24 August 1997 Add link to New York Times report on draft encryption regulations.
Note: Leads to other versions of this document, commentary or news reports are welcomed. E-mail to <jya@pipeline.com> Thanks, JY.

20 August 1997
Source: Anonymous remailer.

For related documents see links at the Export Administration Regulations.

    From: nobody@REPLAY.COM (Anonymous)
    Date: Wed, 20 Aug 1997 21:40:07 +0200 (MET DST)
    Subject: July draft of EI regs
    To: John Young <jya@pipeline.com>

    Note:  This draft of the crypto regs changes procedures for posting crypto
    on the Net to require advance authorization.  It may not be the latest.

    July 25, 1997

    DEPARTMENT OF COMMERCE

    Bureau of Export Administration

    15 CFR Parts 732, 734, 740, 742, 748, 750, 752, 758, 770, 772, and 774

    [Docket No.         ]

    RIN: 0694-AB09

    Encryption Items

    AGENCY: Bureau of Export Administration, Commerce.

    ACTION:  Interim rule.

    SUMMARY:	This interim rule amends the Export Administration
    Regulations (EAR) by clarifying controls on the export and reexport of
    encryption items controlled for "EI" reasons on the Commerce Control List.
    This rule incorporates public comments on an interim rule published in the
    Federal Register on December 30, 1996.

    EFFECTIVE DATE: This rule is effective: (DATE OF PUBLICATION).

    FOR FURTHER INFORMATION CONTACT: James Lewis, Office of Strategic Trade and
    Foreign Policy Controls, Bureau of Export Administration, Telephone: (202)
    482-0092.

    BACKGROUND:

    On December 30, 1996, the Bureau of Export Administration (BXA) published
    in the Federal Register (61 FR 68572) an interim rule that exercises
    jurisdiction over, and imposes new combined national security and foreign
    policy controls on, certain encryption items that were on the United States
    Munitions List, consistent with Executive Order 13026 and pursuant to the
    Presidential Memorandum of that date, both issued by President Clinton on
    November 15, 1996.

    BXA received comments from 45 commenters, and the comments fall into three
    broad categories: general concerns and objections to the policy embodied in
    the regulations; recommendations for specific changes or clarifications to
    the regulations that are consistent with the broad encryption policy
    implemented in the December 30 rule; and recommendations for additional
    changes to encryption policy.

    General Objections

    Twelve commenters stated their fundamental objection to an encryption
    policy based on key recovery.  Five such comments were brief, stating that
    the new regulations are vague and violate the writers' First and Fifth
    amendment constitutional rights.  Two commenters further allege that the
    new regulations pose unconstitutional restraints on free speech, focusing
    on the controls on the dissemination of encryption technology which are
    under court challenge.  One commenter also asserts that access to strong,
    non-recoverable encryption is necessary to advance human rights and protect
    nongovernmental human rights organizations and workers.

    Six commenters provided their general opposition to the encryption policy
    reflected in the December 30 rule, stating that there is no market demand
    for key recovery; strong encryption products are widely available from
    foreign producers; U.S. market leadership is threatened; and export
    controls on encryption should be eliminated.  One commenter noted that the
    December 30 rule reflects that there is no longer a national security
    rationale for controlling 56-bit DES products and that the interim relief
    offered for such products should not be used to "coerce" industry to
    support key recovery.

    Suggestions for changes to clarify existing policy

    A number of commenters provided specific suggestions for changes or
    clarifications which are  consistent with the intent of the policy and
    which would streamline or improve the regulations.    Many of these
    suggestions are implemented in this rule, such as clarifying that the tools
    of trade provisions of License Exception TMP and License Exception BAG
    apply globally and clarifying that anti-virus software does not require a
    license for export.

    Several commenters asked Commerce to adopt exemptions to license
    requirements which were available for encryption exporters under
    §123.16(b)(2) and (b)(9) of  the International Traffic and Arms Regulations
    (ITAR), such as those which allowed the export of components to a U.S.
    subsidiary or which allowed the export of spare parts and components
    without a license for an already approved sale.  This rule adds these new
    provisions under License Exception TMP, making them applicable to
    encryption controlled items as well as other items eligible for TMP
    treatment.

    Two commenters asked that the regulations clarify that the ITAR licensing
    policy for equipment specially made for and limited to the encryption of
    interbanking transactions had not changed with the transfer of jurisdiction
    to Commerce of encryption products.  This interim rule clarifies that this
    equipment is not subject to EI controls.

    Several commenters recommended a number of changes to the Key Escrow
    Product and Agent criteria found in Supplement Nos. 4 and 5 part 742 of the
    EAR.  These recommendations were to simplify the criteria, and to modify
    some of the specific prescriptions to allow for greater flexibility  and
    variation on the part of exporters.  Many commenters found the criteria too
    bureaucratic and legalistic to help advance U.S. encryption policy goals,
    while others noted that the criteria were still overly focused on key
    escrow and not consistent with the broader approach to key recovery found
    elsewhere in the regulation.  Several commenters also encouraged the
    administration to make clear that it had moved beyond key escrow to key
    recovery in its policy. One commenter focused on weaknesses and omissions
    found in the key escrow product and agent criteria found in Supplement Nos.
    4 and 5 to part 742 of the EAR, and provided suggested additions to the
    criteria to make them more consistent with emerging business practices.
    The criteria specified in Supplement Nos. 4 and 5 were discussed
    extensively with  industry prior to publication of the December 30 interim
    rule, and the rule reflects these discussions.  However,  BXA continues to
    look for ways to streamline the criteria, and will address revisions in a
    future regulation.

    Several commenters expressed concerns over the longer processing time
    required for licenses at Commerce.  Some commenters  noted that the
    involvement of Departments of Energy and State, the Arms Control and
    Disarmament Agency and other agencies which did not review license
    applications for encryption products submitted to the Department of State
    added unnecessary levels of review and caused unwarranted delays.  BXA is
    continuing to work with other reviewing Departments and Agencies to ensure
    expeditious review of encryption license applications.  Many commenters
    noted that the requirements for a Commerce license were substantially
    greater than what was required at the Department of State.  The Department
    of Commerce, for example, requires an end-use certificate to be obtained
    for some destinations before approving an export; the Department of State
    did not and exporters question the need for this change.  Other commenters
    noted that the Department of State licensing system was more flexible and
    faster for approvals of distribution and manufacturing arrangements.  The
    Department of Commerce has no equivalent licenses, but is reviewing the
    possibility of such licenses.  Many oral comments received since the close
    of the comment period note that unlike the Department of State, the
    Department of Commerce does not allow licenses to be amended, so that if an
    exporter has, for example, a license which allows him to ship to thirty
    countries and wishes to add one more, the Department of Commerce requires
    submission of an entire new license while the Department of State was
    content with a simple letter noting the requested change.  BXA understands
    industry concerns about the license process under the EAR, and continues to
    look for ways to streamline the process.

    Additional recommendation for changes to encryption policy

    A number of commenters asked that the Administration revisit a number of
    decisions made in the course of the development of the encryption policy as
    reflected in the December 30 interim rule.
    Several asked that we reconsider and liberalize the treatment of
    Cryptographic Application Program Interface.  Others questioned the
    addition of  "defense services" control similar to that contained in the
    ITAR (which prohibits U.S. persons from assisting foreign entities from
    developing their own indigenous encryption products).  Several commenters
    objected to the structure of License Exception KMI for non-recoverable 56
    bit products, with its requirement for a review every six months.  Other
    commenters also called for a reversal of the decision to exempt transferred
    encryption items from normal Department of Commerce regulatory practices.
    Finally, several commenters recommended that the licensing criteria and
    License Exceptions applicable to other dual-use items be fully applicable
    to encryption products, such as considerations of foreign availability, the
    de minimis content exclusion, public domain treatment and the use of
    License Exceptions.  This rule focuses on clarifications to existing
    encryption policy.

    Based on public comments to the December 30 interim rule, this interim rule
    specifically makes the following changes:

    - In §732.2, clarifies that BXA will consider acknowledgments and
    assurances in electronic form provided that they are adequate to assure
    legal undertakings similar to written acknowledgments and assurances.

    - In §734.3, clarifies that downloading or causing the downloading of
    encryption source code and object code in Canada is not controlled and does
    not require a license, and clarifies that the methods used as precautions
    to prevent unauthorized transfer of such code outside the United States or
    Canada must be approved by BXA.

    - In §740.6, clarifies that letters of assurance may be accepted in the
    form of a letter or any other written communication from the importer,
    including communications via facsimile.

    - In §740.8, adds recovery encryption technology to the list of items
    eligible for export under License Exception KMI, after a one-time review,
    and adds a paragraph to authorize exporters of non-key recovery products
    under License Exception KMI to service and support existing customers of
    those products after the two-year transition period.  This section is also
    amended by adding a paragraph to authorize exporters of non-recovery
    encryption products under License Exception KMI to export additional
    quantities of such products to existing customers under a license after the
    two-year transition period.

