How do you classify encryption under the Commerce Department s Export Administration Regulations (EAR)?

Transcription

1 By Ray Gold

2 What is encryption? How do you classify encryption under the Commerce Department s Export Administration Regulations (EAR)? What are potential solutions to managing concerns?

3 Encryption Is Also Known as Cryptography or Crypto. Does Item Have Cryptographic Functionality? Cryptography = Transformation of Data to Hide Its Information Content, Prevent Its Undetected Modification or Prevent Its Unauthorized Use, Using One or More Secret Parameters (e.g., Crypto Variables) and/or Associated Key Management 3

4 Does Item Have Information Security Functionality? All the Means and Functions Ensuring the Accessibility, Confidentiality or Integrity of Information or Communications, Excluding the Means and Functions Intended to Safeguard Against Malfunctions. This Includes Cryptography, Cryptanalysis, Protection against Compromising Emanations and Computer Security Whether Crypto/InfoSec Functions or Not, One Still Needs to See Rest of Commerce Control List (CCL)

5 Our Product Doesn t Contain Its Own Encryption Code, We Just Use Open Source or Call to Already Classified Products Items that Call on Another Product to Perform Cryptography Are Controlled as Encryption Items Examples Invoking Browser Specifically to Establish HTTPS Connection Calling on MS CAPI or CNG, Java, Open SSL to Encrypt/SSL Government Takes Conservative Approach Considers Any Invocation of Security Function to Be a New Specially Designed Crypto Item But May Qualify for Note 4 or Other Lower Level of Control Still a Surprise to Most 5

6 Step 1 Crypto/InfoSec Functionality? Whether Yes or No Still Need to See Rest of CCL Yes Limited Crypto Password/Authentication Feature -> EAR99 Yes Other Crypto 5A002/5D002, 5A992/5D992 SSL, VPN, Data, Encrypted Throughput Difference Between 5A002 vs. 5A992 = Non-MM vs. MM Yes Other Info Sec Functionality Step 2 Note 4 Eligible? Yes See Rest of CCL Step 3 Mass Market Eligible? Yes 5A992.c/5D992.c Items in EAR (b)(2) & (3) Are Excluded from MM

7 5A002 (Hardware) & 5D002 (Software) Items with Cryptographic Functionality Definitions and Notes Exclude Certain Items License Required to All Countries Except Canada Unless a License Exception Applies (ENC, etc.) 5A992.c (Hardware) & 5D992.c (Software) Mass Market Cryptographic Equipment and Software Not Covered by 5A002/5D002 In 9/20/16 Rule, Commerce BIS deleted a & b in 5A992 and 5D992. Such Items Fall to EAR99 Unless a More Stringent Classification (e.g., 5A991, etc.) Applies. No BIS License Req d Except for Embargoed Areas: currently Crimea, Cuba, Iran, North Korea, Sudan, & Syria 5E002 & 5E992 (Technology)

8 5A002/5D002 License Exception ENC Can Export Without a BIS License (b)(2) ENC Restricted Has Complicated Controls. Need Licenses for Gov t End-Users Outside Favorable Treatment Countries. Also Other Restrictions (b)(1) & (3) ENC Unrestricted Can Export to All End-Users, Except Crimea, Cuba, Iran, North Korea, Sudan, and Syria Various Requirements to Qualify Encryption Licensing Arrangement/License 5A992.c/5D992.c No BIS License Required Except to Crimea, Cuba, Iran, North Korea, Sudan, and Syria

9 5A002 Does Not Control Smart Cards and Readers/Writers w/specified Functions Products Limited to "Money or Banking Civil Mobile Phones w/o End-to-End Crypto Short Range Cordless Telephones w/o End-to-End Crypto Phones and Other Client Wireless Personal Area Network Devices Using Only Published or Commercial Crypto Standards Short Range Wireless Personal Area Network Equipment Using Only Published or Commercial Crypto Standards Low-level Civil Mobile Telecom Radio Access Equipment Certain Other Types of Items

10 ECCN 5A002.a.1 and Following Technical Notes Exclude: 56-bit or Less Symmetrical/512-bit or Less Asymmetrical/ 112-bit or Less Elliptic Curve Authentication (Encryption Only of Passwords/PINs to Prevent Unauthorized Access) (Any Key Length) Digital Signatures (Any Key Length) Fixed Data Compression or Coding Also Drops to EAR99 Unless More Stringent ECCN Applies. Examples: Huffman encoding, ZIP, JPEG, Base64, most hashing EAR s Definition of Cryptography Now Has Note Stating `Cryptography does not include fixed data compression or coding techniques. This Note Used to Be in ECCN 5A002.

