Source: https://www.torrestradelaw.com/posts/New-Interim-Final-Rule-Creates-End-045%3Bto-045%3BEnd-Encryption-Carve-045%3BOut-for-ITAR-Technical-Data/187
Timestamp: 2020-07-09 12:28:31
Document Index: 299475415

Matched Legal Cases: ['§ 734', '§ 120', '§ 120', '§ 120', '§ 120', '§ 120', '§ 734', 'art 1', '§ 120', '§ 120', '§ 120', '§ 734', '§ 120', '§ 120', '§ 734']

ITAR Cloudcomputing
The Department of State Directorate of Defense Trade Controls (“DDTC”) has published an interim final rule (“the Interim Final Rule”) seeking public comments and clarifying that certain transfers of encrypted technical data are not exports, reexports, or retransfers subject to the International Traffic in Arms Regulations (“ITAR”). [1] Torres Law previously published a news alert on November 18, 2019 regarding the potential publication of a new rule. The Interim Final Rule is effective on March 25, 2020, and interested parties may submit public comments by January 27, 2020.
The process to reach a final interim rule has been years in the making. On June 3, 2015, DDTC, in conjunction with the Department of Commerce Bureau of Industry and Security (“BIS”),[2] published a proposed rule (the “2015 Proposed Rule”)[3] proposing several new definitions of terms including, “export,” “reexport,” “release,” and “activities that are not exports, reexports, retransfers, or temporary imports,” among other proposed revisions, and requested public comments. On June 3, 2016, DDTC published an interim final rule,[4] revising the definitions of many of the terms subject to the 2015 Proposed Rule but leaving out a new definition for “activities that are not exports, reexports, retransfers, or temporary imports.” For its part, BIS, the agency that administers the Export Administration Regulations, did move forward with a definition of items not considered exports, reexports, or transfers (in-country) under the EAR. This new definition, portions of which are sometimes described as an “encryption carve-out,” is found at 15 C.F.R. § 734.18 and, as we will discuss in further detail later, is the blueprint for the similar revision in the ITAR.
The new definition of “activities that are not Exports, Reexports, Retransfers, or Temporary Imports, is found at 22 C.F.R. § 120.17 and reads, in its entirety, as follows:
The five new provisions in paragraph (a) are equivalent to the revisions BIS made to the EAR in a final rule published on June 3, 2016.[5] Those intimately familiar with the ITAR may notice that not all of the provisions of the new definition at § 120.54 are necessarily new regulations. Specifically, the provision at § 120.54(a)(1) excluding the launching of items into space was previously found in the ITAR at § 120.17(a)(6). The second provision of the new § 120.54 at (a)(2) makes clear what is already understood by most of industry and excludes from being a “controlled event”[6] transmitting technical data to a U.S. person in the United States from a person in the United States. In the Interim Final Rule, DDTC clarified that a transfer of technical data to a foreign person in the United States remains a controlled event.
Saving the best for last, DDTC created subparagraph (a)(5) to essentially harmonize the ITAR with the EAR encryption carve-out, with a few differences. Subparagraphs (a)(5)(i) and (a)(5)(ii) are identical to the equivalent EAR provision at 15 C.F.R. § 734.18. Subparagraph (a)(5)(ii) is slightly different than the similar provision in the EAR. Whereas the EAR provision requires “cryptographic key management and other procedures and controls that are in accordance with guidance provided in current U.S. National Institute for Standards and Technology publications (“NIST”), or other equally or more effective cryptographic means,” the new ITAR provision requires “cryptographic key management, and other procedures and controls that are in accordance with guidance provided in current NIST publications, or by other cryptographic means that provide security strength that is at least comparable to the minimum 128 bits of security strength achieved by the Advanced Encryption Standard (AES-128).” Here, DDTC is providing more specific guidance than BIS as to what will be considered by the agency as acceptable procedures and controls in lieu of FIPS 140-2 compliant modules. DDTC clarifies in the Interim Final Rule that, currently, such other acceptable means are expressed in “Table 2: Comparable strengths” of NIST Special Publication 800-57 Part 1, Revision 4.
Subparagraph (b) of the new definition defines “end-to-end encryption” and expands its explanation further than the equivalent provision in the EAR to specifically clarify that, “The intended recipient must be the originator, a U.S. person in the United States, or a person otherwise authorized to receive the technical data, such as by a license or other approval pursuant to this subchapter.” Lastly, subparagraph (c) clarifies that “the ability to access” technical data in encrypted form does not constitute the release or export of such technical data, if the encrypted technical data meets the criteria of subparagraph (a)(5).
In further explaining the revisions regarding end-to-end encryption in the Interim Final Rule, DDTC states that “a controlled event does not occur when technical data is encrypted prior to leaving the sender’s facilities and remains encrypted until decrypted by the intended authorized recipient or retrieved by the sender, as in the case of remote storage” (e.g., storage in the cloud). Instead, a controlled event occurs when the technical data is “released” as defined at § 120.50.
As a matter of housekeeping, DDTC also revised the definitions of “export,” “temporary import,” “reexport,” and “retransfer”[7] to exclude from those definitions activities identified in § 120.54. DDTC also added a new definition at § 120.55 for “Access Information.” Access Information is defined as “information that allows access to encrypted technical data subject to this subchapter in an unencrypted form. Examples include decryption keys, network access codes, and passwords.” This definition is similar to the EAR companion provision at 15 C.F.R. § 734.19 regarding transfer of access information, but DDTC refused to add language from the EAR provision that required “knowledge that such transfer would result in a release of the technology without a required authorization,” stating that “an existing authorization for the release of technical data to the foreign person must be in place prior to the provision of access information to the foreign person that will allow the transition of the encrypted technical data to an unencrypted state.”
Finally, the Interim Final Rule revises the definition of “release” at § 120.50 to clarify “what constitutes a release of technical data, a controlled event requiring authorization from the [DDTC], and the provision of access information that may result in the release of technical data.” To that end, DDTC added two new subparagraphs to § 120.50(a) and the new subparagraph (b). The new portions of the “release” definition read as follows:
The revisions to the ITAR “release” definition are analogous to EAR’s definition of “access information” and the use of that term at 15 C.F.R. § 734.19 related to the “transfer of access information. DDTC states in the Interim Final Rule, “In the absence of an authorization for the release of technical data in such circumstances, the provision of access information to a foreign person is a violation of ITAR.”
[6] We will hereafter adopt the language used in the interim final rule and collectively describe exports, reexports, retransfers, and temporary imports as “controlled events.”