Encryption Simplification Rule: Final, 52880-52885 [E9-24697]

Agencies

• DEPARTMENT OF COMMERCE
• Bureau of Industry and Security
• Industry and Security Bureau

[Federal Register Volume 74, Number 198 (Thursday, October 15, 2009)]
[Rules and Regulations]
[Pages 52880-52885]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E9-24697]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF COMMERCE

Bureau of Industry and Security

15 CFR Parts 730, 734, 738, 740, 742, 744, 772 and 774

[Docket No. 080211163-9110-02]
RIN 0694-AE18


Encryption Simplification Rule: Final

AGENCY: Bureau of Industry and Security, Commerce.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Bureau of Industry and Security (BIS) published the 
interim final rule entitled ``Encryption Simplification'' on October 3, 
2008 (73 FR 57495). This rule finalizes that rule, corrects errors 
published in the October 3, 2008 interim final rule, and resolves 
inconsistencies in that rule identified by the public.

DATES: Effective Dates: This rule is effective October 15, 2009.

ADDRESSES: Written comments on this final rule may be sent by e-mail to 
publiccomments@bis.doc.gov. Include ``Encryption rule'' in the subject 
line of the message. Comments may also be submitted by mail or hand 
delivery to Sharron Cook, Office of Exporter Services, Regulatory 
Policy Division, Bureau of Industry and Security, Department of 
Commerce, 14th St. & Pennsylvania Avenue, NW., Room 2705, Washington, 
DC 20230, ATTN: Encryption rule; or by fax to (202) 482-3355.

FOR FURTHER INFORMATION CONTACT: For questions of a general nature 
contact Sharron Cook, Office of Exporter Services, Regulatory Policy 
Division at (202) 482-2440 or e-mail: scook@bis.doc.gov.
    For questions of a technical nature contact: The Information 
Technology Division, Office of National Security and Technology 
Transfer Controls at 202-482-0707 or e-mail: C. Randall Pratt at 
cpratt@bis.doc.gov.

SUPPLEMENTARY INFORMATION:

Background

    BIS published the interim final rule entitled ``Encryption 
Simplification'' on October 3, 2008 (73 FR 57495). This rule removed 
section 744.9 of the EAR, which set forth requirements for 
authorization from BIS for U.S. persons to provide technical assistance 
(including training) to foreign persons with the intent to aid a 
foreign person in the development or manufacture outside the United 
States of encryption commodities or software that, if of U.S.-origin, 
would be ``EI'' controlled under ECCNs 5A002 or 5D002. Section 744.9 
was added to the EAR in 1996 when jurisdiction over dual-use encryption 
items was transferred from the Department of State to the Department of 
Commerce. However, other parts of the EAR that referred to section 
744.9 were inadvertently not removed. Therefore, this rule removes 
these references in Sec.  730.5(d), Sec.  734.5(c), Sec.  
736.2(b)(7)(ii), and Sec.  744.1(a)(1). In addition, other corrections 
are made to harmonize with revisions made in the ``Encryption 
Simplification'' rule published on October 3, 2008. Some of the 
revisions in this rule are the results of requests for clarification 
from the public on the October 3 encryption simplification rule.

Part 730

    The last sentence in paragraph (d) of section 730.5 is removed, 
because it makes reference to technical assistance in section 744.9, 
which was removed by the October 3 encryption simplification rule.

Part 734

    Section 734.4 is amended to revise paragraphs (b)(1) and (b)(2) in 
order to harmonize with the October 3 encryption simplification rule 
and corrections thereto. Paragraph (b)(1)(iv) is added to conform with 
the clarifications in this correction by making it clear that section 
740.17(b)(4) is a separate authorization. Paragraph (b)(2) is revised 
to simply state that all items classified under ECCNs 5A992, 5D992, or 
5E992 are eligible for consideration under the de minimis rules. 
Paragraph (c) of section 734.5 is removed because it refers to 
technical assistance in section 744.9, which was

[[Page 52881]]

removed by the October 3 encryption simplification rule.

Part 736

    Paragraph (b)(7)(ii) of section 736.2 is removed and reserved, 
because it refers to technical assistance in section 744.9, which was 
removed by the October 3 encryption simplification rule.