11 Excludes from Cat. 5, Part 2 Items Incorporating or Using Cryptography and Meeting All of the Following: A. Primary Function or Set of Functions Is Not: 1. Information Security ; 2. A Computer, Including Operating Systems, Parts and Components Therefor; 3. Sending, Receiving, or Storing Information (Except to Support Entertainment, Mass Commercial Broadcasts, Digital Rights Management, or Medical Records Management); or 4. Networking (Includes Operation, Administration, Management, and Provisioning); B. Cryptographic Functionality Limited to Supporting Primary Set of Functions; and C. When Necessary, Details of the Items Are Accessible and Will Be Provided, Upon Request, to BIS to Ascertain Compliance. Note 4 Also Decontrols to EAR99 Items Formerly 5A992/5D992 if Crypto Limited to: Broadcast Media Billing Applications; Copy Protected Software, Read-Only Media 11

12 Examples in June 26, 2010 Federal Register Notice: Automotive, Aviation and Other Transportation Systems; Industrial, Manufacturing or Mechanical Systems (Including Robotics, Other Factory or Heavy Equipment, Facilities Systems Controllers Including Fire Alarms and HVAC); Piracy and Theft prevention for Software or Music; Games and Gaming; Household Utilities and Appliances; Printing, Reproduction, Imaging and Video Recording or Playback (Not Videoconferencing); Business Process Modeling and Automation (e.g., Supply Chain Management, Inventory, Scheduling and Delivery); LCD TV, Blu-ray / DVD, Video on Demand (VoD), Cinema, Digital Video Recorders (DVRs) / Personal Video Recorders (PVRs) Devices, On-Line Media Guides, Commercial Content Integrity and Protection, HDMI and Other Component Interfaces 12

13 Medical / Clinical Including Diagnostic Applications, Patient Scheduling, And Medical Data Records Confidentiality Academic Instruction and Testing / On-line Training - Tools and Software Applied Geosciences Mining / Drilling, Atmospheric Sampling / Weather Monitoring, Mapping / Surveying, Dams / Hydrology Scientific Visualization / Simulation / Co-Simulation (Excluding Such Tools for Computing, Networking, Cryptanalysis, etc.) Data Synthesis Tools for Social, Economic, and Political Sciences (e.g., Economic, Population, Global Climate Change, Public Opinion Polling, etc. Forecasting and Modeling) Software and Hardware Design IP Protection Computer Aided Design (CAD) Software and Other Drafting Tools Source: 75 Fed. Reg , (06/25/10) These Examples Are Also in BIS Website FAQs. 13

14 If Qualify, Encryption Does Not Govern Classification Classify as Usual on Commerce Control List (CCL) Items Not Controlled on the CCL fall to EAR99 Optional to Seek CCATS Classification Caution: All Wassenaar Arrangement Countries May Not Agree on Application of Note 4 Caution: Non-Wassenaar Countries May Not Use the Same Approach 14

15 Required Annual Reports of MM Self-Classifications and ENC- Unrestricted (EAR (b)(1) Self-Classifications Report All Such Self-Classified Products. Include New Products or Changes to Encryption of Existing Products Must Continue to Include Products Previously Reported If Such Products Continue to Be Exported or Reexported. Spreadsheet = Less Information Required than for Classification Request Due February 1 of Each Year for the Prior Calendar Year Not Required for Encryption Classified as EAR99 (Either Under Note 4 or Because Encryption Is Limited (e.g., Authentication, Digital Signature.). Exporters Are No Longer Required to Obtain and Maintain Encryption Registrations. BIS Eliminated This Requirement on Sept. 20, But, Much of the Registration Information Is Now Required to Be Provided in Annual Reports Instead. 15

