)€of€this€section,€examples€of€eligible€key€exchange€mechanisms€include,€but€are€not€limitedÏto,€symmetric€algorithms€with€the€same€or€double€the€key€length€authorized€for€theÏconfidentiality€algorithm,€asymmetric€algorithms€with€key€space€of€512,€768€or€up€to€andÏincluding€1024€bits,€proprietary€key€exchange€mechanisms,€or€others.ÌÌà  à(4)€For€export€and€reexport€of€encryption€commodities€and€software€under€paragraphÏ(b)(3)€of€the€License€Exception€ENC,€exporters,€in€order€to€expedite€review€of€the€classification,Ïshould€submit,€as€applicable,€the€following€types€of€information€to€support€the€classificationÏrequest:ÌÌà  àà ` à(i)€Information€describing€how€the€product€is€limited€to€a€client„server€applicationÏor€application€specially€designed€or€tailored€to€the€conditions€outlined€in€the€License€Exception;Ìà0  àÐ (#(# Ðà  àà ` à(ii)€€information€describing€the€end„user€environment€to€which€the€application€willÏbe€limited;ÌÌà  àà ` à(iii)€€information€explaining€how€the€product€will€not€permit€customer„to„Ð ˜+`'* Ðcustomer€communications€or€transactions€above€56„bits;ÌÌà  àà ` à(iv)€€information€on€the€process€by€which€the€merchant(s)€or€application€will€limitÏaccess€to€authorized€users;€orÌÌà  àà ` à(v)€€details€of€the€encryption€system,€including€how€it€is€limited€to€the€applicationÏor€cannot€be€diverted€to€other€end„uses.ÌÌÌ(d)€òòReporting€requirementsóó.€€(1)€You€must€provide€to€BXA€the€names€and€addresses€for€exportsÐ à Ðto€the€following€end„users:ÌÌà  àà ` à(i)€All€military€and€government€end„users€for€non„mass€market€commodities€andÏnon„mass€market€software€exports€authorized€under€paragraph€(a)(3)€of€this€section;€€ÌÌà  àà ` à(ii)€All€health€and€medical€end„users€for€exports€authorized€under€paragraph€(b)(2)Ïof€this€section,€andÌÌà  àà ` à(iii)€All€foreign€on„line€merchants€for€exports€authorized€under€paragraph€(b)(3)Ïof€this€section.ÌÌà  à(2)€You€must€submit€reports€no€later€than€February€1€and€no€later€than€August€1€of€anyÐ ˜+`'* Ðgiven€year.€€Specifically,€the€report€must€identify€the€end„user€name€and€address€and€country€ofÏultimate€destination,€as€well€as€the€classification€or€other€authorization€number.ò ò€€ó óSend€the€reportÐ à Ðto€the€following€address:ÌÌà  àOffice€of€Strategic€Trade€and€Foreign€Policy€ControlsÌà  àBureau€of€Export€AdministrationÌà  àDepartment€of€CommerceÌà  à14th€Street€and€Pennsylvania€Ave.,€N.W.Ìà  àRoom€2705Ìà  àWashington,€D.C.€20230Ìà  àÌà  àAttn:€Encryption€ReportsÌÌÝ‚SmyÿÝÝ  ÝÝ‚Smy5ÂÝà  àÚƒRÚ7Ú  Ú.Û€RÛÝ  Ý€€Supplement€No.€3€is€revised€to€read€as€follows:à p à݃Smy5ÂPÂ݌Р˜` ÐŒÝ  ÝÐ  x@ ÐÌÓ  ÓSUPPLEMENT€NO.€3€TO€PART€740ÌCOUNTRIES€ELIGIBLE€TO€RECEIVE€GENERAL€PURPOSE€ENCRYPTIONÏCOMMODITIES€AND€SOFTWARE€ÌÓ9ÃÓÌÒ(€X€°(#°(#(ÒAnguilla*ÌAntigua*ÌArgentina*ÌAruba*ÌAustria**ÌAustralia**ÌBahamas*ÌBarbados*ÌBelgium**ÌBrazil*ÌCanada**ÌCroatiaÌCzech€Republicò ò*ó óÐ $à" ÐDenmark**ÌDominica*ÌEcuador*ÌFinland**Ð ˜+`'* ÐFrance€**ÌGermany**ÌGreece*ÌHong€KongÌHungary*ÌIceland**ÌIreland**ÌItaly**ÌJapan**ÌKenya*ÌLuxembourg**ÌMonaco*ÌThe€Netherlands**ÌNew€Zealand**ÌNorway**ÌPoland*ÌPortugal**Ð ˜+`'J ÐSt.€Kitts€&€Nevis*€ÌSt.€Vincent/Grenadines*ÌSeychelles*ÌSingaporeÌSpain**ÌSweden**ÌSwitzerland**ÌTrinidad€&€Tobago*ÌTurkey*ÌUruguay*ÌUnited€Kingdom**ÌUnited€States**ÌÌÌ*€Commercial€entities€and€their€branchesÏlocated€in€these€countries€or€any€countryÏlisted€in€this€Supplement€and€designatedÏwith€one€or€two€asterisks€are€eligible€toÏreceive€ð ðrecoverableðð€encryptionÏcommodities€and€software€of€any€key€lengthÏfor€internal€company€proprietary€use.€€SeeÏðð742.15(b)(7)€of€the€EAR.€€Ð ˜+`'* Ї**Commercial€entities€headquartered€inÏthese€countries€and€their€branches€whereverÏlocated€(except€Cuba,€Iran,€Iraq,€Libya,ÏNorth€Korea,€Sudan€and€Syria)€are€eligibleÏto€receive€ð ðrecoverableðð€encryptionÏcommodities€and€software€of€any€key€lengthÏfor€internal€company€proprietary€use.€€SeeÏðð742.15(b)(7)€of€the€EAR.Ð X 8 ÐÒ(€X€°À°À(ÒPART€742€„€[AMENDED]ÌÌÝ‚SmyÿÝÝ  ÝÝ‚SmyÉÝà  àÚƒRÚ8Ú  Ú.Û€RÛÝ  Ý€€Section€742.15€is€amended:݃SmyÉ5ÉÝŒÌŒÝ  ÝÌà  àà ` àa.€€By€revising€the€first€sentence€of€paragraph€(a);Ìà  àà ` àÌà  àà ` àb.€€By€revising€the€phrase€ð ðSupplements€No.€4,€No.€5€and€No.€7"€in€theÏintroductory€paragraph€(b)€to€read€ð ðSupplement€No.€4";ÌÌà  àà ` àc.€€By€revising€the€phrase€ð ðencryption€softwareðð€in€the€title€to€paragraph€(b)(1)€toÏread€ð ðencryption€commodities€and€softwareðð;Ìà  àà ` àÌà  àà ` àd.€€By€revising€paragraph€(b)(1)(i);ÌÌà  àà ` àe.€€By€adding€new€paragraphs€(b)(1)(iii)€and€(b)(1)(iv);ÌÌà  àà ` àf.€€By€revising€paragraph€(b)(2);ÌÌà  àà ` àg.€€By€removing€paragraph€(b)(3);ÌÌà  àà ` àh.€€By€redesignating€paragraphs€(b)(4)€and€(5)€as€(b)(3)€and€(4);ÌÐ ˜+`'* Ðà  àà ` ài.€€By€revising€newly€redesignated€paragraphs€(b)(3);ÌÌà  àà ` àj.€€By€revising€the€heading€of€newly€redesignated€paragraph€(b)(4);ÌÌà  àà ` àk.€€By€removing€the€phrase€ð ðnon„recoverableðð€in€the€first€sentence€of€newlyÏredesignated€paragraph€(b)(4).ÌÌà  àà ` àl.€By€revising€the€phrase€ð ðunder€License€Exception€KMI€(see€ðð740.8€of€the€EAR)ððÏin€newly€redesignated€paragraph€(b)(4)€to€read€ð ðLicense€Exception€ENC€(see€ðð740.17(a)(1)€ofÏthe€EAR)ðð;ÌÌà  àà ` àm.€By€redesignating€paragraph€(b)(6)€and€(7)€as€(b)(8)€and€(9);€ÌÌà  àà ` àn.