ECCN 5A002

(1) ECCN 5A002.a controls "components" providing the means or functions necessary for "information security." All such "components" are presumptively "specially designed" and controlled by 5A002.a. (2) See USML Categories XI (including XI(b)) and XIII(b) (including XIII(b)(2)) for controls on systems, equipment, and components described in 5A002.d or .e that are "subject to the ITAR" (see 22 CFR parts 120 through 130). (3) For "satellite navigation system" receiving equipment containing or employing decryption see 7A005, and for related decryption "software" and "technology" see 7D005 and 7E001. (4) Noting that items may be controlled elsewhere on the CCL, examples of items not controlled by ECCN 5A002.a.4 include the following: (a) An automobile where the only 'cryptography for data confidentiality' having a 'described security algorithm' is performed by a Category 5—Part 2 Note 3 eligible mobile telephone that is built into the car. In this case, secure phone communications support a non-primary function of the automobile but the mobile telephone (equipment), as a standalone item, is not controlled by ECCN 5A002 because it is excluded by the Cryptography Note (Note 3) (See ECCN 5A992.c). (b) An exercise bike with an embedded Category 5—Part 2 Note 3 eligible web browser, where the only controlled cryptography is performed by the web browser. In this case, secure web browsing supports a non-primary function of the exercise bike but the web browser ("software"), as a standalone item, is not controlled by ECCN 5D002 because it is excluded by the Cryptography Note (Note 3) (See ECCN 5D992.c). (5) After classification or self-classification in accordance with § 740.17(b) of the EAR, mass market encryptio

Items may also be controlled under the ITAR (22 CFR 121) administered by the State Department Directorate of Defense Trade Controls (DDTC).

Category 5 has two parts: Part 1 covers telecommunications equipment (transmission, switching, network infrastructure) and Part 2 covers information security (cryptographic systems, key management, and encryption). Encryption controls under 5D002 and 5E002 affect a broad range of software products.

Source: BIS Commerce Control List, eCFR Title 15 Part 774. This reference is for informational purposes only. For licensing determinations, consult BIS.doc.gov or a licensed export compliance attorney.