    - §740.8 is also amended by adding a new paragraph to authorize, after a
    one-time review, exports and reexports under License Exception KMI of
    non-key recovery financial-specific encryption items of any key length that
    are restricted by design (e.g., highly field-formatted with validation
    procedures, and not easily diverted to other end-uses)  for financial
    applications to secure financial transactions, for end-uses such as intra
    or inter-banking transfers and home banking.  No business and marketing
    plan to develop, produce, and/or market similar encryption items with
    recoverable features is required. Conforming changes are also made in
    §742.15.

    - In §740.9, removes the reference to Country Group D:1.  This clarifies
    that encryption software controlled for EI reasons under ECCN 5D002 may be
    pre-loaded on a laptop and exported under the tools of trade provisions of
    License Exception TMP or License Exception BAG.

    - In §740.14, clarifies existing provisions of License Exception BAG and
    imposes a restriction on the use of BAG for exports or reexports of
    EI-controlled items to terrorist supporting destinations or by other than
    U.S. citizens and permanent residents.

    -  §742.15 is amended adding a new paragraph that authorizes exports under
    an Encryption Licensing Arrangement of general purpose non-key recovery,
    non-voice encryption items of any key length for use by financial
    institutions (such as banks) in all destinations except Cuba, Iran, Iraq,
    Libya, North Korea, Syria and Sudan.  Applications will be reviewed on a
    case-by-case basis, and must be supported by a satisfactory business and
    marketing plan which explains in detail the steps the applicant will take
    during the two year transition period beginning January 1, 1997 to develop,
    produce, and/or market similar encryption items with recoverable features.

    - In Supplement No. 4 to part 742, paragraph (3), revises "reasonable
    frequency" to "at least once every three hours" to resolve the ambiguity on
    how often the output must identify the key recovery agent and
    material/information required to decrypt the ciphertext.

    - In Supplement No. 4 to part 742, paragraph (6)(i), clarifies that the
    U.S. government must be able to obtain the key(s) or other
    material/information needed to decrypt all data, without restricting the
    means by which the key recovery products allow this.

    - In Supplement No. 6 to part 742, eliminates the test vector requirement
    for 7-day mass-market classification requests and replaces it with a
    requirement to provide a copy of the encryption subsystem source code.

    -  In Supplement No. 6 to part 742, adds 40-bit DES as being eligible for
    consideration for mass-market eligibility, subject to the additional
    criteria listed in this supplement.

    - In §§ 748.9 and 748.10, clarifies a long-standing policy that no support
    documentation is required for exports of technology or software, and it
    removes the requirement for such support documentation for exports of
    technology or software to Bulgaria, Czech Republic, Hungary, Poland,
    Romania, or Slovakia.  This rule also exempts from support documentation
    requirements all encryption items controlled under ECCNs 5A002, 5B002,
    5D002 and 5E002.  This conforms with the practice under the ITAR prior to
    December 30, 1996.

    - In §750.7, authorizes certain specified changes to Commerce and State
    Encryption Licensing Arrangements by letter.

    - In §752.3, excludes encryption items controlled for EI reasons from
    eligibility for a Special Comprehensive License.

    - In §770.2, adds a new interpretation to clarify that encryption software
    controlled for EI reasons under ECCN 5D002 may be pre-loaded on a laptop
    and exported under the tools of trade provision of License Exception TMP or
    the personal use exemption under License Exception BAG, subject to the
    terms and conditions of such License Exceptions.

    - In part 772, adds new definitions for "effective control", "encryption
    licensing arrangement", "financial institution" and "recovery encryption
    products".

    - In Supplement No. 1 to part 774, Category 5 - Telecommunications and
    Information Security is amended by revising ECCN 5A002 to authorize exports
    of components and spare parts under License Exception LVS, provided the
    value of each order does not exceed $500 and to clarify that equipment for
    the encryption of interbanking transactions is not controlled under that
    entry.

    - Revises the phrase "up to 56-bit key length DES" where it appears to read
    "up to or equal to 56-bit key length DES", and makes other editorial
    changes.

    Several commenters also noted that the exemptions found under §125.4(b) of
    the ITAR should be implemented in the EAR.  Most of the exemptions found in
    §125.4(b) of the ITAR are already available under existing provisions of
    the EAR.  For example, §125.4(b)(4) of the ITAR authorizes exports without
    a license of copies of technical data previously authorized for export.
    The EAR has no restrictions on the number of copies sent to a consignee
    authorized to receive technology under license or a License Exception.
    Section 125.4(b)(5) authorizes exports without a license of technical data
    in the form of basic operations, maintenance, and training information
    relating to a defense article lawfully exported or authorized for export
    provided the technical data is for use by the same recipient.  Further,
    Section 125.4(2) authorizes exports of technical data in furtherance of a
    manufacturing license or technical assistance agreement.  License Exception
    TSU for operation technology and software (see §740.13 of the EAR)
    authorizes the export and reexport of the minimum technology necessary for
    the installation, operation, maintenance and repair of those products
    (including software) that are lawfully exported or reexported under a
    license, a License Exception, or NLR (no license required).  This would
    apply to licenses for hardware as well as software.  Section 125.4(b)(7) of
    the ITAR allows the return of technical data to the original source of
    import.  License Exception TMP similarly authorizes the return of any
    foreign-origin item, including technology, to the country from which it was
    imported if the characteristics have not been enhanced while in the United
    States (see §740.9(b)(3) of the EAR).

    BXA has also received many calls from exporters on the Shipper's Export
    Declaration (SED).  First, this rule amends the SED requirements of the EAR
    to clarify that no SED is required for export control purposes under the
    EAR for temporary exports of tools of trade, including laptop computers,
    under License Exceptions TMP or BAG.  BXA understands the importance of
    ensuring that the SED provisions of the EAR conform with those of the
    Foreign Trade Statistics Regulations (FTSR), and is working with the Bureau
    of Census to make the appropriate revisions to the FTSR.  BXA has also
    received many inquiries on SED requirements for Canada.  Note that the EAR
    do not require exporter's to file an SED for exports of any item to Canada
    for consumption in Canada, unless a license is required.  Further note that
    a license is not required for exports of encryption items for consumption
    in Canada, including certain exports over the internet.  Finally, BXA has
    received many requests for clarification on SED requirements for electronic
    transfers.  Neither the EAR nor the FTSR provide for the filing of SEDs
    for electronic transfers of items controlled by the Department of Commerce
    under the EAR .

    As further clarifications and changes to the encryption provisions of the
    EAR are intended, in particular regarding Supplement Nos. 4 and 5 to part
    742 of the EAR, BXA will publish additional interim rules in the Federal
    Register.

    Rulemaking Requirements

    1.  This interim rule has been determined to be significant for purposes of
    E. O. 12866.

    2.  Notwithstanding any other provision of law, no person is required to
    respond to, nor shall any person be subject to a penalty for failure to
    comply with a collection of information, subject to the requirements of the
    Paperwork Reduction Act, unless that collection of information displays a
    currently valid OMB Control Number. This rule involves collections of
    information subject to the Paperwork Reduction Act of 1980 (44 U.S.C. 3501
    et seq.).  These collections have been approved by the Office of Management
    and Budget under control numbers 0694-0048,  0694-0088, and 0694-0104.

    3.    This rule does not contain policies with Federalism implications
    sufficient to warrant preparation of a Federalism assessment under
    Executive Order 12612.

    4.  The provisions of the Administrative Procedure Act (5 U.S.C. 553)
    requiring notice of proposed rulemaking, the opportunity for public
    participation, and a delay in effective date, are inapplicable because this
    regulation involves a military and foreign affairs function of the United
    States (Sec. 5 U.S.C. 553(a)(1)).  Further, no other law requires that a
    notice of proposed rulemaking and an opportunity for public comment be
    given for this interim final rule.  Because a notice of proposed rulemaking
    and an opportunity for public comment are not required to be given for this
    rule under 5 U.S.C. or by any other law, the requirements of the Regulatory
    Flexibility Act (5 U.S.C. 601 et seq. ) are not applicable.

    However, because of the importance of the issues raised by these
    regulations, this rule is issued in interim form and comments will be
    considered in the development of final regulations.  Accordingly, the
    Department encourages interested persons who wish to comment to do so at
    the earliest possible time to permit the fullest consideration of their
    views.

    The period for submission of comments will close (45 DAYS AFTER DATE OF
    PUBLICATION).  The Department will consider all comments received before
    the close of the comment period in developing final regulations.  Comments
    received after the end of the comment period will be considered if
    possible, but their consideration cannot be assured.  The Department will
    not accept public comments accompanied by a request that a part or all of
    the material be treated confidentially because of its business proprietary
    nature or for any other reason.  The Department will return such comments
    and materials to the person submitting the comments and will not consider
    them in the development of final regulations.  All public comments on these
    regulations will be a matter of public record and will be available for
    public inspection and copying.  In the interest of accuracy and
    completeness, the Department requires comments in written form.

    Oral comments must be followed by written memoranda, which will also be a
    matter of public record and will be available for public review and
    copying.  Communications from agencies of the United States Government or
    foreign governments will not be made available for public inspection.

