Where Industry and Security Intersect
What's New | Sitemap | Search
EAR citations on this page may be found in the
June
6, 2002 Encryption Rule on the
Government Printing Office Web site.
To receive written authorization from the Bureau of Industry and Security (BIS) to export your encryption items under License Exception ENC, you must submit an encryption review request to BIS and the ENC Encryption Request Coordinator. It is important that you read all of the instructions below before submitting a review request. This guidance is designed to help you apply for eligibility to export under License Exception ENC, and should be used in conjunction with the relevant portions of the Export Administration Regulations (EAR), which can be found on the Government Printing Office Web site.
Section 740.17 is the principal regulatory reference for License Exception ENC and Supplement 6 to Part 742 provides specific details on what information to include with a review request for encryption items. In addition, Section 742.15 explains the licensing policy for encryption items subject to the EAR and Supplement 1 to Part 748 provides general information on submitting encryption review requests and other multipurpose applications. Also, we have provided a set of Frequently Asked Questions on this Web site for clarification.
Use the BIS 748P multipurpose application form to apply for License Exception ENC. To order forms you may submit a request by fax at (202) 219-9179 or call the Exporter Counseling Division at (202) 482-4811 or our Western Regional Office at (949) 600-0144, or you can use the Internet order form found on this Web site. If you are submitting a request for more than one item, you must also obtain form BIS 748P-A, which is an item appendix, and follow the instructions for Block 22 for each additional item. You may include up to six items. Alternatively, instead of submitting a paper application form, you can apply over the Internet by using BIS's Simplified Network Application Process (SNAP). Follow the instructions on SNAP to add items electronically.
The form must be typed. When applying for License Exception ENC, please follow the instructions below as appropriate in lieu of the instructions in Supplement 1 to Part 748 in completing the blocks.
Block 5 Mark the classification request box. This is extremely important. DO NOT mark export or reexport. If you do, the application will be returned to you.
Block 9 Indicate the phrase "License Exception ENC" in this block. This is used to route the application to an appropriate licensing officer in BIS. If you fail to use this phrase, the application will be delayed.
Blocks 14-15 Be sure the information in these blocks is complete and correct, because this is where BIS will send the official confirmation document. If both blocks are filled in, the official document will be sent to the individual or entity identified in Block 15.
Block 22(a) For software, enter "5D002." For hardware, enter "5A002." For test, inspection and production equipment enter "5B002." For technology, enter "5E002" (only applicable for exports/reexports to countries listed in Supplement 3 to Part 740).
Block 22(j) Provide a brief technical description including the basic purpose of the encryption product and the type of encryption used (e.g., 128-bit RC4 for secure e-mail, 2048-bit RSA for key exchange). Please DO NOT type "see letter of explanation" or "see brochure". The information identified in this block is entered directly into the BIS license application database, and will be printed on the official confirmation document issued by BIS. A brief technical description is essential.
Block 24 BIS will determine the specific provisions of ENC for which your product qualifies. Indicate the provisions you believe are applicable:
(a) §740.17(a)- encryption items (including technology and Open Cryptographic Interfaces (OCIs)) to end-users located in Supplement 3 to Part 740 countries
(b) §740.17(b)(2)- encryption commodities, software and components that are not classified as retail
(c) §740.17(b)(2)(ii)- encryption source code not considered "publicly available" (NOTE: You may export such source code once you register a complete review request, including a copy of the encryption source code, with BIS and the ENC Encryption Request Coordinator)
(d) §740.17(b)(3)- "retail" encryption commodities, software and components
Use BIS Form 748P-A, Item Appendix, if you have more than one item. Repeat block 22 for each additional item you are requesting LE ENC Review.
Supporting documents, such as technical specifications, must accompany the completed BIS 748P form. The supporting documents must contain the information requested in Supplement 6 to Part 742, including enough information for BIS to verify the encryption functionality of the item (e.g., encryption algorithms and key sizes used, what type of data is encrypted, etc.). In addition, the supporting documents should also address the specific provisions of License Exception ENC for which you are applying (e.g. §740.17(b)(2) or (b)(3)). Carefully review the provisions of License Exception ENC, particularly Section 740.17(d) (this describes how to initiate the review) and Supplement 6 to Part 742 (this describes the technical information you are required to submit). Be sure to include your application control number (e.g., Z999999) on your support documents.
(a) Submit the original BIS Form 748P, 748P-A (if applicable) and support documents, in accordance with Sections 740.17 and 748.3(b) of the EAR, to BIS at the following address:
U.S. Department of Commerce
Bureau of Industry and Security
Office of Strategic Trade and Foreign Policy Controls
14th Street and Pennsylvania Avenue, NW
Room 2705
Washington, D.C. 20230
Attn: "Application Enclosed"
BIS will not accept applications sent C.O.D. When the updated BIS electronic application submission system is implemented, you will be able to submit your support documents electronically, as attachments to the application. Until then, if you submit the forms electronically, either through SNAP or ELAIN, fax the supporting documents to BIS (fax number 202-219-9179 or -9182).
Reminder: to expedite processing you may send a complementary copy of your application to the Information Technology Controls Division (ITCD). You may fax your documents to ITCD at 202-501-0784, or else mail them to the U.S. Department of Commerce, Bureau of Industry and Security, Information Technology Controls Division, Room 2093, 14th & Pennsylvania Ave., NW, Washington, D.C. 20230.
