ÿWPC’ 5®CÎXÇí©ÿ‘‰nÚïÍ Ý¹‡sÔpéláqý°œKÍÆÍ%b¢ŽI€ rD:æ ïZMñšQÐÛßSD¿Gˆ*ì’ÎùCâäªSG&µø5C@‘Ö¥'™™!v¬¸›Á4¶”ñ/f£EAk¦Ûpœpئ€¾­[ú¸l¢»jî]]:aï¦þè sFØjÊPm“A’“hÅízöå~[;s‰‰¢ƒ´Ç®…¬1=Ìfü²PÅj­k„¹ÏTQ ö,ZTy㽇o»müs+‘"àO±ðíéÌ!ùÛ¢ÕŽÓÊÜ'?¶CõѶâ·_pžÿÿVÂÇïCB ñ „ܲ9aÙhØãö‹Õ–ñIƒ×ŽC™Ð¿¹^ 7qõtþQy..3ûŸ5óœƒõQ£NîýÑÓØ³;G7c¦Å*¦–¬Ï €¿ æLs8BÀ ·q*¶ÎŸ5c2ô°R¸ÑM|x0ìSXÿ†$h9'£­(%Ù$?Cdæœh¥Ö²²uH):ùUµÓ>^E;™Ÿ2ïbÙy¸’ªþ_4Xv“f“×7Ö®”o4б0Lþ¡§¯KÊ[CCaR©š~‹ØÍùf;[>iŽ`ïRŸ‘cŠƒîõÃ)¾/àÁ_üêö U N~ %ÌÒ 04âw@4^U r(ÈhH  Z ‹6Times New Roman RegularX3|xO( ¤T$¡¡Ó  Ó FDGeHr‚IJeKDLUMENOØzØ 'ô\  `Ý ƒ¤T!ÝÓ  ÓÝ  ÝñGñ›ñGññGñ›ñGñÑ7€³XXdðdÈ7ÑÑ  ÑÓ°°œXÓÓ€ÓÌà  àñGñœñGñÓ|°(` ¸ hÀpÈ xÐ (#€%Ø'0*ˆ,à.813è5@8˜:ð<H? AøCPF¨HKXM°OR`T¸VYh[À]`pb°ÓñGñ›ñGñÌà  àà ` àà ¸ àà  àà h àà À àà  àà p àBilling€Code:€3510„33„Pà Ð àÐ €Ð Ðà  àà ` àà ¸ àà  àà h àà À àà  àà p àÌDEPARTMENT€OF€COMMERCEÌÌBureau€of€Export€AdministrationÌÌ15€CFR€Parts€734,€740,€742,€762€and€774ÌÌ[Docket€No.€ñGñœñGñ960918265-ñEñ6296„02ñEññFñ›€›€›€›€ñFñ]ñGñ›ñGñÌÌRIN:€0694-AB09ÌÌLicensing€of€key€escrow€encryption€equipment€and€software.ÌÌAGENCY:€€Bureau€of€Export€Administration,€CommerceÌÌACTION:€€Interim€final€rule.ÌÌThis€interim€ñGñœñGñfinal€ruleñGñ›ñGñ€amends€the€Export€Administration€Regulations€(EAR)€by€imposingÏnational€ñGñœñGñsecurity€controls€on€key€escrow€information€security€(encryption)€equipment€andÏsoftware€transferred€from€the€U.S.€Munitions€List€to€the€Commerce€Control€List€following€aÏcommodity€jurisdiction€determination€by€the€Department€of€State.ÌÌThis€interim€final€rule€also€amends€the€EAR€to€exclude€key€escrow€items€from€the€òòde€minimisóóÐ Ø'(#2 Ðprovisions€for€items€exported€from€abroad€and€to€exclude€key€escrow€encryption€software€fromÏmass€market€eligibility.€€Further,€key€escrow€encryption€software€is€subject€to€the€EAR€evenÏwhen€made€publicly€available.ÌÐ x-È(: ÐEFFECTIVE€DATE:€€(THIS€RULE€IS€EFFECTIVE:€DATE€OF€PUBLICATION).ÌÌADDRESSES:€Written€comments€should€be€sent€to€Nancy€Crowe,€Regulatory€Policy€Division,ÏOffice€of€Exporter€Services,€Bureau€of€Export€Administration,€Room€2705,€14th€Street€andÏPennsylvania€Avenue,€N.W.,€Washington,€D.C.€€20230.ÌÌFOR€FURTHER€INFORMATION€CONTACT:€James€A€Lewis,€Office€of€Strategic€Trade€andÏForeign€Policy€Controls,€Telephone€(202)€482-0092ÌÌSUPPLEMENTARY€INFORMATION:ÌÌBackgroundÌÌIn€August€1995€the€United€States€decided€to€ease€export€licensing€requirements€forñGñ›ñGñ€key€escrowÏencryption€software€products.€€As€part€of€this€decision€to€allow€the€export€of€these€products,€draftÏcriteria€were€developed€for€key€escrow€products€and€for€key€holders.€€Products€that€conform€toÏthese€criteria€will€be€considered€for€transfer€from€the€U.S.€Munitions€List€to€the€CommerceÏControl€List€following€a€case-by-case€determination€by€the€Department€of€State€through€theÏcommodity€jurisdiction€procedures.€ÌÌOnce€transferred,€key€escrow€encryption€items€will€be€controlled€for€ñGñœñGñnational€security€reasons.€€AÏlicense€will€be€required€from€the€Department€of€Commerce€to€all€destinations,€except€Canada.€ÏThisñGñ›ñGñ€is€an€initial€step€in€liberalizing€the€treatment€of€encryption€ñGñœñGñexports.ÌÌTheÔ‡X³XXXÔ€Bureau€of€Export€Administration€is€preparing€regulations€to€further€implement€theÐ ((À!0 ÐAdministrationððs€encryption€policies,€which€will€be€published€in€the€Federal€Register€in€the€nearÏfuture.Ô#†X³XXX³Š #ÔÔ‡X³XXX³Ô€€These€further€measures€are€based€upon€the€Administrationððs€October€1,€1996Ð ø*$4 Ðannouncement€of€plans€to€make€it€easier€for€Americans€to€use€stronger€encryption€products€toÏprotect€their€privacy,€intellectual€property€and€other€valuable€information,€and€the€November€15,Ð È-`'8 Ð1996,€Ô#†X³XXX³Ÿ #Ô€Presidential€Memorandum€and€Executive€Order€13026€(15€November€1996,€61€FR€58767)Ð h Ðdirecting€that€all€encryption€items€controlled€on€the€U.S.€Munitions€List,€except€thoseÏspecifically€designed,€developed,€configured,€adapted,€or€modified€for€military€applications,€beÏtransferred€to€the€Commerce€Control€List.Ô‡X³XXX³Ô€€The€plan€to€make€it€easier€for€Americans€to€useÐ   8 Ðstronger€encryption€products€to€protect€their€privacy,€intellectual€property€and€other€valuableÏinformationÔ#†X³XXX³g#ÔÔ‡X³XXX³Ô€envisions€a€worldwide€key€management€infrastructure€with€the€use€of€key€recoveryÐ p   Ðand€key€escrow€encryption€items€to€promote€electronic€commerce€and€secure€communicationsÏwhile€protecting€national€security€and€public€safety.Ô#†X³XXX³Z#Ô€€The€Memorandum€sets€forth€certainÐ @Ø  Ðadditional€provisions€with€respect€to€controls€on€such€encryption€items€to€be€imposed€by€theÏDepartment€of€Commerce.€The€Executive€Order€also€provides€for€appropriate€controls€on€theÏexport€and€foreign€dissemination€of€encryption€items€controlled€on€the€U.S.€Munitions€List€thatÏare€placed€on€the€Commerce€Control€List.Ô‡X³XXX³ÔÐ àx ÐÔ#†X³XXX³#ÔÌThis€interim€final€rule€amends€that€EAR€to€reflect€the€new€licensing€policy€for€key€escrowÏencryption€items.€€TheñGñ›ñGñ€Bureau€of€Export€Administration€will€accept€license€applications€for€theÏexport€and€reexport€of€key€escrow€encryption€items€in€unlimited€quantities€for€all€destinationsÏexcept€to€embargoed€destinations€and€destinations€the€Secretary€of€State€has€determined€toÏsupport€international€terrorism.