16 January 1998
Source: "Implementation of the Wassenaar Arrangement List of Dual-Use Items: Revisions to the Commerce Control List and Reporting Under the Wassenaar Arrangement; Rule."

    Supplement No. 1 to Part 774--the Commerce Control List

    Category 5--``Information Security'', Part II

    Part 2--``Information Security''

        Note: The control status of ``information security'' equipment,
    ``software'', systems, application specific ``electronic
    assemblies'', modules, integrated circuits, components, or functions
    is determined in Category 5, Part 2 even if they are components or
    ``electronic assemblies'' of other equipment.

    A. Systems, Equipment and Components

    5A002   Systems, equipment, application specific ``assemblies'',
    modules or integrated circuits for ``information security'', and
    specially designed components therefor.

    License Requirements

    Reason for Control: NS, AT, EI

                   Control(s)                         Country Chart

    NS applies to entire entry.............  NS Column 1
    AT applies to entire entry.............  AT Column 1

        EI applies to encryption items transferred from the U.S.
    Munitions List to the Commerce Control List consistent with E.O.
    13026 of November 15, 1996 (61 FR 58767) and pursuant to the
    Presidential Memorandum of that date. Refer to Sec. 742.15 of the
    EAR.

        License Requirement Notes: See Sec. 743.1 of the EAR for
    reporting requirements for exports under License Exceptions.
    License Exceptions

    LVS: N/A
    GBS: N/A
    CIV: N/A

    List of Items Controlled

    Unit: $ value
    Related Controls: See also 5A992. This entry does not control: (a)
    ``Personalized smart cards'' or specially designed components
    therefor, with any of the following characteristics: (1) Not capable
    of message traffic encryption or encryption of user-supplied data or
    related key management functions therefor; or (2) When restricted
    for use in equipment or systems excluded from control under the note
    to 5A002.c, or under paragraphs b through h of this note. (b)
    Equipment containing ``fixed'' data compression or coding
    techniques; (c) Receiving equipment for radio broadcast, pay
    television or similar restricted audience television of the consumer
    type, without digital encryption and where digital decryption is
    limited to the video, audio or management functions; (d) Portable or
    mobile radiotelephones for civil use (e.g., for use with commercial
    civil cellular radiocommunications systems) that are not capable of
    end-to-end encryption; (e) Decryption functions specially designed
    to allow the execution of copy-protected ``software'', provided the
    decryption functions are not user-accessible; (f) Access control
    equipment, such as automatic teller machines, self-service statement
    printers or point of sale terminals, that protects password or
    personal identification numbers (PIN) or similar data to prevent
    unauthorized access to facilities but does not allow for encryption
    of files or text, except as directly related to the password or PIN
    protection; (g) Data authentication equipment that calculates a
    Message Authentication Code (MAC) or similar result to ensure no
    alteration of text has taken place, or to authenticate users, but
    does not allow for encryption of data, text or other media other
    than that needed for the authentication; (h) Cryptographic equipment
    specially designed and limited for use in machines for banking or
    money transactions, such as automatic teller machines, self-service
    statement printers or point of sale terminals.
    Related Definitions: For the control of global navigation satellite
    systems receiving equipment containing or employing decryption
    (i.e., GPS or GLONASS see 7A005)
    Items: a. Systems, equipment, application specific ``assemblies'',
    modules or integrated circuits for ``information security'', and
    specially designed components therefor:
        a.1. Designed or modified to use ``cryptography'' employing
    digital techniques to ensure ``information security'';
        a.2. Designed or modified to perform cryptoanalytic functions;
        a.3. Designed or modified to use ``cryptography'' employing
    analog techniques to ensure ``information security'';

        Note: 5A002.a.3 does not control the following:

        1. Equipment using ``fixed'' band scrambling not exceeding 8
    bands and in which the transpositions change not more frequently
    than once every second;
        2. Equipment using ``fixed'' band scrambling exceeding 8 bands
    and in which the transpositions change not more frequently than once
    every ten seconds;

