Cryptography's Role In Securing The Information Society Appendix N Continued [N.4.2 commences p. 655.] __________________________________________________________________ N.4.2 Export Administration Regulations Part 779 Technical Data Sec. 779.1 Definitions.(6) (a) Technology, technical data, technical assistance, and software.7 These terms are defined in Supplement No. 3 to Sec. 799.1 of this subchapter. The terminology used in this part 779 will be changed in the future to conform to the terms and definitions used in Supplement No. 3 to part Sec. 799.1 of this subchapter and in other parts of this subchapter. In the interim, the term "technical data" as used in this part 779, is understood to include both "technology" (i.e., technical data and technical assistance) and "software". If the term "software" is cited separately, the term refers only to software as defined in Supplement No. 3 to Sec. 799.1 of this subchapter. (b) Export of technical data(8)(9) (1) Export of technical data. "Export of technical data" means (i) An actual shipment or transmission of technical data out of the United states;(10) (ii) Any release of technical data in the United States with the knowledge or intent that the data will be shipped or transmitted from the United States to a foreign country; or (iii) Any release of technical data of U.S.-origin in a foreign country. (2) Release of technical data. Technical data may be released for export through: (i) Visual inspection by foreign nationals of U.S.-origin equipment and facilities; [656] (ii) Oral exchanges of information in the United States or abroad; and (iii) The application to situations abroad of personal knowledge or technical experience acquired in the United States. (c) Reexport of technical data. "Reexport of technical data" means an actual shipment or transmission from one foreign country to another, or any release of technical data of U.S. origin in a foreign country with the knowledge or intent that the data will be shipped or transmitted to another foreign country. Technical data may be released for reexport through: (1) Visual inspection of U.S.-origin equipment and facilities abroad; (2) Oral exchanges of information abroad; and (3) The application to situations abroad of personal knowledge or technical experience acquired in the United States. (d) Direct product. The term "direct product" means the immediate product (including processes and services) produced directly by the use of technical data. __________ [Notes on p. 655] (6) See Sec. 770.2 for definitions of other terms used in this part. (7) The provisions of part 779 do not apply to "classified" technical data, i.e., technical data that have been officially assigned a security classification (e.g., "top secret", "secret", or "confidential") by an officer or agency of the U.S. Government. The export of classified technical data is controlled by the Center for Defense Trade of the U.S. Department of State or the U.S. Nuclear Regulatory Commission, Washington, DC. (8) License applications for, or questions about, the export of technical data relating to commodities which are licensed by U.S. Government agencies other than the U.S. Department of Commerce shall be referred to such other appropriate U.S. Government agency for consideration (see Sec. 770.10 of this subchapter). (9) Patent attorneys and others are advised to consult the U.S. Patent Office, U.S. Department of Commerce, Washington, DC 20231, regarding the U.S. Patent Office regulations concerning the filing of patent applications or amendments in foreign countries. In addition to the regulations issued by the U.S. Patent Office, technical data contained in or related to inventions made in foreign countries or in the United States, are also subject to the U.S. Department of Commerce regulations covering the export of technical data, in the same manner as the export of other types of technical data. (10) As used in this Part 779, the United States includes its possessions and territories. Sec. 779.2 Licenses to export. Except as provided in Sec. 770.3(a) of this subchapter, an export of technical data must be made under either a U.S. Department of Commerce general license or a validated export license. (See Secs. 771.1 and 772.2 of this subchapter for definitions of "general" and "validated" licenses.) General Licenses GTDA and GTDR (see Secs. 779.3 and 779.4) apply to specific types of exports of technical data. A validated license is required for any export of technical data where these general licenses do not apply, except in the case of certain exports to Canada.(11)(12) __________ (11) An export of technical data to Canada may be made without either a validated or general license, unless a validated license is required to Canada by a specific subcategory D or E ECCN on the CCL. (12) Although the Bureau of Export Administration may provide general information on licensing policies regarding the prospects of approval of various types of export control actions, including actions with respect to technical data, normally it will give a formal judgement respecting a specific request for an action only upon the actual submission of a formal application or request setting forth all of the facts relevant to the export transaction and supported by all required documentation Advice is always available, however, regarding any questions as to the applicability of a general license. Such questions should be submitted by letter to the U.S. Department of Commerce, Bureau of Export Administration, P.O. Box 273, Washington, DC 20044. Sec. 779.3 General License GTDA: Technical data available to all destinations. Note: In this Sec. 779.3 the word information means "technical data" as used in this part (i.e., "technology" and "software" as defined in Supplement No. 3 to Sec. 799.1 of this subchapter). [657] (a) Establishment of general license. A General License GTDA is hereby established authorizing: (1) Unrestricted export to any destination of information that is already publicly available or will be made publicly available as described in paragraph (b) of this section; (2) Unrestricted export to any destination of information arising during or reulting from fundamental research, as described in paragraph (c) of this section; Note: Paragraphs (a)(1) and (a)(2) of this section do not authorize the export of data contained in a patent application for purposes of filing and/or publishing for opposition abroad. Such exports are controlled by the U.S. Patent and Trademark Office and must be licensed by that office. See EAR Sec. 770.10(j). (3) Release of educational information, as described in paragraph (d) of this section; and (4) Export of information in connection with certain patent applications, as described in paragraph (e) of this section. Note 1: See paragraph (f) regarding Government sponsored research covered by contractual national security controls and the note following this section regarding consulting and training. Use of General License GTDA is subject to the prohibitions of Sec. 771.2(c) (1), (4), and (9), but not to the other prohibitions of Sec. 771.2(c). Note 2: Supplement No. 5 to part 779 contains explanatory questions and answers about the use of General License GTDA. Certain paragraphs of this Sec. 779.3 are followed by references to relevant questions and answers in supplement No. 5. (b) Publicly available. Information is made public and so becomes "publicly available" when it becomes generally accessible to the interested public in any form, including: (1) Publication in periodicals, books, print, electronic, or any other media available for general distribution to any member of the public or to a community of persons, such as those in a scientific or engineering discipline, interested in the subject matter either free or at a price that does not exceed