Export Information for the United States
This page discusses the Export Regulations of the United States and how they relate to CVSNT. This was originally posted to the CVSNT mail list by Glen Starrett on May 14, 2003.
I Am Not A Lawyer, not an expert in matters of export regulations, and I do not represent the CVSNT development team. However, I've researched the ![[WWW]](/moindoc/sinorca4moin/img/moin-www.png){kind=small}
Bureau of Industry and Security (BIS) Export Administration Regulations (EAR) as they apply to CVSNT and this is what I've found (since I too need to comply with these regulations). If you are a US citizen or work for a US company and want to export CVSNT, read the regulations yourself to be certain. Better yet, have your lawyer read it.
ECCN and Export License for CVSNT
From what I've read, CVSNT has an ECCN of 5D002 and qualifies for a license exemption TSU. This means that even though it has strong encryption, there is no export license required according to the EAR.
CVSNT Characteristics
Here are the characteristics of CVSNT that I have found that affect its status under the U.S. Export Administration Regulations (EAR):
It is publicly available as source and object code
It contains strong encryption (MIT's
Kerberos, SSH via PuTTY, and the UNIX crypt function) Each of those strong encryption products are also publicly available in source and object form.
The Regulations
Here's the path of EAR to follow so maybe you won't need to take so much time to unravel it (their FAQ is riddled with references to these sections, so it is actually easier IMHO to go straight to the regulations):
In the Commerce Control List Category 5 Part 2, 5D002 is defined as being software with strong encryption. CVSNT, according to its author, has several strong encryption products in it (listed above).
EAR
Section 734.3(b)(3) lists what is subject to the EAR, (b) is exceptions to that list, and (3) lists publicly available software & technology except software covered by 5D002. Per 734.7, open source code and its associated object code that are both publicly available are still subject to EAR if they are controlled by 5D002. EAR
Section 740.13(e) says that software that is publicly available according to 734.3(b)(3) is eligible for export license exemption TSU.
Note that there are still restrictions and reporting requirements that the US company must adhere to when exporting CVSNT, consult the regulations on the BXA website for more information. Specifically, look at sections 740.13(e)(3) - (6).