16 5A002/5D002 Items Can Be Decontrolled to 5A992/5D992 If User Installable Without Substantial Support Sold to Public Without Restriction Through Over the Counter, Mail Order, Electronic, or Telephone Call Transactions User Cannot Change Crypto Easily and Details of Items Will Be Provided on Request to BIS to Ascertain Compliance with Note 3 (Cryptography Note). Not Just Retail Point of Sale Items, But Can Include Items of Potential Interest to Wide Range of Individuals & Businesses Price and Information about Main Functions Must Be Available Prior to Purchase w/o Need to Consult Vendor/Supplier. But, a Simple Price Inquiry Is Not Considered to Be a Consultation. United States - Mass Market Ineligible Items ENC-Restricted Items (Listed in (b)(2)) ENC-U Items that Perform Vulnerability Analysis or Network or Computer Forensics Described in (b)(3)(iii). 16

17 2 Tiers of Eligibility Full Crypto Classification Request & 30-Day Wait Required (b)(3)(used to be in (b)(3)) Chips, Chipsets, Electronic Assemblies and Field Programmable Logic Devices Cryptographic Libraries, Modules, Development Kits And Toolkits, Including for Operating Systems and Cryptographic Service Providers (CSPs) Commodities, Software, and Components That Provide/Perform Non-Standard Cryptography, Defined Below Cryptographic Activation Commodities, Components, and Software. Self-Classify (b)(1)(used to be in (b)(1)) All Other Mass Market Items (unless Ineligible per Prior Slide) Can Also File Classification Request If Confirmation Desired Must Include in Annual Reports of All (b)(1) Self-Classifications; No Longer Required to Include in Such Reports (b)(1) Classifications Made by BIS in CCATS. For Products Obtained from Manufacturer, You Can Usually Rely on the Manufacturer to Self-Classify and Report Such Products. But, Watch Out for Red Flag(s) That Manufacturer Is Not Reliable (e.g., manufacturer provides HTS number to you as the ECCN, etc.) 17

18 Components and Executable Software Specially Designed for Mass Market Items Note 3, Paragraph b Mass Market Treatment for: Hardware components and executable software that have been designed for existing mass market items, if all of the following apply: 1. "Information security" is not the primary function of the component/executable software; 2. The component/executable software does not change or add cryptographic functionality to the existing items; 3. The feature set of the component/executable software is fixed and is not designed or modified to customer specification; and 4. When necessary, details of the component/executable software and relevant end-items are accessible and will be provided to BIS upon request. Existing can include a class of products e.g., smartphones as long as the component is not being customized for each end-user Can also apply to functionally equivalent aftermarket replacements identical in form, fit and function to OEM components 18

19 Components/Executable Software Still Require BIS Classification Review Chipsets, chips, etc. Technology for Mass Market Encryption Items Remains 5E002 19

20 If Cannot Qualify for Decontrol, Then Stuck with 5X002 But, License Exception ENC May Be Available 3 Main Types of License Exception ENC Eligibility ENC-U With Annual Self Classification Report Most ENC-U (b)(1) Eligible With Classification Request and 30-Day Review and Six Month Reports of Exports from US (and Reexports from Canada) ENC-R (b)(2) (Complicated Controls) (Usually ENC-R Is Available After Class. Request and 30 Day Review, Except to Gov ts Outside FTC) (b)(3) Listed Items (6 Month Reports Req d Only for (b)(3)(iii)) ENC for US Subsidiaries for Internal Company Uses (740.17(a)(2)); ENC for FTC Subsidiaries for Internal Development/Production of New Products (740.17(a)(1)) No Classification, Reporting 20

21 EAR 740 Supplement No. 3, EU + Close U.S. Allies Australia, Austria, Belgium, Bulgaria, Canada, Croatia*, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, The Netherlands, New Zealand, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey, United Kingdom *(added Sept. 20, 2016)

22 ENC for FTC Subsidiaries for Internal Development/Production of New Products (740.17(a)(1)) No Classification, Reporting Foreign Products With US Crypto Content (740.17(a)(3) -- used to be in (b)(4)) Reexports of foreign products developed with or incorporating previously reviewed U.S. origin encryption source code, components, or toolkits w/o change in crypto (a)(3) does not apply to foreign products exported from the US. 22

