Wassenaar Arrangement 2013 Plenary Agreements Implementation: Intrusion and Surveillance Items
Federal Register, Volume 80 Issue 97 (Wednesday, May 20, 2015)
Federal Register Volume 80, Number 97 (Wednesday, May 20, 2015)
Proposed Rules
Pages 28853-28863
From the Federal Register Online via the Government Publishing Office www.gpo.gov
FR Doc No: 2015-11642
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF COMMERCE
Bureau of Industry and Security
15 CFR Parts 740, 742, 748, 772, 774
Docket No. 150304218-5218-01
RIN 0694-AG49
Wassenaar Arrangement 2013 Plenary Agreements Implementation: Intrusion and Surveillance Items
AGENCY: Bureau of Industry and Security, Commerce.
ACTION: Proposed rule, with request for comments.
-----------------------------------------------------------------------
SUMMARY: The Bureau of Industry and Security (BIS) proposes to implement the agreements by the Wassenaar Arrangement (WA) at the Plenary meeting in December 2013 with regard to systems, equipment or components specially designed for the generation, operation or delivery of, or communication with, intrusion software; software specially designed or modified for the development or production of such systems, equipment or components; software specially designed for the generation, operation or delivery of, or communication with, intrusion software; technology required for the development of intrusion software; Internet Protocol (IP) network communications surveillance systems or equipment and test, inspection, production equipment, specially designed components therefor, and development and production software and technology therefor. BIS proposes a license requirement for the export, reexport, or transfer (in-country) of these cybersecurity items to all destinations, except Canada. Although these cybersecurity capabilities were not previously designated for export control, many of these items have been controlled for their ``information security'' functionality, including encryption and cryptanalysis. This rule thus continues applicable Encryption Items (EI) registration and review requirements, while setting forth proposed license review policies and special submission requirements to address the new cybersecurity controls, including submission of a letter of explanation with regard to the technical capabilities of the cybersecurity items.
BIS also proposes to add the definition of ``intrusion software'' to the definition section of the EAR pursuant to the WA 2013 agreements.
DATES: Submit comments on or before July 20, 2015.
ADDRESSES: Comments on this rule may be submitted to the Federal rulemaking
Page 28854
portal (www.regulations.gov). The regulations.gov ID for this rule is: BIS-2015-0011. Comments may also be submitted via email to publiccomments@bis.doc.gov or on paper to Regulatory Policy Division, Bureau of Industry and Security, Room 2099B, U.S. Department of Commerce, 14th St. and Pennsylvania Ave. NW., Washington, DC 20230. Please refer to RIN 0694-AG49 in all comments and in the subject line of email comments.
FOR FURTHER INFORMATION CONTACT: Catherine Wheeler, Director, Information Technology Control Division, Phone: (202) 482-0707 or by email at Catherine.Wheeler@bis.doc.gov.
SUPPLEMENTARY INFORMATION:
Background
The Wassenaar Arrangement (WA) on Export Controls for Conventional Arms and Dual-Use Goods and Technologies is a group of 41 like-minded states committed to promoting responsibility and transparency in the global arms trade, and preventing destabilizing accumulations of arms. As a Participating State, the United States has committed to controlling for export all items on the WA control lists. The lists were first established in 1996 and have been revised annually thereafter. Proposals for changes to the WA control lists that achieve consensus are approved by Participating States at annual December Plenary meetings. Participating States are charged with implementing the agreed list changes as soon as possible after approval. Implementation of WA list changes ensures U.S. companies have a level playing field with their competitors in other WA member states.
In 2013, WA agreed to add the following to their list of dual-use goods: systems, equipment or components specially designed for the generation, operation or delivery of, or communication with, intrusion software; software specially designed or modified for the development or production of such systems, equipment or components; software specially designed for the generation, operation or delivery of, or communication with, intrusion software; technology required for the development of intrusion software; Internet Protocol (IP) network communications surveillance systems or equipment and test, inspection, production equipment, specially designed components therefor, and development and production software and technology therefor. BIS, the Departments of Defense and State, as well as other agencies have been discussing the best way to add these items, which we have named ``cybersecurity items,'' to the Commerce Control List (CCL) (Supplement No. 1 to part 774 of the Export Administration Regulations) without reducing encryption controls and while balancing the national security and foreign policy. For resource planning purposes, as well as license requirements, license exceptions, license submission requirements, and internal license reviews and processing planning purposes, this rule is published as a proposed rule.
Scope of the New Entries
Systems, equipment, components and software specially designed for the generation, operation or delivery of, or communication with, intrusion software include network penetration testing products that use intrusion software to identify vulnerabilities of computers and network-capable devices. Certain penetration testing products are currently classified as encryption items due to their cryptographic and/or cryptanalytic functionality. Technology for the development of intrusion software includes proprietary research on the vulnerabilities and exploitation of computers and network-capable devices. The new entry on the CCL that would control Internet Protocol (IP) network communications surveillance systems or equipment is restricted to products that perform all of the functions listed; however, the Export Administration Regulations (EAR) also prohibits the export of equipment if the exporter intends it will be combined with other equipment to comprise a system described in the new entry.
Addition of ECCNs 4A005 and 4D004 to the Commerce Control List
This rule proposes to add Export Control Classification Number (ECCN) 4A005 (``systems,'' ``equipment,'' or ``components'' therefor, ``specially designed'' for the generation, operation or delivery of, or communication with, ``intrusion software'') and ECCN 4D004 (``software'' ``specially designed'' for the generation, operation or delivery of, or communication with, ``intrusion software'') to the CCL. These ECCNs are proposed to be controlled for national security (NS), regional stability (RS), and anti-terrorism (AT) reasons to all destinations, except Canada. No license exceptions would be available for these items, except certain provisions of License Exception GOV, e.g., exports to or on behalf of the United States Government pursuant to Sec. 740.11(b) of the EAR. This rule also proposes adding a License Requirement Note and a Note in the Related Controls paragraph for these ECCNs, to alert exporters to include all relevant information when submitting classification requests and licensing applications.
ECCN 4D001
This rule also proposes to amend ECCN 4D001 by adding ECCN 4A005 to Items paragraph 4D001.a in order to add control of ``software'' ``specially designed'' or modified for the ``development'' or ``production,'' of equipment controlled by 4A005; adding an RS:1 license requirement paragraph for 4D001.a (as it applies to 4A005 or 4D004), removing License Exceptions TSR and STA eligibility; and adding the same explanatory License Requirement Note and Related Controls Note that would be added to ECCNs 4A005 and 4D004.
As a technical correction, this rule proposes to remove from the ``Reason for control'' paragraph ``NP,'' and from the License Requirement section the two sentences, ``NP applies, unless a license exception is available. See Sec. 742.3(b) of the EAR for information on applicable licensing review policies.'' That text does not articulate any license requirement, and no nuclear non-proliferation license requirement for software classified as 4D001 is set forth elsewhere in the EAR. BIS's regular practice is to impose a license requirement for nuclear non-proliferation reasons on items that are specified on the ``List of Nuclear-Related Dual-Use Equipment, Materials, Software, and Related Technology'' by the Nuclear Suppliers Group. ECCN 4D001 software is not so specified.