€€By€adding€new€paragraphs€(b)(5),€(6)€and€(7);€andÌÌà  àà ` ào.€€By€adding€a€new€paragraph€(b)(8)(iii)€to€read€as€follows:€€ÌÌà  àà ` àÌðð742.15€Encryption€items.ÌÌÓ  Ó*€€€€€*€€€€€*€€€€€*€€€€€*à @¸ àÌÓ[ÐÓÐ ˜+`'* Ї(a)€Licenses€are€required€for€exports€and€reexports€to€all€destinations,€except€Canada,€for€itemsÏcontrolled€under€ECCNs€having€an€ð ðEIðð€(for€ð ðencryption€itemsðð)€under€the€ð ðControl(s)ððÏparagraph.*€€€€€*€€€€*ÌÌ(b)€*€€€€€*€€€€€*ÌÌà  à(1)€*€€€€€*€€€€€*ÌÌà  àà ` à(i)€€Consistent€with€E.O.€13026€of€November€15,€1996€(61€FR€58767),€certainÏencryption€software€that€was€transferred€from€the€U.S.€Munitions€List€to€the€Commerce€ControlÏList€pursuant€to€the€Presidential€Memorandum€of€November€15,€1996,€may€be€released€from€EIÏcontrols€and€thereby€made€eligible€for€mass€market€treatment€after€a€technical€review.€€Further,Ïcertain€encryption€commodities€may€be€released€from€EI€controls€and€thereby€made€eligible€forÏmass€market€treatment€after€a€technical€review.€€To€determine€eligibility€for€mass€marketÏtreatment,€exporters€must€submit€a€classification€request€to€BXA.€€56„bit€mass€market€encryptionÏcommodities€and€software€using€RC2,€RC4,€RC5,€DES€or€CAST,€and€key€exchange€mechanismsÏincluding,€but€not€limited€to,€symmetric€algorithms€with€the€same€or€double€the€key€lengthÏauthorized€for€the€confidentiality€algorithm,€asymmetric€algorithms€with€key€space€of€512,€768Ïor€up€to€and€including€1024€bits,€proprietary€key€exchange€mechanisms,€or€others,€may€beÏeligible€for€a€7„day€review€process,€and€company€proprietary€commodities€and€softwareÏimplementations€may€be€eligible€for€15„day€processing.€€Refer€to€Supplement€No.€6€to€part€742Ïand€ðð748.3(b)(3)€of€the€EAR€for€additional€information.€€Note€that€the€technical€review€is€for€aÐ ˜+`'* Ðdetermination€to€release€encryption€commodities€and€software€in€object€code€only€unlessÏotherwise€specifically€requested.€€Exporters€requesting€release€of€the€source€code€should€refer€toÏparagraph€(b)(3)(v)(E)€of€Supplement€No.€6€to€part€742.€€ÌÌà  àà ` à(ii)€*€€€€€*€€€€€*ÌÌà  àà ` à(iii)€If€after€a€technical€review,€BXA€determines€that€the€encryption€commodity€isÏreleased€from€EI€controls,€the€commodity€is€eligible€for€export€under€License€Exception€ENCÏand€all€provisions€of€the€EAR€applicable€to€other€commodities.€€€However,€if€BXA€determinesÏthat€the€commodity€is€not€released€from€EI€controls,€and€no€License€Exception€applies,€a€licenseÏis€required€for€export€and€reexport€to€all€destinations,€except€Canada,€and€license€applicationsÏwill€be€considered€on€a€case„by„case€basis.ÌÌà  àà ` à(iv)€Mass„market€encryption€software€that€has€already€been€classified€after€aÏtechnical€review€and€that€has€been€released€from€EI€controls€under€the€provisions€of€thisÏparagraph€(b)(1)€will€be€permitted€for€export€and€reexport€under€license€exception€TSU€withÏincreases€of€56„bits€for€the€confidentiality€algorithm,€œthe›€same€or€double€the€key€lengthÏauthorized€for€the€confidentiality€algorithm€for€symmetric€algorithms€for€key€exchangeÏmechanisms€and€œwith€key›€spaces€of€512,€768€or€up€to€and€including€1024€bits€for€asymmetricÏœalgorithms›€œfor›€key€œexchange›€œwithout›€an€additional€technical€review,€provided€that€there€is€noÏother€change€in€the€cryptographic€functionality.€€œExporters›€must€notify€BXA€in€writing€of€theÏincrease€in€the€key€length€for€the€confidentiality€algorithm,€the€asymmetric€or€symmetric€keyÐ ˜+`'* Ðexchange€algorithms,€and€include€the€original€authorization€number€issued€by€BXA€and€theÏinformation€identified€in€œparagraphs›€(a)(2)(iii)€ñšñœñšñœthrough›€(v)€of€Supplement€No.€6€to€part€742€of€theÏEAR€(if€this€information€was€submitted€previously,€then€only€identify€the€modifications).€€BXAÏmust€receive€such€notification€by€œñ›ñMarch€31,€1999ñ›ññœññ›ñ9ñ›ññœññ›ñ›[INSERT€90€DAYS€FROM€DATE€OF€PUBLICATION]ñ›ñ.›€€€ÌÌà  àà ` àà ¸ àœ(A)›€The€notification€should€be€sent€to:€€ÌÌà  àà ` àà ¸ àà  àOffice€of€Strategic€Trade€and€Foreign€Policy€ControlsÌà  àà ` àà ¸ àà  àBureau€of€Export€AdministrationÌà  àà ` àà ¸ àà  àDepartment€of€CommerceÌà  àà ` àà ¸ àà  à14th€Street€and€Pennsylvania€Ave.,€N.W.Ìà  àà ` àà ¸ àà  àRoom€2705Ìà  àà ` àà ¸ àà  àWashington,€D.C.€20230€€ÌÌà  àà ` àà ¸ àà  àAttn:€Encryption€UpgradeÌÌà  àà ` àà ¸ àœ(B)›€A€copy€of€the€certification€should€be€sent€to:ÌÌà  àà ` àà ¸ àà  àAttn:€ENC€Encryption€Request€CoordinatorÌà  àà ` àà ¸ àà  àà h àà  àP.O.€Box€246Ìà  àà ` àà ¸ àà  àAnnapolis€Junction,€MD€20701„0246ÌÐ ˜+`'* Ðà  à(2)€òòKey€escrow€and€key€recovery€encryption€commodities€and€softwareóó.€€Certain€recoveryÐ 8 Ðencryption€commodities€and€software€of€any€key€length€that€are€classified€€under€ECCNs€5A002Ïand€5D002€after€a€technical€review€are€eligible€for€export€and€reexport€under€License€ExceptionÏKMI.€€See€ðð740.8(b)(1)€of€the€EAR€for€information€on€additional€eligibility€requirements.ÌÌà  à(3)€òòGeneral€purpose€encryption€commodities€and€software€of€any€key€length€for€use€byÐ ˜ `  Ðbanks€and€financial€institutionsóó.Ð x@  ÐÌà  à(i)€Commodities€and€software€that€were€eligible€for€License€Exception€TSU€or€KMI€orÏhave€been€licensed€for€export€or€reexport€under€an€Encryption€Licensing€Arrangement€or€aÏlicense€prior€œtoññ€[INSERT€DATE€OF€PUBLICATION]ññññ€December€31,€1998ññ,›€are€now€eligible€for€export€and€reexport€under€LicenseÏException€ENC€under€the€provisions€of€ðð740.17(b)(1)€of€the€EAR.