    The public record concerning these regulations will be maintained in the
    Bureau of Export Administration Freedom of Information Records Inspection
    Facility, Room 4525, Department of Commerce, 14th Street and Pennsylvania
    Avenue, N.W., Washington, D.C.  20230.  Records in this facility, including
    written public comments and memoranda summarizing the substance of oral
    communications, may be inspected and copied in accordance with regulations
    published in Part 4 of Title 15 of the Code of Federal Regulations.
    Information about the inspection and copying of records at the facility may
    be obtained from Margaret Cornejo, Bureau of Export Administration Freedom
    of Information Officer, at the above address or by calling (202) 482-5653.

    List of Subjects

    15 CFR Part 732,  740, 748, 750, 752 and 758

    Administrative practice and procedure, Exports, Foreign trade, Reporting
    and Recordkeeping requirements.

    15 CFR Part 734

    Administrative practice and procedure, Exports, Foreign trade,

    15 CFR Parts 742, 770, 772 and 774

    Exports, foreign trade.

    1.  The authority citation for 15 CFR parts 732, 740, 748, 752 and 772
    continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; E.O. 12924,
    59 FR 43437, 3 CFR, 1994 Comp., p. 917; Executive Order 13026 (November 15,
    1996, 61 FR 58767) Notice of August 15, 1995 (60 FR 42767, August 17,
    1995); Notice of August 14, 1996 (61 FR 42527), 3 CFR, 1995 Comp., p. 501.

    2.  The authority citation for 15 CFR part 734 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.;  E.O.
    12924, 59 FR 43437, 3 CFR, 1994 Comp., p. 917; E.O. 12938, 59 FR 59099, 3
    CFR, 1994 Comp., p. 950; Executive Order 13026 (November 15, 1996, 61 FR
    58767); Notice of August 15, 1995 (60 FR 42767, August 17, 1995); Notice of
    August 14, 1996 (61 FR 42527), 3 CFR, 1995 Comp., p. 501.

    3. The authority citation for 15 CFR part 742 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 18 U.S.C.
    2510 et seq.; 22 U.S.C. 3201 et seq.; 42 U.S.C. 2139a;  E.O. 12058, 43 FR
    20947, 3 CFR, 1978 Comp., p. 179; E.O. 12851, 58 FR 33181, 3 CFR, 1993
    Comp., p. 608; E.O. 12924, 59 FR 43437, 3 CFR, 1994 Comp., p. 917; E.O.
    12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; Executive Order 13026
    (November 15, 1996, 61 FR 58767);  Notice of August 15, 1995 (60 FR 42767,
    August 17, 1995); and Notice of August 14, 1996 (61 FR 42527).

    4.  The authority citation for 15 CFR part 750 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; E.O. 12924,
    59 FR 43437, 3 CFR, 1994 Comp., p. 917; Notice of August 15, 1995 (60 FR
    42767, August 17, 1995); E.O. 12981, 60 FR 62981; Notice of August 14, 1996
    (61 FR 42527), 3 CFR, 1995 Comp., p. 501.

    5.  The authority citation for 15 CFR part 770 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; E.O.
    12924, 59 FR 43437, 3 CFR, 1994 Comp., p. 917; Notice of August 15, 1995
    (60 FR 42767, August 17, 1995); Notice of August 14, 1996 (61 FR 42527), 3
    CFR, 1995 Comp., p. 501.

    6.  The authority citation for 15 CFR part 774 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 10 U.S.C.
    7420; 10 U.S.C. 7430(e); 18 U.S.C. 2510 et seq.; 22 U.S.C. 287c; 22 U.S.C.
    3201 et seq.; 22 U.S.C. 6004; Sec. 201, Pub. L. 104-58, 109 Stat. 557 (30
    U.S.C. 185(s)); 30 U.S.C. 185(u); 42 U.S.C. 2139a; 42 U.S.C. 6212; 43
    U.S.C. 1354; 46 U.S.C. app. 466c; 50 U.S.C. app. 5; E.O. 12924, 59 FR
    43437, 3 CFR, 1994 Comp., p. 917; Executive Order 13026 (November 15, 1996,
    61 FR 58767);  Notice of August 15, 1995 (60 FR 42767, August 17, 1995);
    Notice of August 14, 1996 (61 FR 42527), 3 CFR, 1995 Comp., p. 501.

    7.  The authority citation for 15 CFR part 758 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; E.O. 12924,
    59 FR 43437, 3 CFR, 1994 Comp., p. 917; Notice of August 15, 1995 (60 FR
    42767, August 17, 1995); and Notice of August 14, 1996 (61 FR 42527), 3
    CFR, 1995 Comp., p. 501.

    PART 732 - [AMENDED]

    8.  Section 732.2 is amended by revising the phrase "ECCN 5A002, ECCN
    5D002, and ECCN 5E002" in paragraph (d) to read "ECCN 5A002 or ECCN 5D002".

    9.   Section 732.3 is amended by revising the phrase "ECCN 5A002, ECCN
    5D002, and ECCN 5E002" in paragraph (e)(2) to read "ECCN 5A002 or ECCN
    5D002".

    PART 734 - [AMENDED]

    10.  Section 734.2 is amended by revising paragraph (b)(9)(ii) to read as
    follows:

    §734.2 Important EAR terms and principles.

    (a)  *     *     *

    (b)  *     *     *

    (9) *     *     *

    (ii)  The export of encryption source code and object code software
    controlled for EI reasons under ECCN 5D002 on the Commerce Control List
    (see Supplement No. 1 to part 774 of the EAR) includes downloading, or
    causing the downloading of, such software to locations (including
    electronic bulletin boards, Internet file transfer protocol, and World Wide
    Web sites) outside the U.S. (except Canada), or making such software
    available for transfer outside the United States (except Canada), over
    wire, cable, radio, electromagnetic, photo optical, photoelectric or other
    comparable communications facilities accessible to persons outside the
    United States (except Canada), including transfers from electronic bulletin
    boards, Internet file transfer protocol and World Wide Web sites, unless
    the person making the software available takes precautions adequate to
    prevent unauthorized transfer of such code outside the United States or
    Canada.  Before you rely upon such precautions, they must be submitted to
    the Bureau of Export Administration for review of their adequacy.  Such
    precautions shall be approved in writing through an Advisory Opinion (see
    §748.3 of the EAR) by the Bureau of Export  Administration to prevent
    transfer of such software outside the U.S. without a license, and may
    include ensuring that the facility from which the software is available
    controls the access to and transfers of such software through such measures
    as:

    (A) The access control system either through automated means or human
    intervention, checks the address of every system requesting or receiving a
    transfer and verifies that such systems are located within the United
    States or Canada;

    (B) The access control system, provides every requesting or receiving party
    with notice that the transfer includes or would include cryptographic
    software subject to export controls under the Export Administration
    Regulations, and that anyone receiving such a transfer cannot export the
    software without a license; and

    (C) Every party requesting or receiving a transfer of such software must
    acknowledge affirmatively that he or she understands that the cryptographic
    software is subject to export controls under the Export Administration
    Regulations and that anyone receiving the transfer cannot export the
    software without a license.  BXA will consider acknowledgments in
    electronic form provided that they are adequate to assure legal
    undertakings similar to written acknowledgments.

    	*     *     *     *     *

    11.  Section 734.4 is amended by revising the phrase "ECCN, 5A002, ECCN
    5D002, and 5E002" in paragraph (b)(2) to read "ECCNs 5A002, 5D002, and
    5E002".

    PART 740 - [AMENDED]

    12.  Section 740.6 is amended by revising the first sentence in paragraph
    (a)(3) to read as follows:

    §740.6 Technology and software under restriction (TSR).

    (a) *     *     *

    (3) Form of written assurance.   The required assurance may be made in the
    form of a letter or any other written communication from the importer,
    including communications via facsimile, or the assurance may be
    incorporated into a licensing agreement that specifically includes the
    assurances.   *     *     *

    13.  Section 740.8 is amended:

    (a) By revising paragraph (b)(2);

    (b) By adding a new paragraph (b)(3);

    (c) By revising the phrase "recovery encryption software and equipment" in
    paragraph (d)(1) to read "recovery encryption items";

    (d) By adding a new paragraph (d)(3);

    (e) By  redesignating paragraph (e) as paragraph (g);

    (f) By adding new paragraphs (e) and (f); and

    (g) By revising the phrase "March 1 and no later than September 1" in
    paragraph (g)(2) to read February 1 and no later than August 1", as follows:

    §740.8 Key management infrastructure.

    	*     *     *     *     *

    (b) *    *     *

    (2) Non-recoverable encryption items.  Eligible items are up to  or equal
    to 56-bit key length DES strength non-key recovery equipment and software
    controlled under ECCNs 5A002 and 5D002 that are made eligible as a result
    of a one-time BXA review.  You may initiate this review by submitting a
    classification request for your product in accordance with paragraph (d)(2)
    of this section.
    (3)  Non-key recovery financial-specific encryption items of any key
    length.  After a one-time review, non-key recovery, financial-specific
    encryption items of any key length that are restricted by design (e.g.,
    highly field-formatted with validation procedures, and not easily diverted
    to other end-uses)  for financial applications to secure financial
    transactions for end-uses such as intra or inter-banking transfers and home
    banking will be permitted for export and reexport under License Exception
    KMI.