ECCN 4E001
This rule also proposes to amend ECCN 4E001 by adding a new Items paragraph 4E001.c to control ``technology'' ``required'' for the ``development'' of ``intrusion software.'' ECCN 4E001.a controls ````technology'' according to the General Technology Note, for the ``development,'' ``production,'' or ``use'' of equipment or ``software'' controlled by 4A (except 4A980 or 4A994) or 4D (except 4D980, 4D993 or 4D994).'' Therefore, ECCN 4E001.a would control ``technology'' for the newly added 4A005 and 4D004, as well as 4D001.a (for 4A005 and 4D004). This rule also proposes to add an RS:1 license requirement paragraph for 4E001.a ``technology'' (as it applies to 4A005, 4D001.a (as it applies to 4A005 or 4D004) or 4D004) and 4E001.c, which would require a license to export, reexport, and transfer (in-
country) to all destinations, except Canada. BIS also proposes to remove License Exception Technology and Software Under
Page 28855
Restriction (TSR) and Strategic Trade Authorization (STA) eligibility and add the same explanatory License Requirement Note and Related Controls Note added to ECCNs 4A005, 4D001 and 4D004. Also, a reference to Sec. 772.1 is proposed to be added to ECCNs 4A005, 4D001 and 4E001 to point to the location of the ``intrusion software'' definition, as this rule may be of interest to many new exporters that would not otherwise know that double quoted terms in the EAR are defined in Sec. 772.1.
Lastly, the same technical correction regarding the Nuclear Non-
proliferation (NP) control is proposed for 4E001 as is proposed for 4D001, see explanation above.
ECCN 5A001.j: Internet Protocol (IP) Network Communications Surveillance Systems or Equipment and Test, Inspection, Production Equipment, Specially Designed Components Therefor
Network communication traffic analysis systems are becoming an increasingly sensitive issue, which is why WA agreed to add the control of these items to the WA dual-use list. These systems are using the process of intercepting and analyzing messages to produce personal, human and social information from the communications traffic. BIS proposes to add these items in paragraph 5A001.j and group them with cybersecurity items. The license requirements for these items are proposed to under NS Column 1, RS Column 1 and AT Column 1 on the Commerce Country Chart (Supplement No. 1 to part 738 of the EAR) and would require a license for export, reexport, and transfer (in-country) to all destinations, except Canada. Only certain provisions of License Exception GOV, e.g., exports to or on behalf of the United States Government pursuant to Sec. 740.11(b) of the EAR, would be available for these items.
The same addition of a License Requirement Note and Related Control Note is proposed for ECCNs 5A001, 5D001, and 5E001 as is proposed for ECCNs 4A005, 4D001, 4D004 and 4E001 (see explanation under 4A005 and 4D005 above).
Sec. 740.13--License Exception TSU
BIS proposes to remove cybersecurity software from the mass market provision of License Exception TSU eligibility by adding a new paragraph (d)(2)(ii). This is consistent with the existing encryption exclusion.
Cybersecurity Items That Are Designed or Modified To Use ``Cryptography'' or Cryptanalysis
As previously introduced and explained in the preamble, this rule proposes to add a Related Control note to ECCNs 4A005, 4D004, 4E001, 5A001, 5A002, 5D002 and 5E002 that states that cybersecurity items are classified in cybersecurity ECCNs, even if the items are designed or modified to use ``cryptography'' or cryptanalysis; however, all such cybersecurity items using or incorporating encryption or other ``information security'' functionality classified under ECCNs 5A002, 5D002, 5A992.c, 5D992.c or 5E002, must also satisfy the registration, review and reporting requirements set forth in Sec. Sec. 740.17, 742.15(b) and 748.3(d) of the EAR, including submissions to the ENC Encryption Request Coordinator, Ft. Meade, MD. This note is added so that people will not be confused under which ECCN to classify their products and when a cybersecurity item is designed or modified to use ``cryptography'' or cryptanalysis, after the relevant Encryption Items (EI) requirements for registration and review have been separately satisfied. One effect this will have is that these cybersecurity items will not be eligible for License Exception ENC. However, BIS anticipates licensing broad authorizations to certain types of end users and destinations that will counterbalance the loss of the use of License Exception ENC.
Information To Be Submitted With a License Application To Export, Reexport, or Transfer (In-Country) Cybersecurity Items
In addition to the general information required by Sec. 748.3(b) of the EAR and the requirement that all encryption registration and review provisions must be separately satisfied with BIS and the ENC Encryption Request Coordinator, Ft. Meade, MD, this rule proposes to add a requirement to submit specific technical information in support of applications to export, reexport, or transfer (in-country) cybersecurity items. The specified technical information is set forth in newly added paragraph (z) of Supplement No. 2 to part 748 ``Unique application and submission requirements.'' The Commodity Classification Application Tracking System (CCATS) number(s) or license number(s) for the cyber security item(s) must be included in the license application. If no classification or license application has been done for the cybersecurity item, then the answers to three (3) questions are to be submitted in a letter of explanation.
Also, this rule proposes that upon request from BIS, the applicant must include a copy of the sections of source code and other software (e.g., libraries and header files) that implement or invoke the controlled cybersecurity functionality.
License Review Policy for Cybersecurity Items
The license review policies for cybersecurity items controlled under NS and AT will not be revised. A new license review policy for cybersecurity items is proposed under Sec. 742.6(b) for regional stability. Cybersecurity items controlled for RS are proposed to be reviewed favorably if destined to a U.S. company or subsidiary not located in Country Group D:1 or E:1, foreign commercial partners located in Country Group A:5, government end users in Australia, Canada, New Zealand or the United Kingdom, and on a case-by-case basis to determine whether the transaction is contrary to the national security or foreign policy interests of the United States, including the foreign policy interest of promoting the observance of human rights throughout the world. Note that there is a policy of presumptive denial for items that have or support rootkit or zero-day exploit capabilities. The governments of Australia, Canada, New Zealand or the United Kingdom have partnered with the United States on cybersecurity policy and issues, which affords these countries with favorable treatment for license applications. A note that describes ``foreign commercial partner'' is proposed to be added to Sec. 742.6(b). Any ``information security'' functionality incorporated in the cybersecurity item will also receive a focused case-by-case review for reasons of Encryption Items (EI) control.
Sec. 772.1 Definitions of Terms as Used in the EAR: Addition of Definition for ``Intrusion Software''
The WA-agreed definition for ``intrusion software'' is proposed to be added to Sec. 772.1 of the EAR. The definition also includes a Note that describes some items not included as ``intrusion software,'' e.g., hypervisors, debuggers or Software Reverse Engineering (SRE).
Request for Comments
BIS is seeking information about the effect of this rule and would appreciate the submission of comments, and especially answers to the following questions:
Page 28856
-
How many additional license applications would your company be required to submit per year under the requirements of this proposed rule? If any, of those applications:
-
How many additional applications would be for products that are currently eligible for license exceptions?
-
How many additional applications would be for products that currently are classified EAR99?
-
-
How many deemed export, reexport or transfer (in-country) license applications would your company be required to submit per year under the requirements of this rule?
-
Would the rule have negative effects on your legitimate vulnerability research, audits, testing or screening and your company's ability to protect your own or your client's networks? If so, explain how.
-
How long would it take you to answer the questions in proposed paragraph (z) to Supplement No. 2 to part 748? Is this information you already have for your products?
* The ADDRESSES section of this proposed rule includes information about how to submit comments.
Rulemaking Requirements
-
Executive Orders 13563 and 12866 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This rule has been designated a ``significant regulatory action,'' under Executive Order 12866.