Part 738

    Paragraph (a)(2)(ii)(B) of section 738.4 is amended by removing a 
reference to the mass market review requirements in section 742.15(b) 
for 5A992 and 5D992, and replacing it with an instruction that the 
export may be executed under the No License Required (NLR) principle 
unless the License Requirement section refers the reader to another 
section of the EAR. E.g., in ECCN 5A002 the License Requirement section 
not only refers the reader to the Commerce Country Chart in Supplement 
No. 1 of part 738, but it also refers the reader to section 742.15 of 
the EAR to determine license requirements.

Part 740

    Section 740.17(b)(1)-(3): paragraph (b) is changed for clarity, 
transparency, and simplification of language authorizing export after 
review. Authorization language to Supplement 3 countries under the 
subparagraphs of (b)(1) was complex and confusing to exporters. Under 
the reorganization of License Exception ENC, there is no need to 
exclude exports to countries listed in Supplement 3 from authorization 
under paragraphs (b)(2) and (b)(3). Such exclusions are removed here. 
Once a review has been submitted, Paragraph (b)(1)(i) is intended to 
authorize immediate export to the Supplement 3 countries of all 
encryption items (except ``cryptanalytic items'' to ``government end-
users''). After the review is complete, all items except technology and 
Open Cryptographic Interfaces (OCIs) are authorized by paragraphs 
(b)(2), (b)(3), or (b)(4). As the language has been revised, four sets 
of authorization language will cover almost all items authorized for 
export and reexport. The four authorizations will be:

(a) and (b)(1)(i) technology and OCI;
(a) and (b)(2) ENC restricted commodities and software;
(a) and (b)(3) ENC unrestricted commodities and software; and
(b)(4) ENC commodities and software as described.

Prior to the implementation of this final rule, paragraph (b)(4) 
authorized immediate export under (b)(2) or (b)(3) for source code and 
key length limited items. However, with the authorization under (b)(4), 
it was no longer clear that (b)(2) items were not authorized for 
immediate export to ``government end-users'' outside the Supplement 3 
countries. The added language implemented by this rule makes clear that 
this continues to be true. Products that would not be authorized for 
permanent export to certain ``government end-users'' should not be 
authorized for temporary export to those end-users.
    This rule revises section 740.17(b)(1)(i) of the EAR to remove the 
phrase ``(excluding source code),'' because BIS has received a number 
of inquires from the public who are confused by this phrase appearing 
in this paragraph. This paragraph describes exports and reexports to 
government end-users and non-government end-users located in a country 
listed in Supplement No. 3 of section 740.17 of the EAR that are 
eligible for License Exception ENC once a review request is registered 
with BIS, including commodities and software that are pending review 
(under section 742.15(b)) for mass market treatment (ECCNs 5A992.c and 
5D992.c). Encryption source code is not eligible for such mass market 
treatment. This is what the phrase ``(excluding source code)'' refers 
to. Although this phrase only refers to software that is pending review 
for mass market treatment (under section 742.15(b)), and thus does not 
pertain to any other License Exception ENC-eligible encryption source 
code (e.g., as described in section 740.17(b)(2)(ii)), it has 
nonetheless proven confusing and so is being removed.
    This rule revises section 740.17(b)(4) to fix an incorrect citation 
and clarify concerning what is authorized by each subsection of 
paragraph (b)(4). Paragraph (b)(4) should contain specific 
authorization language like all other License Exception ENC paragraphs. 
The addition of the introductory sentence accomplishes this. The second 
sentence makes it clear that paragraph (b)(4)(ii) does not authorize 
subsequent export from the United States of the foreign developed 
products.
    This rule adds text to sections 740.17(b)(4)(ii) and 742.15(b)(2) 
to provide clarification to the regulated community that foreign 
products developed with or incorporating U.S.-origin encryption source 
code authorized for export under License Exception TSU (section 
740.13(e)) that are subject to the EAR are also excluded from review 
requirements and that after a mass market review request is submitted, 
there is no waiting period for export to certain end-users as 
authorized by sections 740.17(a) and 740.17(b)(1)(i), or for certain 
encryption items as authorized by section 740.17(b)(1)(ii).
    This rule also makes slight editorial corrections to sections 
740.9(c)(3), 740.13(d)(2), 740.17(b)(2)(ii) and 740.17(e)(1)(i)(C).