    (c) *     *     *

    (d) *     *     *

    (3)  Nonkey recovery financialspecific encryption items.  Upon approval
    of your classification request for a nonkey recovery financialspecific
    encryption item, you will become eligible to use License Exception KMI.
    This approval allows the export or reexport of encryption products
    specifically designed and limited for use in the processing of electronic
    financial (commerce) transactions, which implements cryptography in
    specifically delineated fields such as merchant's identification, the
    customer's identification and address, the merchandise purchased, and the
    payment mechanism.  It  does not allow for encryption of data, text or
    other media except as directly related to these elements of the electronic
    transaction to support financial transactions.    For exports under the
    provisions of this paragraph (d)(3), there are no reporting requirements
    and the criteria described in Supplement Nos. 4 and 5 to part 742 of the
    EAR are not applicable.    No business and marketing plan is required.

    	*     *     *     *     *

    (e) Service and support of customers authorized to receive encryption
    products under License Exception KMI.  Exporters authorized to export
    non-key recovery products under the provisions of this section in exchange
    for commitments to key recovery may service and support existing customers
    of those products without a license after the two-year transition period.
    Support and service includes maintenance or replacement of products to
    correct defects or maintain existing functionality.  It also includes
    upgrades that do not increase the strength of the encryption in the product.

    (f)  Additional exports after two-year transition period.  Exporters
    authorized to export 56-bit DES or equivalent strength non-key recovery
    products during the interim period may also export under a license
    additional quantities of those 56-bit DES or equivalent strength non-key
    recovery products after the two year period to existing customers.  Such
    sales may be made to the customers of any exporter that was authorized to
    export such products in exchange for key recovery commitments during the
    two year period.  The additional quantities sold may not be
    disproportionate to the customer's embedded base.

    	*     *     *     *     *

    14.  Section 740.9 is amended:

    a.  By revising paragraph (a)(2)(i);

    b  By revising the reference to "§740.9(a)" in paragraph (a)(2)(ii)(C) to
    read "§740.10(a)";

    c.    By revising the reference to "under §740.8(b)(1)" in the introductory
    text of paragraph (b)(1)(iii) to read "under this paragraph (b)(1)"; and

     		d.  By adding a new paragraph (a)(2)(ix) to read as follows

    §740.9  Temporary imports, exports, and reexports.

    	*      *      *      *      *

    (a) *     *     *

    (2) *     *     *

    (i)  Tools of trade.  Usual and reasonable kinds and quantities of tools of
    trade (commodities and software) for use by employees of the exporter in a
    lawful enterprise or undertaking of the exporter.  Eligible tools of trade
    may include, but are not limited to, such equipment and software as is
    necessary to commission or service goods, provided that the equipment or
    software is appropriate for this purpose and that all goods to be
    commissioned or serviced are of foreign origin, or if subject to the EAR,
    have been legally exported or reexported.  The tools of trade must remain
    under the effective control of the exporter or the exporter's employee (see
    part 772 of the EAR for a definition of "effective control").  The shipment
    of tools of trade may accompany the individual departing from the United
    States or may be shipped unaccompanied within one month before the
    individual's departure from the United States, or at any time after
    departure.  No tools of the trade may be taken to Country Group E:2 (see
    Supplement No. 1 to part 740) or Sudan.  For exports of laptop computers
    under this License Exception, refer to item interpretation 12 in §770.2 of
    the EAR.

    	*     *     *     *    *

    (ix) Temporary exports to U.S. subsidiary, affiliate or facility.  (A)
    Components, parts, tools or test equipment exported by a U.S. person to its
    subsidiary, affiliate or facility owned or controlled by the U.S. person if
    the components, part, tool or test equipment is to be used for manufacture,
    assembly, testing, production or modification, provided that no components,
    parts, tools or test equipment or the direct product of such components,
    parts, tools or test equipment are transferred or reexported to a country
    other than the United States from such subsidiary, affiliate or facility
    without prior authorization by the Bureau of Export Administration.

    (B) For purposes of this paragraph (a)(2)(ix), U.S. person is defined as
    follows:  an individual who is a citizen of the United States, an
    individual who is a lawful permanent resident as defined by 8 U.S.C.
    1101(a)(2) or an individual who is a protected individual as defined by 8
    U.S.C. 1324b(a)(3).  U.S. person also means any juridical person organized
    under the laws of the United States, or any jurisdiction within the United
    States (e.g., corporation, business association, partnership, society,
    trust, or any other entity, organization or group that is incorporated to
    do business in the United States).

    15.  Section 740.10 is amended by revising the reference to
    "§740.8(a)(2)(ii)" in paragraph (a)(2)(i) to read "§740.9(a)(2)(ii)".

    16.  Section 740.11 is amended by redesignating paragraph by revising
    paragraph (a)(2) to read as follows:

    §740.11 Governments and international organizations (GOV).

    *     *     *     *     *

    (a) International safeguards. *     *     *

    (2) Exclusions.  (i) No computers with a CTP greater than 10,000 MTOPS may
    be exported or reexported to countries listed in Computer Tiers 3 or 4.
    See §742.12 of the EAR for a complete list of the countries within Computer
    Tiers 3 and 4.

    (ii) No encryption items controlled for EI reasons under ECCNs 5A002,
    5D002, or 5E002 may be exported under the provisions of this paragraph (a).

    	*     *     *     *     *

    17.  Section 740.14 is amended by revising paragraphs (a), (b), and (c); by
    adding a sentence to the end of paragraph (d); and by adding paragraph (f)
    to read as follows:

    §740.14  Baggage (BAG).

    (a)  Scope.  This License Exception authorizes individuals leaving the
    United States either temporarily (i.e., traveling) or longer-term (i.e.,
    moving) and crew members of exporting or reexporting carriers to take to
    any destination, as personal baggage, the classes of commodities and
    software described in this section.

    (b)  Eligibility.  Individuals leaving the United States may export or
    reexport any of the following commodities or software for personal use of
    the individuals or members of their immediate families traveling with them
    to any destination or series of destinations.  Individuals leaving the
    United States temporarily (i.e., traveling) must bring back items exported
    and reexported under this License Exception unless they consume the items
    abroad or are otherwise authorized to dispose of them under the EAR.  Crew
    members may export or reexport only commodities and software described in
    paragraphs (b)(1) and (b)(2) of this section to any destination.

    (1)  Personal effects.  Usual and reasonable kinds and quantities for
    personal use of wearing apparel, articles of personal adornment, toilet
    articles, medicinal supplies, food, souvenirs, games, and similar personal
    effects, and their containers.

    (2)  Household effects.  Usual and reasonable kinds and quantities for
    personal use of furniture, household effects, household furnishings, and
    their containers.

    (3)  Vehicles.  Usual and reasonable kinds and quantities of vehicles, such
    as passenger cars, station wagons, trucks, trailers, motorcycles, bicycles,
    tricycles, perambulators, and their containers.

    (4)  Tools of trade.  Usual and reasonable kinds and quantities of tools,
    instruments, or equipment and their containers for use in the trade,
    occupation, employment, vocation, or hobby of the traveler or members of
    the household being moved.  For special provisions regarding encryption
    items subject to EI controls, see paragraph (f) of this section.

    (c)  Limits on eligibility.  The export of any commodity or software is
    limited or prohibited, if the kind or quantity is in excess of the limits
    described in this section. In addition, the commodities or software must
    be:

    (1)  Owned by the individuals (or by members of their immediate families)
    or by crew members of exporting carriers on the dates they depart from the
    United States;

    (2)  Intended for and necessary and appropriate for the use of the
    individuals or members of their immediate families traveling with them, or
    by the crew members of exporting carriers;

    (3)  Not intended for sale or other disposal; and

    (4)  Not exported under a bill of lading as cargo if exported by crew members.

    (d)   *     *     * No items controlled for EI reasons may be exported or
    reexported as unaccompanied baggage.

    *     *     *     *     *

    (f) Special provisions: encryption software subject to EI controls.  (1)
    Only a U.S. citizen or permanent resident as defined by 8 U.S.C.
    1101(a)(20) may export or reexport encryption items controlled for EI
    reasons under this License Exception.

    (2) The U.S. person or permanent resident must maintain effective control
    of the encryption items controlled for EI reasons.

    (3) The encryption items controlled for EI reasons may not be exported or
    reexported to Country Group E:2, Iran, Iraq, Sudan, or Syria.