    [[Page 2523]]

        3. Equipment using ``fixed'' frequency inversion and in which
    the transpositions change not more frequently than once every
    second;
        4. Facsimile equipment;
        5. Restricted audience broadcast equipment; and
        6. Civil television equipment;
        a.4. Designed or modified to suppress the compromising
    emanations of information-bearing signals;

        Note: 5A002.a.4 does not control equipment specially designed to
    suppress emanations for reasons of health and safety.

        a.5. Designed or modified to use cryptographic techniques to
    generate the spreading code for ``spread spectrum'' or the hopping
    code for ``frequency agility'' systems;
        a.6. Designed or modified to provide certified or certifiable
    ``multilevel security'' or user isolation at a level exceeding Class
    B2 of the Trusted Computer System Evaluation Criteria (TCSEC) or
    equivalent;
        a.7. Communications cable systems designed or modified using
    mechanical, electrical or electronic means to detect surreptitious
    intrusion.

    5A992  ``Information security'' equipment, n.e.s.; (e.g.,
    cryptographic, cryptoanalytic, and cryptologic equipment, n.e.s.), and
    components therefor.

    License Requirements

    Reason for Control: AT

                   Control(s)                         Country Chart

    AT applies to entire entry.............  AT Column 1

    License Exceptions

    LVS: N/A
    GBS: N/A
    CIV: N/A

    List of Items Controlled

    Unit: $ value
    Related Controls: N/A
    Related Definitions: N/A
    Items: The list of items controlled is contained in the ECCN
    heading.

    B. Test, Inspection and Production Equipment

    5B002   Information Security--test, inspection and ``production''
    equipment.

    License Requirements

    Reason for Control: NS, AT

                   Control(s)                         Country Chart

    NS applies to entire entry.............  NS Column 1
    AT applies to entire entry.............  AT Column 1

        License Requirement Notes: See Sec. 743.1 of the EAR for
    reporting requirements for exports under License Exceptions.

    License Exceptions

    LVS: N/A
    GBS: N/A
    CIV: N/A

    List of Items Controlled

    Unit: $ value
    Related Controls: N/A
    Related Definitions: N/A
    Items: a. Equipment specially designed for:
        a.1. The ``development'' of equipment or functions controlled by
    5A002, 5B002, 5D002 or 5E002, including measuring or test equipment;
        a.2. The ``production'' of equipment or functions controlled by
    5A002, 5B002, 5D002, or 5E002, including measuring, test, repair or
    production equipment;
        b. Measuring equipment specially designed to evaluate and
    validate the ``information security'' functions controlled by 5A002
    or 5D002.

    C. Materials [Reserved]

    D. Software

    5D002   Information Security--``Software''.

    License Requirements

    Reason for Control: NS, AT, EI

                   Control(s)                         Country Chart

    NS applies to entire entry.............  NS Column 1
    AT applies to entire entry.............  AT Column 1

        EI applies to encryption items transferred from the U.S.
    Munitions List to the Commerce Control List consistent with E.O.
    13026 of November 15, 1996 (61 FR 58767) and pursuant to the
    Presidential Memorandum of that date. Refer to Sec. 742.15 of the
    EAR.

        Note: Encryption software is controlled because of its
    functional capacity, and not because of any informational value of
    such software; such software is not accorded the same treatment
    under the EAR as other ``software''; and for the export licensing
    purposes encryption software is treated under the EAR in the same
    manner as a commodity included in ECCN 5A002. License Exceptions for
    commodities are not applicable.

        Note: Encryption software controlled for EI reasons under this
    entry remains subject to the EAR even when made publicly available
    in accordance with part 734 of the EAR, and it is not eligible for
    the General Software Note (``mass market'' treatment under License
    Exception TSU for mass market software). After a one-time BXA
    review, certain encryption software may be released from EI controls
    and made eligible for the General Software Note treatment as well as
    other provisions of the EAR applicable to software. Refer to
    Sec. 742.15(b)(1) of the EAR and Supplement No. 6 to part 742 of the
    EAR.