-
Notwithstanding any other provision of law, no person is required to respond to, nor shall any person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.) (PRA), unless that collection of information displays a currently valid Office of Management and Budget (OMB) Control Number. This rule would involve one collection of information subject to the PRA. One of the collections has been approved by OMB under control number 0694-
0088, ``Multi-Purpose Application,'' and carries a burden hour estimate of 58 minutes for a manual or electronic submission. The additional information proposed to be required under Supplement No. 2 to part 748 paragraph (z) falls under the usual technical information that is submitted with applications to describe the abilities of the items on the license application. This information allows the licensing officer to verify the classification of the product and determine the effect it would have on U.S. national security and foreign policy. Send comments regarding these burden estimates or any other aspect of these collections of information, including suggestions for reducing the burden, to OMB Desk Officer, New Executive Office Building, Washington, DC 20503; and to Jasmeet Seehra, OMB Desk Officer, by email at Jasmeet_K._Seehra@omb.eop.gov or by fax to (202) 395-7285; and to the Office of Administration, Bureau of Industry and Security, Department of Commerce, 1401 Constitution Ave. NW., Room 6622, Washington, DC 20230.
-
This rule does not contain policies with Federalism implications as that term is defined under Executive Order 13132.
-
The provisions of the Administrative Procedure Act (APA) (5 U.S.C. 553) requiring notice of proposed rulemaking, the opportunity for public participation, and a 30-day delay in effective date, are inapplicable because this regulation involves a military and foreign affairs function of the United States (5 U.S.C. 553(a)(1)). Nonetheless, BIS is providing the public with an opportunity to review and comment on this rule, despite its being exempted from that requirement of the APA. Because this rule is not required by the APA to undergo a period of notice and comment, the requirements of the Regulatory Flexibility Act, 5 U.S.C. 601 et seq., do not apply. Accordingly, no regulatory flexibility analysis is required, and none has been prepared.
BIS is interested in the potential impacts to businesses of this rule. Because most of the items impacted by this rule have encryption capabilities, BIS believes they are already being controlled under Category 5 part 2 of the EAR. Even though most encryption items are eligible for License Exception ENC and these cybersecurity items will not be eligible for License Exception ENC, BIS anticipates issuing broad licenses for these items. The impact of this rule is unknown to BIS, therefore the implementation of the Wassenaar Arrangement agreement of 2013 with regard to cybersecurity items is issued as a proposed rule with request for comments concerning the impact of the rule. Comments should be submitted to Sharron Cook, Office of Exporter Services, Bureau of Industry and Security, Department of Commerce, 14th and Pennsylvania Ave. NW., Room 2099, Washington, DC 20230 or emailed to publiccomments@bis.doc.gov. Please refer to RIN 0694-AG49 in all comments and in the subject line of email comments.
List of Subjects
15 CFR Part 740
Administrative practice and procedure, Exports, Reporting and recordkeeping requirements.
15 CFR Part 742
Exports, Terrorism.
15 CFR Part 748
Administrative practice and procedure, Exports, Reporting and recordkeeping requirements.
Exports.
Exports, Reporting and recordkeeping requirements.
Accordingly, parts 740, 742, 748, 772, and 774 of the Export Administration Regulations (15 CFR parts 730 through 774) are proposed to be amended as follows:
PART 740 AMENDED
0
-
The authority citation for part 740 continues to read as follows:
Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 22 U.S.C. 7201 et seq.; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of August 7, 2014, 79 FR 46959 (August 11, 2014).
0
-
Section 740.2 is amended by adding paragraph (a)(19) to read as follows:
Sec. 740.2 Restrictions on all License Exceptions.
(a) * * *
(19) The item is a cybersecurity item, i.e., those controlled by ECCNs 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004 items), 4D004, 4E001.a (``required'' for 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004) or 4D004 items), 4E001.c, 5A001.j, 5B001.a (``specially designed'' for 5A001.j items), 5D001.a (``specially designed'' for 5A001.j items), 5D001.c (``specially designed'' for 5A001.j or 5B001.a items) or 5E001.a (``required'' for 5A001.j, 5B001.a, 5D001.a (for 5A001.j items) or 5D001.c (``specially designed'' for 5A001.j or 5B001.a items) and the export, reexport or transfer (in-country) is not authorized by Sec. 740.11(b)(2)(ii) (made by or consigned to a department or agency of the U.S. government), or
Page 28857
Sec. 740.11(b)(2)(iii) (made for or on behalf of a department or agency of the U.S. Government).
* * * * *
0
-
Section 740.11 is amended by:
0
-
Adding paragraph (a)(2)(vi);
0
-
Removing the ``or'' from the end of paragraph (c)(3)(vi);
0
-
Removing the period from paragraph (c)(3)(vii) and adding a semicolon in its place; and
0
-
Adding paragraph (c)(3)(viii).
The revisions and addition read as follows:
Sec. 740.11 Governments, international organizations, international inspections under the Chemical Weapons Convention, and the International Space Station (GOV).
(a) * * *
(2) * * *
(vi) Cybersecurity items, i.e., those controlled by ECCNs 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004 items), 4D004, 4E001.a (``required'' for 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004) or 4D004 items), 4E001.c, 5A001.j, 5B001.a (``specially designed'' for 5A001.j items), 5D001.a (``specially designed'' or modified for 5A001.j items), 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a items) or 5E001.a (``required'' for 5A001.j, 5B001.a, 5D001.a (``specially designed'' or modified for 5A001.j items) or 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a items).
* * * * *
(c) * * *
(3) * * *
(viii) Cybersecurity items, i.e., those controlled by ECCNs 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004 items), 4D004, 4E001.a (``required'' for 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004) or 4D004 items), 4E001.c, 5A001.j, 5B001.a (``specially designed'' for 5A001.j items), 5D001.a (``specially designed'' or modified for 5A001.j items), 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a items) or 5E001.a (``required'' for 5A001.j, 5B001.a, 5D001.a (``specially designed'' or modified for 5A001.j items) or 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a) items).
* * * * *
0
-
-
Section 740.13 is amended by revising the section heading and paragraph (d)(2) to read as follows:
Sec. 740.13 Technology and Software--Unrestricted (TSU).
* * * * *
(d) * * *
(2) Exclusions--(i) Encryption software. The provisions of this paragraph (d) are not available for encryption software controlled for ``EI'' reasons under ECCN 5D002 or for encryption software with symmetric key length exceeding 64-bits that qualifies as mass market encryption software under the criteria in the Cryptography Note (Note 3) of Category 5, Part 2, of the Commerce Control List (Supplement No. 1 to part 774 of the EAR). (Once such mass market encryption software has been reviewed by BIS and released from ``EI'' and ``NS'' controls pursuant to Sec. 742.15(b) of the EAR, it is controlled under ECCN 5D992.c and is thus outside the scope of License Exception TSU.) See Sec. 742.15(b) of the EAR for exports and reexports of mass market encryption products controlled under ECCN 5D992.c.
(ii) Cybersecurity software. The provisions of this paragraph (d) are not available for cybersecurity ``software'' that is classified under ECCNs 4D001.a (``specially designed'' or modified for 4A005 or 4D004 items), 4D004, or for ``software'' under ECCN 5D001.a or .c (``specially designed'' for ``production,'' ``development'' or ``use'' of 5A001.j equipment or systems, or providing the characteristics, functions or features of 5A001.j or 5B001.a equipment or systems).
* * * * *
0
-
Section 740.17 is amended by revising paragraph (b)(3)(iii) introductory text to read as follows:
Sec. 740.17 Encryption commodities, software and technology (ENC).
* * * * *
(b) * * *
(3) * * *
(iii) Encryption commodities and software not described by paragraph (b)(2) of this section, and not further controlled for NS and RS reasons under ECCNs 5A001.j, 5B001.a (``specially designed'' for 5A001.j), 5D001.a (``specially designed'' or modified for 5A001.j) or 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a), that provide or perform vulnerability analysis, network forensics, or computer forensics functions characterized by any of the following:
* * * * *
0
-
Section 740.20 is amended by adding paragraph (b)(2)(ix) to read as follows:
Sec. 740.20 License Exception Strategic Trade Authorization (STA).