the cost of reproduction and distribution (see Questions A(1) through A(6)); (2) Ready availability at libraries open to the public or at university libraries (see Question A(6)); (3) Patents available at any patent office; and (4) Release at an open conference, meeting, seminar, trade show, or other open gathering. (i) A conference or other gathering is "open" if all technically qualified members of the public are eligible to attend and attendees are permitted to take notes or otherwise make a personal record (not necessarily a recording) of the proceedings and presentations. (ii) All technically qualified members of the public may be considered eligible to attend a conference or other gathering notwithstanding: [658] (A) A registration fee reasonably related to costs and reflecting an intention that all interested and technically qualified persons be able to attend, or (B) A limitation on actual attendance, as long as attendees either are the first who have applied or are selected on the basis of relevant scientific or technical competence, experience, or responsibility (see Questions B(1) through B(6)). This General License GTDA authorizes submission of papers to domestic or foreign editors or reviewers of journals, or to organizers of open conferences or other open gatherings, with the understanding that the papers will be made publicly available if favorably received. (See Questions A(1) and A(3).) (c) Information resulting from fundamental research-- (1) Fundamental research. Paragraphs (c)(2) through (c)(4) and paragraph (f) of this section provide specific operational rules that will be used to determine whether research in particular institutional contexts qualifies as "fundamental research." The intent behind those operational rules is to identify as "fundamental research" basic and applied research in science and engineering, where the resulting information is ordinarily published and shared broadly within the scientific community. Such research can be distinguished from proprietary research and from industrial development, design, production, and product utilization, the results of which ordinarily are restricted for proprietary reasons or specific national security reasons as defined in Sec. 779.3(f). (See Question D(8).) (2) University-based research. (i) Research conducted by scientists, engineers, or students at a university normally will be considered fundamental research, as described below. ("University" means any accredited institution of higher education located in the United States.) (ii) Prepublication review by a sponsor of university research solely to ensure that publication would not inadvertently divulge proprietary information that the sponsor has furnished to the researchers does not change the rule described in paragraph (c)(2)(i) of this section. However, General License GTDA does not authorize the release of information from a corporate sponsor to university researchers where the research results are subject to prepublication review. See other sections in this part 779 for provisions that may authorize such releases without a validated license. (See Questions D(7), D(9), and D(10).) (iii) Prepublication review by a sponsor of university research solely to ensure that publication would not compromise patent rights does not change the rule described in paragraph (c)(2)(i) of this section, so long as the review causes no more than a temporary delay in publication of the research results. (iv) However, General License GTDA does not authorize the initial transfer of information from an industry sponsor to university researchers where the parties have agreed that the sponsor may withhold from publication some or all of the information so provided. (See Question D(2).) (v) University based research is not considered "fundamental research" if the university or its researchers accept (at the request, for example, of an industrial sponsor) other restrictions on publication of scientific and technical information resulting from the project or activity. Scientific and technical information resulting from the research will nonetheless become subject to General License GTDA [659] once all such restrictions have expired or have been removed. (See Questions D(7) and D(9).) (vi) The provisions of paragraph (f) of this section will apply if a university or its researchers accept specific national security controls (as defined in paragraph (f) of this section) on a research project or activity sponsored by the U.S. Government. (See Questions E(1) and E(2).) (3) Research based at Federal agencies or FFRDCs. Research conducted by scientists or engineers working for a Federal agency or a Federally Funded Research and Development Center (FFRDC) mav be designated as "fundamental research" within any appropriate system controlling release of information by such scientists and engineers devised by the agency or the FFRDC. (See Questions D(8) and D(11).) (4) Corporate research. (i) Research conducted by scientists or engineers working for a business entitv will be considered "fundamental research" at such time and to the extent that the researchers are free to make scientific and technical information resulting from the research publicly available without restriction or delay based on proprietary concerns or specific national security controls as defined in paragraph (f) of this section. (ii) Prepublication review by the company solely to ensure that the publication would compromise no proprietary information provided by the company to the researchers is not considered to be a proprietary restriction under paragraph (c)(4)(i) of this section. However General License GTDA does not authorize the release of information to university researchers where the research results are subject to prepublication review. See other sections in this part 779 for provisions that may authorize such releases without a validated license. (See Questions D(8), D(9), and D(10).) (iii) Prepublication review by the company solely to ensure that prepublication would compromise no patent rights will not be considered a proprietary restriction for this purpose, so long as the review causes no more than a temporary delay in publication of the research results. (iv) However, General License GTDA does not authorize the initial transfer of information from a business entity to researchers where the parties have agreed that the business entitS~ may withhold from publication some or all of the information so provided. (5) Research based elsewhere. Research conducted by scientists or engineers who are not working for any of the institutions described in paragraphs (c)(2) through (c)(4) of this section will be treated as corporate research, as described in paragraph (c)(4) of this section. (See Question D(8)). (d) Educational information. The release of "educational information" referred to in paragraph (a)(3) of this section is release by instruction in catalog courses and associated teaching laboratories of academic institutions. Dissertation research is treated in paragraph (c)(2) of this section. (See Question C(1) through C(6).) [660] (e) Patent applications. The information referred to in paragraph (a)(4) of this section is: (1) Information contained in a patent application prepared wholly from foreign-origin technical data where the application is being sent to the foreign inventor to be executed and returned to the United States for subsequent filing in the U.S. Patent and Trademark Office; (2) Information contained in a patent application, or an amendment, modification, supplement, or division of an application, and authorized for filing in a foreign country in accordance with the regulations of the Patent and Trademark Office, 37 CFR part 5 (see Sec. 770.10(j)); or (3) Information contained in a patent application when sent to a foreign