Notice of Issuance of Final Determination Concerning Certain Devices Known as “Pwn Plugs”, 43104-43106 [2012-17805]

Agencies

• DEPARTMENT OF HOMELAND SECURITY
• U.S. Customs and Border Protection

[Federal Register Volume 77, Number 141 (Monday, July 23, 2012)]
[Notices]
[Pages 43104-43106]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2012-17805]


-----------------------------------------------------------------------

DEPARTMENT OF HOMELAND SECURITY

U.S. Customs and Border Protection


Notice of Issuance of Final Determination Concerning Certain 
Devices Known as ``Pwn Plugs''

AGENCY: U.S. Customs and Border Protection, Department of Homeland 
Security.

ACTION: Notice of final determination.

-----------------------------------------------------------------------

SUMMARY: This document provides notice that U.S. Customs and Border 
Protection (``CBP'') has issued a final determination concerning the 
country of origin of certain devices known as Pwn Plugs. Based upon the 
facts presented, CBP has concluded that the programming operations 
performed in the United States, using U.S.-origin software, 
substantially transform non-TAA country microcomputer devices. 
Therefore, the country of origin of Pwn Plugs is the United States for 
purposes of U.S. Government procurement.

DATES: The final determination was issued on July 13, 2012. A copy of 
the final determination is attached. Any party-at-interest, as defined 
in 19 CFR 177.22(d), may seek judicial review of this final 
determination on or before August 22, 2012.

FOR FURTHER INFORMATION CONTACT: Heather K. Pinnock, Valuation and 
Special Programs Branch: (202) 325-0034.

SUPPLEMENTARY INFORMATION: Notice is hereby given that on July 13, 
2012, pursuant to subpart B of Part 177, U.S. Customs and Border 
Protection Regulations (19 CFR part 177, subpart B), CBP issued a final 
determination concerning the country of origin of certain devices known 
as Pwn Plugs which may be offered to the U.S. Government under an 
undesignated government procurement contract. This final determination, 
HQ H215555, was issued under procedures set forth at 19 CFR part 177, 
subpart B, which implements Title III of the Trade Agreements Act of 
1979, as amended (19 U.S.C. Sec.  2511-18). In the final determination, 
CBP concluded that, based upon the facts presented, the programming 
operations performed in the United States, using U.S.-origin software, 
substantially transform non-TAA country microcomputer devices. 
Therefore, the country of origin of the Pwn Plugs is the United States 
for purposes of U.S. Government procurement.
    Section 177.29, CBP Regulations (19 CFR 177.29), provides that a 
notice of final determination shall be published in the Federal 
Register within 60 days of the date the final determination is issued. 
Section 177.30, CBP Regulations (19 CFR 177.30), provides that any 
party-at-interest, as defined in 19 CFR 177.22(d), may seek judicial 
review of a final determination within 30 days of publication of such 
determination in the Federal Register.

    Dated: July 13, 2012.
Sandra L. Bell,
Executive Director, Regulations and Rulings, Office of International 
Trade.

Attachment

HQ H215555

July 13, 2012

MAR OT:RR:CTF:VS H215555 HkP

CATEGORY: Origin

Mr. Dave Porcello
CEO, Pwnie Express
Rapid Focus Security, LLC
27 French Street
Barre, VT 05641

RE: U.S. Government Procurement; Trade Agreements Act; Country of 
Origin of the ``Pwn Plug''; Substantial Transformation

    Dear Mr. Porcello: This is in response to your undated letter, 
received on April 20, 2012, requesting a final determination on 
behalf of Rapid Focus Security, LLC, dba Pwnie Express (``Pwnie 
Express''), pursuant to subpart B of part 177 of the U.S. Customs 
and Border Protection (``CBP'') Regulations (19 C.F.R. Part 177). 
Under these regulations, which implement Title III of the Trade 
Agreements Act of 1979 (``TAA''), as amended (19 U.S.C. Sec.  2511 
et seq.), CBP issues country of origin advisory rulings and final 
determinations as to whether an article is or would be a product of 
a designated country or instrumentality for the purposes of granting 
waivers of certain ``Buy American'' restrictions in U.S. law or 
practice for products offered for sale to the U.S. Government.
    This final determination concerns the country of origin of the 
``Pwn Plug''. As a U.S. importer, Pwnie Express is a party-at-
interest within the meaning of 19 C.F.R. Sec.  177.22(d)(1) and is 
entitled to request this final determination.

