Notice of Issuance of Final Determination Concerning USB Flash Devices, 21702-21705 [E9-10813]

Agencies

• DEPARTMENT OF HOMELAND SECURITY
• U.S. Customs and Border Protection

[Federal Register Volume 74, Number 88 (Friday, May 8, 2009)]
[Notices]
[Pages 21702-21705]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E9-10813]


-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

U.S. Customs and Border Protection


Notice of Issuance of Final Determination Concerning USB Flash 
Devices

AGENCY: U.S. Customs and Border Protection, Department of Homeland 
Security.

ACTION: Notice of final determination.

-----------------------------------------------------------------------

SUMMARY: This document provides notice that U.S. Customs and Border 
Protection (``CBP'') has issued a final determination concerning the 
country of origin of certain USB flash devices (``UFDs'') which may be 
offered to the United States Government under an undesignated 
government procurement contract. Based upon the facts presented, in the 
final determination CBP concluded that either Israel or the United 
States is the country of origin of the UFDs for purposes of U.S. 
Government procurement.

DATES: The final determination was issued on May 5, 2009. A copy of the 
final determination is attached. Any party-at-interest, as defined in 
19 CFR 177.22(d), may seek judicial review of this final determination 
within June 8, 2009.

FOR FURTHER INFORMATION CONTACT: Gerry O'Brien, Valuation and Special 
Programs Branch, Regulations and Rulings, Office of International Trade 
(202-325-0044).

SUPPLEMENTARY INFORMATION: Notice is hereby given that on May 5, 2009, 
pursuant to Subpart B of Part 177, Customs Regulations (19 CFR Part 
177, Subpart B), CBP issued a final determination concerning the 
country of origin of certain UFDs which may be offered to the United 
States Government under an undesignated government procurement 
contract. This final determination, in HQ H034843, was issued at the 
request of SanDisk Corporation under procedures set forth at 19 CFR 
Part 177, Subpart B, which implements Title III of the Trade Agreements 
Act of 1979, as amended (19 U.S.C. 2511-18). In the final 
determination, CBP concluded that, based upon the facts presented, 
certain goods are substantially transformed in either Israel of the 
United States, such that either Israel or the United States is the 
country of origin of the finished article for purposes of U.S. 
Government procurement.
    Section 177.29, Customs Regulations (19 CFR 177.29), provides that 
notice of final determinations shall be published in the Federal 
Register within 60 days of the date the final determination is issued. 
Section 177.30, CBP Regulations (19 CFR 177.30), provides that any 
party-at-interest, as defined in 19 CFR 177.22(d), may seek judicial 
review of a final determination within 30 days of publication of such 
determination in the Federal Register.

    Dated: May 5, 2009.
Sandra L. Bell,
Executive Director, Office of Regulations and Rulings,Office of 
International Trade.
Attachment
HQ H034843
May 5, 2009
MAR-2-05 OT:RR:CTF:VS H034843 GOB
CATEGORY: Marking
Kevin P. Connelly, Esq., Seyfarth Shaw LLP, 975 F Street, N.W., 
Washington, D.C. 20004

RE: U.S. Government Procurement; Title III, Trade Agreements Act of 
1979 (19 U.S.C. Sec.  2511); Subpart B, Part 177, CBP Regulations; 
Country of Origin of USB Flash Drive