    PART 742 - [AMENDED]

    18. Section 742.15 is amended:

    a.  By revising the phrase "by December 31, 1998" in paragraph (b)(2) to
    read "by December 31, 1997";

    b.  By revising the phrase "up to 56-bit key length DES" to read "up to or
    equal to 56-bit key length DES" in paragraph (b)(3) - title; paragraph
    (b)(3)(i) - 3 references; and paragraph (b)(3)(ii) - one reference;

    c.  By revising the title of paragraph (b)(3);

    d.  By revising the phrase "The use of License Exception KMI" in the
    seventh sentence of paragraph (b)(3)(i) to read "Authorization to use
    License Exception KMI";

    e.  By adding a new paragraphs (b)(3)(iii) and (iv); and

    f.  By revising paragraphs (b)(1) and (b)(4)(i) to read as follows:

    §742.15 Encryption items.

    	*     *     *     *     *

    (b) *     *     *

    (1)  Certain mass-market encryption software.  Consistent with E.O. 13026
    of November 15, 1996 (61 FR 58767), certain encryption software that was
    transferred from the U.S. Munitions List to the Commerce Control List
    pursuant to the Presidential Memorandum of November 15, 1996 may be
    released from EI controls and thereby made eligible for mass market
    treatment after a one-time review.  To determine eligibility for mass
    market treatment, exporters must submit a classification request to BXA.
    40-bit mass market encryption software using RC2 or RC4 may be eligible for
    a 7-day review process, and company proprietary software or 40-bit DES
    implementations may be eligible for 15-day processing.  Refer to Supplement
    No. 6 to part 742 and §748.3(b)(3) of the EAR for additional information.
    Note that the one-time review is for a determination to release encryption
    software in object code only unless otherwise specifically requested.
    Exporters requesting release of the source code should refer to paragraph
    (b)(3)(v)(E) of Supplement No. 6 to part 742.  If, after a one-time review,
    BXA determines that the software is released from EI controls, such
    software is eligible for all provisions of the EAR applicable to other
    software, such as License Exception TSU for mass-market software.   If BXA
    determines that the software is not released from EI controls, a license is
    required for export and reexport to all destinations, except Canada, and
    license applications will be considered on a case-by-case basis.

    (3)  Non-key recovery encryption items supported by a satisfactory business
    and marketing plan for exporting recoverable items and services.

    (i) *     *     *

    (ii) *     *     *

    (iii) General purpose Non-key recovery encryption items of  any key length
    for use by financial institutions.  Exports of general purpose non-key
    recovery, non-voice encryption items of  any key length will be permitted
    under an Encryption Licensing Arrangement for distribution to financial
    institutions (such as banks) in all destinations except Cuba, Iran, Iraq,
    Libya, North Korea, Syria and Sudan.  Applications will be reviewed on a
    case-by-case basis.  Only products accompanied by a satisfactory business
    and marketing plan will be allowed for export.  This plan shall be
    submitted by the manufacturer pursuant to Supplement No. 7 of this part,
    which explains in detail the steps the applicant will take during the two
    year transition period beginning January 1, 1997 to develop, produce,
    and/or market similar encryption items with recoverable features.

    (iv) Non-key recovery financial-specific encryption items of any key
    length.  After a one-time review via a classification request, non-key
    recovery financial-specific encryption items of any key length that are
    restricted by design (e.g. highly field-formatted and validation
    procedures, and not easily diverted to other end-uses) for financial
    applications will be permitted for export and reexport under License
    Exception KMI.  No business and marketing plan as referred to in paragraph
    (b)(3)(i) is required.

    (4)   All other encryption items.

    (i) Encryption licensing arrangement.  Applicants may submit license
    applications for exports and reexports of certain encryption commodities
    and software in unlimited quantities for all destinations except, Cuba,
    Iran, Iraq, Libya, North Korea, Syria, and Sudan.  Applications will be
    reviewed on a case-by-case basis.  If approved, encryption licensing
    arrangements may be valid for extended periods as requested by the
    applicant in block #24 on Form BXA-748P.  In addition, the applicant must
    specify the sales territory (and class(es) of end-user(s), if applicable).
    Such licenses may require the license holder to report to BXA certain
    information such as item description, quantity, value, and end-user name
    and address.

    	*     *     *     *     *

    19.  Part 742 is amended by revising Supplement Nos. 4, 5,  and 6 to read
    as follows:

    SUPPLEMENT NO. 4 TO PART 742 - KEY ESCROW OR KEY RECOVERY PRODUCTS CRITERIA

    Key  Recovery Feature

    (1)  The key(s) or other material/information required to decrypt
    ciphertext shall be accessible through a key recovery feature.

    (2) The product's cryptographic functions (greater than 40-bit DES
    strength) shall be inoperable until the key(s) or other
    material/information required to decrypt ciphertext is recoverable by
    government officials under proper legal authority and without the
    cooperation or knowledge of the user.

    (3) The output of the product shall automatically include, in an accessible
    format and with a frequency of at least once every three hours, the
    identity of the key recovery agent(s) and information sufficient for the
    key recovery agent(s) to identify the key(s) or other material/information
    required to decrypt the ciphertext.

    (4) The product's key recovery functions shall allow access to the key(s)
    or other material/information needed to decrypt the ciphertext regardless
    of whether the product generated or received the ciphertext.

    (5) The product's key recovery functions shall allow for the recovery of
    all required decryption key(s) or other material/information required to
    decrypt ciphertext during a period of authorized access without requiring
    repeated presentations of access authorization to the key recovery agent(s).

    Interoperability Feature

    (6) The product's cryptographic functions may:

    (i)  Interoperate with other key recovery products that meet these
    criteria, and shall not interoperate with products whose key recovery
    feature has been altered, bypassed, disabled, or otherwise rendered
    inoperative;

    (ii)  Send information to non-key recovery products only when assured
    access is permitted to the key(s) or other material/information needed to
    decrypt ciphertext generated by the key recovery product.  Otherwise, key
    length is restricted to less than or equal to 40-bits.

    (iii) Receive information from non-key recovery products with a key length
    restricted to less than or equal to 40 bits.

    Design, Implementation and Operational Assurance

    (7) The product shall be resistant to efforts to disable or circumvent the
    attributes described in criteria one through six.

    (8) The product's cryptographic function's key(s) or other
    material/information required to decrypt ciphertext shall be escrowed with
    a key recovery agent(s) (who may be a key recovery agent(s) internal to the
    user's organization) acceptable to BXA, pursuant to the criteria in
    Supplement No. 5 to Part 742.  Since the establishment of a key management
    infrastructure and key recovery agents may take some time, BXA will, while
    the infrastructure is being built, consider exports of key recovery
    encryption products which facilitate establishment of the key management
    infrastructure before a key recovery agent is named.  Exporters of products
    described in this Supplement No. 4 to part 742 are required to furnish the
    name of an agent no later than December 31, 1997.

    SUPPLEMENT NO. 5  TO PART 742 - KEY ESCROW OR KEY RECOVERY AGENT CRITERIA,
    SECURITY POLICIES, AND KEY ESCROW OR KEY RECOVERY PROCEDURES

    KEY ESCROW OR KEY RECOVERY AGENT REQUIREMENTS; SECURITY POLICIES; KEY
    ESCROW OR KEY RECOVERY PROCEDURES

    This Supplement sets forth criteria that the Department of Commerce will
    use to approve key recovery agents to support approval of  the export or
    reexport of key recovery encryption items controlled for EI reasons under
    ECCNs 5A002 and 5D002.   Any arrangements between the exporter or
    reexporter and the key recovery agent must reflect the provisions contained
    in this Supplement in a manner satisfactory to BXA.  This Supplement
    outlines the criteria for employing key recovery agent personnel for key
    recovery procedures.  An applicant for eligibility to export or reexport
    key recovery items shall provide, or cause the proposed key recovery agent
    to provide, to BXA sufficient information concerning any proposed key
    recovery agent arrangements to permit BXA's evaluation of the key recovery
    agent's security policies, key recovery procedures, and suitability and
    trustworthiness to maintain the confidentiality of the key(s) or other
    material/information required to decrypt ciphertext.  The key recovery
    agent, who must be approved by BXA, may be the applicant for the
    classification request.  When there is no key recovery agent involved, or
    the end-user will self-escrow abroad (see paragraph I.8. of this
    Supplement), with or without a legal obligation to the exporter, the
    end-user must be approved by BXA under the provisions of this Supplement.
    BXA retains the right, in addition to any other remedies, to revoke
    eligibility for License Exception KMI if BXA determines that a key recovery
    agent no longer meets these criteria.  The requirements related to the
    suitability and trustworthiness, security policies, and key recovery
    procedures of the key recovery agent shall be made terms and conditions of
    the License Exception for key recovery items.  BXA shall require the key
    recovery agent to provide a representation that it will comply with such
    terms and conditions.

    Note: Use of key recovery agents located outside the U.S. is permitted if
    acceptable to BXA in consultation with the host government, as appropriate.