€ÌÌà  à(ii)€€For€exports€and€reexports€not€eligible€under€a€License€Exception,€exports€andÏreexports€of€general€purpose€non„voice€encryption€commodities€and€software€classified€underÏECCNs€5A002€and€5D002€of€any€key€length€will€generally€be€approved€under€an€EncryptionÏLicensing€Arrangement€for€use€by€banks€and€financial€institutions€(as€defined€in€part€772€of€theÏEAR)€in€all€destinations€except€Cuba,€Iran,€Iraq,€Libya,€North€Korea,€Sudan€and€Syria.€ÏApplications€for€such€commodities€and€software€will€receive€favorable€consideration€when€theÏend„use€is€limited€to€secure€business€financial€communications€or€transactions€and€financialÏcommunications/transactions€between€the€bank€and/or€financial€institution€and€its€customersÏprovided€that€there€are€no€concerns€about€the€country€or€end„user.€€No€customer€to€customerÐ ˜+`'* Ðcommunications€or€transactions€are€allowed.€€ÌÌà  à(iii)€€Note€that€any€country€or€end„user€prohibited€in€the€past€from€receiving€encryptionÏcommodities€and€software€under€a€specific€Encryption€Licensing€Arrangement€will€be€reviewedÏon€a€case„by„case€basis,€and€may€be€considered€by€BXA€for€eligibility€under€future€EncryptionÏLicensing€Arrangement€requests.ÌÌà  à(iv)€€Note€that€distributors,€resellers€or€other€entities€who€are€not€manufacturers€of€theÏencryption€commodities€and€software€are€permitted€to€use€an€existing€Encryption€LicensingÏArrangement€for€exports€and€reexports€of€these€products€only€when€Encryption€LicensingÏArrangement€has€been€granted€to€the€manufacturer€and€the€export€and€reexport€meets€the€termsÏand€conditions€of€this€paragraph€(b)(3).€ÌÌà  à(v)€œThere›€are€no€reporting€requirements€for€exports€to€banks€and€financial€institutions.€€ÌÌÓ  ÓÌÓ  Óà  à(4)€€òòFinancial„specific€encryption€items€of€any€key€lengthóó.*€€€€€*€€€€€*Ð 8"  ÐÌà  à(5)€€òòEncryption€commodities€and€software€of€any€key€length€for€use€by€health€andÐ ø%À!$ Ðmedical€end„usersóó.€€(i)€Commodities€and€software€that€have€been€classified€after€a€technicalÐ Ø' #& Ðreview€through€a€classification€request€or€have€been€licensed€for€export€under€an€EncryptionÏLicensing€Arrangement€or€a€license€are€eligible€for€export€and€reexport€under€License€ExceptionÐ ˜+`'* ÐENC€to€health€and€medical€end„users€without€an€additional€technical€review,€provided€that€theÏexport€or€reexport€meets€all€the€terms€and€conditions€of€that€License€Exception.€€See€ðð740.17€ofÏthe€EAR.€Commodities€and€software€that€were€eligible€for€License€Exception€TSU€or€KMI€€orÏhave€been€licensed€for€export€or€reexport€under€an€Encryption€Licensing€Arrangement€or€aÏlicense€prior€œtoñžñ€[INSERT€DATE€OF€PUBLICATION]ñžññžñ€December€31,€1998ñžñ,›€are€now€eligible€for€export€and€reexport€under€LicenseÏException€ENC€under€the€provisions€of€ðð740.17(b)(2)€of€the€EAR.€ÌÌà  àà ` à(ii)€For€exports€and€reexports€that€are€not€eligible€under€License€Exception€ENC,€Ïexports€and€reexports€of€encryption€commodities€and€software€classified€under€ECCNs€5A002Ïand€5D002€of€any€key€length€will€generally€be€approved€under€an€Encryption€LicensingÏArrangement€for€use€by€health€and€medical€end„users€(as€defined€in€part€772€of€the€EAR)€in€allÏdestinations€except€Cuba,€Iran,€Iraq,€Libya,€North€Korea,€Sudan€and€Syria€except€for€non„U.S.Ïbiochemical€and€pharmaceutical€manufacturers€and€non„U.S.€military€health€and€medicalÏentities.€€No€customer€to€customer€communications€or€transactions€are€allowed.€€ÌÌà  àà ` à(iii)€Note€that€any€country€or€end„user€prohibited€in€the€past€from€receivingÏencryption€commodities€and€software€under€a€specific€Encryption€Licensing€Arrangement€willÏbe€reviewed€on€a€case„by„case€basis,€and€may€be€considered€by€BXA€for€eligibility€under€futureÏEncryption€Licensing€Arrangement€requests.ÌÌà  àà ` à(iv)€Note€that€distributors,€resellers€or€other€entities€who€are€not€manufacturers€ofÏthe€encryption€commodities€and€software€are€permitted€to€use€an€existing€Encryption€LicensingÐ ˜+`'* ÐArrangement€for€exports€and€reexports€of€these€products€only€when€Encryption€LicensingÏArrangement€has€been€granted€to€the€manufacturer€and€the€export€and€reexport€meets€the€termsÏand€conditions€of€this€paragraph€(b)(5).€€€€€€€€ÌÌà  àà ` à(v)€You€must€submit€to€BXA€the€name€and€address€of€the€end„user.à Ð àÐ ¸ € Ðà  àà ` àÌ€€òòà  àóó(6)€€òòEncryption€commodities€and€software€of€any€key€length€for€on„line€merchantsóó.€€(i)€Ð x@  ÐCommodities€and€software€that€were€eligible€for€export€to€on„line€merchants€under€anÏEncryption€Licensing€Arrangement€prior€œtoñŸñ€[INSERT€DATE€OF€PUBLICATION]ñŸññ¡ñ›ñ¡ññŸñ€December€31,€1998ñŸñ›€are€now€eligible€for€export€andÏreexport€under€License€Exception€ENC€under€the€provisions€of€ðð740.17(b)(3).ÌÌà  àà ` à(ii)€€Exports€and€reexports€of€encryption€commodities€and€software€classifiedÏunder€ECCNs€5A002€and€5D002€of€any€key€length€which€are€limited€to€client„server€applicationsÏ(e.g.,€Secure€Socket€Layer€(SSL)€based€applications)€or€applications€specially€designed€for€on„¼line€transactions€for€the€purchase€or€sale€of€goods€and€software€will€be€permitted€under€an€ExportÏLicensing€Arrangement€in€all€destinations€except€Cuba,€Iran,€Iraq,€Libya,€North€Korea,€SudanÏand€Syria€for€use€by€foreign€on„line€merchants€as€defined€in€part€772€of€the€EAR.