    Dear Mr. Connelly: This is in response to your letter of July 17, 
2008 requesting a final determination on behalf of the SanDisk 
Corporation (``SanDisk''), pursuant to subpart B of Part 177, Customs 
and Border Protection (``CBP'') Regulations (19 CFR 177.21 et seq.). 
Pursuant to our request, you provided additional information on March 
10, 2009.
    Under the pertinent regulations, which implement Title III of the 
Trade Agreements Act of 1979 (``TAA''), as amended (19 U.S.C. 2511 et 
seq.), CBP issues country of origin advisory rulings and final 
determinations as to whether an article is or would be a product of a 
designated country or instrumentality for the purpose of granting 
waivers of certain ``Buy American'' restrictions in U.S. law or 
practice for products offered for sale to the U.S. Government. You 
state that SanDisk ``either manufactures or imports the merchandise 
which is the subject of this request.''
    This final determination concerns the country of origin of certain 
encrypted USB flash devices. We note that SanDisk is a party-at-
interest within the meaning of 19 CFR Sec.  177.22(d)(1) and is 
entitled to request this final determination.
    You also request a determination concerning the country-of-origin 
marking of the subject goods.
FACTS:
    You describe the pertinent facts as follows. A USB flash device 
(``UFD'') is a portable device that stores data in a non-volatile 
memory. The data is accessed from a host PC when the UFD is connected 
to its USB port. Flash memory is a form of block-oriented computer 
memory that can be electronically erased and reprogrammed. Flash memory 
is based on one of two current principles of operation: NOR flash and 
NAND flash. NAND-based flash, which is more suitable for mass-data 
storage devices, has faster erase and write times, but its interface 
allows only sequential access to data.
    Four different items are involved here: Cruzer Professional (Stock 
Keeping Unit (``SKU'') SDCZ21); Cruzer Enterprise (SKU SDCZ22 and 
SDCZ35); Cruzer Enterprise FIPS Edition (SKU SDCZ32); and Cruzer 
Identity (SKU SDCZ31). The subject SanDisk UFDs are intended for 
organizations which require protection of their data when a UFD is lost 
or stolen. Cruzer Identity can also be used for managing a user digital 
identity to authenticate the user to different software systems.
    You state that the key hardware component of the UFD is the flash 
memory chip, which stores the data. A flash chip is created in a 
generic manufacturing process for semiconductor device fabrication used 
to create chips and integrated circuits present in electronic devices. 
The process is a sequence of photographic and chemical processing steps 
during which electronic circuits are stacked on a wafer made of 
semiconducting material. Silicon is the most commonly used 
semiconductor material. The entire manufacturing process, which is 
performed in highly specialized facilities, takes six to eight weeks. 
The flash memory chips are manufactured in Japan and are the most 
expensive hardware component of the UFD.
    You state that the UFDs consist of the following components: (1) 
NAND-based flash memory chips for mass data storage; (2) an application 
specific integrated circuit (``ASIC''), which acts as the mass storage 
controller and provides a linear interface to the block-oriented flash 
memory; (3) a USB connector, which provides the interface with the host 
computer; (4) a crystal oscillator, which produces the device's clock 
signal and controls the data output; (5) LEDs, which indicate data 
transfer in progress; (6) capacitors and

[[Page 21703]]

