Publishing apps that contain encryption

[hvuoltee]

Hi,

I'm getting frustrated with this. When attempting to submit an app, I get this:

"A copy of the commodity classification ruling (CCATS) confirming classification of the content under ECCN 5D992, as a mass market encryption item under section 742.15(b)(2) of the Export Administration Regulations OR a copy of the “Notification” described in 742.15(b)(1), must be attached"

I've been reading through 742.15:
http://law.justia.com/cfr/title15/15...26.0.1.14.html

The section (b)(1) specifically states that:

(1) Notification requirement for specified encryption items. You may export or reexport encryption items controlled under ECCNs 5A992, 5D992, or 5E992 and identified in paragraphs (b)(1)(i) or (b)(1)(ii) of this section to most destinations without a license (NLR: No License Required), provided that you have submitted to BIS and to the ENC Encryption Request Coordinator at crypt@bis.doc.gov and enc@nsa.gov, by the time of export, the information described in paragraphs (a) through (e) of Supplement No. 6 to this part. If you are unsure as to whether your encryption items are eligible for export or reexport under this paragraph (b)(1), you should submit a request, to BIS and to the ENC Encryption Request Coordinator, for a review of your encryption items pursuant to the requirements of paragraph (b)(2) of this section (for mass market encryption commodities and software), or under the provisions of License Exception ENC (see §740.17 of the EAR). The following encryption items controlled by ECCN 5A992, 5D992, or 5E992 are eligible for export or reexport without a license, to most destinations, with notification only:
(i) Up to (and including) 64-bit mass market encryption commodities and software;
(ii) Encryption items (including key management products and company proprietary implementations) with key lengths not exceeding 56 bits for symmetric algorithms, 512 bits for asymmetric key exchange algorithms, and 112 bits for elliptic curve algorithms;

I started following the references to other laws and regulations, but I didn't get far. Too much legalese.

Could someone at Nokia provide a simple guide of getting this done?

Does anyone know if filling the 742 supplement 6 is enough, or do I need to do more?

[Andrew Nokia]

Hi,

I'm getting frustrated with this. When attempting to submit an app, I get this:



I've been reading through 742.15:
http://law.justia.com/cfr/title15/15...26.0.1.14.html

The section (b)(1) specifically states that:

I started following the references to other laws and regulations, but I didn't get far. Too much legalese.

Could someone at Nokia provide a simple guide of getting this done?

Does anyone know if filling the 742 supplement 6 is enough, or do I need to do more?

I will ask around and see if i can find further instructions for this. Please stay tuned.

[hvuoltee]

Thanks!

It would be great if you used your lawyers to help cover at least some of the most common cases.

In our case, we are using the bouncycastle library to implement encryption for our client-server communication channel. While it's not quite HTTPS, it still shouldn't be this difficult to figure out the legal stuff



-Heikki

[hvuoltee]

Any updates?

[Andrew Nokia]

Hi Heikki,

I'm verifying with the legal team if the CCATs documents are required for your case.

I will update you when I hear further information on this.

Andrew