23 Most 5X002 Items Eligible for ENC-Unrestricted (b)(1) But, ENC-Unrestricted (b)(1) Is Not Available for Items in (b)(2) and (b)(3)(described Below) Can Export without BIS License to Government and Private Sector End-Users (Except Embargoed Areas) Annual Product Self-Classification Reports Required Can Also Qualify If Seek Optional Classification Request, Just Like any Classification. No Longer Need to Include (b)(1) Classifications from BIS in Your Annual Self-Classification Reports. 23

24 Applies to Items Listed in (b)(3) Full Classification Review and 30-Day Wait BIS/NSA Can Hold Without Action and Stop Clock with Questions Upon Registration of Classification Request, Can Export to Any FTC or FTC HQ d End-User Exportable after 30-Day Wait to Any End-User (Except Embargoed Destinations) Semi-Annual Reports of Export Shipments (and Reexports from Canada) Required Only for (b)(3)(iii) Items 24

25 Items Listed in (b)(3) Require Classification Review: (i) Specified Components and Equivalent or Related 5D002 Software: (A) Chips, Chipsets, Electronic Assemblies and Field Programmable Logic Devices (B) Cryptographic Libraries, Modules, Development Kits and Toolkits, Including for Operating Systems and Cryptographic Service Providers (CSPs) (ii) Encryption Commodities, Software and Components that Provide or Perform Non- Standard Cryptography as Defined in EAR 772 (iii) Encryption Commodities and Software, that Provide or Perform Vulnerability Analysis, Network Forensics, or Computer Forensics Functions Characterized by Any of the Following: (A) Automated Network Analysis, Visualization, or Packet Inspection for Profiling Network Flow, Network User or Client Behavior, or Network Structure/Topology and Adapting in Real-time to the Operating Environment; or (B) Investigation of Data Leakage, Network Breaches, and Other Malicious Intrusion Activities through Triage of Captured Digital Forensic Data for Law Enforcement Purposes or in a Similarly Rigorous Evidentiary Manner (iv) Cryptographic Activation Items 25

26 ENC Restricted (b)(2) Cannot Use for Government End-Users Outside FTC, Except for Network Infrastructure in (b)(2)(i)(A)) to Less Sensitive Gov t End Users Upon Registration of Classification Request Can Export All ENC-R Items to FTC or FTC HQ d Organization (Except Cryptanalytic Items to Government End-Users) Source Code to Non- Government End-Users (Except Embargoed Destinations) 30-Day Wait Required for All Other ENC-R Items to Export to Non- Government End-Users Outside FTC. But, ENC-R Is Not Available for Some Items (e.g., Open Cryptographic Interface, etc.) for Non- Government End-Users Outside FTC. Semi-Annual Reports of Exports Still Required Can Usually Obtain ELAs or Licenses for Non-FTC Governments 27

27 Network Infrastructure with >80-bit Symmetric Crypto: WAN, MAN, VPN, Backhaul or Long-Haul Throughput (including Wireless) equal to or greater than 250 Mbps Transmission Over Satellite > 10 Mbps Media (Voice/Video/Data) Encryption or Encrypted Signaling to more than 2,500 Endpoints (including Centralized Key Management therefor) Terrestrial Wireless: Air-Interface Coverage > 1,000 meters plus: Max Data Rate >10 Mbps or Maximum Concurrent Full-Duplex Voice Channels >30 28

28 Proprietary Crypto Source Code Crypto Modified for Government or to Customer Spec, or Easily Changed by User (If Not Publicly Available) Quantum Cryptography Network Penetration Tools (Encryption Items Used for Cyber Attacks) Public Safety/First Responder Radios Crypto Ultra-Wideband and Spread Spectrum Items (added to (b)(2) on Sept. 20, 2016) Open Crypto Interface or Cryptanalytic Items Encryption Technology

29 Government End-User Applies to Foreign Central, Regional & Local Government Department Agency, or Entity Performing Governmental Functions Includes Government Research Institutions and Government Owned Companies Manufacturing or Distributing Munitions/Dual-Use Items Includes Public Schools and Universities Does Not Include State-Owned Utilities, Banks, Civil Medical, Transportation, Broadcast, Retail/Wholesale, or Entities Not Manufacturing or Distributing Munitions/Dual-Use Items Definition in EAR Part

