Last Tuesday, the Department of Commerce’s Bureau of Industry and Security (BIS) published a final rule amending its existing rules for encryption products (the “Final Rule”). In what will no doubt be seen by industry as at least a small and perhaps long overdue breath of fresh air, the Final Rule streamlines BIS’s approach to encryption products and updates its rules to reflect and implement changes arising from the December 2015 Wassenaar Arrangement Plenary Meeting.

BIS’s Final Rule makes several important and noteworthy adjustments to its existing encryption controls:

  • Deletion of Encryption Registration Requirement. Exporters of certain encryption products previously had to register and obtain an Encryption Registration Number in order to self-classify and then export their products. In its Final Rule, BIS deleted this requirement, opting instead to require exporters to provide the same information previously submitted at registration in their annual encryption self-classification reports.
  • Updates to ENC-Restricted / “(b)(2)” Parameters. BIS also made changes to the required performance parameters for certain products eligible for restricted use of License Exception ENC, including network infrastructure products. These changes, which largely entail increases to operational thresholds, provide for advances in the relevant technology and allow greater flexibility for exporters. BIS also added a definition for “network infrastructure” products to clarify the scope of this term.
  • Elimination of ELAs for “Less Sensitive Government End Users.” Where exporters previously had to apply for and obtain so-called “worldwide” Encryption Licensing Arrangements (ELAs) in order to authorize exports, reexports, and transfers (in-country) of network infrastructure items to less sensitive government end users, BIS eliminated this requirement in its Final Rule. Instead, License Exception ENC now authorizes exports of network infrastructure items to less sensitive government end users in non-Supplement No. 3 countries 30 days after submission of a classification request. BIS’s Final Rule also features formal definitions for the terms “less sensitive government end users” and “more sensitive government end users,” which are consistent with BIS’s long-standing use of these terms.

These and the other changes introduced in BIS’s Final Rule embody the desire for modernization and streamlining driving the President’s Export Control Reform (ECR) Initiative. They also reflect an apparent desire by BIS to update controls on encryption products and other dual-use items to keep pace with innovation, which, as industry has argued time and again, is vital to allowing U.S. businesses involved in the production and export of these items to remain more competitive in the global market.

A more detailed discussion of the changes implemented in BIS’s Final Rule can be found here.