    I. Key Recovery Agent Requirements

    (1)(a) A key recovery agent must identify by name, date and place of birth,
    and social security number (if overseas, other similar personal
    identification number), individual(s) who:

    (i)  Is/are directly involved in the escrowing of key(s) or other
    material/information required to decrypt ciphertext; or

    (ii)	Have access to key(s) or other material/information required to
    decrypt ciphertext, or

    (iii)	Have access to information concerning requests for key(s) or other
    material/information required to decrypt ciphertext; or

    (iv)	Respond to requests for key(s) or other material/information
    required to decrypt ciphertext; or

    (v)	Is/are in control of the key recovery agent and have access or
    authority to obtain key(s) or other material/information required to
    decrypt ciphertext, and

    (b)  Must certify that such individual(s) meet the requirements of the
    following paragraphs (b)(i) or (b)(ii).  BXA reserves the right to
    determine at any time the suitability and trustworthiness of such
    individual(s).  Evidence of an individual's suitability and trustworthiness
    shall include:

    (i)	Information indicating that the individual(s):

    (A)  Has no criminal convictions of any kind or pending criminal charges of
    any kind;
    (B)  Has not breached fiduciary responsibilities (e.g., has not violated
    any surety or performance bonds); and

    (C)  Has favorable results of a credit check; or,

    (ii)	Information that the individual(s) has an active U.S. government
    security clearance of Secret or higher issued or updated within the last
    five years.

    (2)	The key recovery agent shall timely disclose to BXA when an
    individual no longer meets the requirements of paragraphs I.(1)(b)(i) or
    (ii) of this Supplement.

    (3)	To remain eligible for License Exception KMI, a key recovery agent
    must identify to BXA by name, date and place of birth, and social security
    number (if overseas, other similar personal identification number) of any
    new individual(s) who will assume the responsibilities set forth in
    paragraph I.(1)(a) of this Supplement.  Before that individual(s) assumes
    such responsibilities, the key recovery agent must certify to BXA that the
    individual(s) meets the criteria set forth in subparagraphs I.(1)(b)(i) or
    (b)(ii) of this Supplement.  BXA reserves the right to determine at any
    time the suitability and trustworthiness of such personnel.

    (4)	If ownership or control of a key recovery agent is transferred, no
    export may take place under previously issued approvals until the successor
    key recovery agent complies with the criteria of this Supplement.

    (5)	Key recovery agents shall submit suitable evidence of the key
    recovery agent's corporate viability and financial responsibility (e.g., a
    certificate of good standing from the state of incorporation, credit
    reports, and errors/omissions insurance).

    (6)	Key recovery agents shall disclose to BXA any of the following
    which have occurred within the ten years prior to the application:

    (a)	Federal or state felony convictions of the business;
    (b)	Material adverse civil fraud judgments or settlements; and
    (c)	Debarments from federal, state, or local government contracting.

    The applicant shall also timely disclose to BXA the occurrence of any of
    the foregoing during the use of  License Exception KMI.

    (7)	Key recovery agent(s) shall designate an individual(s) to be the
    security and operations officer(s).

    (8) Self-Escrow by organizations.  A key recovery agent may be internal to
    a user's organization and may consist of one or more individuals.  BXA may
    approve such key recovery agents if  sufficient information is provided to
    demonstrate that appropriate safeguards will be employed in handling key
    recovery requests from government entities.  These safeguards should ensure
    the key recovery agent's structural independence from the rest of the
    organization; security; and confidentiality.

    II. Security Policies

    (1)	Key recovery agents must implement security policies that assure
    the confidentiality, integrity, and availability of the key(s) or other
    material/information required for decryption of the ciphertext.

    (a)	Procedures to assure confidentiality shall include:

    (i)	Encrypting all key(s) or other material/information required to
    decrypt ciphertext while in storage, transmission, or transfer; or

    (ii)	Applying reasonable measures to limit access to the database (e.g.
    using keyed or combination locks on the entrances to escrow facilities and
    limiting the personnel with knowledge of or access to the
    keys/combinations).

    (b)	Procedures to assure the integrity of the database (i.e. assuring
    the key(s) and other material/information required to decrypt ciphertext
    are protected against unauthorized changes) shall include the use of access
    controls such as database password controls, digital signatures, system
    auditing, and physical access restrictions.

    (c)	Procedures to assure the availability of the database (i.e.
    assuring that key(s) and other material/information required to decrypt
    ciphertext are retrievable at any time) shall include system redundance,
    physical security, and the use of cryptography to control access.

    (2)	Policies and procedures shall be designed and operated so that a
    failure by a single person, procedure, or mechanism does not compromise the
    confidentiality, integrity and availability of key(s)or other
    material/information required to decrypt ciphertext.  Security policies and
    procedures may include, but are not limited to, multi-person control of
    access to recoverable keys, split keys, and back-up capabilities.

    (3)	Key recovery agents shall implement policies that protect against
    unauthorized disclosure of information regarding whose encryption material
    is stored, the fact that key(s) or other material/information required to
    decrypt ciphertext was requested or provided, and the identity of a
    requester.  Procedures to assure the confidentiality of this information
    shall include those described in paragraph II.(1)(a) of this supplement.

    (4)	Key recovery agents shall provide to BXA prompt notice of a
    compromise of a security policy or of the confidentiality of key(s) or
    other material/information required to decrypt ciphertext.

    (5) Key recovery agents shall keep auditable records of legal access requests.

    III. Key Recovery Procedures

    (1)	Key recovery agents shall maintain the ability to make the key(s)
    or other material/information required to decrypt ciphertext available
    until notified otherwise by BXA.  Key recovery agents shall make requested
    key(s) or other material/information required to decrypt ciphertext
    available, to the extent required by the request, within two hours from the
    time they receive a request from a government agency acting under
    appropriate legal authority.

    (2)	Key recovery agents shall maintain data regarding key recovery
    requests received, release of key(s) or other material/information required
    to decrypt ciphertext, database changes, system administration access, and
    dates of such events for purposes of audits by BXA.

    (3)	 The key recovery agent must transfer all key recovery equipment,
    key(s) and/or other material/information required to decrypt ciphertext,
    key recovery database, and all administrative information necessary to its
    key recovery operations to another key recovery agent approved by BXA in
    the event that:

    (a) The key recovery agent dissolves or otherwise terminates escrowing
    operations, or

    (b)  BXA determines that there is a risk of such dissolution or termination, or

    (c)  BXA determines that the key recovery agent is no longer suitable or
    trustworthy.

    SUPPLEMENT NO. 6 TO PART 742 - GUIDELINES FOR SUBMITTING A CLASSIFICATION
    REQUEST FOR A MASS MARKET SOFTWARE PRODUCT THAT CONTAINS ENCRYPTION

    Classification requests for release of certain mass market encryption
    software from EI controls must be submitted on Form BXA-748P, in accordance
    with §748.3 of the EAR.  To expedite review of the request, clearly mark
    the envelope "Attn.: Mass Market Encryption Software Classification
    Request".  In Block 9: Special Purpose of the Form BXA-748P, you must
    insert the phrase "Mass Market Encryption Software.  Failure to insert this
    phrase will delay processing.  In addition, the Bureau of Export
    Administration recommends that such requests be delivered via courier
    service to:

    Bureau of Export Administration
    Office of Exporter Services
    Room 2705
    14th Street and Pennsylvania Ave., N.W.
    Washington, D.C.  20230

    (a)  Requests for mass market encryption software that meet the criteria in
    paragraph  (a)(2) of this Supplement will be processed in seven (7) working
    days from receipt of a properly completed request.  Those requests for mass
    market encryption software that meet the criteria of paragraph (a)(1) of
    this Supplement only will be processed in fifteen (15) working days from
    receipt of a properly completed request.  When additional information is
    requested, the request will be processed within 15 working days of the
    receipt of the requested information.

    (1)   A mass market software product that meets all the criteria
    established in this paragraph will be processed in fifteen (15) working
    days from receipt of the properly completed request:

    (i)  The commodity must be mass market software.  Mass market software is
    computer software that is available to the public via sales from stock at
    retail selling points by means of over-the-counter transactions, mail order
    transactions, or telephone call transactions;

    (ii)  The software must be designed for installation by the user without
    further substantial support by the supplier.  Substantial support does not
    include telephone (voice only) help line services for installation or basic
    operation, or basic operation training provided by the supplier; and

    (iii)    The software includes encryption for data confidentiality.

    (2)  A mass market software product that meets all the criteria established
    in this paragraph will be processed in seven working days from receipt of
    the properly completed request:

    (i)  The software meets all the criteria established in paragraph (a)(1)(i)
    through (iii) of this supplement;

    (ii)  The data encryption algorithm must be RC4 or RC2 with a key space no
    longer than 40 bits.  The RC4 and RC2 algorithms are proprietary to RSA
    Data Security, Inc.  To ensure that the subject software is properly
    licensed and correctly implemented, contact RSA Data Security,
    (415)595-8782;

    (iii)   If any combination of RC4 or RC2 are used in the same software,
    their functionality must be separate.  That is, no data can be operated
    sequentially on by both routines or multiply by either routine;

    (iv) The software must not allow the alteration of the data encryption
    mechanism and its associated key spaces by the user or any other program;

    (v)   The key exchange used in data encryption must be:

    (A) A public key algorithm with a key space less than or equal to a 512 bit
    modulus and/or;

    (B) A symmetrical algorithm with a key space less than or equal to 64 bits;
    and

    (vi)  The software must not allow the alteration of the key management
    mechanism and its associated key space by the user or any other program.