30 1. No Review, Registration, or Report Required Certain Low-Strength and Limited Crypto Functionality Note 4 (Ancillary Cryptography) Certain Foreign Developed Items 2. BIS Classification Review + 6 Month Shipment Reports 5X002 ENC-Restricted (b)(2) 5X002 ENC-Less Restricted (b)(3) (6 month reports required only for (b)(3)(iii)) 5X992 Mass Market Components (no reports) Publicly available (b)(3) Mass Market not subject to EAR 3. Self Classification + Annual Reports Other Mass Market & ENC-Unrestricted (b)(1) Publicly available (b)(1) Mass Market items not subject to EAR 31

31 Publicly available encryption source code is no longer subject to the EAR once the notification is sent to BIS and ENC Encryption Request Coordinator. This notification requirement was moved from (e)(License Exception TSU) to (b). 5A002 was split into 3 ECCNs: 5A002, 5A003, and 5A004. 5A002 controls cryptographic information security. 5A002 controls the same encryption items as before except for cryptanalytic items (now controlled under 5A004). 5A003 controls non-cryptographic information security.

32 BIS added a Note to (b)(2)(i)(A) to provide a carve out for certain satellite items. The carve out will enable such items to qualify for treatment as mass market encryption items. This carve out applies to satellite terminals or modems meeting all of the following: The encryption of data over satellite is exclusively from the user terminal to the gateway earth station, and limited to the air interface and The satellite terminals and modems meet encryption mass market requirements (Note 3).

33 BIS advised that network infrastructure is now limited to end items. Some components (such as chips) have been classified as (b)(2) in the past. Now, such components will be classified (b)(3). BIS clarified that technology for items decontrolled from Cat. 5, Part 2 (e.g., Note 4, authentication only, etc.) is also excluded from Cat. 5, Part 2.

34 Can Rely on Manufacturer s Annual Classification Reports, or Include Same Item(s) in Your Own Reports. Document Self Classifications Before Shipping New Products. Apply Grandfathering of Old CCATS to New Rubric. Be Extra Careful with CCATS Issued Before June 25, 2010 Amendments, Especially to Verify Items Not Caught By More Restrictive Controls. Changes in Encryption Functionality to Products That Have Already Been Classified Will Necessitate Classifying the Revised Products. Seek CCATS Classifications as Required (b)(2) and (3) and as You Determine for Gray Areas, Just Like Other ECCNs Calendar Feb. 1 to File Self-Classification Report for Prior Year Calendar Feb. 1 and Aug. 1 to File 6-Month Shipment Reports as Required 35

35 Comment: EAR Crypto Controls Are Used More to Collect Information Than Impose True NS Controls; Licenses Are Usually Not Required But Still Need to Jump Through Applicable Hoops Do Not Overlook Non-Encryption Controls, Other US Controls (e.g., OFAC, ITAR, etc.), and non-us Controls.

36 5A002/5D002 Items Not Yet Qualified for ENC ENC Restricted (b)(2) Items to Government End-Users Outside FTC 5E002 Technology that Is Not ENC Eligible Cryptanalytic Any Government End-User Open Cryptographic Interface Any End-User Outside FTC Export to Crimea, Cuba, Iran, North Korea, Sudan, Syria. Export to Denied/Sanctioned Parties Export to Prohibited End-Uses/Users IVL Individual Validated License Limited Quantity Defined End User 4-year Validity ELA Encryption Licensing Arrangement Unlimited Quantities One or More End Users 4-year Validity Single Country vs. Multiple Countries

37 ELAs Authorize Exports of Encryption Items to Governments for Civil Use and Users; by Practice to Strategic Partners of US/FTC Headquartered Companies May Require Reporting Specify Class of End-User, Name & Address Make Clear If Not Distributing from the User If Closed Loop, Partner ELAs Can Be Broad

38 Ben Flowe, Jr. John Ordway Dan Fisher-Owens Ray Gold Michelle Roberts Jason McClurg Babak Hoghooghi Berliner Corcoran & Rowe LLP Washington, DC San Francisco, California