country before or within six months after the filing of a United States patent application for the purpose of obtaining the signature of an inventor who was in the United States when the invention was made or who is a co-inventor with a person residin~ in the United States. (f) Government-sponsored research covered by contract controls. (1) If research is funded by the U.S. Government, and specific national security controls are agreed on to protect information resulting from the research, paragraph (a)(2) of this section will not apply to any export of such information in violation of such controls. General License GTDA as described in paragraph (a)(2) of this section is nonetheless available for any export of information resulting from the research that is consistent with the specific controls. (2) Examples of "specific national security controls" include requirements for prepublication review by the Government, with right to withhold permission for publication; restrictions on prepublication dissemination of information to nonU.S. citizens or other categories of persons; or restrictions on participation of nonU.S. citizens or other categories of persons in the research. A general reference to one or more export control laws or regulations or a general reminder that the Government retains the right to classify is not a "specific national security control". (See Questions E(1) and E(2).) (g) Advice concerning uncontrolled information. Persons may be concerned that an export of uncontrolled information could adversely affect U.S. national security interests. Exporters who wish advice before exporting such information can contact the appropriate Government scientific or technical personnel by calling the Bureau of Export Administration at (202) 377-4811. Note: Consulting and training. Technical data can be inadvertently exported in various ways. Consulting and training are especially effective mechanisms of technology transfer. The exporter should be aware that the Department of Commerce maintains controls on exports of technical data that do not qualify for General License GTDA as described in paragraphs (a)(1) through (a)(3) of this section, including application abroad of personal knowledge or technical experience acquired in the United States. (See also paragraph (g) of this section and Question F(1).) [[661] Sec. 779.4 General license GTDR: Technical data under restriction. A general license designated GTDR is hereby established authorizing the export of technical data that are not exportable under the provisions of General License GTDA, subject to the provisions, restrictions, exclusions, and exceptions set forth below and subject to the written assurance requirement set forth in paragraph (f) of this section. (a) Country restrictions. General License GTDR with written assurance may not be used for exports to Country Groups QWYS and Z, the People's Republic of China, Iran, or Syria. General License GTDR without written assurance (GTDU) may not be used for exports to Country Groups S and Z, Iran or Syria of software available at retail outlets as described in the General Software Note.(13) General License GTDR without written assurance (GTDU) as described in any entry on the Commerce Control List (Supplement No. 1 to Sec. 799.1 of this subchapter) may not be used for exports to Country Groups S and Z. This General License is subject to the prohibitions described in Sec. 771.2(c) of this subchapter, including the prohibition on any export to the South African military or police. __________ (13) The General Software Note (GSN) is contained in Supplement No. 2 to Sec. 799.1 of Subchapter C, Chapter VII, Title 15, Code of Federal Regulations. The text of the GSN is as follows: General License GTDR, without written assurance, is available for release of software that is generally available to the public by being: a. Sold from stock at retail selling points without restriction by means of: 1. Over the counter transactions; 2. Mail order transactions, or 3. Telephone call transactions; and b. Designed for installation by the user without further substantial support by the supplier. General license GTDA is available for software that is publicly available. The General Software Note does not apply to exports of "software" controlled by other agencies of the U.S. Government. The phrase "without restriction" clarifies that software is not "generally available to the public" if it is to be sold only with bundled hardware generally available to the public. Software that is both bundled with hardware and "generally available to the public" does qualify for General License GTDR without a written assurance. __________ (b) General License GTDR without written assurance authorizes the following exports-- (1) Operation technical data. (i) For definitions and conditions for use of General License GTDR without written assurance for operation technical data, refer to the third paragraph of the General Technology Note as listed in Supplement No. 2 to Sec. 799.1 of this subchapter. As defined in that Note, "operation technical data" is the minimum [662] necessary for the installation, operations,(14) maintenance (checking), and repair of those products that are eligible for general licenses, or that are exported under a validated export license. The "minimum necessary" excludes from operation technical data development or production technical data and includes use technology only to the extent required to ensure safe and efficient use of the product. Individual entries in the software and technology subcategories of the CCL may further restrict export of "minimum necessary" technical data. (See Supplement Nos. 2 and 3 to Sec. 799.1 of this subchapter for further information and definitions of the terms "development", "production", "use", and "required".) _________ (14) Exporters of digital computer equipment must describe on their license applications any software, including that shipped under General License GTDR, to be used with the equipment. _________ (ii) Operation software may be exported under GTDR, without assurance, provided that: (A) The operation software is the minimum necessary to operate the equipment authorized for export; and (B) The operation software is in object code. (2) Sales technical data. (i) "Sales technical data" is defined as data supporting a prospective or actual quotation, bid, or offer to sell, lease, or otherwise supply any item controlled by the EAR. (ii) Sales technical data may be exported under GTDR, without written assurances, provided that: (A) The technical data is a type customarily transmitted with a prospective or actual quotation, bid, or offer in accordance with established business practice; and (B) The export will not disclose the detailed design, production, or manufacture, or the means of reconstruction, of either the quoted item or its product. The purpose of this limitation is to prevent disclosure of technical data so detailed that the consignee could use the technical data in production. Note: Neither this authorization nor its use means that the U.S. Government intends, or is committed, to approve an export license application for any commodity, plant, or technical data that may be the subject of the transaction to which such quotation, bid, or offer relates. Exporters are advised to include in any quotations, bids, or offers, and in any contracts entered into pursuant to such quotations, bids, or offers, a provision relieving themselves of liability in the event that an export license (when required) is not approved by the Bureau of Export Administration. (3) Software updates. Software updates that are intended for and are limited to correction of errors ("fixes" to "bugs" that have been identified) qualify for export under General License GTDR, without written assurance, provided