€€End„use€isÏlimited€to:€the€purchase€or€sale€of€goods€and€software;€and€services€connected€with€the€purchaseÏor€sale€of€goods€and€software,€including€interactions€between€purchasers€and€sellers€necessaryÏfor€ordering,€payment€and€delivery€of€goods€and€software.Ô‡JƒóJXXÑÔ€€No€other€end„uses€or€customer€toÐ Ø' #& Ðcustomer€communications€or€transactions€are€allowed.Ô#†XÑXJJƒótý#ÔÐ ¸)€%( ÐÐ ˆ+P'* Ðà  àà ` à(iii)€€Applications€for€Encryption€Licensing€Arrangements€for€on„line€merchantsÏwill€generally€be€approved,€except€for€foreign€on„line€merchants€or€their€separate€business€unitsÏ(as€defined€in€part€772€of€the€EAR)€who€are€engaged€in€the€manufacturing€and€distribution€ofÏitems€or€services€controlled€on€the€U.S.€Munitions€List.€€Such€end„users€will€be€considered€on€aÏcase„by„case€basis.ÌÌà  àà ` à(iv)€€Note€that€any€country€or€end„user€prohibited€in€the€past€from€receivingÏencryption€commodities€and€software€under€a€specific€Encryption€Licensing€Arrangement€willÏbe€reviewed€on€a€case„by„case€basis,€and€may€be€considered€by€BXA€for€eligibility€under€futureÏEncryption€Licensing€Arrangement€requests.ÌÌà  àà ` à(v)€Note€that€distributors,€resellers€or€other€entities€who€are€not€manufacturers€ofÏthe€encryption€commodities€and€software€are€permitted€to€use€an€existing€Encryption€LicensingÏArrangement€for€exports€and€reexports€of€these€products€only€when€Encryption€LicensingÏArrangement€has€been€granted€to€the€manufacturer€and€the€export€and€reexport€meets€the€termsÏand€conditions€of€this€paragraph€(b)(6).€€€€€€ÌÌà  àà ` à(v)€You€must€submit€to€BXA€the€name€and€address€of€the€end„user.Ìà  àÌà  à(7)€€òòRecoverable€encryption€commodities€and€software€of€any€key€length€for€use€byÐ Ø' #& Ðcommercial€entitiesóó.€€(i)€€Exports€and€reexports€of€recoverable€encryption€commodities€andÐ ¸)€%( Ðsoftware€(as€defined€in€part€772€of€the€EAR)€classified€under€ECCNs€5A002€and€5D002€of€anyÐ ˜+`'* Ðkey€length€will€generally€be€approved€under€an€Encryption€Licensing€Arrangement€toÏdestinations€designated€with€a€ð ð*ðð€or€ð ð**ðð€€in€Supplement€No.€3€to€part€740€of€the€EAR€toÏforeign€commercial€entities€for€internal€company€proprietary€use.€€Such€encryption€commoditiesÏand€software€will€generally€be€approved€for€export€and€reexport€to€foreign€subsidiaries€ofÏcommercial€firms€headquartered€in€countries€designated€with€a€ð ð**ðð€in€Supplement€No.€3€to€partÏ740€of€the€EAR€that€are€located€in€any€destination€except€Cuba,€Iran,€Iraq,€Libya,€North€Korea,ÏSudan€and€Syria.€€Exports€and€reexports€to€telecommunication€and€internet€service€providers€isÏpermitted€under€this€policy€for€internal€company€proprietary€use.€€Use€by€service€providers€toÏprovide€service€to€customers€is€excluded€from€this€policy,€but€exports€may€be€possible€under€aÏlicense€or€an€Encryption€Licensing€Arrangement€on€a€case„by„case€basis.€€This€policy€ofÏapproval€excludes€those€foreign€commercial€firms€or€their€separate€business€units€(as€defined€inÏpart€772€of€the€EAR)€engaged€in€the€manufacturing€and€distribution€of€items€or€servicesÏcontrolled€by€the€U.S.€Munitions€List.ÌÌà  àà ` à(ii)€€Note€that€any€country€or€end„user€prohibited€in€the€past€from€receivingÏencryption€commodities€and€software€under€a€specific€Encryption€Licensing€Arrangement€willÏbe€reviewed€on€a€case„by„case€basis,€and€may€be€considered€by€BXA€for€eligibility€under€futureÏEncryption€Licensing€Arrangement€requests.ÌÌà  àà ` à(iii)€€Note€that€distributors,€resellers€or€other€entities€who€are€not€manufacturers€ofÏthe€encryption€commodities€and€software€are€permitted€to€use€an€existing€Encryption€LicensingÏArrangement€for€exports€and€reexports€of€these€products€only€when€Encryption€LicensingÐ ˜+`'* ÐArrangement€has€been€granted€to€the€manufacturer€and€the€export€and€reexport€meets€the€termsÏand€conditions€of€€this€paragraph€(b)(7).€€€€€€ÌÌà  àà ` à(iv)€You€must€submit€to€BXA€the€name€and€address€of€the€end„user.Ìà  àÌà  à(8)€€òòAll€other€encryption€itemsóó.€*€€€€€*€€€€€*Ð ˜ `  ÐÌà  àà ` à(iii)€Exports€and€reexports€of€encryption€commodities€and€software€of€any€keyÏlength€to€ð ðstrategic€partnersðð€of€U.S.€companies€will€receive€favorable€consideration€when€theÏend„use€is€for€the€protection€of€U.S.€company€proprietary€information.ÌÌÌà  àà ` àà ¸ àà  àà h à*€€€€€*€€€€€*€€€€€*€€€€€*à p àÔ‡%Å%XXÑÔÐ ¸€ ÐÌ€Ô#†XÑX%%År#ÔÐ L ÐÝ‚SmyÿÝÝ  ÝÝ‚SmyàÝà  àÚƒRÚ9Ú  Ú.Û€R ÛÝ  Ý€€Supplement€No.€4€to€part€742€is€amended€by€revising€paragraph€(8)€to€read€as€follows:¼à  à݃SmyàûÝŒÌŒÝ  ÝÌSUPPLEMENT€NO.€4€TO€PART€742€„€KEY€ESCROW€OR€KEY€œRECOVERñŸñ›ñŸñABLE›ÏPRODUCTS€CRITERIA.€ÌÌÓ  Ó*€€€€€*€€€€€*€€€€€*€€€€€*Ð @+'* ÐÓAÓÌ(8)€The€product's€cryptographic€function's€key(s)€or€other€material/information€required€toÏdecrypt€ciphertext€shall€be€accessible€to€government€officials€under€proper€legal€authority.ÌÌÌÝ‚SmyÿÝÝ  ÝÝ‚SmyGÝà  àÚƒRÚ10Ú  Ú.Û€R ÛÝ  Ý€€Part€742€is€amended€by€removing€and€reserving€Supplement€No.€5€and€SupplementÏNo.€7.݃SmyGbÝŒÌŒÝ  ÝÌà@þþìà*€€€€€*€€€€€*€€€€€*€€€€€*ˆÌÌÝ‚SmyÿÝÝ  ÝÝ‚SmyjÝà  àÚƒRÚ11Ú  Ú.Û€R ÛÝ  Ý€€Supplement€No.€6€to€part€742€is€revised€to€read€as€follows:à  à݃Smyj…݌РøÀ ÐŒÝ  ÝÌSUPPLEMENT€NO.€6€TO€PART€742€„€GUIDELINES€FOR€SUBMITTING€AÏCLASSIFICATION€REQUEST€FOR€MASS€MARKET€ENCRYPTION€COMMODITIES€ANDÏSOFTWARE.