FACTS:

    The Pwn Plug is described as a full security testing suite 
packed into a micro-server the size of a power brick that provides 
covert, encrypted access over Ethernet, wireless and 3G/GSM 
connections. Its proprietary software is designed to conduct cyber 
security audits (``penetration tests'') of computer networks, 
including password auditing, vulnerability checking, network traffic 
inspecting, wireless network analysis, network port/service 
scanning, and firewall rule validating. The Pwn Plug runs on the 
publicly available off-the-shelf SheevaPlug computer platform (a 
microcomputer device that runs network-based software services that 
normally require a dedicated computer) made in China. Various types 
of wireless adapters and an external storage card can be attached to 
the Pwn Plug by the end-user. There are two versions of the Pwn 
Plug: the Pwn Plug Wireless, and the Pwn Plug Elite, both referred 
to herein as the Pwn Plug.
    Pwnie Express imports SheevaPlug microcomputer devices from 
China that measure 4.3 x 2.7 x 1.9 inches and contain a central 
processing unit, memory chips (SDRAM and HDD), and a SDHC/SDIO card 
slot for disk and Input/Output expansion. Pwnie Express removes all 
software from the SheevaPlugs, including their operating systems, 
and programs them with the following software: Marvell/DENX U-boot 
environment (BIOS); Linux Kernel package; Ubuntu/Debian Linux open-
source base operating system; Open-source security testing suite; 
Pwnie Express web User Interface; and, Pwnie Express remote access 
scripts. The Linux software and the other open-source tools were 
developed by the worldwide open-source community. The role of this 
software is to provide the basic operating system environment and 
the security tools needed to perform standard cyber security 
penetration tests. The role of Pwnie Express' proprietary software, 
developed entirely in the U.S., is to conduct the actual penetration 
tests of computer networks. It provides secure and reliable remote 
access over a variety of network protocols and customer environments 
and has its own interface for web-based configuration and set-up. 
Software installation takes approximately two hours. Product 
literature and packaging are printed

[[Page 43105]]

in the United States. Each Pwn Plug is then packaged for sale 
together with a USB adapter made in China, a USB Ethernet adapter 
made in China, a USB modem made in China, a 16GB SD card made in 
Taiwan, various cables made in China, and the product literature 
printed in the U.S.

ISSUE:

    What is the country of origin of the Pwn Plug for purposes of 
U.S. Government procurement?

LAW AND ANALYSIS:

    Pursuant to Subpart B of Part 177, 19 CFR Sec.  177.21 et seq., 
which implements Title III of the Trade Agreements Act of 1979, as 
amended (19 U.S.C. Sec.  2511 et seq.), CBP issues country of origin 
advisory rulings and final determinations as to whether an article 
is or would be a product of a designated country or instrumentality 
for the purposes of granting waivers of certain ``Buy American'' 
restrictions in U.S. law or practice for products offered for sale 
to the U.S. Government.
    Under the rule of origin set forth under 19 U.S.C. Sec.  
2518(4)(B):
    An article is a product of a country or instrumentality only if 
(i) it is wholly the growth, product, or manufacture of that country 
or instrumentality, or (ii) in the case of an article which consists 
in whole or in part of materials from another country or 
instrumentality, it has been substantially transformed into a new 
and different article of commerce with a name, character, or use 
distinct from that of the article or articles from which it was so 
transformed.

See also 19 C.F.R. Sec.  177.22(a).

