Striking Out in the Game of Encryption: A Look at Decontrol Notes

Export classification can be tricky enough on its own, but add in encryption and you have a whole different ball game. I like to equate encryption to baseball, because putting something into an analogy helps me understand it better. An entire game of baseball from beginning to end can be really hard to sit through and so can a huge narrative on encryption. Because of that, I’m going to focus on the basics of determining if your item is captured in 5A002/5D002 a. or not. Before using any of these exclusions or “outs” you must first work to determine whether or not your item might fall into the Export Control Classification Numbers (ECCNs) of 5A002 b, c, d, or e.

Let’s say your software engineer just came up to you and described a product that is being developed. You quickly pick up that this has some sort of security feature and ask if it has encryption- indeed it does! Category 5 Part 2 will now serve as your home base. Remember: encryption controls trump other ECCNs.

In a real baseball game, the players have the goal of staying at bat and not getting out (although sometimes it appears otherwise depending on your choice of team). However, in the game of encryption, you are actually looking to get out. In particular, you want to determine if your item can “get out” of the Category 5 Part 2 controls.

How do you get out? The “outs” are located in the decontrol notes within Category 5 Part 2. Be sure you start with reading the notes to see if your item stays in the encryption game or gets the boot out of the chapter. Below are three possible “outs.” There are others, but we will focus on three common ones which will exclude an item from 5A002 a. Just be careful. There is also 5A002 b, c, d, and e that you will need to review. However, in many cases, an engineer can look at the line of products and decide whether any fall into b, c, d, or e. 5A002 a. is a very common bucket for software and encrypted products, which is why we will put our focus there.

Exclusions Specific to 5A002 a.

“Out 1:” Strength and Function

• Strength of the Encryption: Items with low-level encryption are not controlled in 5A002 a. While this does not get you out of Category 5 Part 2 altogether, this is a major out for many items. Items with encryption levels under 56 bits symmetric, 512 bits asymmetric, or under 112 bits elliptic curve move out of the encryption control bucket of 5A002 a.
• Items can also be bumped out of 5A002 a. based on the function of the encryption. If the cryptography performs only authentication, digital signature, data integrity, non-repudiation, digital rights management, encryption or decryption in support of entertainment, mass commercial broadcasts or medical rights management OR key management in support of any function listed above, it is NOT controlled in 5A002 a.

“Out 2:” Use

• Use Exceptions: There are a few exclusions for use that will bump your product out of 5A002 a. For example, cryptographic equipment that is specially designed and limited for banking use or money transactions is excluded from classification in 5A002 a. Certain smart cards and smart card readers are also excepted. Further, if the primary function of the encryption is not information security, computing, communication or networks, it also does not belong in 5A002.a. These items include those for gaming, DVRs, HDMI, and smart TV/refrigerators. There are also exceptions for specific portable or mobile radiotelephones for civil use, cordless telephone equipment not capable of end-to-end encryption, and items where the information security is limited to wireless personal area networks. Be sure to review Category 5 Part 2 carefully as each exception lists very specific criteria that your item must meet in order to be excluded.

“Out 3:” Mass Market

• If your item does not strike out for any of the above reasons, then it’s possible that it could be considered to be Mass Market and fall under the lesser-controlled ECCN of 5A992 or 5D992. To qualify for Mass Market, the item should not meet any of the exceptions above and be generally available to the public, have cryptographic functionality that is not easily changed, designed for installation by the user without substantial support, and details of the item must be provided to the Bureau of Industry and Security (BIS) if requested. There are reporting requirements, however, Mass Market items can ship to many locations with no license required.

As one can see, just because an item has encryption does not always mean it is locked into the encryption controls of Category 5 Part 2. The decontrol notes are key in determining if your item belongs there or in another ECCN. For more information on encryption controls and classification, please contact Export Solutions for a free consultation.