Do you need to report your encryption technology to the Bureau of Industry & Security?

Software or Hardware using Encryption? Make sure you don’t need to report to the BIS under the EAR.

Product Laws, Software

EAR stands for Export Administration Regulations.

It is administered by the Bureau of Industry and Security (BIS) within the US Commerce Department.

Under EAR, all software and hardware using encryption must be reported (and authorization from BIS obtained) UNLESS a defined exception applies. These authorizations and exceptions are termed “License Exception ENC.” For certain advanced products using encryption, it might be necessary to obtain a type of classification confirmation from BIS called “CCATS” (see below for more details about CCATS).

Broadly speaking, if your product uses encryption, then you need to make sure that it falls under one of the sub-categories defined in the License Exception ENC:

Export Control Classification Number (ECCN) 5A002 (hardware), 5B002 (software) , 5D002 or 5E002 (equivalent or related software and technology), ECCN 5A004, 5D002 or 5E0022 (“cryptanalytic items” and digital forensics items (investigative tools)).

CCATS : a classification determination (Commodity Classification Automated Tracking System, or CCATS request) that must be obtained from BIS for certain advanced products such as

· network infrastructure items

· non-public encryption source code

· customized

· non-standard or open interface encryption

· quantum cryptography

· network penetration tools

· network vulnerability/digital forensics items

· public safety/first responder radios

· ultra-wideband and spread spectrum items

· cryptanalytic items

License Exception Encryption Commodities, Software, and Technology (ENC)

Here are sites with additional information about EAR and reporting exceptions.

Encryption and Export Administration Regulations (EAR) (doc.gov)

eCFR :: 15 CFR 740.17 -- Encryption commodities, software, and technology (ENC).