BIS Publishes Revised Encryption Export Controls and Seeks Public Comments

On June 25, 2010, the Bureau of Industry and Security (BIS) issued an interim final rule that amends the Export Administration Regulations (EAR) to modify the requirements of License Exception ENC, "Encryption Commodities, Software and Technology," and the requirements for qualifying an encryption item as mass market. In addition, the rule also amends specific license requirements for encryption items. EAR sections affected are 15 CFR Parts 730, 734, 738, 740, 742, 748, 772 and 774. BIS also posted on its website a press release, a summary of the rule, and additional information to assist exporters.

BIS believes that the rule will streamline procedures for (1) less sensitive encryption items eligible for export under License Exception ENC and (2) most mass market encryption products. The interim final rule also implements the Wassenaar Arrangement's decontrol of items that perform "ancillary cryptography" in the Commerce Control List.

The rule includes several significant changes to encryption export controls by modifying the way information about encryption products is collected an analyzed. The rule, as amended: 

    ·    Removes review requirements for less sensitive encryption items;

    ·    Establishes a company registration requirement for encryption items under License Exception ENC or as mass market encryption items. Under the new rule, authorization for License Exception ENC and mass market treatment is based on company authorizations that operate like a bulk license for the company's products rather than product-by-product authorizations; 

    ·    Creates an annual self-classification report requirement for such items pursuant to an encryption registration. Under the new rule, the self-classification report would be required to be submitted annually to BIS and the ENC Encryption Request Coordinator in February for items exported and reexported the previous calendar year; 

    ·    Makes encryption technology eligible for export and reexport under License Exception ENC, except to countries of highest concern;

    ·    Lifts the semi-annual sales reporting for less sensitive encryption items under License Exception ENC. When sales reporting is not required under License Exception ENC, companies need only maintain records as required by the EAR that can be reviewed by appropriate agencies of the U.S. Government upon request;

    ·    Removes the 30-day delay to export and reexport less sensitive encryption items under License Exception ENC; and

    ·    Removes the 30-day delay to make most mass market encryption items eligible for mass market treatment.

Comments on the suggested changes are due by August 24, 2010.