€€Such€applications€will€receive€favorable€consideration€providedÏthat,€prior€to€the€export€or€reexport,€a€key€holder€satisfactory€to€the€Department€of€Commerce€hasÏbeen€identified€(see€new€Supplement€No.€5€part€742)€and€procedures€for€safeguarding€the€key€asÏdescribed€in€a€Supplement€No.€5€to€part€742€are€established€to€the€satisfaction€of€the€DepartmentÏof€Commerce€and€are€maintained€after€export€or€reexport€as€required€by€the€EAR€and€any€licenseÏconditions.€€In€addition,€the€key€escrow€system€must€meet€the€criteria€identified€in€a€newÏSupplement€No.€4€to€part€742.ÌÌThis€interim€final€rule€also€amends€part€734€of€the€EAR€to€reflect€that€key€escrow€encryptionÏsoftware€will€be€subject€to€the€EAR€even€when€made€publicly€available,€and€to€exclude€keyÏescrow€encryption€software€and€items€from€the€òòde€minimisóó€provision€for€items.€€Further,€thisÐ `,ø%6 Ðinterim€final€rule€amends€part€740€of€the€EAR€to€exclude€key€escrow€encryption€software€fromÐ È-`'8 Ðthe€mass€market€provisions€of€License€Exception€TSU,€and€amends€part€762€of€the€EAR€toÏclarify€the€additional€records€that€must€be€kept€for€compliance€with€the€recordkeeping€provisionsÏof€the€EAR.ÌÌFinally,€this€interim€final€rule€also€amends€Supplement€No.€1€to€part€774€(the€Commerce€ControlÏList)€by€clarifying€that€once€transferred€from€the€U.S.€Munitions€List€(USML)€to€the€CommerceÌControl€List€(CCL)€following€a€case-by-case€determination€by€the€Department€of€State€throughÏthe€commodity€jurisdiction€ñGñœñGñprocedures,ñGñ›ñGñ€key€escrow€encryption€items€and€software€are€controlledÏon€the€CCL€under€Export€Control€Classification€Numbers€5A002.a€and€5D002.c.1€respectively.ÌÌThis€rule€involves€no€new€curtailment€of€exports,€because€the€transfer€or€removal€of€items€fromÏthe€United€States€Munitions€List€to€the€CCL€maintains€a€continuity€of€controls.€€Therefore,€theÏprovisions€regarding€the€impact€of€new€controls€do€not€apply,€and€contract€sanctity€also€does€notÏapply€to€this€imposition€of€controls.ÌÌConsistent€with€the€provisions€of€section€6€of€the€Export€Administration€Act,€a€foreign€policyÏreport€was€submitted€to€Congress€on€(DATE€OF€REPORT),€notifying€the€Congress€of€theÌDepartment's€intention€to€impose€foreign€policy€controls€ñGñœñGñonñGñ›ñGñ€key€escrow€encryption€products.€ÌÌAlthough€the€Export€Administration€Act€(EAA)€expired€on€August€20,€1994,€the€PresidentÏinvoked€the€International€Emergency€Economic€Powers€Act€and€continued€in€effect,€to€the€extentÏpermitted€by€law,€the€provisions€of€the€EAA€and€the€EAR€in€Executive€Order€12924€of€AugustÏ19,€1994,€notice€of€August€15,€1995€(60€FR€42767),€and€notice€of€August€14,€1996€(60€FRÏ42527).ÌÌà  à1.€€This€interim€final€rule€has€been€determined€to€be€significant€for€purposes€of€E.€O.Ï12866.ÌÌà  à2.€€Notwithstanding€any€other€provision€of€the€law,€no€person€is€required€to€respond€to,Ð È-`'8 Ðnor€shall€any€person€be€subject€to€a€penalty€for€failure€to€comply€with€a€collection€of€information,Ïsubject€to€the€requirements€of€the€Paperwork€Reduction€Act,€unless€that€collection€of€informationÏdisplays€a€currently€valid€OMB€Control€Number.€This€rule€involves€collections€of€informationÏsubject€to€the€Paperwork€Reduction€Act€of€1980€(44€U.S.C.€3501€et€seq.).€These€collections€haveÏbeen€approved€by€the€Office€of€Management€and€Budget€under€control€numbers€œ0694-0088ñMñ€ñMññNñ.ÌñNññNñ›ñNññMñand€›ò òñMññKñ0694„xxxx.ñKññMñó óñMññKñ›Ð    ЛÐ    ÐñKññMñ›ñMññLñÌñLñ›à  à€3.€€This€rule€does€not€contain€policies€with€Federalism€implications€sufficient€to€warrantÏpreparation€of€a€Federalism€assessment€under€Executive€Order€12612.ÌÌÌà  à4.€€The€provisions€of€the€Administrative€Procedure€Act€(5€U.S.C.€553)€requiring€notice€ofÏproposed€rulemaking,€the€opportunity€for€public€participation,€and€a€delay€in€effective€date,€areÏinapplicable€because€this€regulation€involves€a€military€and€foreign€affairs€function€of€the€UnitedÏStates€(Sec.€5€U.S.C.€553(a)(1)).€€Further,€no€other€law€requires€that€a€notice€of€proposedÏrulemaking€and€an€opportunity€for€public€comment€be€given€for€this€interim€final€rule.€€BecauseÏa€notice€of€proposed€rulemaking€and€an€opportunity€for€public€comment€are€not€required€to€beÏgiven€for€this€rule€under€5€U.S.C.€or€by€any€other€law,€the€requirements€of€the€RegulatoryÏFlexibility€Act€(5€U.S.C.€601€òòet€seq.óó€)€are€not€applicable.Ð Pè" ÐÌà  àHowever,€because€of€the€importance€of€the€issues€raised€by€these€regulations,€this€rule€isÏissued€in€interim€final€form€and€comments€will€be€considered€in€the€development€of€finalÏregulations.€€Accordingly,€the€Department€encourages€interested€persons€who€wish€to€commentÏto€do€so€at€the€earliest€possible€time€to€permit€the€fullest€consideration€of€their€views.ÌÌà  àThe€period€for€submission€of€comments€will€close€(INSERT€DATE€30€DAYS€AFTERÏDATE€OF€PUBLICATION).€€The€Department€will€consider€all€comments€received€before€theÏclose€of€the€comment€period€in€developing€final€regulations.€€Comments€received€after€the€end€ofÏthe€comment€period€will€be€considered€if€possible,€but€their€consideration€cannot€be€assured.