* * * * *
(b) * * *
(2) * * *
(ix) License Exception STA may not be used for any cybersecurity items, i.e., those controlled by ECCNs 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004 items), 4D004, 4E001.a (``required'' for 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004 items) or 4D004 items), 4E001.c, 5A001.j, 5B001.a (``specially designed'' for 5A001.j items), 5D001.a (``specially designed'' or modified for 5A001.j items), 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a items) or 5E001.a (``required'' for 5A001.j, 5B001.a, 5D001.a (``specially designed'' or modified for 5A001.j items) or 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a items) items).
* * * * *
PART 742 AMENDED
0
-
The authority citation for part 742 continues to read as follows:
Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 22 U.S.C. 3201 et seq.; 42 U.S.C. 2139a; 22 U.S.C. 7201 et seq.; 22 U.S.C. 7210; Sec. 1503, Pub. L. 108-11, 117 Stat. 559; E.O. 12058, 43 FR 20947, 3 CFR, 1978 Comp., p. 179; E.O. 12851, 58 FR 33181, 3 CFR, 1993 Comp., p. 608; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Presidential Determination 2003-23 of May 7, 2003, 68 FR 26459, May 16, 2003; Notice of August 7, 2014, 79 FR 46959 (August 11, 2014); Notice of November 7, 2014, 79 FR 67035 (November 12, 2014).
0
-
Section 742.6 is amended by adding paragraph (b)(5) to read as follows:
Sec. 742.6 Regional stability.
* * * * *
(b) * * *
(5) Licensing policy for cybersecurity items. Applications for exports, reexports and transfers of cybersecurity items, i.e., those controlled by ECCNs 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004 items), 4D004, 4E001.a (``required'' for 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004 items) or 4D004 items), 4E001.c, 5A001.j, 5B001.a (``specially designed'' for 5A001.j items), 5D001.a (``specially designed'' or modified for 5A001.j items), 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a items) or 5E001.a (``required'' for 5A001.j, 5B001.a, 5D001.a (``specially designed'' or modified for 5A001.j items) or 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a items) items), controlled for RS will be reviewed favorably if destined to a U.S. company or subsidiary not located in Country Group D:1 or E:1, `foreign commercial
Page 28858
partners' located in Country Group A:5, Government end users in Australia, Canada, New Zealand or United Kingdom and on a case-by-case basis to determine whether the transaction is contrary to the national security or foreign policy interests of the United States, including the foreign policy interest of promoting the observance of human rights throughout the world, except that there is a policy of presumptive denial for items that have or support rootkit or zero-day exploit capabilities. Any ``information security'' functionality incorporated in the cybersecurity item will also receive a focused case-by-case review for reasons of Encryption Items (EI) control.
Note to paragraph (b)(5): A `foreign commercial partner' means a foreign-based non-governmental end-user that has a business need to share the proprietary information of the U.S. company and is contractually bound to the U.S. company (e.g., has an established pattern of continuing or recurring contractual relations). In addition to the information required in Sec. 748.3(c)(1), (c)(2) and paragraph (z) of Supplement No. 2 to part 748 of the EAR, you must explain in a letter of explanation how the end user meets the criteria of a `foreign commercial partner' and how the end user will safeguard the items from unauthorized transfers (in-country) and reexports.
* * * * *
PART 748--AMENDED
0
-
The authority citation for part 748 continues to read as follows:
Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of August 7, 2014, 79 FR 46959 (August 11, 2014).
0
-
Section 748.8 is amended by adding paragraph (z) to read as follows:
Sec. 748.8 Unique application and submission requirements.
* * * * *
(z) Cybersecurity Items.
0
-
Supplement No. 2 is amended by adding paragraph (z) to read as follows:
Supplement No. 2 to Part 748--Unique Application and Submission Requirements
* * * * *
(z) Cybersecurity items. For license applications to export, reexport, transfer (in-country) cybersecurity items, i.e., ECCNs 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004 items), 4D004, 4E001.a (``required'' for 4A005, 4D001.a (``specially designed'' or modified for 4A005 or 4D004) or 4D004 items), 4E001.c, 5A001.j, 5B001.a (``specially designed'' for 5A001.j items), 5D001.a (``specially designed'' or modified for 5A001.j items), 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a items) or 5E001.a (``required'' for 5A001.j, 5B001.a, 5D001.a (``specially designed'' or modified for 5A001.j items) or 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a items) items) you must follow the unique application requirements set forth in this paragraph (z). If the cybersecurity item has encryption or other ``information security'' functionality classified under ECCNs 5A002, 5D002, 5A992.c, 5D992.c or 5E002, all encryption registration and review requirements must be separately completed with BIS and the ENC Encryption Request Coordinator, Ft. Meade, MD, before license applications for a cybersecurity item will be considered, see Sec. Sec. 740.17 and 742.15 of the EAR.
(1) In block 9 of the application (Special Purpose) indicate the phrase ``Cybersecurity Item.'' In addition to the information required by Sec. 748.3(b) of the EAR, submit the following information in a letter of explanation:
(i) Whether the cybersecurity item has encryption or other ``information security'' functionality, Encryption Registration Number (ERN) and encryption Commodity Classification Application Tracking System (CCATS) number(s);
(ii) Whether the cybersecurity item has been previously classified or included in a license application submitted on or after May 20, 2015 for which all requirements of this section (including the questions set forth in paragraph (z)(1)(iii) of this section) have been satisfied. If so, then provide the Commodity Classification Automated Tracking System (CCATS) number(s) or issued license number(s).
(iii) If the cybersecurity item has not been previously classified or included in a license application, then:
(A) Describe the cybersecurity functions and user interfaces (e.g., Application Programming Interfaces (APIs), Command Line Interfaces (CLIs) or Graphical User Interfaces (GUIs)) that are implemented and/or supported. Explain which are for internal use private to the developer of the product, and/or which are for use by the customer or other operator.
(B) Describe the cybersecurity functionality (including as related to ``intrusion software'') that is provided by third-party frameworks, platforms, tools, modules or components (if any). Identify the manufacturers of the cybersecurity items, including specific part numbers and version information as needed to describe the item. As applicable, describe whether the third-party cybersecurity software is statically or dynamically linked.
(C) For items related to ``intrusion software,'' describe how rootkit or zero-day exploit functionality is precluded from the item. Otherwise, for items that incorporate or otherwise support rootkit or zero-day exploit functionality, this must be explicitly stated in the application.
(2) Upon request, include a copy of the sections of source code and other software (e.g., libraries and header files) that implement or invoke the controlled cybersecurity functionality.
PART 772 AMENDED
0
-
The authority citation for part 772 continues to read as follows:
Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of August 7, 2014, 79 FR 46959 (August 11, 2014).
0
-
Section 772.1 is amended by adding the term ``Intrusion software'' in alphabetic order to read as follows:
Sec. 772.1 Definitions of terms as used in the Export Administration Regulations (EAR).
* * * * *
Intrusion software. (Cat 4) ``Software'' ``specially designed'' or modified to avoid detection by `monitoring tools,' or to defeat `protective countermeasures,' of a computer or network-capable device, and performing any of the following:
(a) The extraction of data or information, from a computer or network-capable device, or the modification of system or user data; or
(b) The modification of the standard execution path of a program or process in order to allow the execution of externally provided instructions.
