17 November 1998
Source: http://www.bxa.doc.gov/Encryption/EncrypolicyUpdate.htm

[Published 16 November 1998]

SUMMARY OF ENCRYPTION POLICY UPDATE 1. Release up to "56 bit DES and equivalent" hardware and software Hardware and software exports of up to "56 bits DES and equivalent" products will be eligible for license exception treatment to all users and destinations (except the seven State supporters of terrorism) after a one-time technical review. No further key recovery plans or renewals of existing key recovery plans are required. This release includes up to 56 bit DES, RC2, RC4, RC5 and CAST. Products with asymmetric key sizes up to 1024 bits will be permitted. Semi-annual post-facto reporting of end users for non-mass market exports to military and government end-users will be required.

2. Relax requirements for Key Recovery products

Remove from the regulations the requirement to name and review key recovery agents for exports of key recovery products. Require post-facto reporting of key recovery agents and the end users of key recovery products (currently semi-annual). Supplement 5 (Key Recovery Agent Criteria) will be removed from regulations.

3. Sectors

Semi-annual post-facto reporting is required within each sector.

U.S. Subsidiaries: Approve exports of any encryption with any key length, with or without key recovery, to subsidiaries of U.S. companies (defined in Commerce regulation) world-wide (except the seven state sponsors of terrorism) under license exception, for the protection of internal business operations. This policy will also extend favorable treatment, to "strategic, partners" under license.

Insurance Companies: Treat insurance companies like banks and securities firms by adding them to the definition of "financial institution." The result is license exception treatment to institutions headquartered in nations listed in the recent amendments to the EAR relating to banks and financial institutions (63 FR 50156).

Health/Medical: Permit the export under license exception of any encryption with any key length, with or without key recovery, to organizations in the strictly defined health and medical sectors (see attached definitions) located in the nations listed in the banking regulation. Exports outside the country list found in the banking regulation receive a policy of approval under Encryption Licensing Arrangements (ELAs), recognizing that certain destinations may be denied on foreign policy or other grounds. The EAR will exclude biochemical firms, pharmaceutical firms and military agencies from eligibility for the license exception. Exports to such end users are possible under individual license.

On-Line Merchants: The EAR will permit license exception treatment for the export of client-server applications (e.g., SSL) and applications tailored to on-line transactions, with any encryption algorithm and with any key length and with or without key recovery, to on-line merchants (see attached definitions), located in the country list found in the banking regulation . Exports would be limited to those that facilitate secure electronic transactions between merchants and their customers. Exports outside the country list found in the banking regulation receive a policy of approval under ELA, recognizing that certain destinations may be denied on foreign policy or other grounds. Foreign merchants (non-US owned and controlled) that sell items and services controlled on the U.S. munitions list are excluded from this policy. For merchants having separate business units, only those business units selling munitions items are excluded from this policy of approval and license exception.

4. Recoverable Products

Permit exports, under Export Licensing Arrangements, of recoverable products (see attached definitions) to foreign commercial firms for internal company proprietary use, only (i.e. not sold for individual use) that are located in the following countries:

> > 1. Austria, Australia, Belgium, Canada, Denmark, Finland, France, Germany, Iceland, Ireland, Italy, Japan, Luxembourg, The Netherlands, New Zealand, Norway, Portugal, Spain, Sweden, Switzerland, and the United Kingdom.

> > 2. Anguilla, Antigua, Argentina, Aruba, Bahamas, Barbados, Brazil, Dominica, Ecuador, Greece, Hungary, Kenya, Monaco, Poland, Seychelles, St. Kitts and Nevis, St. Vincent/Grenadines, Trinidad and Tobago, Turkey and Uruguay.

In addition, for those commercial firms headquartered in countries listed in 1 above, further permit exports, ELAs, of recoverable products to their foreign subsidiaries for internal company proprietary use in all destinations except the seven countries identified as State supporters of terrorism.

For both 1 and 2 above, this policy of approval excludes those commercial firms or separate business units of commercial firms engaged in the manufacturing and distribution of products or services controlled on the U.S. Munitions List. Service providers are also excluded from this policy. Semi-annual post export reporting of end users is required. Exports to those end users and countries not listed under this policy are possible under Validated Licenses or Export Licensing Arrangements on a case-by-case basis.