€ÏThe€Department€will€not€accept€public€comments€accompanied€by€a€request€that€a€part€or€all€ofÐ È-`'8 Ðthe€material€be€treated€confidentially€because€of€its€business€proprietary€nature€or€for€any€otherÏreason.€€The€Department€will€return€such€comments€and€materials€to€the€person€submitting€theÏcomments€and€will€not€consider€them€in€the€development€of€final€regulations.€€All€publicÏcomments€on€these€regulations€will€be€a€matter€of€public€record€and€will€be€available€for€publicÏinspection€and€copying.€€In€the€interest€of€accuracy€and€completeness,€the€Department€requiresÏcomments€in€written€form.€ÌÌà  àOral€comments€must€be€followed€by€written€memoranda,€which€will€also€be€a€matter€ofÏpublic€record€and€will€be€available€for€public€review€and€copying.€€Communications€fromÏagencies€of€the€United€States€Government€or€foreign€governments€will€not€be€made€available€forÏpublic€inspection.ÌÌà  àThe€public€record€concerning€these€regulations€will€be€maintained€in€the€Bureau€ofÏExport€Administration€Freedom€of€Information€Records€Inspection€Facility,€Room€4525,ÏDepartment€of€Commerce,€14th€Street€and€Pennsylvania€Avenue,€N.W.,€Washington,€DC€Ï20230.€€Records€in€this€facility,€including€written€public€comments€and€memoranda€summarizingÏthe€substance€of€oral€communications,€may€be€inspected€and€copied€in€accordance€withÏregulations€published€in€Part€4€of€Title€15€of€the€Code€of€Federal€Regulations.€€Information€aboutÏthe€inspection€and€copying€of€records€at€the€facility€may€be€obtained€from€Margaret€Cornejo,ÏBureau€of€Export€Administration€Freedom€of€Information€Officer,€at€the€above€address€or€byÏcalling€(202)€482-5653.ÌÌList€of€SubjectsÌÌ15€CFR€part€734ÌÌà  àAdministrative€practice€and€procedure,€Exports,€Foreign€trade.ÌÌ15€CFR€parts€740Ð È-`'8 Їà  àAdministrative€practice€and€procedure,€Exports,€Foreign€trade,€Reporting€andÏRecordkeeping€requirements.€Ì€€€€Ì15€CFR€part€762ÌÌà  àAdministrative€practice€and€procedures,€Business€and€industry,€Confidential€businessÏinformation,€Export,€Foreign€trade,€Reporting€and€recordkeeping€requirements.ÌÌñGñœñGñ15ñGñ›ñGñ€CFR€parts€742€and€774ÌÌà  àExports,€Foreign€trade.ÌÌà  àAccordingly,€parts€734,€740,€742,€762€and€774€of€the€Export€Administration€RegulationsÏ(15€CFR€Parts€730-799)€are€amended€as€follows:ÌñGñœñGñà  à1.€€The€authority€citation€for€15€CFR€part€734€continues€to€read€as€follows:ÌÔ‡X³XXX³ÔÌà  àòòAuthorityóó:€50€U.S.C.€app.€2401€òòet€seqóó.;€50€U.S.C.€1701€òòet€seqóó.;€€E.O.€12924,€59€FRÐ è€  Ð43437,€3€CFR,€1994€Comp.,€p.€917;€E.O.€12938,€59€FR€59099,€3€CFR,€1994€Comp.,€p.€950;ÏExecutive€Order€13026€(November€15,€1996,€61€FR€58767);€Notice€of€August€15,€1995€(60€FRÏ42767,€August€17,€1995);€and€Notice€of€August€14,€1996€(61€FR€42527).€€òòÐ  !¸& ÐóóÔ#†X³XXX³ù2#ÔÌÌà  à2.€€The€authority€citation€for€15€CFR€part€740€continues€to€read€as€follows:ÌÌÔ‡X³XXX³Ôà  àòòAuthorityóó:€€50€U.S.C.€app.€2401€òòet€seqóó.;€50€U.S.C.€1701€òòet€seqóó.;€E.O.€12924,€59€FRÐ ((À!0 Ð43437,€3€CFR,€1994€Comp.,€p.€917;€Executive€Order€13026€(November€15,€1996,€61€FR€58767);ÏNotice€of€August€15,€1995€(60€FR€42767,€August€17,€1995);€and€Notice€of€August€14,€1996€(61ÏFR€42527).€€Ô#†X³XXX³.5#ÔÐ `,ø%6 ÐÐ È-`'8 Ðà  à3.€€The€authority€citation€for€15€CFR€part€742€continues€to€read€as€follows:ÌÌà  àòòÔ‡X³XXX³ÔAuthorityóó:€50€U.S.C.€app.€2401€òòet€seqóó.;€50€U.S.C.€1701€òòet€seqóó.;€18€U.S.C.€2510€òòet€seqóó.;€22Ð 8 Ð ÐU.S.C.€3201€òòet€seqóó.;€42€U.S.C.€2139a;€€E.O.€12058,€43€FR€20947,€3€CFR,€1978€Comp.,€p.€179;Ð   8 ÐE.O.€12851,€58€FR€33181,€3€CFR,€1993€Comp.,€p.€608;€E.O.€12924,€59€FR€43437,€3€CFR,€1994ÏComp.,€p.€917;€E.O.€12938,€59€FR€59099,€3€CFR,€1994€Comp.,€p.€950;€Executive€Order€13026Ï(November€15,€1996,€61€FR€58767);€€Notice€of€August€15,€1995€(60€FR€42767,€August€17,Ï1995);€and€Notice€of€August€14,€1996€(61€FR€42527).€€òòÐ @Ø  ÐÔ#†X³XXX³J7#ÔóóÌà  à4.€€The€authority€citation€for€15€CFR€part€762€continues€to€read€as€follows:ÌÌà  àòòAuthorityò òóó:ó ó€50€U.S.C.€app.€2401€òòet€seqóó.;€50€U.S.C.€1701€òòet€seqóó.;€E.O.€12924,€59€FRÐ àx Ð43437,€3€CFR,€1994€Comp.,€p.€917;€€Executive€Order€13026€(November€15,€1996,€61€FRÏ58767);€€Notice€of€August€15,€1995€(60€FR€42767,€August€17,€1995);€and€Notice€of€August€14,Ï1996€(61€FR€42527).€€ÌÌà  à5.€€The€authority€citation€for€15€CFR€part€774€continues€to€read€as€follows:ÌòòÔ‡X³XXX³ÔÌAuthorityóó:€50€U.S.C.€app.€2401€òòet€seqóó.;€50€U.S.C.€1701€òòet€seqóó.;€10€U.S.C.€7420;€10€U.S.C.Ð ¸P$ Ð7430(e);€18€U.S.C.€2510€òòet€seqóó.;€22€U.S.C.€287c;€22€U.S.C.€3201€òòet€seqóó.;€22€U.S.C.€6004;€Sec.Ð  !¸& Ð201,€Pub.€L.€104„58,€109€Stat.€557€(30€U.S.C.€185(s));€30€U.S.C.€185(u);€42€U.S.C.€2139a;€42ÏU.S.C.€6212;€43€U.S.C.€1354;€46€U.S.C.€app.€466c;€50€U.S.C.€app.€5;€E.O.€12924,€59€FR€43437,Ï3€CFR,€1994€Comp.,€p.€917;€Executive€Order€13026€(November€15,€1996,€61€FR€58767);€€NoticeÏof€August€15,€1995€(60€FR€42767,€August€17,€1995);€and€Notice€of€August€14,€1996€(61€FRÏ42527).òòÐ ((À!0 Ðà  àóóÔ#†X³XXX³ä;#ÔñGñ›ñGñÌÌPART€734€-€[AMENDED]ÌÐ È-`'8 Ðà  à6.€€Section€œ734.