ÌÓ  ÓÌÓíÓClassification€requests€for€release€of€certain€mass€market€encryption€commodities€and€softwareÏfrom€EI€controls€must€be€submitted€on€Form€BXA„748P,€in€accordance€with€ðð748.3€of€the€EAR.€ÏTo€expedite€review€of€the€request,€clearly€mark€the€envelope€ð ðAttn.:€Mass€Market€EncryptionÏ(Commodity)€or€(Software)€Classification€Requestðð.€€In€Block€9:€Special€Purpose€of€the€FormÏBXA„748P,€you€must€insert€the€phrase€ð ðMass€Market€Encryption€(Commodity)€or€(Software).€ÏFailure€to€insert€this€phrase€will€delay€processing.€€In€addition,€the€Bureau€of€ExportÐ ˜+`'* ÐAdministration€recommends€that€such€requests€be€delivered€via€courier€service€œtoñŸñ›››ñŸñ€Bureau›€ofÏExport€œAdministrationñŸñ›ñŸñ,€Office›€of€Exporter€œServices,ñŸñ›ñŸñ€Room›€œ2705ñŸñ›ñŸñ,€14th›€Street€and€PennsylvaniaÏAve.,€œN.W.ñŸñ›ñŸñ,Washington,›€D.C.€€œ20230.ñŸñ››ñŸñ€€In›€addition,€send€a€copy€of€the€request€and€all€supportingÏdocuments€by€Express€Mail€œtoñŸñ›››ñŸñ:€€Attn:›€Mass€Market€Encryption€Request€œCoordinator,ñŸñ›ñŸñ€P.O.›€BoxÏœ246ñŸñ›ñŸñ,Annapolis›€Junction,€MD€œ20701„0246.›ÌñŸñœñŸñ€€Ì(a)€€Requests€for€mass€market€encryption€commodities€and€software€that€meet€the€criteria€inÏparagraph€(a)(2)€of€this€Supplement€will€be€processed€in€seven€(7)€working€days€from€receipt€ofÏa€properly€completed€request.€€Those€requests€for€mass€market€encryption€commodities€andÏsoftware€that€meet€the€criteria€of€paragraph€(a)(1)€of€this€Supplement€only€will€be€processed€inÏfifteen€(15)€working€days€from€receipt€of€a€properly€completed€request.€€When€additionalÏinformation€is€requested,€the€request€will€be€processed€within€15€working€days€of€the€receipt€ofÏthe€requested€information.€ÌÌà  à(1)€€€A€mass€market€product€that€meets€the€criteria€established€in€this€paragraph€will€beÏprocessed€in€fifteen€(15)€working€days€from€receipt€of€the€properly€completed€request:ÌÌà  àà ` à(i)€€The€commodity€or€software€must€be€mass€market.€€Mass€market€commoditiesÏand€software€that€are€available€to€the€public€via€sales€from€stock€at€retail€selling€points€by€meansÏof€over„the„counter€transactions,€mail€order€transactions,€or€telephone€call€transactions;ÌÌà  àà ` à(ii)€€The€commodity€or€software€must€be€designed€for€installation€by€the€userÐ ˜+`'* Ðwithout€further€substantial€support€by€the€supplier.€€Substantial€support€does€not€includeÏtelephone€(voice€only)€help€line€services€for€installation€or€basic€operation,€or€basic€operationÏtraining€provided€by€the€supplier;€andÌÌà  àà ` à(iii)€€€€The€commodity€or€software€includes€encryption€for€data€confidentiality.ÌÌà  à(2)€A€mass€market€commodity€or€software€product€that€meets€all€the€criteria€establishedÏin€this€paragraph€will€be€processed€in€seven€(7)€working€days€from€receipt€of€the€properlyÏcompleted€request:ÌÌà  àà ` à(i)€€The€commodity€or€software€meets€all€the€criteria€established€in€paragraphÏ(a)(1)(i)€through€(iii)€of€this€Supplement;Ìà  àÌà  àà ` à(ii)€€The€confidentiality€algorithm€must€be€RC2,€€RC4,€RC5,€DES€or€CAST€with€aÏkey€space€no€longer€than€56„bits.€€The€RC2,€RC4€and€RC5€algorithms€are€proprietary€to€RSAÏData€Security,€Inc.€€To€ensure€that€the€subject€commodity€or€software€is€properly€licensed€andÏcorrectly€implemented,€contact€RSA€Data€Security,€(415)€595„8782.€€The€CAST€algorithm€isÏproprietary€to€Entrust€Technologies,€Inc.ò ò€ó óTo€ensure€that€the€subject€software€is€properly€licensedÐ $à" Ðand€correctly€implemented,€contact€Entrust€Technologies,€Inc.,€(972)€994„8000;ÌÌà  àà ` à(iii)€€€If€any€combination€of€RC2,€RC4,€RC5,€DES€or€CAST€are€used€in€the€sameÏcommodity€or€software,€their€functionality€must€be€separate.€€That€is,€no€data€can€be€operatedÐ ˜+`'* Ðsequentially€on€by€both€routines€or€multiply€by€either€routine;ÌÌà  àà ` à(iv)€The€commodity€or€software€must€not€allow€the€alteration€of€theÏconfidentiality€mechanism€and€its€associated€key€spaces€by€the€user€or€any€other€program;ÌÌà  àà ` à(v)€€€The€key€exchange€used€in€confidentiality€must€be:ÌÌà  àà ` àà ¸ à(A)€A€public€key€algorithm€with€a€key€space€less€than€or€equal€to€a€512„¼bit,€768„bit€or€up€œto€and€including›€1024€bit€modulus€and/or;ÌÌà  àà ` àà ¸ à(B)€A€symmetric€algorithm€with€a€key€space€less€than€or€equal€to€112„bits;Ïand€ÌÌà  àà ` à(vi)€€The€commodity€or€software€must€not€allow€the€alteration€of€the€keyÏmanagement€mechanism€and€its€associated€key€space€by€the€user€or€any€other€program.̜̀(b)(1)›€To€submit€a€classification€request€for€a€product€that€is€eligible€for€the€seven„day€handling,Ïyou€must€provide€the€following€information€in€a€cover€letter€to€the€classification€request.€€SendÏthe€original€to€the€Bureau€of€Export€Administration.€€Send€a€copy€of€the€application€and€allÏsupporting€documentation€by€Express€Mail€to:ÌÌà  àà ` àAttn.:€Mass€Market€Encryption€Request€CoordinatorÐ ˜+`'* Ðà  àà ` àP.O.€Box€246Ìà  àà ` àAnnapolis€Junction,€MD€20701„0246ÌÔ‡ XÑXXXÑԀРøÀ Ðœ(2)€Instructions›€for€the€preparation€and€submission€of€a€classification€request€that€is€eligible€forÏseven€day€handling€are€as€follows:ÌÌœ(3)›€If€the€commodity€or€software€product€meets€the€criteria€in€paragraph€(a)(2)€of€thisÏSupplement,€you€must€call€the€Department€of€Commerce€on€(202)€482„0092€to€obtain€a€testÏvector,€or€submit€to€BXA€a€copy€of€the€encryption€subsystem€source€code.