resistors; (7) electrically erasable programmable read-only memory 
(``EEPROM'') to store secret encryption keys in some of the UFD models; 
(8) a printed circuit board, which provides the mounting frame and 
circuitry for the electronic components listed above; and (9) a robust 
plastic or metal case. Cruzer Identity also contains a USB hub and 
smartcard.
    You further state that the subject UFDs consist of firmware and 
application software. The firmware is a piece of binary machine code 
embedded or downloaded to the device using SanDisk's proprietary mass 
production machines (``MPUs'') after the hardware is manufactured. The 
firmware is essential to the use of the UFD. The firmware is 
responsible for the following: transferring data into and out of the 
flash memory chips; determining the storage algorithm; transferring 
data to and from the host PC through the USB port by implementing the 
USB different protocols; controlling the hardware encryption core in 
decisions such as determining which encryption key to use; and 
establishing secure encrypted communication sessions with a related 
software agent running on the host PC. During the manufacturing step of 
embedding the firmware, the production system is responsible for 
provisioning randomly generated encryption keys that are stored in the 
controller internal memory cache. The encryption keys are also crucial 
for the operation of the UFD.
    The application software is responsible for functions such as login 
and user interface. Without it, the UFD does not exhibit its security 
features and behaves like any standard off the shelf USB flash drive 
for storing files in a non-protected manner. Without the application 
software, one cannot access information already stored in the protected 
encrypted form. The application software code is stored in the UFD 
during the manufacturing process in a read only storage area.
    The current versions of the firmware and the application software 
were developed at SanDisk's site in Israel. SanDisk estimates that at 
least 70 man year hours were invested in the development of the 
firmware and the application software and that at least 20 more man 
years are invested each year in its continuing development. The process 
of software development (firmware and application software) is composed 
of requirements analysis, design, code writing, quality assurance 
testing, bug fixing and maintenance and support. The entire development 
process of the firmware and application software is performed in 
Israel.
    The UFDs are intended for organizations that require protection of 
their data when a UFD is lost or stolen. They add security by 
encrypting the data secured on them via a cryptographic hardware core. 
The UFD user must provide a login password to access the data. Cruzer 
Identity may be used for managing a user digital identity to 
authenticate the user to different software systems.
    The UFDs are manufactured in a manufacturing process, which 
requires approximately five minutes for each device. You state that 
SanDisk will perform the first three manufacturing operations in China 
and that it will perform the final three manufacturing operations in 
either Israel or the United States:
    1. Initial Quality Control. SanDisk personnel assemble and visually 
inspect the components.
    2. Component Mounting. SanDisk prints a bare circuit board with 
circuits and populates it with various electronic components through a 
solder paste surface mounting and reflow process (Surface Mounted 
Technology or ``SMT'') to form a printed circuit board assembly 
(``PCBA''). Assembly of the PCBA is performed in a standard SMT 
process. The PCBA is visually inspected and tested to verify that all 
components have been properly mounted and the connections and power 
circuitry are functioning.
    3. Device Housing. The PCBA is joined with a metal USB connector 
and sealed in a plastic case to form the device through an ultrasonic 
housing process. The device then undergoes quality control to verify 
that it has not been harmed in the ultrasonic housing process.
    4. Software Installation and Customization. The proprietary 
software (firmware and application software) is downloaded and the 
device is tested for functionality. Additional software, such as 
security software, can be added at this time or later. During this 
operation, device enumeration and identification to the operating 
system, device configuration, and content loading occur. Depending on 
the customer's unique requirements, some or all of the following 
configurable parameters are accomplished during this step: device 
enumeration and identification to the operating system; device 
configuration; and content. The process is slightly different for 
Cruzer Identity, as it contains the controllers, one for storage and 
one for the smartcode reader. Cruzer Identity provides capability (two-
factor authentication (password and certificate)) which the Cruzer 
Professional, Cruzer Enterprise, and Cruzer Enterprise FIPS Edition do 
not have.
    5. System Diagnostics and Test. The device undergoes a systems test 
consisting of many tests that are performed with ``Read Only'' 
diagnostics software and test vectors to verify product definition and 
functionality.
    6. Packaging. After the firmware and application software are 
downloaded and the system is tested, the completed products are 
packaged and prepared for shipment.
    The components used by SanDisk to manufacture Cruzer Professional 
and Cruzer Enterprise are a printed circuit board, USB connector, LED, 
crystal oscillator, flash memory chip, ASIC controller chip, capacitors 
and resistors, and plastic parts for the case. Cruzer Enterprise FIPS 
Edition consists of the same components with the addition of an EEPROM 
and epoxy glue, coating part of the PCBA. The components used to 
manufacture Cruzer Identity consist of a printed circuit board, USB 
connector, two LEDs, crystal oscillator, flash memory chips, two ASIC 
controller chips, USB hub, EEPROM, smartcard, capacitors and resistors, 
and plastic parts used to make the case.
    As stated above, the flash memory chip is manufactured in Japan. 
The other hardware components are manufactured in Korea, Taiwan, or 
China.
    You state that the addition of the security capabilities of the 
UFDs, through the firmware and application software installation and 
customization process, add significant capability and value to the 
UFDs. The software installation and customization currently drive the 
price of the UFDs, as the price of a UFD with security is currently 
somewhere between seven to nine times the price of a UFD without 
security.
ISSUES:
    What is the country of origin of the UFDs for the purpose of U.S. 
Government procurement?
    What is the country of origin of the UFDs for the purpose of 
marking?
LAW AND ANALYSIS:
    Pursuant to Subpart B of Part 177, 19 CFR 177.21 et seq., which 
implements Title III of the Trade Agreements Act of 1979, as amended 
(19 U.S.C. 2511 et seq.), CBP issues country of origin advisory rulings 
and final determinations as to whether an article is or would be a 
product of a designated country or instrumentality for the purposes of 
granting waivers of certain ``Buy American'' restrictions in U.S. law

