[Federal Register Volume 68, Number 116 (Tuesday, June 17, 2003)]
[Rules and Regulations]
[Pages 35783-35787]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 03-15189]



 ========================================================================
 Rules and Regulations
                                                 Federal Register
 ________________________________________________________________________
 
 This section of the FEDERAL REGISTER contains regulatory documents 
 having general applicability and legal effect, most of which are keyed 
 to and codified in the Code of Federal Regulations, which is published 
 under 50 titles pursuant to 44 U.S.C. 1510.
 
 The Code of Federal Regulations is sold by the Superintendent of Documents. 
 Prices of new books are listed in the first FEDERAL REGISTER issue of each 
 week.
 
 ========================================================================
 

  Federal Register / Vol. 68, No. 116 / Tuesday, June 17, 2003 / Rules 
and Regulations  

[[Page 35783]]



DEPARTMENT OF COMMERCE

Bureau of Industry and Security

15 CFR Parts 734, 740, 742, 748, 770, and 774

[Docket No. 030529136-3136-01]
RIN 0694-AC78


Export Administration Regulations: Encryption Clarifications and 
Revisions

AGENCY: Bureau of Industry and Security, Commerce.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This rule amends the Export Administration Regulations (EAR) 
to clarify when encryption commodities and software may be given de 
minimis treatment, when short-range wireless devices incorporating 
encryption may be given mass market or retail treatment, and to provide 
guidance on when exporters are required to submit encryption review 
requests. It also expands the authorizations according to which 
travelers departing the United States may take encryption for their 
personal use, and clarifies that specially designed medical equipment 
and software are not controlled as encryption or ``information 
security'' items under the EAR. Finally this rule implements changes to 
the Wassenaar Arrangement List of dual-use items (agreed upon in the 
September 2002 meeting and finalized in December 2002) that eliminate 
from Export Control Classification Number (ECCN) 5A002 certain types of 
``Personalized smart cards'' and equipment specially designed and 
limited to controlling access to copyright protected data.

EFFECTIVE DATE: June 17, 2003.

FOR FURTHER INFORMATION CONTACT: Norman LaCroix, Acting Director, 
Information Technology Controls Division, Office of Strategic Trade and 
Foreign Policy Controls, Bureau of Industry and Security, U.S. 
Department of Commerce at (202) 482-4439.