(b) A copy of the entire application (including forms and supporting documents) must also be express mailed to the following address (failure to comply will result in your review being delayed or possibly returned without action):
Attn: ENC Encryption Request Coordinator
9800 Savage Road, Suite 6131
Ft. Meade, MD 20755-6000
Semi-annual reporting to BIS (and a copy to the ENC Encryption Request Coordinator
at Ft. Meade, MD) is required for certain exports and exports under License
Exception ENC. See Section 740.17(e) for the specific requirements and instructions
on encryption reporting. BIS multipurpose forms are available for reporting
purposes.
BIS-742R (pdf)|
BIS-742S (pdf)
Encryption Items to U.S. Subsidiaries: Exports of encryption items under ECCNs 5A002, 5B002, 5D002 and 5E002 to certain foreign subsidiaries of U.S. companies (consult the definition of U.S. Subsidiary in Part 772), do not require review, provided the items are not sold or transferred outside the U.S. company or transferred to countries listed in Country Group E:1 in Supplement 1 to Part 740 or nationals of these countries. This provision includes source code and items that provide an Open Cryptographic Interface (OCI). See Section 740.17(b)(1) of the EAR.
Reminder: All items produced or developed by U.S. subsidiaries using encryption commodities, software or technology exported under this license exception provision are controlled encryption items of "U.S. origin". All such items are subject to the EAR and thus require review or separate authorization prior to sale or transfer outside the U.S. company.
Encryption Items to the European Union plus eight additional countries ("EU+8"): Except for cryptanalytic items (see definition in Part 772 of the EAR) to government end-users, exporters may immediately export any encryption item (including source code, technology and OCIs) to government and non-government end-users located in the countries listed in Supplement 3 to Part 740 of the EAR (current European Union plus eight additional countries), once a complete review request is registered with BIS and the ENC Encryption Request Coordinator. To be considered complete, a review request must contain the information requested in Supplement No. 6 to Part 742 of the EAR, even for exports to the "EU+8".
Reminder: All complete requests for "retail" (§740.17(b)(3)) or "non-retail" (§740.17(b)(2)) review under License Exception ENC satisfy the review requirements for exports and reexports to the "EU+8". You do not need to submit a separate review request for "EU+8" treatment.
Use of "Publicly Available" Encryption Source Code: Encryption source code that would be considered publicly available under §734.3(b)(3) of the EAR (and the corresponding object code, if it is also made publicly available) does not require review under License Exception ENC for export and reexport. Instead, such "publicly available" encryption software may be exported and reexported under License Exception TSU once notification (or a copy of the source code) is provided to BIS and the ENC Encryption Request Coordinator. Refer to §740.13(e) for this provision of the EAR.
Reminders:
1. Although §740.13(e) of the EAR does not authorize the export or reexport of "company proprietary" encryption source code (i.e., when the complete source code has not been made publicly available), such source code may be eligible for several provisions of License Exception ENC (e.g. §740.17(a), §740.17(b)(1) and §740.17(b)(2)(ii)).
2. Generally speaking, the provisions of License Exception ENC apply to all U.S.-origin "commercial" encryption products, including those that employ cryptography obtained (or derived) from publicly available sources.
Before applying for "retail" treatment, review Section 740.17(b)(3) to determine whether your encryption commodity, software or component is likely to qualify under the "retail" category. This section of the EAR contains the criteria for "retail" treatment under License Exception ENC.
Most "retail" encryption commodities, software and components are generally available to the public by being distributed or for use in one of these three ways (see §740.17(b)(3)(i)):
(1) sold through retail outlets,
(2) specially designed for individual consumer use, or
(3) sold or will be sold in large volume without restrictions through mail order, electronic or telephone sales.
However, to be eligible for "retail" treatment, these products cannot:
(a) allow the cryptographic functionality to be easily changed by the user,
(b) require substantial support to install and use,
(c) be modified or customized for the customer, or
(d) be designed to be used as network infrastructure products.
When submitting your "retail" review request, please provide information that describes how your product satisfies these criteria.
In addition, the following products will also be considered as retail encryption products (see §740.17(b)(3)(ii)):
(A) Encryption commodities and software (including key management products) with key lengths not exceeding 64-bits for symmetric algorithms, 1024-bits for asymmetric key exchange algorithms, and 160-bits for elliptic curve algorithms;
(B) Encryption products and network-based applications that provide equivalent functionality to other "mass market" or "retail" encryption commodities and software;
(C) Encryption products that are limited to allowing foreign-developed cryptographic products to operate with U.S. products (e.g. signing). No review of the foreign-developed cryptography is required;
(D) Encryption commodities and software that activate or enable cryptographic functionality in retail encryption products which would otherwise remain disabled.
Reminder: You should include a letter of explanation with your request describing which "retail" category you believe your product(s) qualify under and why (e.g. which criteria do your products meet?). Do not simply reiterate the criteria in your request. For example, describe how the product is distributed and why it should not be excluded from "retail" treatment (e.g. why it is not a "network infrastructure" product). Providing real life examples is helpful. Your explanation will assist BIS to determine the proper classification and will expedite the review process. Otherwise, it may be necessary for BIS to call you for this information, hence delaying not only your review, but possibly also your official authorization to export.
Components and Technologies for Short-Range Wireless Products: Certain products that incorporate short range wireless components or technologies do not require review or notification (see §740.17(b)(3)(iii)(H) and §742.15(b)(3)(ii) of the EAR). However, the short-range wireless components and technologies themselves require notification (e.g. if limited to 56-bits), review or licensing (e.g. if not authorized under License Exception ENC) for export or reexport.
Beta Test Encryption Software:
For exports of Beta Test Software, see "Notifications" under Guidance
56-bit Encryption Products: 56-bit encryption items (and encryption items with 512-bit asymmetric and 112-bit elliptic curve algorithms) do not require review under License Exception ENC. For guidance pertaining to such items, see "NLR" under Guidance.