Definitions (preliminary)

Insurance company means:

a) A company organized and regulated under the laws of any of the United States and its branches and affiliates whose primary and predominant business activity is the writing of insurance or the reinsuring of risk, or

b) A company organized and regulated under the laws of a foreign country and its branches and affiliates, regulated by an insurance Commissioner or an equivalent foreign regulatory authority and whose primary and predominant business activity is the writing of insurance or the reinsuring of risks.

Health/Medical

Any entity, the primary purpose of which is the lawful provision of "medical or other health services", not including biochemical and pharmaceutical manufacturers and military or government entities.

On-line merchants

A seller of goods using electronic means (e.g., the Internet) to conduct commercial transactions and is defined to be a person that deals in goods of the kind involved in the transaction.

Recoverable products

1. A stored data product containing a recovery feature that, when activated, allows recovery of the plaintext* of encrypted data without the assistance of the end user; or

2. A product or system designed such that network administrator or other authorized persons who are removed from the end user can provide law enforcement access to plaintext without the knowledge or assistance of the end user. This includes, for example, products or systems where plaintext exists and is accessible at intermediate points in a network or infrastructure system, enterprise-controlled recovery systems, and products which permit recovery of plaintext at the server where a system administrator controls and/or can provide recovery of plaintext across an enterprise, and so on.

* Plaintext indicates that data that is initially received by or presented to the recoverable product before encryption takes place.

Go to the Encryption page

Source: http://207.96.11.93/Encryption/encchart.htm

Encryption Export Controls Update
Licensing Policy Matrix

Class of End Users | Products | License Mechanism1 | Country Scope | Reporting2 | Restrictions3
U.S. Subsidiaries | Recoverable / Non-Recoverable | L.E. "ENC"4 | Global except T-7 | W | a,g
Banks/Financial Institutions and Insurance Companies | Recoverable / Non-Recoverable | L.E. KMI | 44 (including global branches) | W | a,b
|  | ELA | Specific countries excluded | W | b
|  | IL | Specific endusers |  | h
Health /Medical Companies | Recoverable / Non-Recoverable | L.E. "ENC" | 44 countries | F | a,b,c
|  | ELA | Specific countries excluded | F | b,c
|  | IL | Specific endusers |  | h
On-Line Merchants | Client-Server or on-line Applications | L.E. "ENC" | 44 countries | F | a,b,d
|  | ELA | Specific countries excluded | F | b,d
|  | IL | Specific endusers |  | h
Commercial Entities | Recoverable | ELA | 41 countries (21 includes global branches) | F | e,f,g
|  | ELA/IL | All others |  | g,h
Any EndUser | Up to 56-bit DES or equivalent | L.E. "ENC" | Global except T-7 | W,M | a
Any EndUser | Key Recovery Products | L.E. KMI | Global except T-7 | F | a

Footnotes:
1. | L.E.=License Exception, ELA=Encryption Licensing Arrangement, IL=Individual License
Reporting:
2. | W=report the quantity and ECCN for Non-Wassenaar countries only. F=report the information required by EAR Section 742.15. M=in addition to "W" reporting, include name and address of all military and government end users in all destinations.
Restrictions:
3. | a= One time technical review. b= Enduse within sector; no customer-to-customer. c= Excludes biochemical/pharmaceutical firms and military agencies under license exception. d= Excludes foreign merchants or separate business units that sell items and services on the USML under license exception.
e= Excludes Telecom or Internet Service providers under the current ELA country scope.
f= Excludes firms or separate business units engaged in the manufacturing and distribution of products or servces on the USML.
g=For internal company proprietary use only.
h=case-by-case review.
4. | Proposed new License Exception.

Source: http://www.bxa.doc.gov/factsheets/EncCountryList.htm

## Countries Eligible to Receive General Purpose
Encryption Commodities and Software Under License Exception

Anguilla Antigua Argentina Aruba Australia
Austria
Bahamas
Barbados
Belgium
Brazil
Canada
Croatia*
Denmark
Dominica
Ecuador
Finland
France
Germany
Greece
Hong Kong*
Hungary
Iceland
Ireland
Italy
Japan
Kenya
Luxembourg
Monaco
Netherlands
New Zealand
Norway
Poland
Portugal
St. Kitts & Nevis
St. Vincent/Grenadines
Seychelles
Singapore*
Spain
Sweden
Switzerland
Trinidad & Tobago
Turkey
Uruguay
United Kingdom
* These countries will not be eligible for Encryption Licensing Arrangements (ELAs) for export of 'recoverable products.'

11/16/98

[BXA counter]