SUPPLEMENTARY INFORMATION 

Background

    This rule amends Sec.  734.4(b) to clarify the de minimis 
eligibility of encryption items controlled for National Security 
(``NS'') or Anti-Terrorism (``AT'') reasons under the Export 
Administration Regulations (EAR), subject to the applicable 
notification or review requirements described in Sec.  740.13(e) and 
Sec.  742.15(b). As with other encryption items no longer subject to 
``EI'' controls (such as items classified under Export Control 
Classification Numbers (ECCNs) 5A992, 5D992 or 5E992), this rule 
clarifies that ECCN 5D002 encryption source code that would be 
considered publicly available under Sec.  734.3(b)(3) of the EAR (and 
the corresponding object code) is eligible for de minimis treatment 
once exporters have complied with the applicable notification 
requirement that releases such ECCN 5D002 software from ``EI'' 
controls.
    This rule also updates License Exception BAG and the Related 
Control notes to ECCN 5A002 relative to the Wassenaar Arrangement List 
of dual-use items, and in several sections of the EAR clarifies 
existing instructions related to encryption commodities and software 
pre-loaded onto laptops, handheld devices, computers or other 
equipment. This rule also adds a ``checklist'' on encryption and other 
``information security'' functions to Supplement 5 to part 742 of the 
EAR, to help exporters more fully consider and identify controlled 
encryption and ``information security'' components within their 
products, when making classification decisions and assessing whether an 
encryption review by BIS is required.
    Consistent with the standing export control agreement among 
Wassenaar Arrangement member nations, this rule also adds a nota bene 
(``NB'') immediately following Note 1 in Category 5 part II that 
clarifies that commodities and software specially designed for medical 
end-use that incorporate encryption items listed in Category 5 part II 
are not controlled by Category 5, part II of the Commerce Control List. 
This rule thus clarifies that a commodity or software product that is 
specially designed for medical end-use is classified as EAR99, even if 
the medical product incorporates another product, part or component 
that would otherwise be classified as 5A002, 5D002, 5A992 or 5D992.
    This rule expands the scope of License Exception BAG by allowing 
U.S. citizens or permanent resident aliens of the United States to 
export encryption commodities and software for their personal use to 
any destination except Country Group E:1. Persons other than U.S. 
citizens or permanent resident aliens of the United States (except 
nationals of countries listed in Country Group E:1 of Supplement No. 1 
to part 740 who are not U.S. citizens or permanent resident aliens of 
the United States) may also take such commodities and software as 
accompanying baggage for their personal use to any destination except 
Country Group E:1. This rule updates the provisions in 740.14(d) for 
``unaccompanied baggage'' by permitting shipments of personal use 
encryption commodities and software subject to ``EI'' controls to the 
same destinations that are permitted for CB, MT, NS and NP controlled 
items.
    In the Related Control notes to ECCN 5A002, the previous 
restriction to ``one-time'' copy control of copyright protected audio/
video data has been removed. Likewise, as is now the case for such 
playback audio/video data, software that is subject to the EAR but not 
specified on the Commerce Control List (i.e., items that are classified 
as EAR99) remains classified EAR99 when copy protected. Lastly, Related 
Control note (a) is amended and divided into two sub-paragraphs. 
[FEDREG][VOL]*[/VOL][NO]*[/NO][DATE]*[/
DATE][RULES][RULE][PREAMB][AGENCY]*[/AGENCY][SUBJECT]*[/SUBJECT][/
PREAMB][SUPLINF][HED]*[/HED]
    Although the Export Administration Act expired on August 20, 2001, 
Executive Order 13222 of August 17, 2001 (66 FR 44025, August 22, 
2001), as extended by the notice of August 14, 2002 (67 FR 53721, 
August 16, 2002), continues the Regulations in effect under the 
International Emergency Economic Powers Act.

Rulemaking Requirements

    1. This final rule has been determined to be not significant for 
purposes of E.O. 12866.
    2. Notwithstanding any other provision of law, no person is 
required to respond to, nor shall any person be subject to a penalty 
for failure to comply, with a collection of information subject to the 
requirements of the

[[Page 35784]]

Paperwork Reduction Act, unless that collection of information displays 
a currently valid Office of Management and Budget Control Number. This 
rule involves a collection of information subject to the Paperwork 
Reduction Act of 1980 (44 U.S.C. 3501 et seq.). This collection has 
been approved by the Office of Management and Budget under control 
number 0694-0088, ``Multi-Purpose Application,'' which carries a burden 
hour estimate of 45 minutes for a manual submission and 40 minutes for 
an electronic submission.
    3. This rule does not contain policies with Federalism implications 
as that term is defined under E.O. 13132.
    4. The provisions of the Administrative Procedure Act (5 U.S.C. 
553) requiring notice of proposed rulemaking, the opportunity for 
public participation, and a delay in effective date, are inapplicable 
because this regulation involves a military and foreign affairs 
function of the United States (5 U.S.C. 553(a)(1)). Further, no other 
law requires that a notice of proposed rulemaking and an opportunity 
for public comment be given for this interim rule. Because a notice of 
proposed rulemaking and an opportunity for public comment are not 
required to be given for this rule under the Administrative Procedure 
Act or by any other law, the analytical requirements of the Regulatory 
Flexibility Act (5 U.S.C. 601 et seq.) are not applicable. Therefore, 
this regulation is issued in final form. Although there is no formal 
comment period, public comments on this regulation and on proposals to 
further update the encryption provisions of the EAR are welcome on a 
continuing basis. Comments should be submitted to Sharron Cook, Office 
of Exporter Services, Bureau of Industry and Security, Department of 
Commerce, PO Box 273, Washington, DC 20044.