Notes: 1. ``Intrusion software'' does not include any of the following:
-
Hypervisors, debuggers or Software Reverse Engineering (SRE) tools;
-
Digital Rights Management (DRM) ``software''; or
-
``Software'' designed to be installed by manufacturers, administrators or users, for the purposes of asset tracking or recovery.
-
-
Network-capable devices include mobile devices and smart meters.
Technical Notes: 1. `Monitoring tools': ``software'' or hardware devices, that monitor system behaviors or processes running on a device. This includes antivirus (AV) products, end point security products, Personal Security Products (PSP), Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS) or firewalls.
-
`Protective countermeasures': techniques designed to ensure the safe execution of code, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR) or sandboxing.
* * * * *
PART 774 AMENDED
0
-
The authority citation for part 774 continues to read as follows:
Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 10 U.S.C. 7420; 10 U.S.C. 7430(e); 22 U.S.C. 287c, 22 U.S.C. 3201 et seq.; 22 U.S.C. 6004; 30 U.S.C. 185(s), 185(u); 42 U.S.C. 2139a; 42 U.S.C. 6212; 43 U.S.C. 1354; 15 U.S.C. 1824a; 50 U.S.C. app. 5; 22
Page 28859
U.S.C. 7201 et seq.; 22 U.S.C. 7210; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of August 7, 2014, 79 FR 46959 (August 11, 2014).
Supplement No. 1 to Part 774--Amended
0
-
In Supplement No. 1 to Part 774 (the Commerce Control List), Category 4 is amended by adding ECCN 4A005 after ECCN 4A004 to read as follows:
Supplement No. 1 to Part 774--The Commerce Control List
* * * * *
4A005 ``Systems,'' ``equipment,'' or ``components'' therefor, ``specially designed'' or modified for the generation, operation or delivery of, or communication with, ``intrusion software''.
License Requirements
Reason for Control: NS, RS, AT
Country chart (see supp. No.
Control(s) 1 to part 738)
NS applies to entire entry................ NS Column 1
RS applies to the entire entry............ RS Column 1
AT applies to entire entry................ AT Column 1
License Requirement Note: All license applications for 4A005 must include the information required in Supplement No. 2 to part 748 of the EAR, paragraph (z). Also, all such cybersecurity items using or incorporating encryption or other ``information security'' functionality classified under ECCNs 5A002, 5D002, 5A992.c, 5D992.c or 5E002, must also satisfy the registration, review and reporting requirements set forth in Sec. Sec. 740.17, 742.15(b) and 748.3(d) of the EAR, including submissions to the ENC Encryption Request Coordinator, Ft. Meade, MD prior to applying for a license.
List Based License Exceptions (See Part 740 for a Description of All License Exceptions)
LVS: N/A
GBS: N/A
CIV: N/A
Special Conditions for STA
STA: License Exception STA may not be used to export, reexport, or transfer (in-country) commodities controlled by ECCN 4A005 to any destination.
List of Items Controlled
Related Controls: (1) ``Systems'', ``equipment'' and ``components'' described under ECCN 4A005 are classified under this ECCN, even if the ``systems'', ``equipment'' or ``components'' are designed or modified to use ``cryptography'' or cryptanalysis. (2) See Categories XI(b) and XIII in the International Traffic in Arms Regulations (ITAR) (22 CFR parts 120 through 130) and the U.S. Munitions List (22 CFR part 121). (3) See also ECCN 4D001.a (``development'' and ``production'' ``software''), 4D004 and 4E001.a and .c.
Related Definitions: See Sec. 772.1 of this EAR for the definition of ``intrusion software.''
Items: The list of items controlled is contained in the ECCN heading.
0
-
In Supplement No. 1 to Part 774 (the Commerce Control List), Category 4, ECCN 4D001 is amended by:
0
-
Revising the Reason for Control paragraph in the License Requirements section;
0
-
Adding an entry for ``RS'' after the entry for ``NS'' in the table in the License Requirements section;
0
-
Removing the NP note after the table in the License Requirements section and adding in its place a License Requirement Note;
0
-
Revising the TSR paragraph in the List Based License Exceptions section;
0
-
Revising the Special Conditions for STA section;
0
-
Revising the Related Controls paragraph in the List of Items Controlled section;
0
-
Revising Items paragraph a.
The revisions and addition read as follows:
4D001 ``Software'' as follows (see List of Items Controlled).
License Requirements
Reason for Control: NS, RS, CC, AT
Country chart (see supp. No.
Control(s) 1 to part 738)
* * * * *
RS applies to 4D001.a (if ``specially RS Column 1
designed'' or modified for 4A005 or
4D004).
* * * * *
License Requirement Note: All license applications for 4D001.a (if ``specially designed'' or modified for 4A005 or 4D004) must include the information required in Supplement No. 2 to part 748 of the EAR, paragraph (z). Also, all such cybersecurity items using or incorporating encryption or other ``information security'' functionality classified under ECCNs 5A002, 5D002, 5A992.c, 5D992.c or 5E002, must also satisfy the registration, review and reporting requirements set forth in Sec. Sec. 740.17, 742.15(b) and 748.3(d) of the EAR, including submissions to the ENC Encryption Request Coordinator, Ft. Meade, MD prior to applying for a license.
* * * * *
List Based License Exceptions (See Part 740 for a Description of All License Exceptions)
* * * * *
TSR: Yes, except for: (1) ``software'' ``specially designed'' or modified for the ``development'' or ``production'' of commodities with an ``Adjusted Peak Performance'' (``APP'') exceeding 1.0 WT; or (2) ``software'' if ``specially designed'' or modified for the ``development'' or ``production'' of commodities or ``software'' specified by ECCNs 4A005 or 4D004.
* * * * *
Special Conditions for STA
STA: License Exception STA may not be used to: (1) Ship or transmit ``software'' ``specially designed'' or modified for the ``development'' or ``production'' of equipment specified by ECCN 4A001.a.2 or for the ``development'' or ``production'' of ``digital computers'' having an `Adjusted Peak Performance' (`APP') exceeding 1.0 Weighted TeraFLOPS (WT) to any of the destinations listed in Country Group A:6 (See Supplement No.1 to part 740 of the EAR); or (2) ship or transmit ``software'' ``specially designed'' or modified for the ``production'' or ``development'' of commodities or ``software'' specified by ECCNs 4A005 or 4D004, to any destination.
List of Items Controlled
Related Controls: (1) ``Software'' described under ECCN 4D001 (if ``specially designed'' or modified for 4A005 or 4D004) is classified under this ECCN, even if the ``software'' is designed or modified to use ``cryptography'' or cryptanalysis. (2) See also the International Traffic in Arms Regulations (ITAR) (22 CFR parts 120 through 130) and the U.S. Munitions List (22 CFR part 121).
* * * * *
Items: a. ``Software'' ``specially designed'' or modified for the ``development'' or ``production'', of equipment controlled by 4A001, 4A003, 4A004, 4A005 or ``software'' controlled by 4D (except 4D980, 4D993 or 4D994).
* * * * *
0
-
-
In Supplement No. 1 to Part 774 (the Commerce Control List), Category 4 is amended by adding ECCN 4D004 after ECCN 4D002 to read as follows:
4D004 ``Software'' ``specially designed'' or modified for the generation, operation or delivery of, or communication with, ``intrusion software''.
License Requirements
Reason for Control: NS, RS, AT
Country chart (see supp.