Part 742

    The second sentence in paragraph (b)(1) of section 742.15 is 
revised and the fourth sentence removed to conform to the new mandatory 
SNAP-R procedures (published August 21, 2008, effective October 20, 
2008, 73 FR 49323) for submission of review requests.
    Supplement No. 6 to part 742 ``Guidelines for Submitting Review 
Requests for Encryption Items'' is amended by removing the fourth and 
fifth sentences of the introductory paragraph to harmonize with the new 
mandatory SNAP-R procedures (published August 21, 2008, effective 
October 20, 2008, 73 FR 49323) for submission of review requests. This 
rule adds text to introductory paragraph (a), which was inadvertently 
omitted in the October 3 rule, explaining that appropriate technical 
information must accompany the review request. This language was in the 
introductory paragraph to Supplement 6 prior to the October 3 
publication. The intent was to move it to paragraph (a) where it would 
be more visible. Instead it was inadvertently removed. Also, paragraph 
(c)(6) is corrected to refer to ECC (elliptic curve cryptography), as 
opposed to ECCN (Export Control Classification Number).

Part 744

    The fifth sentence in paragraph (a)(1) of section 744.1 of the EAR 
is removed, because it refers to section 744.9, which was removed by 
the October 3 encryption simplification rule.

Part 772

    Exporters have been confused by the Nota Bene to the ``personal 
area network'' (PAN) definition. This rule deletes some of the text in 
that note for clarity. In one of the deleted sentences, the words 
``enterprise'' and ``long range'' in the absence of a specific 30 meter 
range limitation could be read to include intermediate-range devices. 
What is authorized by section 740.17(b)(4)(iii) are certain ``PAN'' 
items with nominal operating ranges not exceeding 30 meters. This rule 
deletes other text where the language could also be misunderstood to 
describe items clearly not eligible for section 740.17(b)(4)(iii) 
treatment. ``PAN'' items are not necessarily eligible for section

[[Page 52882]]

740.17(b)(4)(iii). Eliminating the confusing examples should help the 
public understand why a ``data capable wireless telephone'', for 
example, is not eligible for section 740.17(b)(4)(iii) self-
classification.
    In addition, this rule revises the Nota Bene for the term 
``ancillary cryptography'' by making editorial clarifications, as well 
as adding a footnote to clarify that for the purpose of this 
definition, the term `transportation systems' does not include any 
Automatic Identification System (AIS)/Vessel Traffic Service (VTS). 
Secure AIS/VTS and their maritime applications are not considered 
``ancillary cryptography''.

Supplement No. 1 to Part 774--Commerce Control List

    ECCN 5B002 is amended by adding License Exception ENC to the 
License Exception section to clarify that this ECCN may be considered 
for License Exception ENC eligibility.
    ECCN 5E002 is amended by adding License Exception ENC to the 
License Exception section to clarify that this ECCN may be considered 
for License Exception ENC eligibility.
    ECCN 5E992 is amended by inserting ``according to the General 
Technology Note'' into the heading to more clearly define the scope of 
this ECCN.
    Although the Export Administration Act expired on August 20, 2001, 
the President, through Executive Order 13222 of August 17, 2001, 3 CFR, 
2001 Comp., p. 783 (2002), as extended by the Notice of August 13, 2009 
(74 Fed. Reg. 41,325 (August 14, 2009)), has continued the Export 
Administration Regulations in effect under the International Emergency 
Economic Powers Act.

