United States Department of Commerce Bureau of Export Administration Washington, DC 20230 AUG 22 1997
Kenneth C. Bass, III, Esq.
Thomas J. Cooper, Esq.
Venable, Baetjer, Howard & Civiletti, L.L.P.
1201 New York Avenue, N.W. Suite 1000
Washington, D.C. 20005-3917
Re: Commodity Classification Request for Contents of Computer Diskette (Z101908) on Behalf of Philip R. Karn
Dear Messrs. Bass and Cooper:
This is in response to the commodity classification application (Z101908), dated July 22, 1997, for a diskette containing encryption software that you submitted on behalf of your client, Philip R. Karn. [1] The classification of the software on the diskette is set forth in the attached CCATS No. G007075. Since the diskette includes encryption software programs in source code form that are classified as Export Commodity Classification Number ("ECCN") 5D002 on the Commerce Control List ("CCL"), the diskette, as submitted, is classified as ECCN 5D002 for the reasons set forth below. [2]
In Executive Order 13026, 61 Fed. Reg. 58767 (Nov 19, 1996) (hereinafter "E.O. 13026"), the President determined that the export of encryption products, including software, that function to maintain the secrecy of information may harm the national security and foreign policy interests of the United States. Based on the President's direction, the Export Administration Regulations ("EAR") provide that encryption items controlled under ECCN 5D002 are subject to "EI" licensing controls for all destinations, except Canada. See 15 C.F.R. para 742.15.
You set forth several reasons why you believe this software diskette should not be subject to export licensing controls under the EAR. First, you state that "the identical information has been published and distributed worldwide without control in printed form." The EAR expressly distinguish between printed materials containing encryption source code, such as books, and encryption source code in electronic form or media, such as computer diskettes. See 15 C.F.R. para 734.3(b)(2)-(3) and accompanying Note. Printed material setting forth encryption source code is not subject to the EAR and therefore may be exported without a license. Id. In contrast, encryption source code in electronic form or media is subject to the EAR. Id. Moreover, the software diskette that you submitted does not merely contain readable information, but software that may be easily compiled and executed on a computer for those who wish to incorporate encryption into their applications.
You also state that the software on the diskette is currently available in digital form on the Internet. The President directed the Department of Commerce to regulate cryptographic software as an encryption product, rather than as technical data or technology, because the export of encryption source code is regulated for its functional capacity rather than for any possible informational value. Accordingly, for export licensing purposes, encryption software included in ECCN 5D002 is effectively treated "in the same manner a a[n] [encryption] commodity included in ECCN 5A002." Supp. 1 to 15 C.F.R. Part 774, ECCN 5D002. Export controls on encryption software are also distinct from EAR controls applicable to other kinds of software. See 15 C.F.R. para 742.15; see also id. Part 772 (definition of "commodity"). For these reasons, while publicly available software is generally not subject to the EAR, the public availability exclusion does not apply to encryption software covered by ECCN 5D002. See 15 C.F.R. para 734.3(b)(3), 734.7-734.9.
In addition, in certain circumstances, the foreign availability of items on the CCL affects the availability and scope of export licenses. See 15 C.F.R. Part 768. However, in his Executive Order, the President determined that the export of encryption products formerly regulated under the United States Munitions List ("USML") (such as the diskette at issue) "could harm national security and foreign policy interests even where comparable products are or appear to be available from sources outside the United States." E.O. 13026, supra, at 58767. The President further determined that "facts and questions concerning the foreign availability of such encryption products cannot be made subject to public disclosure or judicial review without revealing or implicating classified information that could harm United States national security and foreign policy interests." Id. The President therefore directed that the provisions of the EAR relating to foreign availability shall not apply to encryption items transferred from the USML. Id. The EAR carry out that directive. See 15 C.F.R. para 768.1(b).
You also requested in the alternative that you be granted an export license for the unlimited export of the diskette throughout the world. You submitted a commodity classification request, not an export license application under the EAR. See Supp. 1 to 15 C.F.R., Part 748. You may submit a license application in accordance with the requirements of the EAR. See 15 C.F.R. Part 748. As provided in Section 742.15(b)(4)(ii) of the EAR, we will consider any license application seeking to export encryption software classified under ECCN 5D002 on a case-by-case basis. We note that, based on your classification request, the encryption software controlled under ECCN 5D002 on the diskette at issue does not fall within an exception to EI licensing controls, which apply to certain mass-market encryption and to "key recovery" encryption items. See 15 C.F.R. para 741.15(b)(1)-(3) and Supplement Nos. 4-7 to 15 C.F.R. Part 742.
The remaining reasons you cite constitute legal arguments against the export controls at issue. As to these arguments, we believe that the EAR provisions regarding encryption items fully satisfy constitutional requirements, see Karn v. Department of State, 925 F. Supp. 1 (D.D.C. 1995), as well as statutory authority.
If you wish to appeal this classification, you may do so in accordance with the procedures set forth in Part 756 of the EAR. Any such appeal would be decided within 45 days and would constitute final agency action.
Sincerely,
[signed]
James A. Lewis
Director
Office of Strategic Trade
And Foreign Policy Controls
[2] You requested a classification for the entire diskette. As noted on the CCATS, however, not all of the software programs contained on the diskette are classified as ECCN 5D002. Specifically, the programs MD5, N-HASH, and SHS, by themselves, are classified EAR99.