List of Subjects

15 CFR Part 734

    Administrative practice and procedure, Exports, Foreign trade, 
Reporting and recordkeeping requirements.

15 CFR Parts 740 and 748

    Administrative practice and procedure, Advisory committees, 
Exports, Foreign trade, Reporting and recordkeeping requirements.

15 CFR Parts 742, 770, and 774

    Exports, Foreign trade.

0
Accordingly, parts 734, 740, 742, 748, 770, and 774 of the Export 
Administration Regulations (15 CFR parts 730-799) are amended as 
follows:

PART 734--[AMENDED]

0
1. The authority citation for part 734 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 13020, 61 
FR 54079, 3 CFR, 1996 Comp. p. 219; E.O. 13026, 61 FR 58767, 3 CFR, 
1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 
783; notice of November 9, 2001, 66 FR 56965, 3 CFR, 2001 Comp., p. 
917; notice of August 14, 2002, 67 FR 53721, August 16, 2002.

0
2. Section 734.4 is amended by revising paragraph (b) to read as 
follows:


Sec.  734.4  De minimis U.S. content.

    (a) * * *
    (b) There is no de minimis level for foreign-made items that 
incorporate U.S.-origin items controlled for ``EI'' reasons under ECCN 
5A002, 5D002 or 5E002 on the Commerce Control List (Supplement No. 1 to 
part 774 the EAR). However, exporters may, as part of an encryption 
review request, ask that software controlled for EI reasons under ECCN 
5D002 and eligible for export under the ``retail'' or ``source code'' 
provisions of license exception ENC, and parts and components 
controlled under ECCN 5A002, be made eligible for de minimis treatment. 
The review of de minimis eligibility will take U.S. national security 
interests into account. Other encryption items controlled for NS or AT 
reasons under ECCNs 5D002, 5A992, 5D992, and 5E992 are not eligible for 
de minimis treatment, unless exporters have complied with the 
applicable notification or review requirements described in Sec.  
740.13(e), Sec.  742.15(b)(1), and Sec.  742.15(b)(2) of the EAR. 
Encryption items controlled by ECCN 5A992, 5D992, or 5E992 and 
described in Sec.  742.15(b)(3) of the EAR are not subject to these 
notification or review requirements.
* * * * *

PART 740--[AMENDED]

0
3. The authority citation for part 740 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
sec. 901-911, Pub. L. 106-387; E.O. 13026, 61 FR 58767, 3 CFR, 1996 
Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; 
notice of August 14, 2002, 67 FR 53721, August 16, 2002.

0
4. Section 740.9 is amended by revising paragraph (a)(2)(i) to read as 
follows:


Sec.  740.9  Temporary imports, exports, and reexports (TMP).

* * * * *
    (a) * * *
    (2) * * *
    (i) Tools of trade. Usual and reasonable kinds and quantities of 
tools of trade (commodities and software) for use by the exporter or 
employees of the exporter in a lawful enterprise or undertaking of the 
exporter. Eligible tools of trade may include, but are not limited to, 
such equipment and software as is necessary to commission or service 
goods, provided that the equipment or software is appropriate for this 
purpose and that all goods to be commissioned or serviced are of 
foreign origin, or if subject to the EAR, have been legally exported or 
reexported. The tools of trade must remain under the effective control 
of the exporter or the exporter's employee (see part 772 of the EAR for 
a definition of ``effective control''). All tools of trade may 
accompany the individual departing from the United States or may be 
shipped unaccompanied within one month before the individual's 
departure from the United States, or at any time after departure. No 
tools of the trade may be taken to Country Group E:2 (see Supplement 
No.1 to part 740) or Sudan. For exports under this License Exception of 
laptops, handheld devices and other computers and equipment loaded with 
encryption commodities or software, refer to item interpretation 13 in 
Sec.  770.2 of the EAR.
* * * * *
    5. Section 740.14 is amended by revising ``items'' in the last 
sentence of paragraph (b)(4) to read ``commodities and software'' and 
by revising paragraphs (d) and (f) to read as follows:


Sec.  740.14  Baggage (BAG).