ñOñ3ñOññOñ4ñOñ›€is€amended€by€redesignating€paragraphs€(b)(3)(i)€through€(b)(3)(iv)€asÏ(b)(3)(i)(A)€through€(b)(3)(i)(D),€and€adding€a€new€paragraph€(b)(3)(ii)€to€read€as€follows:ÌÌ(b)€€*€€€€€*€€€€€*ÌÌà  à(3)(i)€*€€€€€*€€€€€*ÌñGñœñGñÌñGñ›ñGñà  àà ` à(ii)€Key€escrow€encryption€software€controlled€under€ECCN€5D002.c.1€remainsÏsubject€to€the€EAR€even€when€made€publicly€available€(see€Supplement€No.€1€to€part€774€of€theÏEAR).ÌÌà  à€7.€€Section€734.4€is€amended€by€revising€paragraph€(b)€and€revising€paragraph€(h)€to€readÏas€follows:€€ÌÌðð734.4€€òòDe€minimisóó€U.S.€content.Ð ° ÐÌà@þþìà*€€€€€*€€€€€*€€€€€*€€€€€*ˆÌÌ(b)€There€is€no€òòde€minimisóó€level€for€the€reexport€of€foreign-€origin€items€that€incorporate€theÐ ¸P$ Ðfollowing:Ì€€€€Ìà  à€(1)€Items€controlled€by€ECCN€9A004.a;€orÌÌà  à(2)€Key€escrow€encryption€software€controlled€under€ECCN€5D002.c.1€or€equipmentÏdesigned€or€modified€to€ñGñœñGñuseñGñ›ñGñ€key€escrow€encryption€items€controlled€under€ECCN€5A002.a.Ïtransferred€from€the€U.S.€Munitions€List€following€a€case-by-case€determination€by€theÏDepartment€of€State€through€the€commodity€jurisdiction€procedure.ÌÌà@þþìà*€€€€€*€€€€€*€€€€€*€€€€€*ˆÐ È-`'8 Ї(h)€€Notwithstanding€the€provisions€of€paragraphs€(c)€and€(d)€of€this€section,€U.S.-originÏtechnology€controlled€by€ECCN€9E003a.1€through€a.12,€and€.f,€and€related€controls,€ñGñœñGñandñGñ›ñGñ€keyÏescrow€encryption€software€controlled€under€ECCN€5D002.c.1€do€not€lose€their€U.S.-originÏwhen€redrawn,€used,€consulted,€or€otherwise€commingled€abroad€in€any€respect€with€otherÏsoftware€or€technology€of€any€other€origin.€€Therefore,€any€subsequent€or€similar€software€orÏtechnology€prepared€or€engineered€abroad€for€the€design,€construction,€operation,€or€maintenanceÏof€any€plant€or€equipment,€or€part€thereof,€which€is€based€on€or€uses€any€such€U.S.-originÏsoftware€or€technology€is€subject€to€the€EAR.€€ÌÌà  à8.€€Section€734.7€is€amended€by€revising€paragraph€(b)€to€read€as€follows:ÌÌðð734.7€Published€information€and€software.ÌÌÌà@þþìà*€€€€€*€€€€€*€€€€€*€€€€€*ˆÌÌ(b)€Software€and€information€is€published€when€it€is€available€for€general€distribution€either€forÏfree€or€at€a€price€that€does€not€exceed€the€cost€of€reproduction€and€distribution.€€SeeÌSupplement€No.€1€to€this€part,€Questions€G(1)€through€G(3).€€Note€that€key€escrow€encryptionÏsoftware€controlled€under€ECCN€5D002.c.1€remains€subject€to€the€EAR€even€when€madeÏpublicly€available€(see€Supplement€No.€1€to€part€774€of€the€EAR).ÌÌÌPART€740€-€LICENSE€EXCEPTIONSÌÌà  à9.€€Section€740.8€is€amended€by€redesignating€paragraph€(d)(2)€as€(d)(3)€and€adding€aÏnew€paragraph€(d)(2)€to€read€as€follows:ÌÌðð740.8€€Technology€and€software€-€unrestricted.Ð È-`'8 ЇÌà@ìà*€€€€*€€€€€*€€€€*€€€€*€€ˆÌÌ(d)€€*€€€€*€€€€€*ÌÌà  à(2)€òòSoftware€not€eligible€for€this€License€Exceptionóó.€€This€License€Exception€is€notÐ p   Ðavailable€for€key€escrow€encryption€software€controlled€by€ECCN€5D002.c.1.ÌÌPART€742€„€[AMENDED]ÌÌà  à10.€€€Part€742€is€amended€by€adding€a€new€ðð742.15,€and€new€Supplements€4€and€5€to€readÏas€follows:€€ÌÌðð742.15€Key€escrow€encryption€items.ÌÌ(a)€òòLicense€requirementsóó.€€Licenses€are€required€for€all€destinations,€except€Canada,€ñGñœñGññHñœñHñforñIñ€ñIññJñ›ñJñkeyñGñ›ñGññJññHñ›ñHññJñÐ € Ðescrow€encryption€software€controlled€under€ECCN€5D002.c.1;€and€equipment€designed€orÏmodified€to€use€key€escrow€encryption€items€controlled€under€ECCN€5A002.a.Ì€€€€Ì(b)€€òòLicensing€policyóó.€€BXA€will€accept€license€applications€for€the€export€and€reexport€ñJñœñJñofñJñ›ñJñ€keyÐ  !¸& Ðescrow€encryption€software€controlled€by€ECCN€5D002.c.1€and€equipment€designed€or€modifiedÏto€use€key€escrow€encryption€software€controlled€by€ECCN€5A002.a€in€unlimited€quantities€forÏall€destinations€except€Country€Groups€E:1€and€E:2€(see€Supplement€No.€1€to€part€742),€Iran,ÏSyria,€and€Sudan.€€Such€applications€will€receive€favorable€consideration€provided€that,€prior€toÏthe€export€or€reexport,€keys€are€escrowed€with€a€key€holder€satisfactory€to€the€Department€ofÏCommerce€(see€Supplement€No.€5€to€this€part)€and€procedures€for€safeguarding€the€key€asÏdescribed€in€Supplement€No.€5€to€this€part€are€established€to€the€satisfaction€of€the€Department€ofÏCommerce€and€are€maintained€after€export€or€reexport€as€required€by€the€EAR€and€any€licenseÏconditions.€€In€addition,€the€key€escrow€system€must€meet€the€criteria€identified€in€SupplementÐ È-`'8 ÐNo.€4€to€this€part.€€This€includes€a€legally€binding€arrangement€between€the€exporter€orÏreexporter€and€the€key€holder,€satisfactory€to€BXA,€which€ensures€that€appropriate€key€escrowÏsafeguard€procedures€will€be€carried€out€by€the€key€holder.€€If€the€exporter€or€reexporter€intendsÏto€be€the€key€holder,€then€the€exporter€or€reexporter€must€meet€all€of€the€requirements€of€a€keyÏholder.€€Continuing€compliance€by€the€key€holder€with€the€key€safeguard€procedures€shall€beÏmade€a€condition€of€any€license€issued.€€Because€BXA€will€be€relying€on€representations€andÏundertakings€of€the€key€holder€to€make€decisions€on€license€applications,€the€key€holder€isÏrequired€to€comply€with€all€applicable€record€requirements€in€the€EAR,€including€the€recordÏretention€requirements.