Compliance with US export Laws

[kmrnavin]

HI,
While reviewing the Nokia Ovi pubisher agreement, we came across a clause which states that the export control is governed by United States copyright laws. I have a couple of questions –

1. US export control requires that all software published out of the US that uses encryption technology get a CCATS certificate from US government. This certification typically requires 3-4 weeks but we have to submit apps by 21st April. I wanted to check if this is mandatory for Ovi and whether your other developers have this certificate?
2. Is there any specific reason why it refers to US laws and not Finland laws?

regards
Navin
+91 9741491130

[mobileperry]

Hi Navin,

Yes, we require a classification number if the publisher content includes encryption.

We reference US laws and broader international laws. US laws are some of the strictest, and we aim to comply with these restrictions as Nokia does business in the US.


Best,

[Liwuje]

Hi Navin,

Yes, we require a classification number if the publisher content includes encryption.

We reference US laws and broader international laws. US laws are some of the strictest, and we aim to comply with these restrictions as Nokia does business in the US.


Best,

Hi,

I use HTTPS for safe communication and AES to store authentication data on the device. I don't
want to encrypt any other data. Do I need a classification number?

My plan is to give following answers for the questions about encryption during OVI Store submit:

Does your content contain encryption? Yes
Does your content contain encryption used for authentication? Yes
Does your content contain encryption used for protection of data or information security purposes? No

Is it OK?

Someone wrote that after submitting these answers QA said: "Your submitted application failed as
encrypted content is not permitted to be distributed in the United States of America. Please change
the distribution and resubmit the item." I always thought that the aim is NOT TO export encryption
to untrusted countries so I am a little bit confused with that answer.

Please help! Explain it to me

Liwuje

[nowheremanmail]

hi, I'm trying to submit my wallet application into ovistore (Qt application for N900). It uses aes encryption to protect data. It is using OpenSSL library.

Because it is using encryption, they ask me to provide a copy of:

A copy of the commodity classification ruling (CCATS) confirming classification of the content under ECCN 5D992, as a mass market encryption item under section 742.15(b)(2) of the Export Administration Regulations OR a copy of the “Notification” described in 742.15(b)(1), must be attached.

My english it's not enought to understand legal documentation.

First question will be, i really have to submit it if I using OpenSSL included into n900? Moreover software it's opensource!

Is there any body who can indicate to me which steps I have to follow? Or how / where to start?

At this moment I'm trying to ask for a PIN on http://www.bis.doc.gov/snap/pinsnapr.htm but they are always talking about "company", and I don't have any company!



Thank's

[tamhanna]

Not really difficult. Call up the bureau of exports, and they help you. You need to get a SNAP-R accoiunt first, then you send the declaration and it is gold.

I will write a writeup of all that pretty soon...

[nowheremanmail]

Not really difficult. Call up the bureau of exports, and they help you. You need to get a SNAP-R accoiunt first, then you send the declaration and it is gold.

I will write a writeup of all that pretty soon...

It seems no difficult but, at this moment I'm on a loop. I think I follow all steps, but I cannot get a CID and PIN for access to SNAP-R web.

I wrote a letter as described on http://www.bis.doc.gov/snap/pinsnapr.htm, and I sent it by email to SNAPR@bis.doc.gov as it's described. But they answer me with next email:
---------------------------------------------
You will have to submit a Statement Explaining what Item/Items you are Exporting and What Country.
>>> SNAPR 11/3/2010 1:29 PM >>>
{
The link is on the BIS web site SNAP-R page: http://www.bis.doc.gov/snap/index.htm
The link directly to the user manual is: http://www.bis.doc.gov/snapr/snapr_e...ser_manual.pdf
---------------------------------------------

But if you follow this links they will ask you for a CID and PIN. And start again

[tamhanna]

Hi,
sorry for my delayed response!

You just need to send in a form to requst the CIN and PIN! it then comes via email!

All the best
Tam Hanna

[espenr]

Hi,
sorry for my delayed response!

You just need to send in a form to requst the CIN and PIN! it then comes via email!

All the best
Tam Hanna

Could you explain in detail what exactly was needed? Which form/forms needs to be signed, with what, where do we get them from etc?

[tamhanna]

Hi,
sorry if I am a bit confused - there is some form you have to send in. I don't have it handy now - try to call them...

If they can't help, I will send you more info.

[nowheremanmail]

I'm in progress to get CCats documentation. It cost me some days to understand every think but now I'm on path.

in order to get snapr access you have to write a document with a brief description you want to export. After some days you will get a pin to access to web.
Then check http://www.bis.doc.gov/encryption/ma...64bitsnup.html
and unofficial web (sorry but it is for iphone :-)
http://zetetic.net/blog/2009/08/03/m...-8-easy-steps/

[tamhanna]

Hi,
this blog link looks cool.

One day I will write a wiki on this. One day....