* * * * *
    (d) Special provision: unaccompanied baggage. Individuals departing 
the United States may ship unaccompanied baggage, which is baggage sent 
from the United States on a carrier other than that on which an 
individual departs. Crew members of exporting carriers may not ship 
unaccompanied baggage. Unaccompanied shipments under this License 
Exception shall be clearly marked ``BAGGAGE.'' Shipments of 
unaccompanied baggage may be made at the time of, or within a 
reasonable time before or after departure of the consignee or owner 
from the United States. Personal baggage controlled for chemical and 
biological weapons (CB), missile technology (MT), national security 
(NS), encryption items (EI) or nuclear nonproliferation (NP) must be 
shipped within 3 months before or after the month in which the 
consignee or owner departs the United States. However, commodities 
controlled for

[[Page 35785]]

CB, MT, NS, EI or NP may not be exported under this License Exception 
as unaccompanied baggage to Country Groups D:1, D:2, D:3, D:4, or E:1. 
(See Supplement No. 1 of this part).
* * * * *
    (f) Special provisions: encryption commodities and software subject 
to EI controls on the Commerce Control List. (1) A U.S. citizen or 
permanent resident alien of the United States as defined by 8 U.S.C. 
1101(a)(20) may use this license exception to export or reexport 
encryption commodities and software to any destination not in Country 
Group E:1 of Supplement No. 1 of this part.
    (2) A person other than a U.S. citizen or permanent resident alien 
of the United States as defined by 8 U.S.C. 1101(a)(20) (except a 
national of a country listed in Country Group E:1 of Supplement No. 1 
of this part who is not a U.S. citizen or permanent resident alien of 
the United States) may also use this license exception to export or 
reexport encryption commodities and software to any destination not in 
Country Group E:1 of Supplement No. 1 of this part.

0
6. Section 740.17 is amended by revising paragraph (b)(3)(iii)(H) to 
read as follows:


Sec.  740.17  Encryption Commodities and Software (ENC).

* * * * *
    (b) * * *
    (3) * * *
    (iii) * * *
    (H) Short-range wireless components and software that do not 
qualify as mass market. Commodities and software that would not 
otherwise be controlled under Category 5 (telecommunications and 
``information security'') of the Commerce Control List, but which are 
controlled under ECCN 5A002 or 5D002 only because they incorporate 
components or software that provide short-range wireless encryption 
functions (e.g., with an operating range typically not exceeding 100 
meters), may be exported or reexported under the retail provisions of 
License Exception ENC, without review or reporting.
* * * * *

PART 742--[AMENDED]

0
7. The authority citation for part 742 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
18 U.S.C. 2510 et seq.; 22 U.S.C. 3201 et seq.; 42 U.S.C. 2139a; 
sec. 901-911, Pub. L. 106-387; sec. 221, Pub. L. 107-56; E.O. 12058, 
43 FR 20947, 3 CFR, 1978 Comp., p. 179; E.O. 12851, 58 FR 33181, 3 
CFR, 1993 Comp., p. 608; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., 
p. 950; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 
13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; notice of November 9, 
2001, 66 FR 56965, 3 CFR, 2001 Comp., p. 917; notice of August 14, 
2002, 67 FR 53721, August 16, 2002.

0
8. Section 742.15 is amended by revising the first two sentences of 
paragraph (b) (1), and revising paragraph (b)(3)(ii) to read as 
follows:


Sec.  742.15  Encryption items.