€€In€addition,€the€key€holder€shall€be€required€to€carry€out€the€key€holdingÏobligations€as€approved€by€BXA,€and€any€violation€of€any€of€the€key€holding€obligations€shallÏalso€constitute€a€violation€of€the€EAR.€€Applicants€should€list€in€their€license€applications€thoseÏcountries€for€which€they€seek€approval€to€export€or€reexport,€or€identify€that€you€seek€export€orÏreexport€to€all€destinations€except€Country€Groups€E:1€and€E:2,€Iran,€Syria,€and€Sudan.ÌÌ(c)€€òòContract€sanctityóó.€€Contract€sanctity€provisions€are€not€available€for€license€applicationsÐ ° Ðreviewed€under€this€section.ÌÌ(d)€€[Reserved]€ÌÌÌà@þþìà*€€€€€*€€€€€*€€€€€*€€€€€*ˆÌÌÌSUPPLEMENT€NO.€4€TO€PART€742€-€KEY€CRITERIAÌÌòòKey€€Recovery€FeatureóóÐ )(#2 ÐÌ1)€€The€key(s)€required€to€decrypt€the€productððs€key€escrow€cryptographic€functions€ciphertextÏshall€be€accessible€through€a€key€escrow€feature.Ð È-`'8 Ї2)€€The€productððs€key€escrow€cryptographic€functions€shall€be€inoperable€until€the€key€is€or€theÏkeys€are€escrowed€in€accordance€with€the€criteria€identified€in€Supplement€5€to€this€part.€ÌÌ3)€€The€productððs€key€escrow€cryptographic€functions€ciphertext€shall€contain,€in€an€accessibleÏformat€and€with€a€reasonable€frequency,€the€identity€of€the€key€escrow€€holder(s)€and€informationÏsufficient€for€the€recovery€€holder(s)€to€identify€the€keys€required€to€decrypt€the€ciphertext.ÌÌ4)€€The€productððs€key€escrow€feature€shall€allow€access€to€the€key(s)€needed€to€decrypt€theÏproduct€s€ciphertext€regardless€of€whether€the€product€generated€or€received€the€ciphertext.ÌÌ5)€€The€productððs€key€escrow€feature€shall€allow€for€the€recovery€of€multiple€decryption€keysÏduring€the€period€of€authorized€access€without€requiring€repeated€presentations€of€accessÏauthorization€to€the€key€escrow€holder(s).ÌÌòòKey€Length€FeatureóóÐ ° ÐÌ6)€€€The€productððs€key€escrow€functions€shall€use€an€unclassified€encryption€algorithm.ÌÌòòInteroperability€FeatureóóÐ ¸P$ ÐÌ7)€The€productððs€cryptographic€functions€shall€interoperate€only€with€other€key€escrow€productsÏthat€meet€these€criteria,€and€shall€not€interoperate€with€products€whose€key€escrow€feature€hasÏbeen€altered,€bypassed,€disabled,€or€otherwise€rendered€inoperative.€€Key€escrow€products€shallÏinteroperate€with€non„key€escrow€products€only€when€the€key€escrow€product€permits€access€toÏthe€keys€or€other€escrowed€material/information€needed€to€decrypt€ciphertext€generated€orÏreceived€by€the€key€ñJñœñJñescrow€product.ñJñ›ñJñÌÌòòDesign,€Implementation€and€Operational€AssuranceóóÐ `,ø%6 ÐÐ È-`'8 Ð8)€€The€product€shall€be€resistant€to€efforts€to€disable€or€circumvent€the€attributes€described€inÏcriteria€one€through€seven.ÌÌ€ÌSUPPLEMENT€NO.€5€€TO€PART€742€-€KEY€HOLDER€REQUIREMENTS;ÌSAFEGUARD€PROCEDURES;€KEY€ESCROW€PROCEDURESÌÌThis€Supplement€sets€forth€criteria€that€ñJñœñJñBXA,ñJñ›ñJñ€in€consultation€with€other€departments€andÏagencies,€will€use€to€approve€key€holders€to€support€approval€of€the€export€or€reexport€of€keyÏescrow€encryption€items€controlled€by€ECCNs€5A002.a€and€€5D002.c.1.€€€Any€arrangementsÏbetween€the€exporter€or€reexporter€and€the€key€holder€must€reflect€the€provisions€contained€inÏthis€Supplement€in€a€manner€satisfactory€to€BXA.€€This€Supplement€also€outlines€the€criteria€forÏemploying€key€holder€personnel€and€key€escrow€procedures.€€An€applicant€for€a€license€to€exportÏor€reexport€key€escrow€encryption€€items€shall€provide,€or€cause€the€proposed€key€holder€toÏprovide,€to€BXA€sufficient€information€concerning€any€proposed€key€holder€arrangements€toÏpermit€BXA€to€evaluate€the€key€holderððs€safeguard€procedures,€suitability€and€trustworthiness€toÏmaintain€the€confidentiality€of€the€key€and€key€components,€and€its€key€escrow€procedures.€€TheÏkey€holder€may€be€the€applicant€for€the€export€or€reexport€license€or€another€party€legallyÏobligated€to€the€applicant€to€provide€recovery€services,€as€approved€by€BXA.€€BXA€retains€theÏright,€in€addition€to€any€other€remedies,€to€revoke€export€or€reexport€licenses€if€a€key€holder€noÏlonger€meets€these€criteria.€€The€safeguard€procedures,€procedures€related€to€the€key€holderððsÏsuitability€and€trustworthiness,€and€key€escrow€procedures€of€the€key€holder€generally€shall€beÏmade€terms€and€conditions€of€the€export€or€reexport€license€for€key€escrow€encryption€software€ifÏgranted.€€BXA€may€require€the€key€holder€to€provide€a€representation€that€it€will€comply€withÏsuch€terms€and€conditions.ÌÌ(a)€€Key€holder€requirements.ÌÌà  à(1)€To€become€a€qualified€key€holder,€the€key€holderððs€personnel€involved€in€the€recoveryÐ È-`'8 Ðof€keys€with€access€to€escrowed€keys€or€key€escrow€access€request€information,€or€in€respondingÏto€key€escrow€requests,€and€persons€in€control€of€the€key€holder€with€access€or€authority€to€obtainÏaccess€to€keys€or€key€components€must€be€suitable€and€trustworthy€as€determined€by€the€BureauÏof€Export€Administration€prior€to€export€or€reexport€of€the€recovery€product,€and€BXA€mayÏevaluate€and€determine€the€suitability€and€trustworthiness€of€such€personnel€thereafter€from€timeÏto€time.