Rulemaking Requirements

    1. This final correction rule has been determined to be significant 
for purposes of Executive Order 12866.
    2. Notwithstanding any other provision of law, no person is 
required to respond to, nor shall any person be subject to a penalty 
for failure to comply with a collection of information subject to the 
requirements of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et 
seq.) (PRA), unless that collection of information displays a currently 
valid Office of Management and Budget (OMB) Control Number. This rule 
involves two collections of information subject to the PRA. One of the 
collections has been approved by OMB under control number 0694 0088, 
``Multi Purpose Application,'' and carries a burden hour estimate of 58 
minutes for a manual or electronic submission. The other collection has 
been approved by OMB under control number 0694-0104, ``Commercial 
Encryption Items Under the Jurisdiction of the Department of 
Commerce,'' and carries a burden hour estimate of 7 hours for a manual 
or electronic submission. Send comments regarding these burden 
estimates or any other aspect of these collections of information, 
including suggestions for reducing the burden, to Jasmeet Seehra, OMB 
Desk Officer, by e-mail at jseehra@omb.eop.gov or by fax to (202) 395-
7285; and to the Office of Administration, Bureau of Industry and 
Security, Department of Commerce, 14th and Pennsylvania Avenue, NW., 
Room 6622, Washington, DC 20230.
    3. This rule does not contain policies with Federalism implications 
as that term is defined under Executive Order 13132.
    4. The provisions of the Administrative Procedure Act (5 U.S.C. 
553) requiring notice of proposed rulemaking, the opportunity for 
public participation, and a delay in effective date, are inapplicable 
because this regulation involves a military and foreign affairs 
function of the United States (5 U.S.C. 553(a)(1)). Further, no other 
law requires that a notice of proposed rulemaking and an opportunity 
for public comment be given for this final rule. Because a notice of 
proposed rulemaking and an opportunity for public comment are not 
required to be given for this rule under the Administrative Procedure 
Act or by any other law, the analytical requirements of the Regulatory 
Flexibility Act (5 U.S.C. 601 et seq.) are not applicable. Therefore, 
this correction regulation is issued in final form. Although there is 
no formal comment period, public comments on this regulation are 
welcome on a continuing basis. Comments should be submitted to Sharron 
Cook, Office of Exporter Services, Bureau of Industry and Security, 
Department of Commerce, 14th and Pennsylvania Ave., NW., Room 2705, 
Washington, DC 20230.

List of Subjects

15 CFR Part 730

    Administrative practice and procedure, Advisory committees, 
Exports, Reporting and recordkeeping requirements, Strategic and 
critical materials.

15 CFR Part 734

    Administrative practice and procedure, Exports, Inventions and 
patents, Research Science and technology.

15 CFR Parts 738 and 772

    Exports.

15 CFR Part 740

    Administrative practice and procedure, Exports, Reporting and 
recordkeeping requirements.

15 CFR Part 742

    Exports, Terrorism.

15 CFR Part 744

    Exports, Reporting and recordkeeping requirements, Terrorism.

15 CFR Part 774

    Exports, Reporting and recordkeeping requirements.

0
Accordingly, parts 730, 734, 738, 740, 742, 744, 772, and 774 of the 
Export Administration Regulations (15 CFR parts 730-774) are amended as 
follows:

PART 730--[AMENDED]

0
1. The authority citation for part 730 continues to read as follows:

    Authority:  50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
10 U.S.C. 7420; 10 U.S.C. 7430(e); 22 U.S.C. 287c; 22 U.S.C. 2151 
note; 22 U.S.C. 3201 et seq.; 22 U.S.C. 6004; 30 U.S.C. 185(s), 
185(u); 42 U.S.C. 2139a; 42 U.S.C. 6212; 43 U.S.C. 1354; 46 U.S.C. 
app. 466c; 50 U.S.C. app. 5; 22 U.S.C. 7201 et seq.; 22 U.S.C. 7210; 
E.O. 11912, 41 FR 15825, 3 CFR, 1976 Comp., p. 114; E.O. 12002, 42 
FR 35623, 3 CFR, 1977 Comp., p. 133; E.O. 12058, 43 FR 20947, 3 CFR, 
1978 Comp., p. 179; E.O. 12214, 45 FR 29783, 3 CFR, 1980 Comp., p. 
256; E.O. 12851, 58 FR 33181, 3 CFR, 1993 Comp., p. 608; E.O. 12854, 
58 FR 36587, 3 CFR, 1993 Comp., p. 179; E.O. 12918, 59 FR 28205, 3 
CFR, 1994 Comp., p. 899; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., 
p. 950; E.O. 12947, 60 FR 5079, 3 CFR, 1995 Comp., p. 356; E.O. 
12981, 60 FR 62981, 3 CFR, 1995 Comp., p. 419; E.O. 13020, 61 FR 
54079, 3 CFR, 1996 Comp., p. 219; E.O. 13026, 61 FR 58767, 3 CFR, 
1996 Comp., p. 228; E.O. 13099, 63 FR 45167, 3 CFR, 1998 Comp., p. 
208; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; E.O. 13224, 
66 FR 49079, 3 CFR, 2001 Comp., p. 786; E.O. 13338, 69 FR 26751, May 
13, 2004; Notice of August 13, 2009, 74 FR 41,325 (August 14, 2009); 
November 10, 2008, 73 FR 67097 (November 12, 2008).


