Commerce Reduces Requirements Relating to Mass-Market Encryption Items and Publicly Available Software
The U.S. Department of Commerce’s Bureau of Industry and Security ("BIS") recently revised the Export Administration Regulations ("EAR") to, among other things, modify reporting and self-classification requirements for certain encryption commodities, software, and technologies.
On March 29, 2021, BIS issued a final rule modifying the EAR. In addition to implementing changes to several Export Control Classification Numbers ("ECCNs"), the final rule made three modifications that are noteworthy for companies working with commodities, software, or technology that utilize or implement encryption. Importantly, none of these changes affect any items that use non-standard cryptography.
First, the final rule eliminates the requirement to either submit classification requests to BIS or file annual self-classification reports in accordance with the EAR for most mass-market encryption items. Classification requests and/or reports will still be required for certain mass-market items, including encryption chips, chipsets, electronic assemblies and field programmable logic devices, and their qualifying executable software.
Second, the final rule now allows companies to self-classify most mass-market "components" and "executable software" as eligible for License Exception ENC (b)(1), so long as they are not described under section (b)(2) of that exception. Companies will need to file an annual self-classification report to be eligible to use the license exception.
Third, the final rule eliminates the requirement to submit email notifications to BIS and the ENC Encryption Coordinator before publicly available encryption source code will be considered no longer subject to the EAR. Before this change, an email notification was required that provided the Internet location of this source code.
Companies that work with encryption commodities, software, or technology will likely welcome these changes. While analysis of export controls applicable to encryption remains a complex endeavor, these modifications should provide welcome relief in certain areas.