Control(s) No.1 to part 738)
NS applies to entire entry................ NS Column 1
RS applies to entire entry................ RS Column 1
AT applies to entire entry................ AT Column 1
License Requirement Note: All license applications for 4D004 must include the information required in Supplement No. 2 to part 748 of this EAR, paragraph (z). Also, all such cybersecurity items using or incorporating encryption or other
Page 28860
``information security'' functionality classified under ECCNs 5A002, 5D002, 5A992.c, 5D992.c or 5E002, must also satisfy the registration, review and reporting requirements set forth in Sec. Sec. 740.17, 742.15(b) and 748.3(d) of the EAR, including submissions to the ENC Encryption Request Coordinator, Ft. Meade, MD prior to applying for a license.
List Based License Exceptions (See Part 740 for a Description of All License Exceptions)
CIV: N/A
TSR: N/A
Special Conditions for STA
STA: License Exception STA may not be used to export, reexport, or transfer (in-country) ``software'' controlled by ECCN 4D004 to any destination.
List of Items Controlled
Related Controls: (1) ``Software'' described under ECCN 4D004 is classified under this ECCN, even if the ``software'' is designed or modified to use ``cryptography'' or cryptanalysis. (2) See also the International Traffic in Arms Regulations (ITAR) (22 CFR parts 120 through 130) and the U.S. Munitions List (22 CFR part 121). (3) See also ECCN 4E001.a.
Related Definitions: See Sec. 772.1 of the EAR for the definition of ``intrusion software.''
Items: The list of items controlled is contained in the ECCN heading.
0
-
In Supplement No. 1 to Part 774 (the Commerce Control List), Category 4, ECCN 4E001 is amended by:
0
-
Revising the Reasons for Control paragraph in the License Requirements section;
0
-
Adding an entry for ``RS'' after the entry for ``MT'' in the table in the License Requirements section;
0
-
Removing the NP note after the table in the License Requirements section and adding in its place a License Requirement Note;
0
-
Revising the TSR paragraph in the List Based License Exceptions section;
0
-
Revising the Special Conditions for STA section;
0
-
Revising the Related Controls and Related Definitions paragraphs in the List of Items Controlled section;
0
-
Adding paragraph c to the Items paragraph of the List of Items Controlled section.
The revisions and additions read as follows:
4E001 ``Technology'' as follows (see List of Items Controlled).
License Requirements
Reason for Control: NS, MT, RS, CC, AT
Country chart (see supp. No.
Control(s) 1 to part 738)
* * * * *
RS applies to 4E001.a ``technology'' (if RS Column 1
``required'' for 4A005, 4D001.a (if
``specially designed'' or modified for
4A005 or 4D004) or 4D004) and if
``required'' for 4E001.c.
* * * * *
License Requirement Note: All license applications for 4E001.a ``technology'' (if ``required'' for 4A005, 4D001.a (if ``specially designed'' or modified for 4A005 or 4D004) or 4D004) and if ``required'' for 4E001.c must include the information required in Supplement No. 2 to part 748 of the EAR, paragraph (z). Also, all such cybersecurity items using or incorporating encryption or other ``information security'' functionality classified under ECCNs 5A002, 5D002, 5A992.c, 5D992.c or 5E002, must also satisfy the registration, review and reporting requirements set forth in Sec. Sec. 740.17, 742.15(b) and 748.3(d) of the EAR, including submissions to the ENC Encryption Request Coordinator, Ft. Meade, MD prior to applying for a license.
* * * * *
List Based License Exceptions (See Part 740 for a Description of All License Exceptions)
* * * * *
TSR: Yes, except for: ``technology'' for the ``development'' or ``production'' of ``commodities'' with an ``Adjusted Peak Performance'' (``APP'') exceeding 1.0 WT, ``commodities'' in 4A005 or ``software'' in 4D001.a (if ``specially designed'' or modified for 4A005 or 4D004) or ``required'' for 4D004; or ``technology'' specified by 4E001.c.
* * * * *
Special Conditions for STA
STA: License Exception STA may not be used to ship or transmit ``technology'' according to the General Technology Note for the ``development'' or ``production'' of any of the following equipment or ``software'': a. Equipment specified by ECCN 4A001.a.2; b. ``Digital computers'' having an `Adjusted Peak Performance' (`APP') exceeding 1.0 Weighted TeraFLOPS (WT); or .c ``software'' specified in the License Exception STA paragraph found in the License Exception section of ECCN 4D001 to any of the destinations listed in Country Group A:6 (See Supplement No. 1 to part 740 of the EAR); or to ship any ``technology'' specified by 4E001.a ``required'' for ``commodities'' in 4A005 or ``software'' in 4D001.a (if ``specially designed'' or modified for 4A005 or 4D004), 4D004, or by 4E001.c, to any destination.
List of Items Controlled
Related Controls: (1) ``Technology'' described under ECCN 4E001.a (``required'' for equipment in 4A005 or ``software'' in 4D001.a (if ``specially designed'' or modified for 4A005 or 4D004) or 4D004) or 4E001.c is classified under this ECCN, even if it includes ``technology'' for the ``development'' or ``production'' of cryptographic or cryptanalytic items. (2) See also the International Traffic in Arms Regulations (ITAR) (22 CFR parts 120 through 130) and the U.S. Munitions List (22 CFR part 121).
Related Definitions: See Sec. 772.1 for the definition of ``intrusion software.''
Items:* * *
-
``Technology'' ``required'' for the ``development'' of ``intrusion software''.
0
-
-
In Supplement No. 1 to Part 774 (the Commerce Control List), Category 5, ECCN 5A001 is amended by:
0
-
Revising the Reason for Control paragraph in the License Requirements section;
0
-
Revising the first entry in the table in the License Requirements section;
0
-
Adding an entry for ``RS'' after the second entry in the table in the License Requirements section;
0
-
Adding a License Requirement Note after the table in the License Requirements section;
0
-
Revising the List Based License Exceptions section;
0
-
Revising the Special Conditions for STA section;
0
-
Revising the Related Controls paragraph of the List of Items Controlled section; and
0
-
Adding paragraph .j to the Items paragraph of the List of Items Controlled section.
The revisions and additions read as follows:
5A001 Telecommunications systems, equipment, ``components'' and ``accessories,'' as follows (see List of Items Controlled).
License Requirements
Reason for Control: NS, RS, SL, AT
Country chart (see supp. No.
Control(s) 1 to part 738)
NS applies to 5A001.a, .e, .b.5, f.3, .h NS Column 1
and .j.
* * * * *
RS applies to 5A001.j..................... RS Column 1
* * * * *
License Requirement Note: All license applications for cybersecurity items (5A001.j) must include the information required in Supplement No. 2 to part 748 of the EAR, paragraph (z). Also, all such cybersecurity items using or incorporating encryption or other ``information security'' functionality
Page 28861
classified under ECCNs 5A002, 5D002, 5A992.c, 5D992.c or 5E002, must also satisfy the registration, review and reporting requirements set forth in Sec. Sec. 740.17, 742.15(b) and 748.3(d) of the EAR, including submissions to the ENC Encryption Request Coordinator, Ft. Meade, MD prior to applying for a license.
* * * * *
List Based License Exceptions (See Part 740 for a Description of All License Exceptions)
LVS: N/A for 5A001.a, .b.5, .e, .f, .h, and .j; $5000 for 5A001.b.1, .b.2, .b.3, .b.6, .d, and .g; $3000 for 5A001.c.
GBS: Yes, except 5A001.a, .b.5, .e, .f, .h, and .j.
CIV: Yes, except 5A001.a, .b.3, .b.5, .e, .f, .h, and .j.
Special Conditions for STA
STA: License Exception STA may not be used to ship any commodity in 5A001.b.3, .b.5, or .h to any of the destinations listed in Country Group A:6 (See Supplement No. 1 to part 740 of the EAR), or to ship any commodity in 5A001.j to any destination.