* * * * *
    (b) * * *
    (1) Notification requirement for specified encryption items. You 
may export or reexport encryption items controlled under ECCN 5A992, 
5D992 or 5E992 and identified in paragraphs (b)(1)(i) and (b)(1)(ii) of 
this section to most destinations without a license (NLR: No License 
Required), provided that you have submitted to BIS, by the time of 
export, the information described in paragraphs (a) through (e) of 
Supplement No. 6 of this part. For notifications submitted under 
paragraph (b)(1)(i) of this section, you must also provide specific 
information describing how your products qualify for mass market 
treatment under the criteria in the Cryptography Note (Note 3) of 
Category 5, Part 2, of the Commerce Control List (Supplement No. 1 to 
part 774 of the EAR). * * *
* * * * *
    (3) * * *
    (ii) Mass market short-range wireless commodities or software. Mass 
market commodities or software that would not otherwise be controlled 
under Category 5 (telecommunications and ``information security'') of 
the Commerce Control List, but which are controlled under ECCN 5A992 or 
5D992 only because they incorporate components or software that provide 
short-range wireless encryption functions (e.g., wireless products with 
an operating range typically not exceeding 100 meters).
* * * * *

0
9. Part 742 is amended by adding a new Supplement No. 5 to read as 
follows:

SUPPLEMENT NO. 5 TO PART 742--CHECKLIST ON ENCRYPTION AND OTHER 
``INFORMATION SECURITY'' FUNCTIONS

    1. Does your product perform ``cryptography'', or otherwise 
contain any parts or components that are capable of performing any 
of the following ``information security'' functions? (Mark with an 
``X'' all that apply)
a. ---- encryption
b. ---- decryption only (no encryption)
c. ---- key management/public key infrastructure (PKI)
d. ---- authentication (e.g., password protection, digital 
signatures)
e. ---- copy protection
f. ---- anti-virus protection
g. ---- other (please
    explain) :--------------------
h. ---- NONE/NOT APPLICABLE
    2. For items with encryption, decryption and/or key management 
functions (1.a, 1.b, 1.c above):
    a. What symmetric algorithms and key lengths (e.g., 56-bit DES, 
112/168-bit Triple-DES, 128/256-bit AES/Rijndael) are implemented or 
supported?
    b. What asymmetric algorithms and key lengths (e.g., 512-bit 
RSA/Diffie-Hellman, 1024/2048-bit RSA/Diffie-Hellman) are 
implemented or supported?
    c. What encryption protocols (e.g., SSL, SSH, IPSEC or PKCS 
standards) are implemented or supported?
    d. What type of data is encrypted?
    3. For products that contain an ``encryption component'', can 
this encryption component be easily used by another product, or else 
accessed/re-transferred by the end-user for cryptographic use?

PART 748--[AMENDED]

0
10. The authority citation for part 748 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 
FR 44025, 3 CFR, 2001 Comp., p. 783; notice of August 14, 2002, 67 
FR 53721, August 16, 2002.

0
11. Section 748.3 is amended by adding a sentence to the end of 
paragraph (a), and revising (d) to read as follows:


Sec.  748.3  Classification requests, advisory opinions, and encryption 
review requests.

    (a) Introduction. * * * A review of the questions provided in 
Supplement No. 5 to part 742 of the EAR may assist in determining 
whether you must submit an encryption review request (see paragraph (d) 
of this section) for your particular item.
* * * * *
    (d) Review requests for encryption items. A Department of Commerce 
review of encryption items transferred from the U.S. Munitions List 
consistent with Executive Order 13026 of November 15, 1996 (3 CFR, 1996 
Comp., p. 228) and pursuant to the Presidential Memorandum of that date 
may be required to determine eligibility under License Exception ENC or 
for release from ``EI'' controls. Refer to Supplement No. 5 to part 742 
of the EAR for questions that provide initial guidance in determining 
whether you must submit an encryption review request for your item. 
Refer to Supplement No. 6 to part 742 of the EAR for a complete list of 
technical information that is required for encryption review requests. 
Refer

[[Page 35786]]

also to Sec.  742.15(b) of the EAR for instructions regarding mass 
market encryption commodities and software. Refer to Sec.  740.17 of 
the EAR for the provisions of License Exception ENC.