€€Evidence€of€an€individualððs€suitability€and€trustworthiness€could€include:ÌÌà  à€à ` à(i)€€Information€indicating€the€individual(s):Ð @Ø  ÐÌà  àà ` àà ¸ à(A)€Have€no€felony€convictions€or€pending€felony€charges;ÌÌà  àà ` àà ¸ à(B)€Are€not€currently€serving€a€term€of€probation;ÌÌà  àà ` àà ¸ à(C)€Have€satisfactorily€performed€any€positions€of€a€fiduciary€nature,€forÏexample€have€had€no€violations€of€surety€or€performance€bonds;€andÌÌà  àà ` àà ¸ à(D)€Have€favorable€results€of€criminal€background€and€credit€checks;€orÌÌà  àà ` à(ii)€€€Have€an€active€U.S.€government€security€clearance€of€secret€or€higher€issuedÏor€updated€within€the€last€five€years.ÌÌà  à(2)€€Suitable€evidence€of€the€key€holderððs€corporate€viability€and€financial€responsibilityÏ(e.g.€a€certificate€of€good€standing€from€the€state€of€incorporation,€credit€reports,€andÏerrors/omissions€insurance)€must€be€submitted€with€an€application€to€export€or€reexport€keyÏescrow€item.€ÌÌà  à(3)€Key€holder€operating€procedures€shall€provide€for€the€designation€of€individual(s)€toÏbe€responsible€as€security€and€operations€officers.ÌÐ È-`'8 Ðà  à(4)€Upon€the€request€of€BXA,€key€holders€shall€provide€to€BXA€information€concerningÏcompliance€with€or€violations€of€federal,€state,€and€local€laws€and€regulations€determined€byÏBXA€to€be€relevant€to€the€evaluation€of€trustworthiness€of€the€key€holders,€its€personnel,€andÏpersons€in€control€of€the€key€holder.ÌÌà  à(5)€Policies€and€procedures€shall€be€designed€and€implemented€to€preclude€disclosure€ofÏkeys€or€key€components€to€additional€persons€in€control€not€previously€authorized€by€BXA.€€ForÏpurposes€of€these€criteria€in€this€Supplement€No.€5,€a€€person€in€control€is€each€of€the€following:ÌÌ€à  àà ` à(A)€A€person€with€the€power,€direct€or€indirect,€whether€exercised€or€notÐ ¨  Ðexercised,€and€whether€or€not€exercisable,€through€the€ownership€of€the€key€holderððs€securities,Ïby€contractual€arrangements€or€other€means,€to€direct€or€decide€matters€affecting€theÏmanagement€or€operations€of€the€key€holder€in€a€manner€which€may€result€in€the€unauthorizedÏdisclosure€of€a€key€or€key€component€or€a€breach€of€the€terms€and€conditions€of€an€export€orÏreexport€license;ÌÌà  àà ` à(B)€A€person€with€ownership€or€beneficial€ownership,€direct€or€indirect,€of€5Ïpercent€or€more€of€the€key€holderððs€voting€securities;ÌÌà  àà ` à(C)€€A€person€with€ownership€or€beneficial€ownership,€direct€or€indirect,€of€25Ïpercent€or€more€of€the€key€holderððs€non-voting€securities;ÌÌà  àà ` à(D)€Management€positions,€such€as€directors,€officers,€or€executive€personnel€ofÏthe€key€holder€held€by€non€U.S.€citizens;ÌÌà  àà ` à(E)€A€person€with€the€power,€direct€or€indirect,€to€control€the€election,Ïappointment,€or€tenure€of€directors,€officers,€or€executive€personnel€of€the€key€holder;€orÌÌ(F)€A€person€with€a€contract,€agreement,€understanding,€or€arrangement€to€manage€the€keyÐ È-`'8 Ðholder.ÌÌ(b)€€Safeguard€procedures.ÌÌà  à(1)€€Key€holders€must€implement€safeguard€procedures€that€assure€the€confidentiality,Ïintegrity,€and€availability€of€the€key€to€key€escrow€encryption€software€or€key€products.ÌÌà  àà ` à(i)€€Procedures€to€assure€the€confidentiality€of€this€information€may€include:ÌÌà  àà ` àà ¸ à€(A)€Encrypting€all€keys€or€key€components€while€in€storage,€transmission,Ïor€transfer;€orÌÌà  àà ` àà ¸ à(B)€Applying€reasonable€measures€to€limit€access€to€the€recovery€databaseÏ(e.g.€using€keyed€or€combination€locks€on€the€entrances€to€recovery€facilities€and€limiting€theÏpersonnel€with€knowledge€of€or€access€to€the€keys/combinations).Ì€Ìà  àà ` à(ii)€Procedures€to€assure€the€integrity€of€the€recovery€database€(i.e.€assuring€the€Ïrecovered€key/key€components€are€protected€against€unauthorized€changes)€may€include€the€useÏof€access€controls€based€on€an€appropriate€use€of€database€password€controls,€digital€signatures,Ïsystem€auditing,€and€physical€access€restrictions.ÌÌà  àà ` à(iii)€Procedures€to€assure€the€availability€of€the€recovery€database€(i.e.€assuringÏrecovered€keys/key€components€are€retrievable€at€any€time)€may€include€system€redundance,Ïphysical€security,€and€the€use€of€cryptography€to€control€access.ÌÌà  à(2)€€Policies€and€procedures€shall€be€designed€and€implemented€so€that€a€failure€by€aÏsingle€person,€procedures,€or€mechanism€does€not€compromise€key€or€key€componentÏconfidentiality,€integrity€and€availability.€€Such€measures€could€include€two€person€control€ofÏaccess€to€recoverable€keys,€split€keys,€and€back-up€capabilities.Ð È-`'8 Їà  à(3)€€Key€holders€shall€implement€policies€that€protect€against€unauthorized€disclosure€ofÏinformation€regarding€the€identity€of€owners€or€end€users€of€encryption€products€whose€keys€areÏrecoverable,€the€fact€that€a€key€or€key€component€was€requested€or€provided,€and€the€identity€of€aÏrequester.€€Procedures€to€assure€the€confidentiality€of€this€information€could€include€thoseÏdescribed€in€paragraph€(a)(1)(i).ÌÌà  à(4)€€Policies€and€procedures€shall€be€designed€and€implemented€to€provide€notice€to€BXAÏof€a€compromise€of€the€confidentiality€of€a€key€or€key€component,€or€other€safeguards.