Sec.  730.5  [Amended]

0
2. Section 730.5 is amended by removing the last sentence in paragraph 
(d).

PART 734--[AMENDED]

0
3. The authority citation for part 734 continues to read as follows:

    Authority:  50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 13020, 61 
FR 54079, 3 CFR, 1996 Comp., p. 219; E.O. 13026, 61 FR 58767, 3 CFR, 
1996 Comp., p.

[[Page 52883]]

228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of 
August 13, 2009, 74 FR 41,325 (August 14, 2009); November 10, 2008, 
73 FR 67097 (November 12, 2008).

0
4. Section 734.4 is amended by:
0
a. Revising paragraphs (b)(1)(ii), and (b)(1)(iii);
0
b. Adding a new paragraph (b)(1)(iv); and
0
c. Revising paragraph (b)(2) and the note to paragraph (b) to read as 
follows:


Sec.  734.4  De Minimis U.S. Content.

* * * * *
    (b) * * *
    (1) * * *
    (ii) Authorized for License Exception ENC by BIS after a review 
pursuant to Sec.  740.17(b)(3) of the EAR;
    (iii) Authorized for License Exception ENC by BIS after a review 
pursuant to Sec.  740.17(b)(2), and the foreign made product will not 
be sent to any destination in Country Group E:1 in Supplement No. 1 to 
part 740 of the EAR; or
    (iv) Authorized for License Exception ENC pursuant to Sec.  
740.17(b)(4).
    (2) U.S. origin encryption items classified under ECCNs 5A992, 
5D992, or 5E992.

    Note to paragraph (b):  See supplement No. 2 to this part for de 
minimis calculation procedures and reporting requirements.

* * * * *


Sec.  734.5  [Amended]

0
5. Section 734.5 is amended by removing paragraph (c).

PART 738--[AMENDED]

0
6. The authority citation for part 738 continues to read as follows:

    Authority:  50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
10 U.S.C. 7420; 10 U.S.C. 7430(e); 22 U.S.C. 287c; 22 U.S.C. 3201 et 
seq.; 22 U.S.C. 6004; 30 U.S.C. 185(s), 185(u); 42 U.S.C. 2139a; 42 
U.S.C. 6212; 43 U.S.C. 1354; 46 U.S.C. app. 466c; 50 U.S.C. app. 5; 
22 U.S.C. 7201 et seq.; 22 U.S.C. 7210; E.O. 13026, 61 FR 58767, 3 
CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., 
p. 783; Notice of August 13, 2009, 74 FR 41,325 (August 14, 2009).


0
7. Section 738.4 is amended by revising paragraph (a)(2)(ii)(B) to read 
as follows:


Sec.  738.4  Determining whether a license is required.

    (a) * * *
    (2) * * *
    (ii) * * *
    (B) If no, a license is not required based on the particular Reason 
for Control and destination. Provided that General Prohibitions Four 
through Ten do not apply to your proposed transaction and the License 
Requirement section does not refer you to any other part of the EAR to 
determine license requirements. For example, any applicable review 
requirements described in Sec.  742.15(b) of the EAR must be met for 
certain mass market encryption items to effect your shipment using the 
symbol ``NLR.'' Proceed to parts 758 and 762 of the EAR for information 
on export clearance procedures and recordkeeping requirements. Note 
that although you may stop after determining a license is required 
based on the first Reason for Control, it is best to work through each 
applicable Reason for Control. A full analysis of every possible 
licensing requirement based on each applicable Reason for Control is 
required to determine the most advantageous License Exception available 
for your particular transaction and, if a license is required, 
ascertain the scope of review conducted by BIS on your license 
application.
* * * * *

PART 740--[AMENDED]

0
8. The authority citation for part 740 continues to read as follows:

    Authority:  50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
22 U.S.C. 7201 et seq.; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., 
p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice 
of August 13, 2009, 74 Fed. Reg. 41325 (August 14, 2009).


Sec.  740.9  [Amended]

0
9. Section 740.9 is amended by revising the citation ``742.15(b)(2)'' 
to read ``742.15(b)'' in paragraph (c)(3).

0
10. Section 740.13 is amended by revising the last two sentences of 
paragraph (d)(2) to read as follows:


Sec.  740.13  Technology and Software--Unrestricted (TSU).