    In order to determine whether a substantial transformation 
occurs when components of various origins are assembled into 
completed products, CBP considers the totality of the circumstances 
and makes such determinations on a case-by-case basis. The country 
of origin of the item's components, extent of the processing that 
occurs within a country, and whether such processing renders a 
product with a new name, character, and use are primary 
considerations in such cases. Additionally, factors such as the 
resources expended on product design and development, the extent and 
nature of post-assembly inspection and testing procedures, and 
worker skill required during the actual manufacturing process will 
be considered when determining whether a substantial transformation 
has occurred. No one factor is determinative.
    In Data General v. United States, 4 Ct. Int'l Trade 182 (1982), 
the court determined that for purposes of determining eligibility 
under item 807.00, Tariff Schedules of the United States 
(predecessor to subheading 9802.00.80, Harmonized Tariff Schedule of 
the United States), the programming of a foreign PROM (Programmable 
Read-Only Memory chip) in the United States substantially 
transformed the PROM into a U.S. article. In programming the 
imported PROMs, the U.S. engineers systematically caused various 
distinct electronic interconnections to be formed within each 
integrated circuit. The programming bestowed upon each circuit its 
electronic function, that is, its ``memory'' which could be 
retrieved. A distinct physical change was effected in the PROM by 
the opening or closing of the fuses, depending on the method of 
programming. This physical alteration, not visible to the naked eye, 
could be discerned by electronic testing of the PROM. The court 
noted that the programs were designed by a U.S. project engineer 
with many years of experience in ``designing and building 
hardware.'' While replicating the program pattern from a ``master'' 
PROM may be a quick one-step process, the development of the pattern 
and the production of the ``master'' PROM required much time and 
expertise. The court noted that it was undisputed that programming 
altered the character of a PROM. The essence of the article, its 
interconnections or stored memory, was established by programming. 
The court concluded that altering the non-functioning circuitry 
comprising a PROM through technological expertise in order to 
produce a functioning read only memory device, possessing a desired 
distinctive circuit pattern, was no less a ``substantial 
transformation'' than the manual interconnection of transistors, 
resistors and diodes upon a circuit board creating a similar 
pattern.
    In Texas Instruments v. United States, 681 F.2d 778, 782 (CCPA 
1982), the court observed that the substantial transformation issue 
is a ``mixed question of technology and customs law.''
    In C.S.D. 84-85, 18 Cust. B. & Dec. 1044 (Apr. 2, 1984), CBP 
stated:
    We are of the opinion that the rationale of the court in the 
Data General case may be applied in the present case to support the 
principle that the essence of an integrated circuit memory storage 
device is established by programming . . . . [W]e are of the opinion 
that the programming (or reprogramming) of an EPROM results in a new 
and different article of commerce which would be considered to be a 
product of the country where the programming or reprogramming takes 
place.
    Accordingly, the programming of a device that changes or defines 
its use generally constitutes substantial transformation. See also 
Headquarters Ruling Letter (``HQ'') 558868, dated February 23, 1995 
(programming of SecureID Card substantially transforms the card 
because it gives the card its character and use as part of a 
security system and the programming is a permanent change that 
cannot be undone); HQ 735027, dated September 7, 1993 (programming 
blank media (EEPROM) with instructions that allow it to perform 
certain functions that prevent piracy of software constitute 
substantial transformation); and, HQ 733085, dated July 13, 1990; 
but see HQ 732870, dated March 19, 1990 (formatting a blank diskette 
does not constitute substantial transformation because it does not 
add value, does not involve complex or highly technical operations 
and did not create a new or different product); HQ 734518, dated 
June 28, 1993, (motherboards are not substantially transformed by 
the implanting of the central processing unit on the board because, 
whereas in Data General use was being assigned to the PROM, the use 
of the motherboard had already been determined when the importer 
imports it).
    HQ H052325, dated February 14, 2006, concerned the country of 
origin of a switch and a switch/router. The Brocade 7800 Extension 
Switch was assembled to completion in China and programmed in the 
U.S. with U.S.-origin operating system (OS) software and customer 
specified firmware and software. The Brocade FX8-24 switch/router 
contained a PCBA that was assembled and programmed in China and 
shipped to the U.S., where it was assembled with other components to 
make the final product. The completed unit was then programmed with 
U.S.-origin OS software and customer firmware and software. In both 
cases, the U.S.-origin OS software provided the devices with their 
functionality. Customs found that in both cases, the processing 
performed in the United States, including the downloading of the 
U.S.-origin OS software, resulted in a substantial transformation of 
the foreign origin components, and that the United States was the 
country of origin.
    In HQ H014068, dated October 9, 2007, CBP determined that a 
cellular phone designed in Sweden, assembled in either China or 
Malaysia and shipped to Sweden, where it was loaded with software 
that enabled it to test equipment on wireless networks, was a 
product of Sweden. Once the software was installed on the phones in 
Sweden, they became devices with a new name, character and use, that 
is, network testing equipment. As a result of the programming 
operations performed in Sweden, CBP found that the country of origin 
of the network testing equipment was Sweden.
    In HQ H175415, dated October 4, 2011, hardware components were 
assembled into complete Ethernet switches in China. The switches 
were then shipped to the U.S., where they were programmed with EOS 
software, developed in the U.S. The U.S.-origin EOS software enabled 
the imported switches to interact with other network switches 
through network switching and routing, and allowed for the 
management of functions such as network performance monitoring and 
security and access control. Without this software, the imported 
devices could not function as Ethernet switches. As a result of the 
programming performed in the U.S., with software developed in the 
U.S., CBP found that the imported switches were substantially 
transformed in the U.S.
    Similarly, in this case, fully assembled SheevaPlug 
microcomputer devices are imported into the United States, where 
they are programmed with Pwnie Express proprietary software 
developed in the U.S. The custom software provides a web-based 
interface for configuring the microcomputer devices into Pwn Plugs. 
In addition, the U.S. software allows Pwn Plugs to provide secure, 
persistent and reliable remote access over a variety of network 
protocols and customer environments. Without the U.S.-origin Pwnie 
Express software, an imported microcomputer device could not 
function as a Pwn Plug. As a result of the programming performed in 
the U.S., with software developed in the U.S., we find that the 
imported microcomputer devices are