ÌÌ(c)€€Key€escrow€procedures.ÌÌà  à€(1)€€In€the€event€the€key€holder€dissolves€or€otherwise€terminates€recovery€operations,€orÏif€BXA€determines€that€there€is€a€risk€of€such€dissolution€or€termination,€or€if€BXA€determinesÏthe€key€holder€is€no€longer€suitable€or€trustworthy,€then€the€key€holder€must€transfer€all€of€itsÏrecovery€equipment€and€recovered€information€to€another€key€holder€that€is€approved€by€theÏBureau€of€Export€Administration.€Ì€€€€Ìà  à(2)€€Key€holders€will€maintain€the€ability€to€make€the€key€available€in€accordance€withÏappropriate€State€and€Federal€legal€authority€until€notified€otherwise€by€BXA.€€Key€holders€shallÏmake€requested€keys€and€key€components€available,€to€the€extent€required€by€the€request,€withinÏtwo€hours€from€the€time€they€receive€a€€request€from€a€government€agency€acting€underÏappropriate€legal€authority€that€requires€or€compels€the€key€holder€to€produce€the€key€or€keyÏcomponents.€€€The€requesting€government€agency€will€be€responsible€for€obtaining€the€keys€orÏkey€components€from€the€key€holder.ÌÌà  à(3)€€Key€holders€shall€enter€keys€and€key€components€into€the€recovery€data€base€uponÏreceipt€of€new€or€replacement€keys€and€key€components.ÌÌà  à(4)€€Key€holders€must€agree€to€maintain€data€regarding€key€requests€received,€keys€andÐ È-`'8 Ðkey€components€released,€database€changes,€system€administration€access,€dates€of€such€events,Ïetc.,€for€purposes€of€audits€by€BXA.ÌÌÌà  à11.€€Section€762.2€is€amended€by€redesignating€paragraphs€(b)(6)€through€(b)(34)€asÏ(b)(7)€through€(b)(35)€and€adding€a€new€paragraph€(b)(6)€to€read€as€follows:ÌÌðð762.2€Records€to€be€retained.ÌÌ(a)€*€€€€€*€€€€€*ÌÌ(b)€*€€€€€*€€€€€*ÌÌà  à(6)€Section€742.15;ÌÌPART€774€-€[AMENDED]ÌÌà  à12.€€In€Supplement€No.€1€to€part€774€(the€Commerce€Control€List),€Category€5Ï(Telecommunications€and€Information€Security),€the€Information€Security€category,€ECCNsÏ5A002€and€5D002€are€amended€to€read€as€follows:ÌÌÌ5A002€€Systems,€equipment,€application€specific€"electronic€assemblies",€modules€or€integratedÏcircuits€for€"information€security",€and€specially€designed€components€therefor.Ì€€€€Ìò òLicense€Requirementsó óÐ )(#2 ÐÌ€€€€€Reason€for€Control:€€€NS,€AT,€EIÌ€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€Ð È-`'8 Ðà  àòòControl(s)óó€€€€€€€€€€€€€€€€€€€€€€€€€à h àòòà À àà  àCountry€ChartóóÐ h Ѐ€€€Ìà  àNS€applies€to€entire€ñJñœñJñentryà h àà À àà  àNS€Column€1ñJñ›ñJñÐ 8 Ð Ѐ€Ìà  àAT€applies€to€entire€entry€€€€€€€€€à À àà  àAT€Column€1Ð    ÐÌà  àñJñœñJñÌÌò òLicense€Exceptionsó óÐ ¨@  ÐÌòòà  àLVSóó:€€N/A€Ð x Ðòòà  àGBSóó:€€N/AÐ àx Ѐà  àòòCIVóó:€€N/A€€€€€€Ð Hà ÐÌò òList€of€Items€ControlledÐ ° Ðó óÌ€à  àòòUnitóó:€$€valueÐ è€  Ðà0  àòòRelated€Controlsóó:€N/AÐPè"(#(# Ðà  àòòRelated€Definitionsóó:€N/AÐ ¸P$ Ðà  àòòItemsóó:Ð  !¸& ÐÌà  àa.€€Designed€or€modified€to€use€"cryptography"€employing€digital€techniques€to€ensureÏ"information€security";ÌÌà  àò òNoteó ó:€5A002.a€includes€controls€key€escrow€encryption€items€transferred€from€the€U.S.Ð ((À!0 ÐMunitions€List€following€a€case-€by-case€determination€by€the€Department€of€State€through€theÏcommodity€jurisdiction€procedure.€€(See€ðð742.15€of€the€EAR)ñJñ›ñJñÌÌb.€€Designed€or€modified€to€perform€cryptoanalytic€functions;Ð È-`'8 Їc.€€Designed€or€modified€to€use€"cryptography"€employing€analog€techniques€to€ensureÏ"information€security";ÌÌà  àò òNoteó ó:€€5A002.c€does€not€control€the€following:Ð   8 ÐÌà  à1.€€Equipment€using€"fixed"€band€scrambling€not€exceeding€8€bands€and€in€which€theÏtranspositions€change€not€more€frequently€than€once€every€second;ÌÌà  à2.€€Equipment€using€"fixed"€band€scrambling€exceeding€8€bands€and€in€which€theÏtranspositions€change€not€more€frequently€than€once€every€ten€seconds;ÌÌà  à3.€€Equipment€using€"fixed"€frequency€inversion€and€in€which€the€transpositions€changeÏnot€more€frequently€than€once€every€second;ÌÌà  à4.€€Facsimile€equipment;ÌÌà  à5.€€Restricted€audience€broadcast€equipment;€andÌÌà  à6.€€Civil€television€equipment;ÌÌd.€€Designed€or€modified€to€suppress€the€compromising€emanations€of€information-bearingÏsignals;ÌÌà  àò òNoteó ó:€€5A002.d€does€not€control€equipment€specially€designed€to€suppress€emanations€forÐ À&X . Ðreasons€of€health€and€safety.ÌÌe.€€Designed€or€modified€to€use€cryptographic€techniques€to€generate€the€spreading€code€forÏ"spread€spectrum"€or€hopping€code€for€"frequency€agility"€systems;ÌÐ È-`'8 Ðf.€€Designed€or€modified€to€provide€certified€or€certifiable€"multilevel€security"€or€user€isolationÏat€a€level€exceeding€Class€Be€of€the€Trusted€Computer€System€Evaluation€Criteria€(TCSEC)€orÏequivalent;ÌÌg.€€Communications€cable€systems€designed€or€modified€using€mechanical,€electrical€orÏelectronic€means€to€detect€surreptitious€intrusion.ÌÌà  àò òNoteó ó:€€5A002€does€not€control:Ð @Ø  ÐÌ€€€€€a.€€"Personalized€smart€cards"€or€specially€designed€components€therefor,€with€any€of€theÏfollowing€characteristics:ÌÌà  àà ` à1.€€Not€capable€of€message€traffic€encryption€or€encryption€of€user-supplied€dataÏor€related€key€management€functions€therefor;€orÌÌà  àà ` à2.