€The€test€vector€orÏsource€code€must€be€used€in€the€classification€process€to€confirm€that€the€software€has€properlyÏimplemented€the€approved€encryption€algorithms.ÌÌœ(4)›€Upon€receipt€of€the€test€vector,€the€applicant€must€encrypt€the€test€plain€text€input€providedÏusing€the€productððs€encryption€routine€(RC2,€RC4,€RC5,€DES€or€CAST)€with€the€given€keyÏvalue.€€The€applicant€should€not€pre„process€the€test€vector€by€any€compression€or€any€otherÏroutine€that€changes€its€format.€€Place€the€resultant€test€cipher€text€output€in€hexadecimal€formatÏon€an€attachment€to€form€BXA„748P.Ô#†XÑXX XÑ/(#Ôà À àÐ 8"  ÐÌœ(5)›€You€must€provide€the€following€information€in€a€cover€letter€to€the€classification€request:ÌÌà  àà ` à(i)€€Clearly€state€at€the€top€of€the€page€ð ðMass€Market€Encryption€(Commodity)Ï(Software)€„€7€Day€Expedited€Review€Requestedðð;Ð ˜+`'* Їà  àà ` à(ii)€State€that€you€have€reviewed€and€determined€that€the€commodity€or€softwareÏsubject€to€the€classification€request€meets€the€criteria€of€paragraph€(a)(2)€of€this€Supplement;€€€ÌÌà  àà ` à(iii)€State€the€name€of€the€single€commodity€or€software€product€being€submittedÏfor€review.€€A€separate€classification€request€is€required€for€each€product;ÌÌà  àà ` à(iv)€State€how€the€commodity€or€software€has€been€written€to€preclude€userÏmodification€of€the€encryption€algorithm,€key€management€mechanism,€and€key€space;ÌÌà  àà ` à(v)€Provide€the€following€information€for€the€commodity€or€software€product:ÌÌà  àà ` àà ¸ à(A)€Whether€the€commodity€or€software€uses€the€RC2,€RC4,€RC5,€DES€orÏCAST€algorithm€and€how€the€algorithm(s)€is€used.€€If€any€combination€of€these€algorithms€areÏused€in€the€same€product,€and€also€state€how€the€functionality€of€each€is€separated€to€assure€thatÏno€data€is€operated€by€more€than€one€algorithm;Ìà  àÌà  àà ` àà ¸ à(B)€Pre„processing€information€of€plaintext€data€before€encryption€(e.g.Ïthe€addition€of€clear€text€header€information€or€compression€of€the€data);ÌÌà  àà ` àà ¸ à(C)€Post„processing€information€of€cipher€text€data€after€encryption€(e.g.Ïthe€addition€of€clear€text€header€information€or€packetization€of€the€encrypted€data);€ÌÐ ˜+`'* Ðà  àà ` àà ¸ à(D)€Whether€a€public€key€algorithm€or€a€symmetric€key€algorithm€is€usedÏto€encrypt€keys€and€the€applicable€key€space;ÌÌà  àà ` àà ¸ à(E)€For€classification€requests€regarding€source€code:ÌÌà  àà ` àà ¸ àà  àòò(1)óó€Reference€the€applicable€executable€product€that€has€alreadyÐ ˜ `  Ðreceived€a€technical€review;ÌÌà  àà ` àà ¸ àà  àòò(2)óó€Include€whether€the€source€code€has€been€modified€by€deletingÐ 8 Ðthe€encryption€algorithm,€its€associated€key€management€routine(s),€and€all€calls€to€the€algorithmÏfrom€the€source€code,€or€by€providing€the€encryption€algorithm€and€associated€key€managementÏroutine(s)€in€object€code€with€all€calls€to€the€algorithm€hidden.€€You€must€provide€the€technicalÏdetails€on€how€you€have€modified€the€source€code;€ÌÌà  àà ` àà ¸ àà  àòò(3)óó€Include€a€copy€of€the€sections€of€the€source€code€that€containÐ x@ Ðthe€encryption€algorithm,€key€management€routines,€and€their€related€calls;€andÌÌà  àà ` àà ¸ à(F)€Provide€any€additional€information€which€you€believe€would€assist€inÏthe€review€process.ÌÌ(c)€€€Instructions€for€the€preparation€and€submission€of€a€classification€request€that€is€eligible€forÏ15„day€handling€are€as€follows:€Ð ˜+`'* Ї€€à  à(1)€€If€the€commodity€or€software€product€meets€only€the€criteria€in€paragraph€(a)(1)€ofÐ 8 Ðthis€Supplement,€you€must€prepare€a€classification€request.€€Send€the€original€to€the€Bureau€ofÏExport€Administration.€€Send€a€copy€of€the€application€and€all€supporting€documentation€byÏExpress€Mail€to:ÌÌà  àà ` àAttn.:€Mass€Market€Encryption€Request€CoordinatorÌà  àà ` àP.O.€Box€246Ìà  àà ` àAnnapolis€Junction,€MD€20701„0246ÌÌà  à(2)€You€must€provide€the€following€information€in€a€cover€letter€to€the€classificationÏrequest:ÌÌà  àà ` à(i)€Clearly€state€at€the€top€of€the€page€ð ðMass€Market€EncryptionÏ(Commodity)(Software)€„€15€Day€Expedited€Review€Requestedðð;ÌÌà  àà ` à(ii)€State€that€you€have€reviewed€and€determined€that€the€commodity€or€softwareÏsubject€of€the€classification€request,€meets€the€criteria€of€paragraph€(a)(1)€of€this€Supplement;ÌÌà  àà ` à(iii)€State€the€name€of€the€single€commodity€or€software€product€being€submittedÏfor€review.€€A€separate€classification€request€is€required€for€each€product;ÌÌà  àà ` à(iv)€State€that€a€duplicate€copy,€in€accordance€with€paragraph€(c)(1)€of€thisÐ ˜+`'* ÐSupplement,€has€been€sent€to€the€15„day€Encryption€Request€Coordinator;€andÌÌà  àà ` à(v)€Ensure€that€the€information€provided€includes€brochures€or€otherÏdocumentation€or€specifications€relating€to€the€commodity€or€software,€as€well€as€any€additionalÏinformation€which€you€believe€would€assist€in€the€review€process.ÌÌà  à(3)€Contact€the€Bureau€of€Export€Administration€on€(202)€482„0707€prior€to€submissionÏof€the€classification€to€facilitate€the€submission€of€proper€documentation.ÌÌÓ  ÓñŸñœñŸñÓ™?ÓÌ.€ÌPART€743€„€[AMENDED]ÌÌÝ‚SmyÿÝÝ  ÝÝ‚SmyÚ?Ýà  àÚƒRÚ12Ú  Ú.Û€R ÛÝ  Ý€€Section€743.1€is€amended:݃SmyÚ?õ?ÝŒÌŒÝ  ÝÌà  àà ` àa.€€By€revising€the€phrase€ð ðGOV€and€KMI€(under€the€provisions€ofÏðð740.8(b)(2)(ii)€and€(iii)€only)ðð€in€paragraph€(b)€to€read€ð ðENCðð;€andÌÌà  àà ` àb.