List of Items Controlled
Related Controls: (1) See USML Category XI for controls on direction-finding ``equipment'' including types of ``equipment'' in ECCN 5A001.e and any other military or intelligence electronic ``equipment'' that is ``subject to the ITAR.'' (2) See USML Category XI(a)(4)(iii) for controls on electronic attack and jamming ``equipment'' defined in 5A001.f and .h that are subject to the ITAR. (3) ``Systems,'' ``equipment'' and ``components'' described under ECCN 5A001.j are classified under this ECCN even if the ``systems,'' ``equipment'' or ``components'' are designed or modified to use ``cryptography'' or cryptanalysis. (4) ECCN 5A001.j includes a note that explicitly excludes equipment designed for marketing purposes, quality of service (QoS) or quality of experience (QoE) purposes. The intent of the entry is to capture only products that are not ``specially designed'' for legitimate network operator functions. The control has very specific parameters and includes only systems or equipment that perform all five of the capabilities listed in 5A001.j below. Equipment that is not described in the new ECCN 5A001.j entry because it does not have all five capabilities required is likely to be described in ECCNs 5A002 or 5A992 if it has encryption functionality, or ECCNs 5A991 or 4A994 if it does not. However, such equipment may not be sold separately with knowledge that it will be combined with other equipment to comprise a system described in new paragraph ECCN 5A001.j. (see Sec. 764.2(h) of the EAR) (5) See also 5A101, 5A980, and 5A991.
* * * * *
Items: * * *
-
IP network communications surveillance ``systems'' or ``equipment'', and ``specially designed'' components therefor, having all of the following:
j.1. Performing all of the following on a carrier class IP network (e.g., national grade IP backbone):
j.1.a. Analysis at the application layer (e.g., Layer 7 of Open Systems Interconnection (OSI) model (ISO/IEC 7498-1));
j.1.b. Extraction of selected metadata and application content (e.g., voice, video, messages, attachments); and
j.1.c. Indexing of extracted data; and
j.2. Being ``specially designed'' to carry out all of the following:
j.2.a. Execution of searches on the basis of `hard selectors'; and
j.2.b. Mapping of the relational network of an individual or of a group of people.
Note: 5A001.j does not apply to ``systems'' or ``equipment'', ``specially designed'' for any of the following:
-
Marketing purpose;
-
Network Quality of Service (QoS); or
-
Quality of Experience (QoE).
Technical Note: `Hard selectors': data or set of data, related to an individual (e.g., family name, given name, email or street address, phone number or group affiliations).
0
-
-
In Supplement No. 1 to Part 774 (the Commerce Control List), Category 5, ECCN 5B001 is amended by:
0
-
Revising the Reasons for Control paragraph of the License Requirements section;
0
-
Revising the table in the License Requirements section;
0
-
Adding a License Requirement Note after the table in the License Requirements section;
0
-
Revising the List Based License Exceptions section; and
0
-
Revising the Special Conditions for STA section.
The revisions and addition to read as follows:
5B001 Telecommunication test, inspection and production equipment, ``components'' and ``accessories,'' as follows (See List of Items Controlled).
License Requirements
Reason for Control: NS, RS, AT
Country chart (see supp.
Control(s) No. 1 to part 738)
NS applies to 5B001.a equipment, NS Column 1
``components'' and ``accessories''
``specially designed'' for 5A001.j.
NS applies to entire entry (except 5B001.a NS Column 2
for 5A001.j).
RS applies to 5B001.a equipment, RS Column 1
``components'' and ``accessories''
``specially designed'' for 5A001.j.
AT applies to entire entry................ AT Column 1
License Requirement Note: All license applications for cybersecurity items (5B001.a equipment, ``components'' and ``accessories'' ``specially designed'' for 5A001.j) must include the information required in Supplement No. 2 to part 748 of the EAR, paragraph (z). Also, all such cybersecurity items using or incorporating encryption or other ``information security'' functionality classified under ECCNs 5A002, 5D002, 5A992.c, 5D992.c or 5E002, must also satisfy the registration, review and reporting requirements set forth in Sec. Sec. 740.17, 742.15(b) and 748.3(d) of the EAR, including submissions to the ENC Encryption Request Coordinator, Ft. Meade, MD prior to applying for a license.
* * * * *
List Based License Exceptions (See Part 740 for a Description of All License Exceptions)
LVS: $5000, except N/A for 5B001.a (for 5A001.f.1 or .j)
GBS: Yes, except for 5B001.a (for 5A001.f.1 or .j)
CIV: Yes, except for 5B001.a (for 5A001.f.1 or .j)
Special Conditions for STA
STA: License Exception STA may not be used to ship 5B001.a equipment and ``specially designed'' ``components'' or ``accessories'' therefor, ``specially designed'' for the ``development'' or ``production'' of equipment, functions or features specified by ECCN 5A001.b.3, .b.5 or .h to any of the destinations listed in Country Group A:6 (See Supplement No.1 to part 740 of the EAR), or to ship any commodity in 5B001.a for equipment or systems specified by 5A001.f.1. or .j to any destination.
* * * * *
0
-
-
In Supplement No. 1 to Part 774 (the Commerce Control List), Category 5, ECCN 5D001 is amended by:
0
-
Revising the Reasons for Control paragraph in the License Requirements section;
0
-
Adding an entry for ``RS'' after the entry for ``NS'' in the table in the License Requirements section;
0
-
Adding a License Requirement Note after the table in the License Requirements section;
0
-
Revising the List Based License Exceptions section;
0
-
Revising the Special Conditions for STA section; and
0
-
Revising the Related Controls paragraph in the List of Items Controlled section.
The revisions and additions read as follows:
5D001 ``Software'' as follows (see List of Items Controlled).
Page 28862
License Requirements
Reason for Control: NS, RS, SL, AT
Country chart (see supp.
Control(s) No. 1 to part 738)
* * * * *
RS applies to 5D001.a ``software'' RS Column 1
``specially designed'' or modified for
5A001.j, and 5D001.c ``software''
``specially designed'' or modified for
5A001.j or 5B001.a.
* * * * *
License Requirement Note: All license applications for cybersecurity items (5D001.a ``software'' ``specially designed'' or modified for 5A001.j, and 5D001.c ``software'' ``specially designed'' or modified for 5A001.j or 5B001.a) must include the information required in Supplement No. 2 to part 748 of the EAR, paragraph (z). Also, all such cybersecurity items using or incorporating encryption or other ``information security'' functionality classified under ECCNs 5A002, 5D002, 5A992.c, 5D992.c or 5E002, must also satisfy the registration, review and reporting requirements set forth in Sec. Sec. 740.17, 742.15(b) and 748.3(d) of the EAR, including submissions to the ENC Encryption Request Coordinator, Ft. Meade, MD prior to applying for a license.
* * * * *
List Based License Exceptions (See Part 740 for a Description of All License Exceptions)
CIV: Yes, except for ``software'' controlled by 5D001.a and ``specially designed'' or modified for the ``development'' or ``production'' of items controlled by 5A001.b.5, 5A001.f.1, 5A001.h and 5A001.j.
TSR: Yes, except for exports and reexports to destinations outside of those countries listed in Country Group A:5 (See Supplement No. 1 to part 740 of the EAR) of ``software'' controlled by 5D001.a and ``specially designed'' or modified for items controlled by 5A001.b.5, 5A001.f.1, 5A001.h and 5A001.j.