* * * * *
    (d) * * *
    (2) Exclusions. * * * (Once such mass market encryption software 
has been reviewed by BIS and released from ``EI'' and ``NS'' controls 
pursuant to Sec.  742.15(b) of the EAR, it is controlled under ECCN 
5D992.c and is thus outside the scope of License Exception TSU.) See 
Sec.  742.15(b) of the EAR for exports and reexports of mass market 
encryption products controlled under ECCN 5D992.c.
* * * * *

0
11. Section 740.17 is amended by:
0
a. Removing the phrase ``(excluding source code)'' from paragraph 
(b)(1)(i);
0
b. Revising paragraph (b)(1)(ii);
0
c. Revising the introductory paragraph to (b)(2);
0
d. Removing the phrase ``encryption source code that is not otherwise 
eligible'' and adding the phrase ``encryption source code is not 
otherwise eligible'' in its place in paragraph (b)(2)(ii);
0
e. Removing the phrase ``Supplement No. 3 to this part or'' in 
paragraph (b)(3);
0
f. Adding a new first sentence to paragraph (b)(4) introductory text;
0
g. Revising paragraph (b)(4)(ii); and
0
h. Adding a comma after ``open cryptographic interface'', and removing 
the phrase ``exported to a foreign developer'' and adding the phrase 
``to a foreign developer'' in its place in paragraph (e)(1)(i)(C).
    The revisions and additions read as follows:


Sec.  740.17  Encryption Commodities, Software and Technology (ENC).

* * * * *
    (b) * * *
    (1) * * *
    (ii) Export and reexport to countries not listed in Supplement No. 
3 of this part. License Exception ENC authorizes the export and 
reexport of the following commodities and software (except certain 
exports and reexports to ``government end-users'' as further described 
in paragraph (b)(2) of this section, or any ``open cryptographic 
interface'' item):
* * * * *
    (2) Review required with 30 day wait (non-``government end-users'' 
only). Thirty (30) days after your review request is registered with 
BIS in accordance with paragraph (d) of this section and subject to the 
reporting requirements in paragraph (e) of this section, License 
Exception ENC authorizes the export or reexport of the following 
commodities and software to ``government end-users'' located or 
headquartered in a country listed in Supplement 3 to this part, and 
also to non-``government end-users'' located in a country not listed in 
Country Group E:1 of Supplement No. 1 to part 740 of the EAR:
* * * * *
    (4) Items excluded from review requirements. License Exception ENC 
authorizes the export and reexport of the commodities and software 
described in this paragraph (b)(4) without review (for encryption 
reasons) by BIS, except that paragraph (b)(4)(ii) of this section does 
not authorize exports from the United States of foreign products 
developed with or incorporating U.S.-origin encryption source code, 
components, or toolkits.
* * * * *
    (ii) Foreign products developed with or incorporating U.S.-origin 
encryption

[[Page 52884]]

source code, components, or toolkits. Foreign products developed with 
or incorporating U.S.-origin encryption source code, components or 
toolkits that are subject to the EAR, provided that the U.S.-origin 
encryption items have previously been reviewed and authorized by BIS 
(or else authorized for export under License Exception TSU upon meeting 
the notification requirements of section 740.13(e) of the EAR, without 
need for further review) and the cryptographic functionality has not 
been changed. Such products include foreign-developed products that are 
designed to operate with U.S. products through a cryptographic 
interface.
* * * * *

PART 742--[AMENDED]

0
12. The authority citation for part 742 continues to read as follows:

    Authority:  50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
22 U.S.C. 3201 et seq.; 42 U.S.C. 2139a; 22 U.S.C. 7201 et seq.; 22 
U.S.C. 7210; Sec 1503, Pub. L. 108-11, 117 Stat. 559; E.O. 12058, 43 
FR 20947, 3 CFR, 1978 Comp., p. 179; E.O. 12851, 58 FR 33181, 3 CFR, 
1993 Comp., p. 608; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 
950; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 
66 FR 44025, 3 CFR, 2001 Comp., p. 783; Presidential Determination 
2003-23 of May 7, 2003, 68 FR 26459, May 16, 2003; Notice of August 
13, 2009, 74 Fed. Reg. 41,325 (August 14, 2009); November 10, 2008, 
73 FR 67097 (November 12, 2008).