0
12. Part 748, Supplement No. 1 is amended by revising the paragraph 
labeled ``Block 5'' to read as follows:

SUPPLEMENT NO. 1 TO PART 748-BIS-748P, BIS-748P-A; ITEM APPENDIX, AND 
BIS-748P-B; END USER APPENDIX; MULTIPURPOSE APPLICATION INSTRUCTIONS

* * * * *
    Block 5: Type of Application. Export. If the items are located 
within the United States, and you wish to export those items, mark 
the Box labeled ``Export'' with an (X). Reexport. If the items are 
located outside the United States, mark the Box labeled ``Reexport'' 
with an (X). Classification. If you are requesting BIS to classify 
your item against the Commerce Control List (CCL), mark the Box 
labeled ``Classification Request'' with an (X). Encryption Review. 
If you are requesting encryption review under License Exception ENC 
(Sec.  740.17 of the EAR) or ``mass market'' encryption provisions 
(Sec.  742.15(b)(2) of the EAR), mark the Box labeled 
``Classification Request'' with an (X). Special Comprehensive 
License. If you are submitting a Special Comprehensive License 
application in accordance with the procedures described in part 752 
of the EAR, mark the Box labeled ``Special Comprehensive License'' 
with an (X).
* * * * *


0
13. Part 748, Supplement No. 2 is amended by adding a new paragraph (r) 
immediately following paragraph (q) and reading as follows:

SUPPLEMENT NO. 2 TO PART 748--UNIQUE LICENSE APPLICATION REQUIREMENTS

* * * * *
    (r) Encryption review requests. Enter, in Block 9 (Special 
Purpose) of the BIS-748P, ``License Exception ENC'' if you are 
submitting an encryption review request for License Exception ENC 
(Sec.  740.17 of the EAR) or ``mass market encryption'' if you are 
submitting an encryption review request under the mass market 
encryption provisions (Sec.  742.15(b)(2) of the EAR). If you seek 
an encryption review for another reason, enter ``encryption--
other''.

PART 770--[AMENDED]

0
14. The authority citation for part 770 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; notice of August 
14, 2002, 67 FR 53721, August 16, 2002.


0
15. Section 770.2 is amended by revising paragraph (m) to read as 
follows:


Sec.  770.2  Item interpretations.

* * * * *
    (m) Interpretation 13: Encryption commodities and software 
controlled for EI reasons. Encryption commodities and software 
controlled for EI reasons under ECCNs 5A002 and 5D002 may be pre-loaded 
on a laptop, handheld device or other computer or equipment and 
exported under the tools of trade provision of License Exception TMP or 
the personal use exemption under License Exception BAG, subject to the 
terms and conditions of such License Exceptions. This provision 
replaces the personal use exemption of the International Traffic and 
Arms Regulations (ITAR) that existed for such software prior to 
December 30, 1996. Neither License Exception TMP nor License Exception 
BAG contains a reporting requirement. Like other ``information 
security'' ``software'', components, ``electronic assemblies'' or 
modules, the control status of encryption commodities and software is 
determined in Category 5, part 2 even if they are bundled, commingled 
or incorporated in a computer or other equipment. However, commodities 
and software specially designed for medical end-use that incorporate an 
item in Category 5, part 2 are not controlled in Category 5, part 2. 
See Note 1 to Category 5, part 2 (``Information Security'') of 
Supplement No. 1 to Part 774 (the Commerce Control List) of the EAR.
* * * * *

PART 774--[AMENDED]

Supplement No. 1 to Part 774 (The Commerce Control List)--[Amended]

