United StatesEAR published and publicly available encryption source code
15 C.F.R. 734.3(b)(3), 734.7(b), 742.15(b)
In force since .
An encryption items rule binding private bodies.
As of .
What it requires
- Before you treat published encryption source code as outside the EAR, confirm that it is publicly available under 15 C.F.R. 734.3(b)(3) and 734.7, that is, made available to the public without restrictions upon its further dissemination, for example by posting it on the internet on sites available to the public (15 C.F.R. 734.7(a), (a)(4)).
- If the published source code provides or performs non-standard cryptography as defined in part 772 of the EAR, email BIS (crypt@bis.doc.gov) and the ENC Encryption Request Coordinator (enc@nsa.gov) the internet location of the code or a copy of it, send a new copy each time its cryptographic functionality is updated or modified, and give notice each time the internet location changes (15 C.F.R. 742.15(b)(2)).
- Do not rely on publication to take mass market encryption software outside the EAR until you have completed the classification or self-classification that 15 C.F.R. 740.17(b) requires.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A willful violation, attempt or conspiracy is punishable by a fine of up to $1,000,000 and, for an individual, imprisonment of up to 20 years, or both (50 U.S.C. 4819(b)).
Penalty structure
The statute sets the greater of $300,000 or twice the value of the transaction that is the basis of the violation; the amount coded is the inflation-adjusted maximum that Commerce publishes.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 374,474
Who enforces it
Enforcement body
Department of Commerce, which imposes civil penalties through the Secretary of Commerce under 50 U.S.C. 4819(c); willful violations are criminal offenses under 50 U.S.C. 4819(b).
What it reaches
Obligation class
Reporting, Licensing
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- The source code is encryption source code classified under ECCN 5D002.
- The source code, or its object code, is published or made publicly available as 15 C.F.R. 734.3(b)(3) and 734.7 describe.
What this law does
Publicly available encryption source code classified under ECCN 5D002 is not subject to the EAR, even if a licensing fee or royalty is charged for commercial production or sale of any product developed using it (section 742.15(b)(1)).
Where the source code provides or performs non-standard cryptography as defined in part 772, the publisher must email BIS and the ENC Encryption Request Coordinator the internet location of the code or a copy of it, send further copies each time its cryptographic functionality is updated or modified, and give notice each time the internet location changes (742.15(b)(2)); a rule effective removed the notification requirement for the majority of publicly available software.
Publicly available encryption object code classified under ECCN 5D002 is outside the EAR only when its source code meets the 742.15(b) criteria (734.7(b)), and mass market encryption software that would be publicly available stays subject to the EAR until the classification or self-classification in 740.17 is complete.
When LexLint raises it
When your app profile says your app ships encryption.