Special Conditions for STA
STA: License Exception STA may not be used to ship or transmit 5D001.a ``software'' ``specially designed'' or modified for the ``development'' or ``production'' of equipment, functions or features, specified by ECCN 5A001.b.3, .b.5, .f.1, .h or .j; and for 5D001.b. for ``software'' ``specially designed'' or modified to support ``technology'' specified by the STA paragraph in the License Exception section of ECCN 5E001 to any of the destinations listed in Country Group A:6 (See Supplement No.1 to part 740 of the EAR); and for 5D001.c. for ``software'' ``specially designed'' or modified to provide characteristics, functions or features of equipment or systems classified under ECCNs 5A001.f.1 or .j, or 5B001.a (for 5A001.f.1 or .j)).
List of Items Controlled
Related Controls: (1) ``Software'' described under ECCN 5D001.a or .c (if ``specially designed'' or modified for 5A001.j) is classified under this ECCN, even if the ``software'' is designed or modified to use ``cryptography'' or cryptanalysis. (2) See also 5D980 and 5D991.
* * * * *
0
-
-
In Supplement No. 1 to Part 774 (the Commerce Control List), Category 5, Part 1, ECCN 5E001 is amended by:
0
-
Revising the Reasons for Control paragraph in the License Requirements section;
0
-
Adding an entry for ``RS'' after the entry for ``NS'' in the table in the License Requirements section;
0
-
Adding a License Requirement Note after the table in the License Requirements section;
0
-
Revising the TSR paragraph in the List Based License Exceptions section;
0
-
Revising the Special Conditions for STA section; and
0
-
Adding paragraph (3) to the Related Control paragraph in the List of Items Controlled section.
The revisions and additions read as follows:
5E001 ``Technology'' as follows (see List of Items Controlled).
License Requirements
Reason for Control: NS, RS, SL, AT
Country chart (see supp.
Control(s) No. 1 to part 738)
* * * * *
RS applies to 5E001.a for commodities RS Column 1
controlled under 5A001.j or ``software''
controlled under 5D001.a (if ``specially
designed'' or modified for 5A001.j), and
5D001.c (if ``specially designed'' or
modified for 5A001.j or 5B001.a) for RS
reasons.
* * * * *
License Requirement Note: All license applications for cybersecurity items (5A001.j or ``software'' controlled under 5D001.a (if ``specially designed'' or modified for 5A001.j), and 5D001.c (if ``specially designed'' or modified for 5A001.j or 5B001.a)) must include the information required in Supplement No. 2 to part 748 of the EAR, paragraph (z). Also, all such cybersecurity items using or incorporating encryption or other ``information security'' functionality classified under ECCNs 5A002, 5D002, 5A992.c, 5D992.c or 5E002, must also satisfy the registration, review and reporting requirements set forth in Sec. Sec. 740.17, 742.15(b) and 748.3(d) of the EAR, including submissions to the ENC Encryption Request Coordinator, Ft. Meade, MD prior to applying for a license.
* * * * *
List Based License Exceptions (See Part 740 for a Description of All License Exceptions)
* * * * *
TSR: Yes, except: N/A for ``technology'' controlled by 5E001.a if ``required'' for the ``development'' or ``production'' of items controlled by 5A001.f.1. or .j, 5D001.a (if ``specially designed'' or modified for 5A001.f.1 or .j) or 5D001.c (if ``specially designed'' or modified for 5A001.j or 5B001.a) to any destination; or for exports or reexports to destinations outside of those countries listed in Country Group A:5 (See Supplement No. 1 to part 740 of the EAR) of ``technology'' controlled by 5E001.a for the ``development'' or ``production'' of the following: (1) Items controlled by 5A001.b.5 or 5A001.h; or (2) ``Software'' controlled by 5D001.a that is ``specially designed'' or modified for the ``development'' or ``production'' of equipment, functions or features controlled by 5A001.b.5 or 5A001.h.
Special Conditions for STA
STA: License Exception STA may not be used to ship or transmit ``technology'' according to the General Technology Note for the ``development'' or ``production'' of equipment, functions or features specified by 5A001.b.3, .b.5 or .h; or for ``software'' in 5D001.a that is specified in the STA paragraph in the License Exception section of ECCN 5D001 to any of the destinations listed in Country Group A:6 (See Supplement No.1 to part 740 of the EAR); or to ship any ``technology'' in 5E001.a if ``required'' for any commodity in 5A001.f.1 or .j, or if ``required'' for any ``software'' in 5D001.a or .c (``specially'' or modified designed for any commodity in 5A001.f.1 or .j or 5B001.a (``specially designed'' for 5A001.f.1 or .j)), to any destination.
List of Items Controlled
Related Controls: * * * (3) ``Technology'' described under ECCN 5E001.a if ``required'' for ``systems,'' ``equipment'' or ``components'' classified under 5A001.j or ``software'' classified under 5D001.a (``specially designed'' or modified for 5A001.j) or 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a) is classified under this ECCN even if it includes ``technology'' for the ``development'' or ``production'' of cryptographic or cryptanalytic items.
* * * * *
0
-
-
In Supplement No. 1 to Part 774 (the Commerce Control List), Category 5 Part 2, ECCN 5A002 is amended by adding paragraph (4) to the Related Controls paragraph in the List of Items Controlled section to read as follows:
Page 28863
5A002 ``Information security'' systems, equipment ``components'' therefor, as follows (see List of Items Controlled).
* * * * *
List of Items Controlled
Related Controls: * * * (4) ``Systems,'' ``equipment'' and ``components'' described under ECCNs 4A005 or 5A001.j are classified under ECCNs 4A005 or 5A001.j, even if the ``systems,'' ``equipment'' or ``components'' are designed or modified to use ``cryptography'' or cryptanalysis.
* * * * *
0
-
In Supplement No. 1 to Part 774 (the Commerce Control List), Category 5 Part 2, ECCN 5D002 is amended by adding paragraph (3) to the Related Controls paragraph in the List of Items Controlled section to read as follows:
5D002 ``Software'' as follows (see List of Items Controlled).
* * * * *
List of Items Controlled
Related Controls: * * * (3) ``Software'' described under ECCN 4D001.a (``specially designed'' or modified for 4A005 or 4D004), 4D004, 5D001.a (``specially designed'' or modified for 5A001.j) or 5D001.c (``specially designed'' or modified for 5A001.j or 5B001.a) is classified under those ECCNs, even if the ``software'' is designed or modified to use ``cryptography'' or cryptanalysis.
* * * * *
0
-
In Supplement No. 1 to Part 774 (the Commerce Control List), Category 5 Part 2, ECCN 5E002 is amended by revising the Related Controls paragraph in the List of Items Controlled section to read as follows:
5E002 ``Technology'' as follows (see List of Items Controlled).
* * * * *
List of Items Controlled
Related Controls: (1) See also 5E992. This entry does not control ``technology'' ``required'' for the ``use'' of equipment excluded from control under the Related Controls paragraph or the Technical Notes in ECCN 5A002 or ``technology'' related to equipment excluded from control under ECCN 5A002. This ``technology'' is classified as ECCN 5E992. (2) ``Technology'' described under ECCN 4E001.a (``required'' for equipment in 4A005 or ``software'' in 4D004), 4E001.c, or 5E001.a (``required'' for 5A001.j or 5D001.a) that is designed or modified to use ``cryptography'' or cryptanalysis is classified under ECCNs 4E001.a or .c, or ECCN 5E001.a, respectively.
* * * * *
Dated: May 11, 2015.
Kevin J. Wolf,
Assistant Secretary for Export Administration.
FR Doc. 2015-11642 Filed 5-19-15; 8:45 am
BILLING CODE 3351-33-P