0
16. The authority citation for part 774 continues to read as follows:

    Authority: 50 U.S.C. app. 2401 et seq.; 50 U.S.C. 1701 et seq.; 
10 U.S.C. 7420; 10 U.S.C. 7430(e); 18 U.S.C. 2510 et seq.; 22 U.S.C. 
287c, 22 U.S.C. 3201 et seq., 22 U.S.C. 6004; 30 U.S.C. 185(s), 
185(u); 42 U.S.C. 2139a; 42 U.S.C. 6212; 43 U.S.C. 1354; 46 U.S.C. 
app. 466c; 50 U.S.C. app. 5; sec. 901-911, Pub. L. 106-387; sec. 
221, Pub. L. 107-56; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 
228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; notice of 
August 14, 2002, 67 FR 53721, August 16, 2002.

0
17. Supplement No. 1 to Part 774 (Commerce Control List), Category 5--
Telecommunications and ``Information Security'', following the heading 
II--``INFORMATION SECURITY'' is amended by adding a new Nota Bene 
(``N.B.'') immediately following Note 1, and amending Export Control 
Classification Number (ECCN) 5A002 by revising the Related Controls 
paragraph of the List of Items Controlled section as set forth below:

SUPPLEMENT NO. 1 TO PART 774--THE COMMERCE CONTROL LIST

* * * * *

Category 5--Telecommunications and ``Information Security''

* * * * *

Part II. ``Information Security''

    Note 1: * * *
    N.B. to Note 1: Commodities and software specially designed for 
medical end-use that incorporate an item in Category 5, part 2 are 
not classified in any ECCN in Category 5, part 2.
* * * * *

A. SYSTEMS, EQUIPMENT AND COMPONENTS

    5A002 Systems, equipment, application specific ``electronic 
assemblies'', modules and integrated circuits for ``information 
security'', as follows (see List of Items Controlled), and other 
specially designed components therefor.
* * * * *

List of Items Controlled

Unit * * *

    Related Controls: See also 5A992. This entry does not control: 
(a) ``Personalized smart cards'': (1) Where the cryptographic 
capability is restricted for use in equipment or systems excluded 
from control paragraphs (b) through (f) of this note; or (2) For 
general public-use applications where the cryptographic capability 
is not user-accessible and it is specially designed and limited to 
allow protection of personal data stored within. Note that if a 
``personalized smart card'' has multiple functions, the control 
status of each function is assessed individually; (b) Receiving 
equipment for radio broadcast, pay television or similar restricted 
audience broadcast of the consumer type, without digital encryption 
except that exclusively used for sending the billing or program-
related information back to the broadcast providers; (c) Portable or 
mobile radiotelephones for civil use (e.g., for use with commercial 
civil cellular radio communications systems) that are not capable of 
end-to-end encryption; (d) Equipment where the cryptographic 
capability is not user-accessible and which is specially designed 
and limited to allow any of the following: (1) Execution of copy-
protected ``software''; (2) Access to any of the following: (a) 
Copy-protected contents stored on read-only media; or (b) 
Information stored in encrypted form on media (e.g., in connection 
with the protection of intellectual property rights) where the media 
is offered for sale in identical sets to the public; or (3) Copying 
control of copyright protected audio/video data; (e) Cryptographic 
equipment specially designed and limited for banking use or money 
transactions; (f) Cordless telephone equipment not capable of end-
to-end encryption where the maximum effective range of unboosted 
cordless operation (e.g., a single, unrelayed hop between terminal 
and home basestation) is less than 400 meters according to the 
manufacturer's specifications. These items are controlled under ECCN 
5A992.

[[Page 35787]]

    Related Definitions: * * *
    Items: * * *

    Dated: June 10, 2003.
James J. Jochum,
Assistant Secretary for Export Administration.
[FR Doc. 03-15189 Filed 6-16-03; 8:45 am]
BILLING CODE 3510-33-P