Note: This White House document was sent out on September, 18, 1998. It reflected a change in US Government Encryption Exportation Policy, raising the floor on exportable symmetric encryption products from 40-bit keys to 56-bit and asymmetric encryption products to 1024-bit keys! This document was slightly modified by Thomas Jerry Scott for use in his Computer Security classes. It has been included to give you a sense of how the crypto regulations have been changed.
Return to The Main Menu

SUMMARY OF ENCRYPTION POLICY UPDATE

1. Release up to "56 bit DES and equivalent" hardware and software

Hardware and software exports of up to "56 bits DES and equivalent" products will be eligible for license exception treatment to all users and destinations (except the seven State supporters of terrorism) after a one-time technical review. No further key recovery plans or renewals of existing key recovery plans are required.

This release includes up to 56 bit DES, RC2, RC4, RC5 and CAST. Products with asymmetric key sizes up to 1024 bits will be permitted. Semi-annual post-facto reporting of end users for non-mass market exports to military and government end-users will be required.


2. Relax requirements for Key Recovery products

Remove from the regulations the requirement to name and review key recovery agents for exports of key recovery products. Require post-facto reporting of key recovery agents and the end users of key recovery products (currently semi-annual). Supplement 5 (Key Recovery Agent Criteria) will be removed from regulations.


3. Sectors

Semi-annual post-facto reporting is required within each sector.

U.S. Subsidiaries:

Approve exports of any encryption with any key length, with or without key recovery, to subsidiaries of U.S. companies (defined in Commerce regulation) world-wide (except the seven state sponsors of terrorism) under license exception, for the protection of internal business operations. This policy will also extend favorable treatment, to "strategic, partners" under license.

Insurance Companies:

Treat insurance companies like banks and securities firms by adding them to the definition of "financial institution." The result is license exception treatment to institutions headquartered in nations listed in the recent amendments to the EAR relating to banks and financial institutions (63 FR 50156).

Health/Medical:

Permit the export under license exception of any encryption with any key length, with or without key recovery, to organizations in the strictly defined health and medical sectors (see attached definitions) located in the nations listed in the banking regulation. Exports outside the country list found in the banking regulation receive a policy of approval under Encryption Licensing Arrangements (ELAs), recognizing that certain destinations may be denied on foreign policy or other grounds. The EAR will exclude biochemical firms, pharmaceutical firms and military agencies from eligibility for the license exception. Exports to such end users are possible under individual license.

On-Line Merchants:

The EAR will permit license exception treatment for the export of client-server applications (e.g., SSL) and applications tailored to on-line transactions, with any encryption algorithm and with any key length and with or without key recovery, to on-line merchants (see attached definitions), located in the country list found in the banking regulation . Exports would be limited to those that facilitate secure electronic transactions between merchants and their customers. Exports outside the country list found in the banking regulation receive a policy of approval under ELA, recognizing that certain destinations may be denied on foreign policy or other grounds. Foreign merchants (non-US owned and controlled) that sell items and services controlled on the U.S. munitions list are excluded from this policy. For merchants having separate business units, only those business units selling munitions items are excluded from this policy of approval and license exception.

4. Recoverable Products

Permit exports, under Export Licensing Arrangements, of recoverable products (see attached definitions) to foreign commercial firms for internal company proprietary use, only (i.e. not sold for individual use) that are located in the following countries:         

1. Austria, Australia, Belgium, Canada, Denmark, Finland, France, Germany, Iceland, Ireland, Italy, Japan, Luxembourg, The Netherlands, New Zealand, Norway, Portugal, Spain, Sweden, Switzerland, and the United Kingdom.

2. Anguilla, Antigua, Argentina, Aruba, Bahamas, Barbados, Brazil, Dominica, Ecuador, Greece, Hungary, Kenya, Monaco, Poland, Seychelles, St. Kitts and Nevis, St. Vincent/Grenadines, Trinidad and Tobago, Turkey and Uruguay.



In addition, for those commercial firms headquartered in countries listed in 1 above, further permit exports, ELAs, of recoverable products to their foreign subsidiaries for internal company proprietary use in all destinations except the seven countries identified as State supporters of terrorism.

For both 1 and 2 above, this policy of approval excludes those commercial firms or separate business units of commercial firms engaged in the manufacturing and distribution of products or services controlled on the U.S. Munitions List. Service providers are also excluded from this policy. Semi-annual post export reporting of end users is required. Exports to those end users and countries not listed under this policy are possible under Validated Licenses or Export Licensing Arrangements on a case-by-case basis.


Definitions (preliminary)

Insurance company means:

a) A company organized and regulated under the laws of any of the United States and its branches and affiliates whose primary and predominant business activity is the writing of insurance or the reinsuring of risk, or

b) A company organized and regulated under the laws of a foreign country and its branches and affiliates, regulated by an insurance Commissioner or an equivalent foreign regulatory authority and whose primary and predominant business activity is the writing of insurance or the reinsuring of risks.

Health/Medical

Any entity, the primary purpose of which is the lawful provision of "medical or other health services", not including biochemical and pharmaceutical manufacturers and military or government entities.
On-line merchants

A seller of goods using electronic means (e.g., the Internet) to conduct commercial transactions and is defined to be a person that deals in goods of the kind involved in the transaction. 

Recoverable products

1. A stored data product containing a recovery feature that, when activated, allows recovery of the plaintext of encrypted data without the assistance of the end user; or

2. A product or system designed such that network administrator or other authorized persons who are removed from the end user can provide law enforcement access to plaintext without the knowledge or assistance of the end user. This includes, for example, products or systems where plaintext exists and is accessible at intermediate points in a network or infrastructure system, enterprise-controlled recovery systems, and products which permit recovery of plaintext at the server where a system administrator controls and/or can provide recovery of plaintext across an enterprise, and so on.

Plaintext indicates that data that is initially received by or presented to the recoverable product before encryption takes place.

Return to the Beginning of This Document