the updates are being exported to the same consignee and do not enhance the functional capacities of the initial software package. (4) Technical data described in the Commerce Control List. Certain other technical [663] data may be exported under GTDR without written assurance. Such technical data is identified in the "Requirements" section of the ECCN under the heading "GTDU". The designations "GTDU: Yes" or "GTDU: Yes except ...." indicate that General License GTDR without written assurance is available subject to any applicable exceptions. The designation "GTDU: No" indicates that General License GTDR without written assurance is not available. However, the designation "GTDU: No" does not restrict exports under paragraphs (b)(1), (b)(2), or (b)(3) of this section. Exporters have the option of using the term "GTDU" to describe General License GTDR without written assurance for all purposes, including information requirements on the Shipper's Export Declaration. (c)-(d) [Reserved] (e) Restrictions applicable to the Republic of South Africa-- (1) General prohibition. Except as provided in Sec. 779.4 (b)(1), (b)(2), and (b)(3), no technical data may be exported or reexported to the Republic of South Africa under this General License GTDR where the exporter or reexporter knows or has reason to know that the data or the direct product of the data are for delivery, directly or indirectly, to or for use by or for military or police entities in South Africa or for use in servicing equipment owned, controlled, or used by or for such entities. In addition, no technical data relating to the commodities listed in Supplement No. 2 to this Part 779 may be exported or reexported under General License GTDR to any consignee in the Republic of South Africa. (2) Written assurances. In addition to any written assurances that may or may not be required by paragraph (f) of this section, no export or reexport of technical data may be made to the Republic of South Africa under General License GTDR until the exporter has received written assurance from the importer that neither the technical data nor the direct product of the data will be made available to or for use by or for military or police entities of the Republic of South Africa. (f) General License GTDR with written assurances. Except as provided in Sec. 779.4(b) and (f)(5), no export of technical data described in this Sec. 779.4(f) may be made under General License GTDR: (1) Until the U.S. exporter has received a written assurance from the foreign importer that, unless prior authorization is obtained from the Office of Export Licensing, the importer will not knowingly: (i) Reexport, directly or indirectly, to Country Group Q, S, W,(15) Y, or Z, or the [664] People's Republic of China any technical data relating to commodities controlled to Country Group W as described in the paragraph titled "Validated License Required" of any entry of the Commerce Control List; _________ [Note on page 663] (15) Effective April 26, 1971, Country Group W no longer included Romania Assurances executed prior to April 26, 1971, that refer to Country Group W continue to apply to Romania as well as Poland. Effective April 25,1991, Czechoslovakia was added to Country Group W. Assurances executed on or after April 25,1991, that refer to Country Group W apply to Czechoslovakia as well as Poland. On May 8,1992, Hungary was removed from Country Group W. Assurances are no longer applicable to Hungary. On January 1,1993, Czechoslovakia became two separate countries called the Czech Republic and the Slovak Republic. Assurances executed prior to January 1, 1993, that refer to Czechoslovakia continue to apply to the Czech Republic and the Slovak Republic. _________ (ii) Export, directly or indirectly, to Countrv Group Z any direct product of the technical data if such direct product is controlled to Country Group "W" in the paragraph of any entry on the Commerce Control List titled "Validated License Required"; or (iii) Export, directly or indirectly, to any destination in Country Group Q, S, W, Y, or the People's Republic of China, any direct product of the technical data if such direct product is identified by the code letter "A" following the Export Control Classification Number on the Commerce Control List. (2) If the direct product of any technical data is a complete plant or any major component of a plant that is capable of producing a commodity controlled to Country Group "W" in the paragraph of any entry on the Commerce Control List titled "Validated License Required" or appears on the U.S. Munitions List, a written assurance by the person who is or will be in control of the distribution of the products of the plant (whether or not such person is the importer) shall be obtained by the U.S. exporter (via the foreign importer), stating that, unless prior authorization is obtained from the Office of Export Licensing, such person will not knowingly: (i) Reexport, directly or indirectly, to Country Group Q, S, W, Y, or Z, or the People's Republic of China, the technical data relating to the plant or the major component of a plant; (ii) Export, directly or indirectly, to Country Group Z, the plant or the major component of a plant (depending upon which is the direct product of the technical data) or any product of such plant or of such major component, if such product is identified by the symbol "W" in the paragraph of any entry on the Commerce Control List titled "Validated License Required" or appears on the U.S. Munitions List; or (iii) Export, directly or indirectly, to any destination in Country Group Q, S, W, Y, or the People's Republic of China, the plant or the major component of a plant (depending upon which is the direct product of the technical data) or any product of such plant or of such major component, if such product is identified by the code letter "A" following the Export Control Classification Number on the Commerce Control List or appears on the U.S. Munitions List. Note: Effective April 1,1964, Sec. 779.4(f)(2)(ii) and (f)(2)(iii) required certain written assurances relating to the disposition of the products of a complete plant or major component of a plant that is the direct product of unpublished technical data of U.S. origin exported under General License GTDR. Except as to commodities identified by the code letter "A" following the Export Control Classification Number on the Commerce Control List, and items on the U.S. Munitions List, the effective date of the written assurance requirements for plant products as a condition of using General License GTDR for export of this type of technical data is hereby deferred until further notice, subject to the following limitations: 1. The exporter shall, at least two weeks before the initial export of the technical data, notify the Office of Export Licensing, by letter, of the facts required [665] to be disclosed in an application for a validated export license covering such technical data; and 2. The exporter shall obtain from the person who is or will be in control of the distribution of the products of the plant (whether or not such person is the importer) a written commitment that he will notify the U.S. Government, directly or through the exporter, whenever he enters into negotiations to export any product of the plant to any destination covered by Sec. 779.4(f)(2)(ii), when such product is not identified by the code letter "A" following the Export Control Classification Number on the Commerce Control List and requires a validated license for export to Countr,v Group W by the information set forth in the applicable CCL entry in the paragraph titled "Validated License Required". The notification should state the product, quantity, country of destination, and the estimated date of the shipment. Moreover, during the period of deferment, the