        License Requirement Notes: See Sec. 743.1 of the EAR for
    reporting requirements for exports under License Exceptions.

        License Exceptions

    CIV: N/A
    TSR: N/A

    List of Items Controlled

    Unit: $ value
    Related Controls: See also 5D992. This entry does not control
    ``software'' ``required'' for the ``use'' of equipment excluded from
    control under 5A002 or ``software'' providing any of the functions
    of equipment excluded from control under 5A002
    Related Definitions: N/A
    Items: a. ``Software'' specially designed or modified for the
    ``development'', ``production'' or ``use'' of equipment or
    ``software'' controlled by 5A002, 5B002 or 5D002.
        b. ``Software'' specially designed or modified to support
    ``technology'' controlled by 5E002.
        c. Specific ``software'' as follows:
        c.1. ``Software'' having the characteristics, or performing or
    simulating the functions of the equipment controlled by 5A002 or
    5B002;
        c.2. ``Software'' to certify ``software'' controlled by
    5D002.c.1.

    5D992  ``Software'' not controlled by 5D002.

    License Requirements

    Reason for Control: AT

                   Control(s)                         Country Chart

    AT applies to 5D992.a and .b...........  AT Column 1
    AT applies to 5D992.c..................  AT Column 2

    License Exceptions

    CIV: N/A
    TSR: N/A

    List of Items Controlled

    Unit: $ value
    Related Controls: N/A
    Related Definitions: N/A
    Items: a. ``Software'', specially designed or modified for the
    ``development'', ``production'', or ``use'' of information security
    or cryptologic equipment (e.g., equipment controlled by 5A992)
        b. ``Software'' having the characteristics, or performing or
    simulating the functions of the equipment controlled by 5A992.
        c. ``Software'' designed or modified to protect against
    malicious computer damage, e.g., viruses.

    E. Technology

    5E002  ``Technology'' according to the General Technology Note for the
    ``development'', ``production'' or ``use'' of equipment controlled by
    5A002 or 5B002 or ``software'' controlled by 5D002.

    License Requirements

    Reason for Control: NS, AT, EI

                   Control(s)                         Country Chart

    NS applies to entire entry.............  NS Column 1
    AT applies to entire entry.............  AT Column 1

        EI applies to encryption items transferred from the U.S.
    Munitions List to the Commerce Control List consistent with E.O.
    13026 of November 15, 1996 (61 FR 58767) and pursuant to the
    Presidential Memorandum of that date.

    Refer to Sec. 742.15 of the EAR

        License Requirement Notes: See Sec. 743.1 of the EAR for
    reporting requirements for exports under License Exceptions
    License Exceptions

    CIV: N/A
    TSR: N/A

    List of Items Controlled

    Unit: N/A
    Related Controls: See also 5E992

    [[Page 2524]]

    Related Definitions: N/A
    Items: The list of items controlled is contained in the ECCN
    heading.

    5E992  ``Technology'', n.e.s., for the ``development'', ``production'',
    or ``use'' of ``information security'' or cryptologic equipment (e.g.,
    equipment controlled by 5A992), or ``software'' controlled by 5D992.

    License Requirements

    Reason for Control: AT

                   Control(s)                         Country Chart

    AT applies to entire entry.............  AT Column 1

    License Exceptions

    CIV: N/A
    TSR: N/A

    List of Items Controlled

    Unit: N/A
    Related Controls: N/A
    Related Definitions: N/A
    Items: The list of items controlled is contained in the ECCN
    heading.

    EAR99  Items subject to the EAR that are not elsewhere specified in
    this CCL Category or in any other category in the CCL are designated by
    the number EAR99.