0
13. Section 742.15 is amended by:
0
a. Revising the second sentence and removing the fourth sentence in 
paragraph (b)(1); and
0
b. Adding a Note in parentheses after the first sentence in paragraph 
(b)(2).
    The revision and addition read as follows:


Sec.  742.15  Encryption items.

* * * * *
    (b) * * *
    (1) Procedures for requesting review. * * * Review requests must be 
submitted to BIS in accordance with Sec. Sec.  748.1 and 748.3 of the 
EAR. See paragraph (r) of Supplement No. 2 to part 748 of the EAR for 
special instructions about this submission. Submissions to the ENC 
Encryption Request Coordinator should be directed to the mailing 
address indicated in Sec.  740.17(e)(1)(ii) of the EAR. BIS will notify 
you if there are any questions concerning your request for review 
(e.g., because of missing or incompatible support documentation). * * *
    (2) Action by BIS. * * * (Note that once a mass market review 
request is submitted, there is no waiting period for export or reexport 
under License Exception ENC to certain end users as authorized by 
Sec. Sec.  740.17(a) and (b)(1)(i), or for certain items as authorized 
by Sec.  740.17(b)(1)(ii), while the mass market request is pending 
review with BIS.) * * *
* * * * *

0
14. Supplement No. 6 to part 742 is amended by:
0
a. Revising the introductory text;
0
b. Adding paragraph (a) introductory text; and
0
c. Revising the acronym ``ECCN'' to read ``ECC'' in paragraph (c)(6).
    The revision and addition read as follows:

Supplement No. 6 to Part 742--Guidelines for Submitting Review Requests 
for Encryption Items

    Review requests for encryption items must include all of the 
documentation described in this supplement and be submitted to BIS 
in accordance with Sec. Sec.  748.1 and 748.3 of the EAR. To ensure 
that your review request is properly routed, insert the phrase 
``Mass market encryption'', ``License Exception ENC'' or ``Other 
Encryption'' (whichever is applicable) in Block 9 (Special Purpose) 
of the application form and place an ``X'' in the box marked 
``Classification Request'' in Block 5 (Type of Application)--Block 5 
does not provide a separate item to check for the submission of 
encryption review requests. Failure to properly complete these items 
may delay consideration of your review request.
    In addition, you must send a copy of your review request and all 
support documents to: Attn: ENC Encryption Request Coordinator, 9800 
Savage Road, Suite 6940, Fort Meade, MD 20755-6000.
    If you intend to rely on the 30 day registration provisions of 
the regulations, express mail certification of these documents is 
needed.
    (a) For all review requests of encryption items, you must 
provide brochures or other documentation or specifications related 
to the technology, commodity or software, relevant product 
descriptions, architecture specifications, and as necessary for the 
technical review, source code. In addition, you must provide the 
following information in a cover letter accompanying your review 
request:
* * * * *

PART 744--[AMENDED]

0
15. The authority citation for part 744 continues to read as follows:

    Authority:  50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
22 U.S.C. 3201 et seq.; 42 U.S.C. 2139a; 22 U.S.C. 7201 et seq.; 22 
U.S.C. 7210; E.O. 12058, 43 FR 20947, 3 CFR, 1978 Comp., p. 179; 
E.O. 12851, 58 FR 33181, 3 CFR, 1993 Comp., p. 608; E.O. 12938, 59 
FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 12947, 60 FR 5079, 3 CFR, 
1995 Comp., p. 356; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 
228; E.O. 13099, 63 FR 45167, 3 CFR, 1998 Comp., p. 208; E.O. 13222, 
66 FR 44025, 3 CFR, 2001 Comp., p. 783; E.O. 13224, 66 FR 49079, 3 
CFR, 2001 Comp., p. 786; Notice of August 13, 2009, 74 FR 41,325 
(August 14, 2009); November 10, 2008, 73 FR 67097 (November 12, 
2008).


Sec.  744.1  [Amended]

0
16. Section 744.1 is amended by removing the fifth sentence in 
paragraph (a)(1).

PART 772--[AMENDED]

0
17. The authority citation for part 772 continues to read as follows:

    Authority:  50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of August 
13, 2009, 74 FR 41,325 (August 14, 2009).


0
18. In section 772.1 the definition for ``ancillary cryptography'' is 
amended by revising the Nota Bene (N.B.) and the definition for 
``personal area network'' is amended by revising the Nota Bene to read 
as follows:


Sec.  772.1  Definitions of terms as used in the Export Administration 
Regulations (EAR).