€€By€removing€the€phrase€ð ð,€5A002,€5B002,€5D002,€and€5E002"€in€paragraphÏ(c)(1)(v).ÌÌÐ ˜+`'* ЇPART€772€„€[AMENDED]ÌÌÝ‚SmyÿÝÝ  ÝÝ‚SmyáAÝà  àÚƒRÚ13Ú  Ú.Û€R ÛÝ  Ý€€Part€772€is€amended€by€revising€the€definition€of€œfinancial€institution›€and€adding,€inÏalphabetical€order,€new€definitions€for€business€unit,€health/medical€end„user,€on„line€merchant,Ïrecoverable€commodities€and€software,€strategic€partner,€and€U.S.€subsidiary.݃SmyáAüAÝŒÌŒÝ  ÝÌÓ  Ó*€€€€€*€€€€€*€€€€€*€€€€€*ÌÓ  ÓÌÌòòBusiness€Unitóó.€€As€applied€to€encryption€items,€means€a€unit€of€a€business€which,€whether€or€notÐ à Ðseparately€incorporated,€has:ÌÌà  à(a)€a€distinct€organizational€structure€which€does€not€overlap€with€other€business€units€ofÏthe€same€business;ÌÌà  à(b)€a€distinct€set€of€accounts;€andÌÌà  à(c)€separate€facilities€for€purchase,€sale,€delivery,€and€production€of€goods€and€services.ÌÌÓ  Ó*€€€€€*€€€€€*€€€€€*€€€€€*ÌÓnEÓà  àÌà  àÐ ˜+`'* Ðà  àÌÓ  ÓÌÓßEÓÌòòFinancial€Institutionóó.€€As€applied€to€encryption€items,€means€any€of€the€following:Ð Ø   ÐÌà  à(a)€a€broker,€dealer,€government€securities€broker€or€dealer,€self-regulatory€organization,Ïinvestment€company€or€investment€adviser,€which€is€regulated€or€supervised€by€the€SecuritiesÏand€Exchange€Commission€or€a€self-regulatory€organization€that€is€registered€with€the€SecuritiesÏand€Exchange€Commission;€orÌÌà  à(b)€a€broker,€dealer,€government€securities€broker€or€dealer,€€investment€company,€Ïinvestment€adviser,€or€entity€that€engages€in€securities€activities€that,€if€conducted€in€the€UnitedÏStates,€would€be€described€by€the€definition€of€the€term€ð ðself„regulatory€organizationðð€in€theÏSecurities€Exchange€Act€of€1934,€which€is€organized€under€the€laws€of€a€foreign€country€andÏregulated€or€supervised€by€a€foreign€securities€authority;€orÌÌà  à(c)€a€U.S.€board€of€trade€that€is€designated€as€a€contract€market€by€the€CommodityÏFutures€Trading€Commission€or€a€futures€commission€merchant€that€is€regulated€or€supervisedÏby€the€Commodity€Futures€Trading€Commission;€orÌÌà  à(d)€€a€U.S.€entity€engaged€primarily€in€the€business€of€issuing€a€general€purpose€charge,Ïdebit,€or€stored€value€card,€or€a€branch€of,€or€affiliate€controlled€by,€such€an€entity;€orÐ ˜+`'* Їà  à(e)€a€branch€or€affiliate€of€any€of€the€entities€listed€in€paragraphs€(a),€(b),€or€(c)€of€thisÏdefinition€regulated€or€supervised€by€the€Securities€and€Exchange€Commission,€the€CommodityÏFutures€Trading€Commission,€or€a€foreign€securities€authority;€orÌÌà  à(f)€an€affiliate€of€any€of€the€entities€listed€in€paragraph€(a),€(b),€(c),€or€(e),€of€thisÏdefinition€€engaged€solely€in€the€business€of€providing€data€processing€services€to€one€or€moreÏbank€or€financial€institutions,€or€a€branch€of€such€an€affiliate;€orÔ‡&•Ä&XXÑÔ€Ô#†XÑX&&•ÄLM#ÔòòÐ x@  ÐÌà  àóó(g)€a€company€organized€and€regulated€under€the€laws€of€any€of€the€United€States€and€itsÐ 8 Ðbranches€and€affiliates€whose€primary€and€predominant€business€activity€is€the€writing€ofÏinsurance€or€the€reinsuring€of€risks;€or€a€company€organized€and€regulated€under€the€laws€of€aÏforeign€country€and€its€branches€and€affiliates€whose€primary€and€predominant€business€activityÏis€the€writing€of€insurance€or€the€reinsuring€of€risks.ÌÌÓ  ÓÌ*€€€€€*€€€€€*€€€€€*€€€€€*ÌÓvOÓÌòòHealth/medical€end„useróó.€€As€applied€to€encryption€items,€means€any€entity,€including€civilianÐ $à" Ðgovernment€agencies,€the€primary€purpose€of€which€is€the€provision€of€medical€or€other€healthÏœservices.ñŸñ›››ñŸñ€The›€term€medical€or€other€health€services€includes€the€following€items€or€services:ÌÌà  à(a)€physiciansðð€services€and€services€and€supplies€furnished€as€an€incident€to€aÐ ˜+`'* Ðphysicianððs€professional€service€(such€as€laboratory€services),€of€€kinds€which€are€commonlyÏfurnished€in€physiciansðð€offices;€services€provided€by€a€physician€assistant€or€by€a€nurseÏpractitioner;€including€services€which€would€be€physiciansðð€services€if€furnished€by€a€physicianÏand€which€are€performed€by€a€physician€assistant€under€the€supervision€of€a€physician,€orÏservices€which€would€be€physiciansðð€services€if€furnished€by€a€physician€and€which€areÏperformed€by€a€nurse€practitioner€or€clinical€nurse€specialist€in€collaboration€with€a€physician;Ïcertified€nurse-midwife€services€or€services€of€a€certified€registered€nurse€anesthetist;ÌÌà  à(b)€hospital€services€incident€to€physicians€services€rendered€to€outpatients€andÏhospitalization€services€incident€to€such€services;€ambulance€services;€ÌÌà  à(c)€psychologist€services€or€clinical€social€worker€services;€orÌÌà  à(d)€health€cost€reimbursers€(e.g.,€health€insurers,€HMOs).ÌÌÌÌÓ  Ó*€€€€€*€€€€€*€€€€€*€€€€€*¹Ó:UÓÌÌÌà  àòòOn„line€merchantóó.€€As€applied€to€encryption€items,€means€an€entity€regularly€engaged€inÐ ˜+`'* Ðlawful€commerce€that€uses€means€of€electronic€communications€(e.g.,€the€Internet)€to€conductÏcommercial€transactions.ÌÓ  Ó*€€€€€*€€€€€*€€€€€*€€€€€*ÌÓgVÓÌà  àòòRecoverable€commodities€and€softwareóó.€€As€applied€to€encryption€items,€means€any€ofÐ ¸ € Ðthe€following:ÌÌà  à(a)€A€stored€data€product€containing€a€recovery€feature€that,€when€activated,€allowsÏrecovery€of€the€plaintext€of€encrypted€data€without€the€assistance€of€the€end„user;€orÌÌà  à(b)€€A€product€or€system€designed€such€that€a€network€administrator€or€other€authorizedÏpersons€who€are€removed€from€the€end„user€can€provide€law€enforcement€access€to€plaintextÏwithout€the€knowledge€or€assistance€of€the€end„user.