    (b) To submit a classification request for a product that is eligible for
    the seven day handling, you must provide the following information in a
    cover letter to the classification request.  Send the original to the
    Bureau of Export Administration.  Send a copy of the application and all
    supporting documentation by Express Mail to:

    Attn.: Mass Market Encryption Request Coordinator
    P.O. Box 246
    Annapolis Junction, MD 20701-0246

    (1) Clearly state at the top of the page "Mass Market Encryption Software -
    7 Day Expedited Review Requested";

    (2) State that you have reviewed and determined that the software subject
    to the classification request meets the criteria of paragraph (a)(2) of
    this Supplement;

    (3) State the name of the single software product being submitted for
    review.  A separate classification request is required for each product;

    (4) State how the software has been written to preclude user modification
    of the encryption algorithm, key management mechanism, and key space;

    (5) Provide a copy of the encryption subsystem source code;

    (6) Provide the following information for the software product:

    (A) Whether the software uses the RC2 or RC4 algorithm and how the
    algorithm(s) is used.  If any combination of these algorithms are used in
    the same product, also state how the functionality of each is separated to
    assure that no data is operated by more than one algorithm;

    (B) Pre-processing information of plain text data before encryption (e.g.
    the addition of clear text header information or compression of the data);

    (C) Post-processing information of cipher text data after encryption (e.g.
    the addition of clear text header information or packetization of the
    encrypted data);

    (D) Whether a public key algorithm or a symmetric key algorithm is used to
    encrypt keys and the applicable key space;

    (E) For classification requests regarding source code:

    (1) Reference the applicable executable product that has already received a
    one-time review;

    (2) Include whether the source code has been modified by deleting the
    encryption algorithm, its associated key management routine(s), and all
    calls to the algorithm from the source code, or by providing the encryption
    algorithm and associated key management routine(s) in object code with all
    calls to the algorithm hidden.  You must provide the technical details on
    how you have modified the source code;

    (3) Include a copy of the sections of the source code that contain the
    encryption algorithm, key management routines, and their related calls; and

    (F) Provide any additional information which you believe would assist in
    the review process.

    (c)   Instructions for the preparation and submission of a classification
    request that is eligible for 15 day handling are as follows:

      	(1)  If the software product meets only the criteria in paragraph
    (a)(1) of this supplement, you must prepare a classification request.  Send
    the original to the Bureau of Export Administration.  Send a copy of the
    application and all supporting documentation by Express Mail to:

    Attn.: Mass Market Encryption Request Coordinator
    P.O. Box 246
    Annapolis Junction, MD 20701-0246

    (2) You must provide the following information in a cover letter to the
    classification request:

    (i) Clearly state at the top of the page "Mass Market Software and
    Encryption - 15 Day Expedited Review Requested";

    (ii) State that you have reviewed and determined that the software subject
    of the classification request, meets the criteria of paragraph (a)(1) of
    this Supplement;

    (iii) State the name of the single software product being submitted for
    review.  A separate classification request is required for each product;
    (iv) State that a duplicate copy, in accordance with paragraph (c)(1) of
    this Supplement, has been sent to the 15 day Encryption Request
    Coordinator; and

    (v) Ensure that the information provided includes brochures or other
    documentation or specifications relating to the software, as well as any
    additional information which you believe would assist in the review process.

    (3) Contact the Bureau of Export Administration on (202) 482-0092  prior to
    submission of the classification  to facilitate the submission of proper
    documentation.

    PART 748 -[ AMENDED]

    20.  Section 748.9 is amended by revising paragraph (a)(7) and by adding
    new paragraph (a)(8) to read as follows:

    §748.9 Support documents for license applications.

    (a) *     *     *

    (7) The license application is submitted to export or reexport software or
    technology.

    (8)   The license application is submitted to export or reexport encryption
    items controlled under ECCNs 5A002, 5B002, 5D002 and 5E002.

    21.  Section 748.10 is amended by revising paragraph (b)(1) to read as follows:

    §748.10 Import and End-User Certificates

    	*     *     *     *     *

    (b) *     *     *

    (1) Any commodities on your license application are controlled for national
    security (NS) reasons, except for items controlled under ECCN 5A002 or
    5B002;

    	*     *     *     *     *

    PART 750 - [AMENDED]

    22.  Section 750.3 is amended by amending paragraph (b)(2)(i) to read as
    follows:

    §750.3 Review of license applications by BXA and other government agencies
    and departments.

    	*     *     *     *     *

    (b) *     *     *

    (2) *     *     *

    (i) The Department of Defense is concerned primarily with items controlled
    for national security and regional stability reasons and with controls
    related to encryption items;

    	*     *     *     *     *

    23.  Section 750.7 is amended:

    a.  By redesignating paragraphs (c)(1) through (5) as (c)(1)(i) through (v);

    b.  By redesignating paragraphs (c)(6)(i) through (v) as (c)(1)(vi)(A)
    through (E);

    c.  By redesignating paragraphs (c)(7) and (8) as (c)(7)(vii) and (viii); and

    d.  By adding a new paragraph (c)(2) to read as follows:

    §750.7 Issuance of licenses.

    	*     *     *     *     *

    (c) *     *     *

    (2)  Changes to encryption licensing arrangements.  (i)  For  encryption
    licensing arrangements issued by BXA for exports and reexports of items
    controlled under ECCN 5A002, 5B002, 5D002 and 5E002, and for encryption
    items previously on the U.S. munitions List and currently authorized for
    export or reexport under a State Department license, distribution
    arrangement or any other authority of the State Department, the following
    changes may be requested by letter to BXA:

    (A) Additional sales territory or country of destination; and

    (B) Additional quantity.

    (ii) Letters requesting changes pursuant to paragraph (c)(2)(i) of this
    section should be made by the license holder on company letterhead, clearly
    identifying the original license number and the requested change.  In
    addition, requests for changes to State licenses or other authorizations
    must be accompanied by a copy of the original State license or
    authorization.  Send requests for changes to the following address:

    Office of Strategic Trade
    Bureau of Export Administration
    U.S. Department of Commerce
    Room 2705
    14th Street and Pennsylvania Ave., N.W.
    Washington, DC 20230

    (C) Additional products.

    PART 752 - [AMENDED]

    24.  Section 752.3 is amended by redesignating paragraphs (a)(5) through
    (a)(10) as (a)(6) through (a)(11) and adding a new paragraph (a)(5) to read
    as follows:

    §752.3 Eligible items.

    (a) *     *     *

    (5) Items controlled for EI reasons on the CCL;

    	*     *     *     *     *

    PART 758 - [AMENDED]

    25.  Section 758.1 is amended by adding a new paragraph (e)(1)(i)(D) to
    read as follows:

    §758.1 Export Clearance Requirements.

    	*     *     *     *     *
    (e) *     *     *

    (1) *     *     *

    (ii) *     *     *

    (D) Exports of tools of trade under License Exception TMP or BAG.

    PART 770 -[AMENDED]

    26.  Section 770.2 is amended by revising the section title and adding a
    new paragraph (l) to read as follows:

    §770.2 Item interpretations.

    	*     *     *     *     *

    (l)  Interpretation 12: Encryption software controlled for EI reasons.
    Encryption software controlled for EI reasons under ECCN 5D002 may be
    pre-loaded on a laptop and exported under the tools of trade provision of
    License Exception TMP or License Exception BAG, subject to the terms and
    conditions of such License Exceptions.  This provision replaces the
    personal use exemption of the International Traffic and Arms Regulations
    that existed for such software prior to December 30, 1996.  Neither License
    Exception TMP nor License Exception BAG contains a reporting requirement.

    PART 772 - [AMENDED]

    27.   Part 772 is amended by adding, in alphabetical order, new definitions
    "Banks and Financial Institutions", "Effective control", "Encryption
    licensing arrangement", and "Recovery encryption products" to read as
    follows:

    Banks and Financial Institutions. For purposes of this part, "banks and
    financial institutions" means:

    a) a bank or savings association, as defined in section 3 of the Federal
    Deposit Insurance Act (12 U.S.C. 1813 (a) or (b));  a credit union, as
    defined in section 101 of the Federal Credit Union Act (12 U.S.C. 1752);

    b) a subsidiary, holding company, branch located outside the United States,
    of the entities described in paragraph (a);

    c) a bank service company as defined in section 1 of the Bank Service
    Company Act (12 U.S.C. 1861); or a service corporation under section 5 of
    the Home Owners' Loan Act (12 U.S.C. 1464(c)(4)(B));  a corporation charted
    under section 25A of the Federal Reserve Act (12 U.S.C. 611), including any
    branch thereof; or a corporation having an agreement or undertaking with
    the Board of Governors of the Federal Reserve System under section 25 of
    the Federal Reserve Act (12 U.S.C. 611), including any branch or subsidiary
    thereof;

    d) a company organized under the laws of a foreign country which engages in
    the business of banking, including, without limitation, foreign commercial
    banks, foreign merchant banks and other foreign institutions that engage in
    banking activities usual in connection with the business of banking in the
    countries where such foreign institutions are organized or operating,
    including any branch or subsidiary thereof;

    e) a interbank clearing system that is, or whose members are subject to
    state or national regulation or supervision;

    f) a broker or dealer in securities registered with the Securities and
    Exchange Commission; a foreign broker or dealer in securities subject to
    governmental supervision or regulation by a foreign securities authority;
    an investment company,  registered with the Securities and Exchange
    Commission; an investment adviser, as defined in § 2(20) of the Investment
    Company Act of 1940 (15 U.S.C. 80a-2), that is registered with the
    Securities and Exchange Commission and is engaged solely in the business of
    advising one or more investment companies; a foreign investment company; or
    a securities, commodity, futures, or option exchange or other financial
    market that is subject to governmental supervision or regulation;

    g) an issuer of a general purpose charge, credit or debit card; or

    h) a company engaged in the electronic transmission of money, credit or
    financial instruments between a financial institution (as defined in this
    section) and a customer or other financial institutions.