€€When€restricted€for€use€in€equipment€or€systems€excluded€from€control€underÏthe€note€to€5A002.c,€or€under€paragraphs€b€through€h€of€this€note.ÌÌà  àb.€Equipment€containing€"fixed"€data€compression€or€coding€techniques;ÌÌà  àc.€€Receiving€equipment€for€radio€broadcast,€pay€television€or€similar€restricted€audienceÏtelevision€of€the€consumer€type,€without€digital€encryption€and€where€digital€decryption€isÏlimited€to€the€video,€audio€or€management€functions;ÌÌà  àd.€€Portable€or€mobile€radiotelephones€for€civil€use€(e.g.,€for€use€with€commercial€civilÏcellular€radiocommunications€systems)€that€are€not€capable€of€end-to-end€encryption;ÌÌà  àe.€€Decryption€functions€specially€designed€to€allow€the€execution€of€copy-protectedÏ"software",€provided€the€decryption€functions€are€not€user-accessible;Ð È-`'8 Їà  àf.€€Access€control€equipment,€such€as€automatic€teller€machines,€self-service€statementÏprinters€or€point€of€sale€terminals,€that€protects€password€or€personal€identification€numbersÏ(PIN)€or€similar€data€to€prevent€unauthorized€access€to€facilities€but€does€not€allow€forÏencryption€of€files€or€text,€except€as€directly€related€to€the€password€or€PIN€protection;ÌÌà  àg.€€Data€authentication€equipment€that€calculates€a€Message€Authentication€Code€(MAC)Ïor€similar€result€to€ensure€no€alteration€of€text€has€taken€place,€or€to€authenticate€users,€but€doesÏnot€allow€for€encryption€of€data,€text€or€other€media€other€than€that€needed€for€the€authentication;ÌÌà  àh.€€Cryptographic€equipment€specially€designed€and€limited€for€use€in€machines€forÏbanking€or€money€transactions,€such€as€automatic€teller€machines,€self-service€statement€printersÏor€point€of€sale€terminals.ÌÌà@00ìà*€€€€*€€€€€*€€€€*€€€€*€ˆÌÌ5D002€€Information€Security€€SoftwareÌÌò òLicense€Requirementsó óÐ Pè" ÐÌ€€€€€Reason€for€Control:€€€NS,€ñJñœñJñATñJñ›ñJñÌ€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€Ìòòà  àControl(s)óó€€€€€€€€€€€€€€€€€€€€€€€€à h àà À àà  à€òòCountry€ChartóóÐ ð#ˆ* Ѐ€€€Ìà  àNS€applies€to€entire€entry€€€€€€€€€à À àà  àNS€Column€1Ð À&X . ÐÌà  àAT€applies€to€entire€entry€€€€€€€€€à À àà  àAT€Column€1Ð )(#2 ÐÌà0  àñJñœñJñÐ (#(# ÐÐ È-`'8 ÐñJñ›ñJñà  àò òNoteó ó:€€Key€escrow€encryption€software€€controlled€under€5D002.c.1.€remain€subject€to€Ð h Ðà  àthe€EAR€even€when€made€publicly€available€in€accordance€with€ðð734.7€of€the€EAR,€and€¼à  àit€is€not€eligible€for€€mass€market€€treatment€under€License€Exception€TSU€for€mass€¼à  àmarket€software.€€€See€ðð742.15(b)(1)€of€the€EAR.ÌÌò òLicense€Exceptionsó óÐ p   ÐÌòòà  àGBSóó:€€N/AÐ @Ø  Ðà  àòòCIVóó:€€N/A€€€€€€Ð ¨@  ÐÌò òList€of€Items€Controlledó óÐ x ÐÌà  àòòUnitóó:€$€valueÐ Hà Ðà  àòòRelated€Controlsóó:€NAÐ °H Ðà  àòòRelated€Definitionsóó:€€N/AÐ ° Ðà  àòòItemsóó:Ð € ÐÌa.€€"Software"€specially€designed€or€modified€for€the€"development",€"production"€or€"use"€ofÏequipment€or€"software"€controlled€by€5A002,€5B002€or€5D002.ÌÌb.€€"Software"€specially€designed€or€modified€to€support€"technology"€controlled€by€5E002.ÌÌc.€€Specific€"software"€as€follows:€€€€€€€€€€€€€€€€€€€€€€€€Ì€€€€€€€€€Ìà  àc.1.€€"Software"€having€the€characteristics,€or€performing€or€simulating€the€functions€ofÏthe€equipment€controlled€by€5A002€or€5B002;ÌÌà  àò òNoteó ó:€€€5D002.c.1€includes€controls€key€escrow€encryption€software€transferred€from€theÐ `,ø%6 ÐU.S.€Munitions€List€following€a€case-by-case€determination€by€the€Department€of€State€throughÐ È-`'8 Ðthe€commodity€jurisdiction€procedure.€See€ðð742.15€of€the€EAR.ÌÌà  àc.2.€€"Software"€to€certify€"software"€controlled€by€5D002.c.1;ÌÌà  àc.3.€€"Software"€designed€or€modified€to€protect€against€malicious€computer€damage,€e.g.,Ïviruses;ÌÌà  àò òNote:ó ó€5D002€does€not€control:Ð @Ø  Ѐ€€€€€€€€Ìà  àà ` àa.€€"Software"€"required"€for€the€"use"€of€equipment€excluded€from€control€underÏthe€Note€to€5A002;ÌÌà  àà ` à€b.€€"Software"€providing€any€of€the€functions€of€equipment€excluded€from€controlÏunder€the€Note€to€5A002.ÌÌÌà  à13.€€Supplement€No€2€to€Part€774€is€revised€to€read€as€follows:ÌÌÌSUPPLEMENT€NO.€2€TO€PART€774€-€GENERAL€TECHNOLOGY€AND€SOFTWAREÌNOTESÌÌà@ìà€*€€€€€€*€€€€€€*€€€€€€*€€€€€€*ˆÌÌÌ2.€€General€Software€Note.€€License€Exception€TSU€(€mass€market€software)€is€available€to€allÏdestinations,€except€Cuba,€Iran,€Libya,€North€Korea,€Sudan,€and€Syria,€for€release€of€softwareÏthat€is€generally€available€to€the€public€by€€being:ÌÐ È-`'8 Ðà  àa.€€Sold€from€stock€at€retail€selling€points,€without€restriction,€by€means€of:ÌÌà  àà ` à1.€€Over€the€counter€transactions;ÌÌà  àà ` à2.€€Mail€order€transactions;€orÌÌà  àà ` à3.€€Telephone€call€transactions;€andÌÌà  àb.€€Designed€for€installation€by€the€user€without€further€substantial€support€by€theÏsupplier.ÌÌà  àNote:€€License€Exception€TSU€for€mass€market€software€does€not€apply€to€key€escrowÏencryption€software€controlled€under€ECCN€5D002.c.1.€that€has€been€transferred€from€the€U.S.ÏMunitions€List€following€a€commodity€jurisdiction€determination€by€the€Department€of€State.ÌÌÌDATED:ÌÌÌÌSue€E.€EckertÌAssistant€Secretary€forÌExport€AdministrationÌÌÌ