remaining written assurance requirements of Sec. 779.4 (f)(2)(ii) and (fl(2)(iii) as to plant products that are identified by the code letter "A" following the Export Control Classification Number on the Commerce Control List, or are on the U.S. Munitions List, will be waived if the plant is located in one of the following COCOM countries: Australia, Belgium, Canada, Denmark, the Federal Republic of Germany, France, Greece, Italy, Japan, Luxembourg, the Netherlands, Norway, Portugal, Spain, Turkey, and the United Kingdom. This deferment applies to exports of technical data pursuant to any type of contract or arrangement, including licensing agreements, regardless of whether entered into before or after April 1,1964. (3) The required assurance may be made in the form of a letter or other written communication from the importer or, if applicable, the person in control of the distribution of the products of a plant; or the assurance may be incorporated into a licensing agreement that restricts disclosure of the technical data to be used only in authorized destinations, and prohibits shipment of the direct product thereof by the licensee to any unauthorized destination. An assurance included in a licensing agreement will be acceptable for all exports made during the life of the agreement, provided that the obligations of the importer set forth in the assurances survive any termination of the licensing agreement. If such assurance is not received, this general license is not applicable and a validated export license is required. An application for validated license shall include an explanatory statement setting forth the reasons why such assurance cannot be obtained. (4) In addition, this general license is not applicable to any export of technical data of the kind described in this Sec. 779.4(f), if at the time of export of the technical data from the United States, the exporter knows or has reason to believe that the direct product to be manufactured abroad by use of the technical data is intended to be exported directly or indirectly to any unauthorized destination. (5) The limitations in this Sec. 779.4(f) do not apply to the export of technical data included in an application for the foreign filing of a patent, provided such filin~ is in accordance with the re~ulations of the U.S. Patent Office. (g) Additional restrictions applicable to chemical or biological weapons. In [666] addition to any other restrictions in Sec. 779.4, the use of General License GTDR is further restricted bv Sec. 778.8(a)(5) of this subchapter. Sec. 779.5 Validated license applications. (a) General. No technical data, other than that exportable without license to Canada or under general license to other destinations, may be exported from the United States without a validated export license. Such validated export licenses are issued by the Office of Export Licensing upon receipt of an appropriate export application or reexport request. An application for a technical data license shall consist of: (1) Form BXA-622P, Application for Export License, accompanied by; (2) A letter of explanation described in Sec. 779.5(d) for technology or description of the capabilities of the software; and (3) For shipments to the Czech Republic, Hungary, Poland, and the Slovak Republic, an Import Certificate issued by the appropriate national government. (See Sec. 775.8 and supplement No. 1 to part 775 of this subchapter.) (b) Application Form. Form ITA-622P shall be completed as provided in Sec. 772.4, except that Items 9(a) and 11 shall be left blank. In Item 9(b), "Description of Commodity or Technical Data," enter a general statement which specifies the technical data (e.g., blueprints, manuals, etc.). In Purpose." (c) [Reserved] (d) Letter of explanation. Each application shall be supported by a comprehensive letter of explanation in duplicate. This letter shall set forth all the facts required to present to the Office of Export Licensing a complete disclosure of the transaction including, if applicable, the following: (1) The identification of all parties to the transaction; (2) The exact project location where the technical data will be used; (3) The type of technical data to be exported; (4) The form in which the export will be made; (5) The uses for which the data will be employed; (6) An explanation of the process, product, size, and output capacity of the plant or equipment, if applicable, or other description that delineates, defines, and limits the data to be transmitted (the "technical scope"); (7) The availability abroad of comparable foreign technical data. (e) Special provisions-- (1) Maritime nuclear propulsion plants and related commodities.(16) These special provisions are applicable to technical data relating to maritime (civil) nuclear propulsion plants, their land prototypes, and special facilities for their construction, [667] support, or maintenance, including any machinery, device, component, or equipment specifically developed or designed for use in such plants or facilities. Every application for license to export technical data relating to any of these commodities shall include the following: _________ (16) See Sec. 779.8(a) which sets forth provisions prohibiting exports and reexports of certain technical data and products manufactured therefrom. _________ (i) A description of the foreign project for which the technical data will be furnished; (ii) A description of the scope of the proposed services to be offered by the applicant, his consultant(s), and his subcontractor(s), including all the design data which will be disclosed; (iii) The names, addresses and titles of all personnel of the applicant, his consultant(s) and his subcontractor(s) who will discuss or disclose the technical data or be involved in the design or development of the technical data; (iv) The beginning and termination dates of the period of time during which the technical data will be discussed or disclosed and a proposed time schedule of the reports which the applicant will submit to the U.S. Department of Commerce, detailing the technical data discussed or disclosed during the period of the license; (v) The following certification: I (We) certify that if this application is approved, I (we) and any consultants, subcontractors, or other persons employed or retained by us in connection with the project thereby licensed will not discuss with or disclose to others, directly or indirectly, any technical data relating to U.S. naval nuclear propulsion plants. I (We) further certify that I (we) will furnish to the U.S. Department of Commerce all reports and information which it may require concerning specific transmittals or disclosures of technical data pursuant to any license granted as a result of this application; (vi) A statement of the steps which the applicant will take to assure that personnel of the applicant, his consultant(s) and his subcontractor(s) will not discuss or disclose to others technical data relating to U.S. naval nuclear propulsion plants; and (vii) A written statement of assurance from the foreign importer that unless prior authorization is obtained from the Office of Export Licensing, the importer will not knowingly export directly or indirectly to Country Group Q, S, W, Y, or Z, or the People's Republic of China, the direct product of the technical data. However, if the U.S. exporter is not able to obtain this statement from the foreign importer, the U.S. exporter shall attach an explanatory statement to his license application setting forth the reasons why such an assurance cannot be obtained. (2) Other license applications. For all other license applications to export technical data identified in an entrv with an ECCN ending in the code letter "A" to any destination, other than Country Group Q, S, W, Y, or Z, or the People's Republic of China, an