[[Page 21704]]

or practice for products offered for sale to the U.S. Government.
    Under the rule of origin set forth under 19 U.S.C. 2518(4)(B):

    An article is a product of a country or instrumentality only if 
(i) it is wholly the growth, product, or manufacture of that country 
or instrumentality, or (ii) in the case of an article which consists 
in whole or in part of materials from another country or 
instrumentality, it has been substantially transformed into a new 
and different article of commerce with a name, character, or use 
distinct from that of the article or articles from which it was so 
transformed.

    See also, 19 CFR Sec.  177.22(a).
    In determining whether the combining of parts or materials 
constitutes a substantial transformation, the determinative issue is 
the extent of operations performed and whether the parts lose their 
identity and become an integral part of the new article. Belcrest 
Linens v. United States, 573 F. Supp. 1149 (Ct. Int'l Trade 1983), 
aff'd, 741 F.2d 1368 (Fed. Cir. 1984). Assembly operations that are 
minimal or simple, as opposed to complex or meaningful, will generally 
not result in a substantial transformation. See, C.S.D. 80-111, C.S.D. 
85-25, C.S.D. 89-110, C.S.D. 89-118, C.S.D. 90-51, and C.S.D. 90-97. In 
C.S.D. 85-25, 19 Cust. Bull. 844 (1985), CBP held that for purposes of 
the Generalized System of Preferences (``GSP''), the assembly of a 
large number of fabricated components onto a printed circuit board in a 
process involving a considerable amount of time and skill resulted in a 
substantial transformation. In that case, in excess of 50 discrete 
fabricated components (such as resistors, capacitors, diodes, 
integrated circuits, sockets, and connectors) were assembled. Whether 
an operation is complex and meaningful depends on the nature of the 
operation, including the number of components assembled, number of 
different operations, time, skill level required, attention to detail, 
quality control, the value added to the article, and the overall 
employment generated by the manufacturing process.
    The courts and CBP have also considered the essential character of 
the imported article in making these determinations. See, for example, 
Uniroyal, Inc. v. United States, 542 F. Supp. 1026, 3 CIT 220, 224-225 
(1982) (where it was determined that imported uppers were the essence 
of a completed shoe) and National Juice Products Association, et al v. 
United States, 628 F. Supp. 978, 10 CIT 48, 61 (1986) (where the court 
addressed each of the factors (name, character, and use) in finding 
that no substantial transformation occurred in the production of retail 
juice products from manufacturing concentrate).
    In order to determine whether a substantial transformation occurs 
when components of various origins are assembled into completed 
products, CBP considers the totality of the circumstances and makes 
such determinations on a case-by-case basis. The country of origin of 
the item's components, extent of the processing that occurs within a 
country, and whether such processing renders a product with a new name, 
character, and use are primary considerations in such cases. 
Additionally, factors such as the resources expended on product design 
and development, extent and nature of post-assembly inspection and 
testing procedures, and worker skill required during the actual 
manufacturing process may be considered when determining whether a 
substantial transformation has occurred. No one factor is 
determinative.
    In Data General v. United States, 4 CIT 182 (1982), the court 
determined that for purposes of determining eligibility under item 
807.00, Tariff Schedules of the United States, the programming of a 
foreign PROM (Programmable Read-Only Memory chip) substantially 
transformed the PROM into a U.S. article. The court noted that it is 
undisputed that programming alters the character of a PROM. Programming 
changes the pattern of interconnections within the PROM. A distinct 
physical change is effected in the PROM by the opening or closing of 
the fuses, depending on the method of programming. This physical 
alteration, not visible to the naked eye, may be discerned by 
electronic testing of the PROM. The essence of the article, its 
interconnections or stored memory, is established by programming. The 
court concluded that altering the non-functioning circuitry comprising 
a PROM through technological expertise in order to produce a 
functioning read only memory device possessing a desired distinctive 
circuit pattern is no less a ``substantial transformation'' than the 
manual interconnection of transistors, resistors and diodes upon a 
circuit board creating a similar pattern.
    In C.S.D. 84-86, CBP stated:

We are of the opinion that the rationale of the court in the Data 
General case may be applied in the present case to support the 
principle that the essence of an integrated circuit memory storage 
device is established by programming * * * [W]e are of the opinion 
that the programming (or reprogramming) of an EPROM results in a new 
and different article of commerce which would be considered to be a 
product of the country where the programming or reprogramming takes 
place.

    In HQ 563012, dated May 4, 2004, CBP considered whether components 
of various origins were substantially transformed when assembled to 
form a fabric switch which involved a combination of computer hardware 
and software. Most of the assembly of computer hardware was performed 
in China. Then, in either Hong Kong or the U.S., the hardware was 
completed and the U.S.-origin software was downloaded onto the 
hardware. CBP noted that the U.S.-developed software provided the 
finished product with its ``distinctive functional characteristics.'' 
In making the determination that the product was substantially 
transformed in the U.S., where the fabric switch was assembled to 
completion, CBP considered both the assembly process that occurred in 
the U.S. and the configuration operations that required U.S.-origin 
software. In the scenario where the fabric switch was assembled to 
completion in Hong Kong, CBP determined the origin for marking purposes 
was Hong Kong.
    In HQ 559255, dated August 21, 1995, a device referred to as a 
``CardDock'' was under consideration for country of origin marking 
purposes. The CardDock was a device which was installed in IBM PC 
compatible computers. After installation, the units were able to accept 
PCMCIA cards for the purpose of interfacing such PCMCIA cards with the 
computer in which the CardDock unit was installed. The CardDock units 
were partially assembled abroad but completed in the United States. The 
overseas processing included manufacturing the product's injection 
molded plastic frame and installing integrated circuits onto a circuit 
board along with various diodes, resistors and capacitors. After such 
operations, these items were shipped to the United States for further 
processing that included mating a U.S.-origin circuit board to the 
foreign-origin frame and board. The assembled units were thereafter 
subjected to various testing procedures. In consideration of the 
foregoing, CBP held that the foreign-origin components, i.e., the ISA 
boards, frame assemblies and connector cables, were substantially 
transformed when assembled to completion in the United States. In 
finding that the name, character, and use of the foreign-origin 
components had changed during processing in the United States, CBP 
noted that the components had lost their separate identity during 
assembly and had become an integral part of a new and distinct item 
which was visibly different from any of the individual foreign-origin 
components.