    	*     *     *     *     *

    Effective control.  You maintain effective control over an item when you
    either retain physical possession of the item, or secure the item in such
    an environment as a hotel safe, a bonded warehouse, or a locked or guarded
    exhibition facility.  Retention of effective control over an item is a
    condition of certain temporary exports and reexports.

    Encryption licensing arrangement.  A license that allows the export of
    specified products to specified destinations in unlimited quantities.  In
    certain cases, exports are limited to specified end-users for specified
    end-uses.  Generally, reporting of all sales of the specified products is
    required at six month intervals.  This includes sales made under
    distribution arrangements and distribution and warehousing agreements that
    were previously issued by the Department of State for encryption items.

    	*     *     *     *     *

    Recovery encryption products.  Encryption products (including software)
    that allow government officials to obtain under proper legal authority and
    without the cooperation or knowledge of the user, the plaintext of
    encrypted data and communications.

    	*     *     *     *     *

    PART 774 - [AMENDED]

    28.   In Supplement No. 1 to part 774, Category 5 - Telecommunications and
    Information Security is amended by revising ECCNs 5A002 and 5D002 to read
    as follows:

    5A002  Systems, equipment, application specific "assemblies", modules or
    integrated circuits for "information security", and specially designed
    components therefor.

    License Requirements

    Reason for Control:   NS, AT, EI

    Control(s)					Country Chart

    NS applies to entire entry 		NS Column 1

    AT applies to entire entry 		AT Column 1

    EI applies to encryption items transferred from the U.S. Munitions List to
    the Commerce Control List consistent with E.O. 13026 of November 15, 1996
    (61 FR 58767) and pursuant to the Presidential Memorandum of that date.
    Refer to §742.15 of this subchapter.

    License Requirement Notes:  See §743.1 of the EAR for reporting
    requirements for exports of commodities controlled under 5A002 and exported
    under License Exceptions  LVS, or GOV.

    License Exceptions

    LVS:	Yes: $500 for components and spare parts only.  N/A for equipment.

    GBS:	N/A
    CIV:	N/A

    List of Items Controlled

    Unit: $ value
    Related Controls:  For the control of global navigation satellite systems
    receiving equipment containing or employing decryption (i.e., GPS or
    GLONASS see 7A005).  This entry does not control: a.)  "Personalized smart
    cards" or specially designed components therefor, with any of the following
    characteristics: 1.)  Not capable of message traffic encryption or
    encryption of user-supplied data or related key management functions
    therefor; or 2.)  When restricted for use in equipment or systems excluded
    from control under the note to 5A002.c, or under paragraphs b through h of
    this note. b.) Equipment containing "fixed" data compression or coding
    techniques; c.)  Receiving equipment for radio broadcast, pay television or
    similar restricted audience television of the consumer type, without
    digital encryption and where digital decryption is limited to the video,
    audio or management functions; d.)  Portable or mobile radiotelephones for
    civil use (e.g., for use with commercial civil cellular radiocommunications
    systems) that are not capable of end-to-end encryption; e.)  Decryption
    functions specially designed to allow the execution of copy-protected
    "software", provided the decryption functions are not user-accessible; f.)
    Access control equipment, such as automatic teller machines, self-service
    statement printers or point of sale terminals, that protect password or
    personal identification numbers (PIN) or similar data to prevent
    unauthorized access to facilities but do not allow for encryption of files
    or text, except as directly related to the password or PIN protection; g.)
    Data authentication equipment that calculates a Message Authentication Code
    (MAC) or similar result to ensure no alteration of text has taken place, or
    to authenticate users, but does not allow for encryption of data, text or
    other media other than that needed for the authentication; h.)
    Cryptographic equipment specially designed, developed or modified for use
    in machines for banking or money transactions, as restricted to use only in
    such transactions.  Machines for banking and money transactions include
    automatic teller machines, self-service statement printers, point of sale
    terminals or equipment for the encryption of interbanking transactions.
    Related Definitions: N/A
    Items:

    a.  Designed or modified to use "cryptography" employing digital techniques
    to ensure "information security";

    b.  Designed or modified to perform cryptoanalytic functions;

    c.  Designed or modified to use "cryptography" employing analog techniques
    to ensure "information security";

    Note:  5A002.c does not control the following:

    1.  Equipment using "fixed" band scrambling not exceeding 8 bands and in
    which the transpositions change not more frequently than once every second;

    2.  Equipment using "fixed" band scrambling exceeding 8 bands and in which
    the transpositions change not more frequently than once every ten seconds;

    3.  Equipment using "fixed" frequency inversion and in which the
    transpositions change not more frequently than once every second;

    4.  Facsimile equipment;

    5.  Restricted audience broadcast equipment; and

    6.  Civil television equipment;

    d.  Designed or modified to suppress the compromising emanations of
    informationbearing signals;

    Note:  5A002.d does not control equipment specially designed to suppress
    emanations for reasons of health and safety.

    e.  Designed or modified to use cryptographic techniques to generate the
    spreading code for "spread spectrum" or hopping code for "frequency
    agility" systems;

    f.  Designed or modified to provide certified or certifiable "multilevel
    security" or user isolation at a level exceeding Class B2 of the Trusted
    Computer System Evaluation Criteria (TCSEC) or equivalent;

    g.  Communications cable systems designed or modified using mechanical,
    electrical or electronic means to detect surreptitious intrusion.

    	*     *     *     *     *

    5D002  Information Security - "Software".

    License Requirements

    Reason for Control:   NS, AT, EI

    Control(s)					Country Chart

    NS applies to entire entry 		NS Column 1

    AT applies to entire entry 		AT Column 1

    EI applies to encryption items transferred from the U.S. Munitions List to
    the Commerce Control List consistent with E.O. 13026 of November 15, 1996
    (61 FR 58767) and pursuant to the Presidential Memorandum of that date.
    Refer to §742.15 of the EAR.

    Note:  Encryption software is controlled because of its functional
    capacity, and not because of any informational value of such software; such
    software is not accorded the same treatment under the EAR as other
    "software"; and for the export licensing purposes encryption software is
    treated under the EAR in the same manner as a commodity included in ECCN
    5A002.  License Exceptions for commodities are not applicable.

    Note:  Encryption software controlled for EI reasons under this entry
    remains subject to the EAR even when made publicly available in accordance
    with part 734 of the EAR, and it is not eligible for the General Software
    Note ("mass market" treatment under License Exception TSU for mass market
    software).  After a one-time BXA review, certain encryption software may be
    released from EI controls and made eligible for the General Software Note
    treatment as well as other provisions of the EAR applicable to software.
    Refer to §742.15(b)(1) of the EAR, and Supplement No. 6 to part 742 of the
    EAR.

    License Requirement Notes:  See §743.1 of the EAR for reporting
    requirements for exports of software controlled under 5D002 and exported
    under License Exceptions  TSU or GOV.

    License Exceptions

    CIV:	N/A
    TSR:	N/A

    List of Items Controlled

    Unit: $ value
    Related Controls:  5D002.a controls "software" designed or modified to use
    "cryptography" employing digital or analog techniques to ensure
    "information security".
    Related Definitions: N/A
    Items:

    a.  "Software" specially designed or modified for the
    "development", "production" or "use" of equipment or "software" controlled
    by 5A002, 5B002 or 5D002.

    b.  "Software" specially designed or modified to support
    "technology" controlled by 5E002.

    c.	Specific "software" as follows:

    c.1.  "Software" having the characteristics, or performing or simulating
    the functions of the equipment controlled by 5A002 or 5B002;

    c.2.  "Software" to certify "software" controlled by 5D002.c.1.

    Note:  5D002 does not control:

    a.  "Software" "required" for the "use" of equipment excluded from control
    under the Note to 5A002;

    b.  "Software" providing any of the functions of equipment excluded from
    control under the Note to 5A002.

    Dated:

    Iain S. Baird
    Acting Assistant Secretary for
    Export Administration