applicant shall attach to the license application a written statement from his foreign importer assuring that, unless prior authorization is obtained from the Office of Export Licensing, the importer will not knowingly reexport the technical data to any destination, or export any national security controlled direct product of the technical data, directly or indirectly, to Country Group Q, S, W, Y, or Z, or the People's Republic of China. However, if the U.S. exporter is not able to obtain the required statement from his importer, the exporter [668] shall attach an explanatory statement to his license setting forth the reasons why such an assurance cannot be obtained. (f) Validity period and extension-- (1) Initial validity. Validated licenses covering exports of technical data will generally be issued for a validity period of 24 months. Upon request, a validity period exceeding 24 months may be granted where the facts of the transaction warrant it and the Office of Export Licensing determines that such action would be consistent with the objectives of the applicable U.S. export control program. Justification for a validity period exceeding 24 months should be provided in accordance with the procedures set forth in Sec. 772.9(d)(2) for requesting an extended validity period with a license application. The Office of Export Licensing will make the final decision on what validity beyond 24 months, if any, should be authorized in each case. (2) Extensions. A request to extend the validity period of a technical data license shall be made on Form ITA-685P in accordance with the procedures set forth in Sec. 772.12(a). The request shall include on Form ITA-685P, in the space entitled "Amend License to Read as Follows," whether the license has been previously extended and the date(s) and duration of such extension(s). The Office of Export Licensing will make the final decision on what extension beyond 24 months, if any, should be authorized in each case. (See Sec. 779.8(c)(1) for validity period extensions for reexports of technical data.) Sec. 779.6 Exports under a validated license. (a) Use of validated licenses-- (1) Retention of license. The validated technical data license need not be presented to the customs of fice or post office but shall be retained and made available for inspection in accordance with the provisions of Sec. 787.13 of this subchapter. (2) Return of revoked or suspended technical data licenses. If the Office of Export Licensing revokes or suspends a technical data license, the licensee shall return the license immediately to the Office of Export Licensing in accordance with the instructions in Sec. 786.2(d) of this subchapter. (b) Records. Any person to whom a validated technical data license has been issued shall retain the license and maintain complete records in accordance with Sec. 786.2(d) of this subchapter, including any export licenses (whether used or unused, valid or expired) and all supporting documents and shipping records. Sec. 779.7 Amendments. Requests for amendments shall be made in accordance with the provisions of Sec. 772.11. Changes requiring amendment include any expansion or upgrade of the technical scope that was described in the letter of explanation, as approved or modified on the export license. [669] Sec. 779.8 Reexports of technical data and exports of the product manufactured abroad by use of United States technical data. (a) Prohibited exports and reexports. Unless specifically authorized by the Office of Export Licensing, or otherwise authorized under the provisions of paragraph (b) of this section, no person in the United States or in a foreign country may: (1) Reexport any technical data imported from the United States, directly or indirectly, in whole or in part, from the authorized country(ies) of ultimate destination; (2) Export any technical data from the United States with the knowledge that it is to be reexported, directly or indirectly, in whole or in part, from the authorized country(ies) of ultimate destination; or (3) Export or reexport to Country Group Q, S, W, Y or Z, the People's Republic of China or Afghanistan any foreign produced direct product of U.S. technical data, or any commodity produced by any plant or major component thereof that is a direct product of U.S. technical data, if such direct product or commodity is covered by the provisions of Sec. 779.4(f) or Sec. 779.5(e)(1); or (b) Permissive reexports-- (1) Exportable under General License GTDA or GTDR. Any technical data which have been exported from the United States may be reexported from any destination to any other destination provided that, at the time of reexport, the technical data may be exported directly from the United States to the new country of destination under General License GTDA or GTDR and provided that all of the requirements and conditions for use of these general licenses have been met. (2) COCOM authorization. Separate specific authorization by the Office of Export Licensing to reexport any U.S. origin technical data is not required if all of the following conditions are met: (i) The data being exported are identified bv the suffix "A" on the CCL; (ii) The export or reexport is from a COCOM participating country, i.e., Australia, Belgium, Canada, Denmark, France, the Federal Republic of Germany, Greece, Italy, Japan, Luxembourg, the Netherlands, Norway, Portugal, Spain, Turkey, or the United Kingdom; (iii) The export or reexport is made in accordance with the condihons of the licensing authorization issued by the applicable COCOM participating country; and (iv) The export or reexport is to a country in Country Group Q, W, or Y or the People's Republic of China. (3) Direct product. Separate specific authorization by the Office of Export Licensing to export or reexport the direct product of U.S. origin technical data is not required if the direct product, were it of U.S. origin, could be shipped under any of the permissive reexport provisions of Sec. 774.2 of this subchapter. (4) People's Republic of China. Separate specific authorization by the Office of Export Licensing is not required to reexport software from a COCOM participating country, Austria, Finland, Hong Kong, Ireland, New Zealand, Sweden, or Switzerland to the People's Republic of China that meets the requirements set forth in Advisory Notes for the People's Republic of China or for Country Groups [670] Q, W, Y in the Commerce Control List (Supplement No. 1 to Sec. 799.1 of this subchapter) and are licensed for shipment by the country from which reexported. (c) Specific authorization to reexport-- (1) Submission of request for reexport authorization. Requests for specific authorization to reexport technical data or to export any product thereof, as applicable, shall be submitted on Form ITA-699P, Request To Dispose of Commodities or Technical Data Previously Exported (OMB approval No. 0625-0009), to: Office of Export Licensing, P.O. Box 273, Washington, DC 20044. (See Supplement No. 1 to Part 774 for instructions on completing the form.) If Form ITA-699P is not readily available, a request for specific authorization to reexport technical data or to export any product thereof, as applicable, may be submitted by letter. The letter shall bear the words "Technical Data Reexport Request" immediately below the heading or letterhead and contain all the information required by Sec. 779.5(d). Authorization to reexport technical data or to export the product thereof, if granted, will generally be issued with a validity period of 24 months on Form ITA- 699P, or by means of a letter from the Office of Export Licensing. Any request for extension of the validity period shall be requested in accordance with Sec. 774.5(b), and shall specify the period for which additional validity is required. The Office of Export Licensing