* * * * *
    ``Ancillary cryptography''. * * *

    N.B. Examples of commodities and software that perform 
``ancillary cryptography'' are items specially designed and limited 
to: Piracy and theft prevention for software, music, etc.; games and 
gaming; household utilities and appliances; printing, reproduction, 
imaging and video recording or playback (but not videoconferencing); 
business process modeling and automation (e.g., supply chain 
management, inventory, scheduling and delivery); industrial, 
manufacturing or mechanical systems (including robotics, other 
factory or heavy equipment, and facilities systems controllers, such 
as fire alarms and HVAC); automotive, aviation and other 
transportation systems.\1\ Commodities and software included in this 
description are not limited to wireless communication and are not 
limited by range or key length.

    \1\ For the purpose of this definition, the term 
``transportation systems'' does not include any Automatic 
Identification System (AIS)/Vessel Traffic Service (VTS). Secure 
AIS/VTS and their maritime applications are not considered 
``ancillary cryptography''.
---------------------------------------------------------------------------

* * * * *
    ``Personal area network''. * * *

    N.B. ``Personal area network'' items include but are not limited 
to items designed to comply with the Institute of Electrical and 
Electronic Engineers (IEEE) 802.15.1 standard, class 2 (10 meters) 
and class 3 (1 meter), but not class 1 (100 meters) items. IEEE 
802.15.1 class 2 and class 3 devices include hands-free headsets, 
wireless mice, keyboards and printers, bar code scanners and game 
console wireless controllers, as well as devices or software for 
transfer of files between devices using Object Exchange (OBEX).
* * * * *

[[Page 52885]]

PART 774--[AMENDED]

0
19. The authority citation for part 774 continues to read as follows:

    Authority:  50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
10 U.S.C. 7420; 10 U.S.C. 7430(e); 22 U.S.C. 287c, 22 U.S.C. 3201 et 
seq., 22 U.S.C. 6004; 30 U.S.C. 185(s), 185(u); 42 U.S.C. 2139a; 42 
U.S.C. 6212; 43 U.S.C. 1354; 46 U.S.C. app. 466c; 50 U.S.C. app. 5; 
22 U.S.C. 7201 et seq.; 22 U.S.C. 7210; E.O. 13026, 61 FR 58767, 3 
CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., 
p. 783; Notice of August 13, 2009, 74 FR 41,325 (August 14, 2009).


0
20. In Supplement No. 1 to part 774 (the Commerce Control List), 
Category 5 Telecommunications and ``Information Security'', Part 2 
Information Security, Export Control Classification Number (ECCN) 5B002 
is amended by revising the License Exception section to read as 
follows:

    5B002 Information Security--test, inspection and ``production'' 
equipment.
* * * * *

License Exceptions

    LVS: N/A
    GBS: N/A
    CIV: N/A
    ENC: Yes for certain EI controlled equipment, see Sec.  740.17 
of the EAR for eligibility.
* * * * *


0
21. In Supplement No. 1 to part 774 (the Commerce Control List), 
Category 5 Telecommunications and ``Information Security'', Part 2 
Information Security, Export Control Classification Number (ECCN) 5E002 
is amended by revising the License Exception section to read as 
follows:

    5E002 ``Technology'' according to the General Technology Note 
for the ``development'', ``production'' or ``use'' of equipment 
controlled by 5A002 or 5B002 or ``software'' controlled by 5D002.
* * * * *

License Exceptions

    CIV: N/A
    TSR: N/A
    ENC: Yes for certain EI controlled technology, see Sec.  740.17 
of the EAR for eligibility.
* * * * *


0
22. In Supplement No. 1 to part 774 (the Commerce Control List), 
Category 5 Telecommunications and ``Information Security'', Part 2 
Information Security, Export Control Classification Number (ECCN) 5E992 
is amended by revising the Heading to read as follows:

    5E992 ``Information Security'' ``technology'' according to the 
General Technology Note, not controlled by 5E002.
* * * * *

    Dated: October 7, 2009.
Matthew S. Borman,
Acting Assistant Secretary for the Bureau of Industry and Security.
[FR Doc. E9-24697 Filed 10-14-09; 8:45 am]
BILLING CODE 3510-33-P