€€This€includes,€for€example,€products€orÏsystems€where€plaintext€exists€and€is€accessible€at€intermediate€points€in€a€network€orÏinfrastructure€system,€enterprise„controlled€recovery€systems,€and€products€which€permitÏrecovery€of€plaintext€at€the€server€where€a€system€administrator€controls€or€can€provide€recoveryÏof€plaintext€across€an€enterprise.€ÌÌà  àNote:€ð ðPlaintextðð€indicates€that€data€that€is€initially€received€by€or€presented€to€theÏrecoverable€product€before€encryption€takes€place.ÌÌÓ  Ó*€€€€€*€€€€€€*€€€€€€*€€€€€*Ð ˜+`'* ÐÓ  ÓÌòòà  àStrategic€partner€(of€a€U.S.€company)óó.€€As€applied€to€encryption€items,€means€a€foreign„Ð à Ðbased€entity€that:ÌÌà  à(a)€has€a€business€need€to€share€the€proprietary€information€with€one€or€more€U.S.Ïcompanies;€òòandÐ ˜ `  ÐÌà  àóó(b)€is€contractually€bound€to€the€U.S.€company€(e.g.,€has€an€established€pattern€ofÐ X  Ðcontinuing€or€recurring€contractual€relations).òòÐ 8 ÐóóÌÓ  Ó*€€€€€*€€€€€*€€€€€*€€€€€*ÌÓ÷\Ớ̜ÌÌà  àòòU.S.€subsidiaryóó.€€As€applied€to€encryption€items,€means€Ð X  ÐÌà  à(a)€a€foreign€branch€of€a€U.S.€company;€orÌÌà  à(b)€a€foreign€subsidiary€or€entity€of€a€U.S.€entity€in€which:ÌÌà  àà ` à(1)€the€U.S.€entity€beneficially€owns€or€controls€(whether€directly€or€indirectly)€25Ð ˜+`'* Ðpercent€or€more€of€the€voting€securities€of€the€foreign€subsidiary€or€entity,€if€no€other€personsÏowns€or€controls€(whether€directly€or€indirectly)€an€equal€or€larger€percentage;€orÌÌà  àà ` à(2)€the€foreign€entity€is€operated€by€the€U.S.€entity€pursuant€to€the€provisions€ofÏan€exclusive€management€contract;€orÌÌà  àà ` à(3)€a€majority€of€the€members€of€the€board€of€directors€of€the€foreign€subsidiary€orÏentity€also€are€members€of€the€comparable€governing€body€of€the€U.S.€entity;€orÌÌà  àà ` à(4)€the€U.S.€entity€has€the€authority€to€appoint€the€majority€of€the€members€of€theÏboard€of€directors€of€the€foreign€subsidiary€or€entity;€or€ÌÌà  àà ` à(5)€the€U.S.€entity€has€the€authority€to€appoint€the€chief€operating€officer€of€theÏforeign€subsidiary€or€entity.€€€€€€€€€€€€€€€€€€Ì€ÌÌÌPART€774€„€[AMENDED]ÌÌÝ‚SmyÿÝÝ  ÝÝ‚SmyþaÝà  àÚƒRÚ14Ú  Ú.Û€RÛÝ  Ý€€In€Supplement€No.€1€to€part€774,€Category€5€„€Telecommunications€and€InformationÏSecurity€is€amended€by€revising€the€License€Requirements€section€of€ECCNs€5A002€and€5D002Ïto€read€as€follows:݃Smyþab݌Р˜+`'* ÐŒÝ  ÝÌÌ5A002€€Systems,€equipment,€application€specific€"assemblies",€modules€or€integrated€circuits€forÏ"information€security",€and€specially€designed€components€therefor.ÌÌLicense€RequirementsÌÌà  àòòReason€for€Controlóó:€€€NS,€AT,€EIÐ X  Ðà  àà ` àà ¸ àà  àà h àà À àà  àà p àà È àÌà  àà ` àòòControl(s)óóà  àà h àà À àà  àà p àòòCountry€ChartóóÐ à Ðà  àÌà  àà ` àNS€applies€to€entire€entry€à À àà  àNS€Column€1Ð Ø  ÐÌà  àà ` àAT€applies€to€entire€entry€à À àà  àAT€Column€1Ð ˜` ÐÌà0  àà0` (#(#àEI€applies€to€encryption€items€transferred€from€the€U.S.€Munitions€List€to€theÏCommerce€Control€List€consistent€with€E.O.€13026€of€November€15,€1996€(61€FRÏ58767)€and€pursuant€to€the€Presidential€Memorandum€of€that€date.€€Refer€toÏðð742.15€of€this€subchapter.Ð ` (#` (# ÐÌà  àÌÓ  Ó*€€€€€€*€€€€€*€€€€€*€€€€€*Ð ˜+`'* ÐÓgÓò òÌ5D002€€Information€Security€„€"Software".ó óÐ à ÐÌò òLicense€Requirementsó óÐ Ø   ÐÌà  àòòReason€for€Controlóó:€€€NS,€AT,€EIÐ ˜ `  Ðà  àà ` àà ¸ àà  àà h àà À àà  àà p àà È àÌà  àà ` àòòControl(s)óóà  àà h àà À àà  àà p àòòCountry€ChartóóÐ X  Ðà  àÌà  àà ` àNS€applies€to€entire€entry€à À àà  àNS€Column€1Ð à ÐÌà  àà ` àAT€applies€to€entire€entry€à À àà  àAT€Column€1Ð Ø  ÐÌà0  àà0` (#(#àEI€applies€to€encryption€items€transferred€from€the€U.S.€Munitions€List€to€theÏCommerce€Control€List€consistent€with€E.O.€13026€of€November€15,€1996€(61€FRÏ58767)€and€pursuant€to€the€Presidential€Memorandum€of€that€date.€€Refer€toÏðð742.15€of€the€EAR.Ð ` (#` (# ÐÌà0  àà0` (#(#àò òNote:ó ó€€Encryption€software€is€controlled€because€of€its€functional€capacity,€andÐ ø%À!$ Ðnot€because€of€any€informational€value€of€such€software;€such€software€is€notÏaccorded€the€same€treatment€under€the€EAR€as€other€"software";€and€for€exportÏlicensing€purposes,€encryption€software€is€treated€under€the€EAR€in€the€sameÐ ˜+`'* Ðmanner€as€a€commodity€included€in€ECCN€5A002.€€License€Exceptions€forÏcommodities€are€not€applicable.Ð ` (#` (# ÐÌà0  àà0` (#(#àò òNote:ó ó€€Encryption€software€controlled€for€EI€reasons€under€this€entry€remainsÐ Ø   Ðsubject€to€the€EAR€even€when€made€publicly€available€in€accordance€with€partÏ734€of€the€EAR,€and€it€is€not€eligible€for€the€General€Software€Note€("massÏmarket"€treatment€under€License€Exception€TSU€for€mass€market€software).€ÏAfter€a€technical€review,€certain€encryption€software€may€be€released€from€EI€œÐ ` (#` (# ÐÌÌÌÌÌÌÌÌÌÌà0  àcontrols›€and€made€eligible€for€the€General€Software€Note€treatment€as€well€as€otherÏprovisions€of€the€EAR€applicable€to€software.€€Refer€to€ðð742.15(b)(1)€of€the€EAR,€andÏSupplement€No.€6€to€part€742€of€the€EAR.Ð (#(# ÐÓ  ÓÐ ˜+`'* Ð*€€€€€*€€€€€*€€€€€*€€€€€*ÌÓ‘pÓÌDated:ÌÌÌR.€Roger€MajakÌAssistant€Secretary€forÌExport€Administration€ÌÌœ