[[Page 21705]]

    In HQ 735027, dated September 7, 1993, a device that software 
companies used to protect their software from piracy was under 
consideration for country of origin marking purposes. The device, 
referred to as the ``MemoPlug,'' was assembled in Israel from parts 
that were obtained from Taiwan (such as various connectors and an 
Electronically Erasable Programmable Read Only Memory, or ``EEPROM'') 
and Israel (such as an internal circuit board). After assembly, these 
components were shipped to a processing facility in the United States 
where the EEPROM was programmed with special software. Such processing 
in the United States accounted for approximately 50 percent of the 
final selling price of the MemoPlugs. In finding that the foreign-
origin components were substantially transformed in the United States, 
CBP noted that the U.S. processing transformed a blank media, the 
EEPROM, into a device that performed functions necessary to the 
prevention of software piracy.
    We make our determination herein based on the totality of the 
circumstances. In doing so, we take particular note of the fact that 
the installation of the firmware and the application software makes the 
UFDs functional and executes the security features. In addition, the 
installation and customization of the firmware and application software 
greatly increase the value of a UFD without security.
    Based upon the above precedents and the totality of the 
circumstances, we determine that there is a substantial transformation 
of the component parts in either Israel or the United States, the 
location where the final three manufacturing operations, including 
installation and customization of the firmware and application 
software, occur, i.e., if the final three manufacturing operations 
occur in Israel, there is a substantial transformation in Israel and if 
the final three manufacturing operations occur in the United States, 
there is a substantial transformation in the United States. Therefore, 
the country of origin for government procurement purposes is such 
location, either Israel or the United States.

Country of Origin Marking

    Section 304 of the Tariff Act of 1930, as amended (19 U.S.C. 1304), 
provides that, unless excepted, every article of foreign origin 
imported into the United States shall be marked in a conspicuous place 
as legibly, indelibly, and permanently as the nature of the article (or 
container) will permit, in such manner as to indicate to the ultimate 
purchaser in the U.S. the English name of the country of origin of the 
article.
    Part 134, CBP Regulations (19 CFR Part 134), implements the country 
of origin marking requirements and exceptions of 19 U.S.C. 1304. 
Section 134.1(b), CBP Regulations (19 CFR 134.1(b)), defines the 
country of origin of an article as the country of manufacture, 
production, or growth of any article of foreign origin entering the 
United States. Further work or material added to an article in another 
country must effect a substantial transformation in order to render 
such other country the country of origin for country of origin marking 
purposes.
    Based upon our determination, above, with respect to substantial 
transformation of the UFDs, the country of origin for marking of these 
goods is Israel or the United States if the final three manufacturing 
steps, described above, are performed in either of these countries. If 
the final three manufacturing steps are performed in Israel, the UFDs 
should be marked ``Made in Israel.'' For a determination as to whether 
SanDisk may mark the UFDs ``Made in the United States'' when the final 
three manufacturing operations are performed in the U.S., please 
contact the Federal Trade Commission, Division of Enforcement, 6th 
Street and Pennsylvania Ave., NW., Washington, DC 20580.
Holdings
    There is a substantial transformation of the component parts in 
either Israel or the United States, the location where the final three 
operations, including the installation and customization of the 
firmware and application software, occur. Therefore, the country of 
origin for government procurement purposes is such location, either 
Israel or the United States.
    The country of origin of the UFDs is Israel or the United States if 
the final three manufacturing steps, described above, are performed in 
these countries. If the final three manufacturing steps are performed 
in Israel, the UFDs should be marked ``Made in Israel.'' For a 
determination as to whether SanDisk may mark the UFDs ``Made in the 
United States'' when the final three manufacturing operations are 
performed in the United States, please contact the Federal Trade 
Commission.
    Notice of this final determination will be given in the Federal 
Register, as required by 19 CFR 177.29. Any party-at-interest other 
than the party which requested the final determination may request, 
pursuant to 19 CFR Sec.  177.31, that CBP reexamine the matter anew and 
issue a new final determination. Any party-at-interest may, within 30 
days after publication of the Federal Register notice referenced above, 
seek judicial review of this final determination before the Court of 
International Trade.

Sincerely,
Sandra L. Bell,
Executive Director, Office of Regulations and Rulings, Office of 
International Trade

[FR Doc. E9-10813 Filed 5-7-09; 8:45 am]
BILLING CODE 9111-14-P