will make the final decision on what validity beyond 24 months, if any, should be authorized in each case. (2) Return of reexport authorization. If the Office of Export Licensing revokes or suspends a reexport authorization, the licensee shall return the reexport authorization immediately to the Office of Export Licensing. (3) Records. Any person to whom a reexport authorization has been issued shall retain and make available for inspection records in accordance with the provisions of Sec. 787.13 of this subchapter, including any reexport authorizations (whether used or unused, valid or expired) and all supporting documents and shipping records. (d) Effect of foreign laws. No authority granted by the U.S. Office of Export Licensing, or under the provisions of the U S. Export Administration Regulations, to reexport technical data or export a product thereof shall in any way relieve any person from his responsibility to comply fully with the laws, rules, and regulations of the country from which the reexport or export is to be made or of any other country having authority over any phase of the transaction. Conversely, no foreign law, rule, regulation, or authorization in any way relieves any person from his responsibility to obtain such authorization from the U.S. Office of Export Licensing as may be required by the U.S. Export Administration Regulations. Sec. 779.9 Commercial agreements with certain countries. Pursuant to section 5(j) of the Export Administration Amendments Act of 1979, as amended, any non-governmental U.S. person or firm that enters into an [671] agreement with any agency of the government of a controlled country (Country Groups Q, W, Y, and the People's Republic of China), which agreement encourages technical cooperation and is intended to result in the export from the U.S. to the other party of U.S.-origin technical data (except under General License GTDA or General License GTDR as provided under the provisions of Sec. 779.4(b)), shall submit those portions of the agreement that include the statement of work and describe the anticipated exports of data to the Office of Technology and Policy Analysis, Room 4054, P.O. Box 273, Washington, DC 20044. This material shall be submitted no later than 30 days after the final signature on the agreement. (a) This requirement does not apply to colleges, universities and other educational institutions. (b) The submission required by this section does not relieve the exporter from the licensing requirements for controlled technical data and goods. (c) Acceptance of a submission does not represent a judgment as to whether Export Administration will or will not issue any authorization for export of technical data. Sec. 779.10 Other applicable provisions. As far as may be consistent with the provisions of this part, all of the other provisions of the Export Administration Regulations shall apply equally to exports of technical data and to applications for licenses and licenses issued under this part. Supplement No. 1 to Part 779-- Technical Data Interpretations 1. Technology based on U.S.-origin technical data. U.S.-origin technical data does not lose its U.S.-origin when it is redrawn, used, consulted, or otherwise commingled abroad in any respect with other technical data of any other origin. Therefore, any subsequent or similar technical data prepared or engineered abroad for the design, construction, operation, or maintenance of any plant or equipment, or part thereof, which is based on or utilizes any U.S.-origin technical data, is subject to the same U.S. Export Administration Regulations that are applicable to the original U.S.-origin technical data, including the requirement for obtaining Office of Export Licensing authorization prior to reexportation. 2. Distinction between General and Validated License requirements for shipment to QWY destinations of technical data and replacement parts. A number of exporters have recently asked where the line is drawn between general license and validated license exports to PQWY destinations of technical data related to equipment exports. The export of technical data under validated license is authorized only to the extent specifically indicated on the face of the license. The only data related to equipment exports that can be provided under general license is the publicly [672] available data authorized by General License GTDA, or the assembly, installation, maintenance, repair, and operation data authorized by General License GTDR. 771.20 General License GLX; exports to Country Groups QWY and the People's Republic of China. (a) Scope. A general license designated GLX is established, authorizing exports to civil end-users in Country Group QWY and the People's Republic of China (PRC) of certain specified items. (b) Eligible exports. The items eligible for this general license are those described in the Advisory Notes in the CCL that indicate likelihood of approval for "Country Groups QWY and the PRC," except items described in the notes to ECCNs lC18A and 2B18A. Likelihood of approval notes that apply only to the PRC, or to specified destinations in Country Group Y also qualify for this general license to eligible destinations (however, those notes indicating Country Group Q or W only, are specifically not eligible). In addition, those entries and sub-entires listed in Supplement No. 1 to this Part 771 are eligible to export under this general license. However, this general license is not available for items that are also subject to missile technology (MT), nuclear nonproliferation (NP), or foreign policy (FP) controls to the recipient country. (c) Eligible consignees. This general license is available only for exports to civil end-users for civil end-uses. Exports under this general license may not be made to military end-users or to known military uses. Such exports will continue to require an individual validated license and be considered on a case-by-case basis. In addition to conventional military activities, military uses include any proliferation activities described in Part 778 of this subchapter. Retransfers to military end-users or end-uses in eligible countries are strictly prohibited, without prior authorization. The relevant part of the Commerce Control List is the "Information Security" category, as described below (taken from Supplement Number 1 to Section 799.1 of the Code of Federal Regulations). II. "Information Security" NOTE: The control status of "information security" equipment, "software", systems, application specific "assemblies", modules, integrated circuits, components, technology or functions is defined in the "information security" entries in this Category even if they are components or "assemblies" of other equipment. NOTE: "Information security" equipment, "software", systems, application specific "assemblies", modules, integrated circuits, components, technology or functions that are excepted from control, not controlled, or eligible for licensing under an Advisory Note are under the licensing jurisdiction of the Department of Commerce. For all other, exporters requesting a validated license from the Department [673] of Commerce must provide a statement from the Department of State, Office of Defense Trade Control, verifying that the equipment intended for export is under the licensing jurisdiction of the Department of Commerce. A. Equipment, Assemblies and Components 5A11A Systems, equipment, application specific "assemblies", modules or integrated circuits for "information security", as described in this entry, and other specially designed components therefor. List of Items Controlled Systems, equipment, application specific "assemblies", modules or integrated circuits for "information security," as follows, and other specially designed components therefor: a. Designed or modified to use "cryptography" employing digital techniques to ensure "information security"; b. Designed or modified to perform cryptanalytic functions; c. Designed or modified to use "cryptography" employing analog techniques to ensure "information security", except: c.1. Equipment using "fixed" band scrambling not exceeding 8 bands and in which the transpositions change not more frequently than once very second; c.2. Equipment, using "fixed" band scrambling exceeding 8 bands and in which the transpositions change not more frequently than once every ten seconds; c.3. Equipment using "fixed" frequency inversion and in which the transpositions change not more frequently than once every second; c.4. Facsimile equipment; c.5. Restricted audience broadcast equipment; c.6. Civil television equipment; d. Designed or modified to suppress the compromising emanations of information-bearing signals; NOTE: 5A11.d does not control equipment specially designed to suppress emanations for health and safety reasons. e. Designed or modified to use cryptographic techniques to generate the spreading code for "spread spectrum" or hopping code for "frequency agility" systems; f. Designed or modified to provide certified or certifiable "multilevel security" or user isolation at a level exceeding Class B2 of the Trusted Computer System Evaluation Criteria (TCSEC) or equivalent; g. Communications cable systems designed or modified using mechanical, electrical or electronic means to detect surreptitious intrusion. 5B11A Equipment specially designed for the development of equipment or functions controlled by the "information security" entries in this Category, including measuring or test equipment. [674] 5B12A Equipment specially designed for the production of equipment or functions controlled by the "information security" entries in this Category, including measuring, test, repair or production equipment. 5B13A Measuring equipment specially designed to evaluate and validate the "information security" functions controlled by the "information security" entries in 5A or 5D. C. Materials [Reserved] D. "Software" 5D11A "Software" specially designed or modified for the "development", "production", or "use" of equipment controlled by "information security" entries 5A11, 5B11, 5B12, or 5B13 or "software" controlled by "information security" entries 5D11, 5D12, or 5D13. 5D12A "Software" specially designed or modified to support technology controlled by "information securitv" entry 5E11. 5D13A Specific "software" as follows. NOTE: Exporter must have determined that the software is not controlled by the Office of Defense Trade Control, Department of State, before using this general license. List of Items Controlled a. "Software" having the characteristics, or performing or simulating the functions of the equipment controlled by the "information security" entries in 5A or 5B. b. "Software" to certify "software" controlled by 5D13.a; c. "Software" designed or modified to protect against malicious computer damage, e.g., viruses. E. Technology 5E11A Technology according to the General Technology Note for the "development", "production", or "use" of equipment controlled by "Information Security" entries 5A11, 5B11, 5B12, or 5B13 or "software" controlled by "information security" entries 5D11, 5D12, or 5D13. NOTES for "Information Security" NOTE 1: "Information security" entries in this Category do not control: a. "Personalized smart cards" using "cryptography" restricted for use only in equipment or systems released from control under 5A11.c.1 to c.6, by this Note or as described in "Information Security" Advisory Notes 3 and 4 below; [675] b. Equipment containing "fixed" data compression or coding techniques; c. Receiving equipment for radio broadcast, pay television or similar restricted audience television of the consumer type, without digital encryption and where digital decryption is limited to the video, audio or management functions; d. Portable (personal) or mobile radio-telephones for civil use; e.g., for use with commercial civil cellular radiocommunications systems, containing encryption, when accompanying their users; e. Decryption functions specially designed to allow the execution of copy-protected "software", provided that the decryption functions are not user-accessible. NOTE 2: "Information Security" entries in this Category do not control: a. "Software" "required" for the "use" of equipment released by "Information Security" Note 1; b. "Software" providing any of the functions of equipment released by "Information Security" Note 1; ADVISORY NOTE 3: Licenses are likely to be approved, as administrative exceptions, for exports to Country Group W or cellular radio equipment or systems specially designed for cryptographic operation, provided any message traffic encryption capability that is within the scope of the control of the "information security" entries in Category 5 and that is contained in such equipment or systems is irreversibly disabled. N.B.: Provided message traffic encryption is not possible within such a system, the export of mobile or portable cellular radio subscriber equipment containing cryptographic capabilities is permitted under this Advisory Note. ADVISORY NOTE 4: Licenses are likely to be approved, as administrative exceptions, for exports to satisfactory end-users in Country Groups QWY and the PRC of the following cryptographic equipment, provided that the equipment is intended for civil use: a. Access control equipment, such as automatic teller machines, self-service statement printers or point of sale terminals, that protects password or personal identification numbers (PIN) or similar data to prevent unauthorized access to facilities, but does not allow for encryption of files or text, except as directly related to the password of PIN protection; b. Data authentication equipment that calculates a Message Authentication Code (MAC) or similar result to ensure no alteration of text has taken place, or to authenticate users, but does not allow for encryption of data, text or other media other than that needed for the authentication; c. Cryptographic equipment specially designed, developed or modified for use in machines for banking or money transactions, such as automatic teller machines, self-service statement printers, point of sale terminals or equipment for the encryption of interbanking transactions, and intended for use only in such applications. ADVISORY NOTE 5: (Eligible for GTDR). Licenses are likely to be approved as administrative exceptions, for exports to satisfactory end-users in Country Groups QWY and the PRC of the following cryptographic "software"; a. "Software" required for the "use" of equipment eligible for administrative exceptions treatment under Advisory Notes 3 and 4 in the Notes for "Information Security" (Category 5); b. "Software" providing any of the functions of equipment eligible for administrative exceptions treatment under Advisory Notes 3 and 4 in the Notes for "Information Security" (Category 5). *[End of Notes for "Information Security."]* [676] III. Other Equipment, Materials, "Software" and Technology A. Equipment, Assemblies and Components 5A20B Telemetering and telecontrol equipment usable as launch support equipment for unmanned air vehicles or rocket svstems. 5A80D Communications intercepting devices; and parts and accessories therefor. (Specify by name.) (Also see S776.13 of this subchapter.) NOTES: 1. These items are subject to the United Nations Security Council arms embargo against Rwanda described in S785.4 (a) of this subchapter. 2. Controls on this equipment are maintained in accordance with the Omnibus Crime Control and Safe Streets Act of 1968 (Pub. L. 90-351). [End N.4.2 and Appendix N] __________________________________________________________________ Digitized November 12-13, 1996.