[[Page 43106]]

substantially transformed in the U.S. See Data General, C.S.D. 84-
85, HQ 052325, HQ 558868, HQ 735027, and HQ 733085. The country of 
origin of Pwn Plugs is the United States.
    When the U.S.-origin Pwn Plugs are packaged together with 
cables, wireless adaptors and modems from China and memory cards 
from Taiwan, we find that the essential character of the products 
offered for sale is provided by the U.S.-origin Pwn Plugs. ``The 
term `character' is defined as `one of the essentials of structure, 
form, materials, or function that together make up and usually 
distinguish the individual.''' Uniden America Corporation v. United 
States, 120 F. Supp. 2d. 1091, 1096 (citations omitted) (Ct. Int'l 
Trade 2000), citing National Hand Tool Corp. v. United States, 16 
Ct. Int'l Trade 308, 311 (1992). In Uniden (concerning whether the 
assembly of cordless telephones and the installation of their 
detachable A/C (alternating current) adapters constituted instances 
of substantial transformation), the Court of International Trade 
applied the ``essence test'' and found that ``[t]he essence of the 
telephone is housed in the base and the handset. Consumers do not 
buy the article because of the specific function of the A/C adapter, 
but rather because of what the completed handset and base provide: 
communication over telephone wires.'' Id. at 1096.
    We also find that the memory cards from Taiwan and the cables, 
wireless adaptors, and modems from China are substantially 
transformed with the Pwn Plug, in that they have a new character, 
use and name because they are attached to the Pwn Plug. See Uniden, 
supra, in which the court also found that the detachable A/C 
adapters underwent a substantial transformation pursuant to the 
Generalized System of Preferences (GSP) when attached to the 
cordless telephones. The court noted that the substantial 
transformation test is to be applied to the product as a whole and 
not to each of its detachable components. See id. Consequently, the 
court found that the A/C adapter, as part of the cordless phone, had 
a new character, use and name. See also HQ H100055, dated May 28, 
2010, in which CBP found that a detachable hand control and battery 
charger were substantially transformed when attached to a lift unit. 
In addition, the Court in Uniden noted that the cordless telephone 
with its detachable components was a ``GRI 1 article'' and not a 
set, mixture or composite good. Id. at 1099-1100 (addressing the 
applicability of T.D. 91-7, Cust. B. 7, entitled ``Eligibility of 
Sets, Mixtures and Composite Goods for Special Tariff Treatment 
Programs'' to the cordless telephones at issue, the Court noted that 
``[i]f the Department of Treasury had meant for T.D. 91-7 to apply 
to GRI 1 articles, it would not have chosen to make frequent use of 
the very specific language `sets, mixtures and composite goods' 
throughout T.D. 91-7.''). Likewise, in this instance, we find that 
when Pwn Plugs are packaged together with cables, wireless adaptors, 
modems, and memory cards they are GRI 1 articles.
    Based on the findings of the court in Uniden, we find that the 
cables, wireless adaptors, modems, and memory cards are 
substantially transformed when attached to Pwn Plugs. Moreover, they 
are packaged together with Pwn Plugs and offered for sale as GRI 1 
articles. Consequently, the country of origin of Pwn Plugs for 
purposes of U.S. government procurement will be the United States.
    Please contact the Trade Commission, Division of Enforcement, 
6th and Pennsylvania Avenue NW, Washington, DC 20508, on whether the 
Pwn Plugs may be marked ``Made in the U.S.A.''

HOLDING:

    Based on the facts provided, the programming operations 
performed in the United States impart the essential character to Pwn 
Plugs. As such, Pwn Plugs are considered products of the United 
States for purposes of U.S. Government procurement. Moreover, 
because Pwn Plugs convey the essential character of the retail 
products, and the adapters, modems and memory cards are used with 
the Pwn Plugs, they are substantially transformed when attached to 
the Pwn Plugs. The country of origin of the adapters, modems and 
memory cards for purposes of U.S. government procurement, when 
packaged with Pwn Plugs, is the United States.
    Notice of this final determination will be given in the Federal 
Register, as required by 19 C.F.R. Sec.  177.29. Any party-at-
interest other than the party which requested this final 
determination may request, pursuant to 19 C.F.R. Sec.  177.31, that 
CBP reexamine the matter anew and issue a new final determination. 
Pursuant to 19 C.F.R. Sec.  177.30, any party-at-interest may, 
within 30 days of publication of the Federal Register Notice 
referenced above, seek judicial review of this final determination 
before the Court of International Trade.

 Sincerely,

Sandra L. Bell, Executive Director,

Regulations and Rulings, Office of International Trade.


[FR Doc. 2012-17805 Filed 7-20-12; 8:45 am]
BILLING CODE P