Document ID: chunk:federal_register_of_legislation:F2024L01024:front:0:p177
Version: federal_register_of_legislation:F2024L01024
Segment Type: other
Provision Reference: 
Character Range: 513050–516575

data confidentiality' having a 'described security algorithm'; or
                              c. Equipment or systems excluded from 5.A.2.a. by entries b. to f. of this Note; and
                            2. It cannot be reprogrammed for any other use; or
                           b. Having all of the following:
                            1. It is specially designed and limited to allow protection of 'personal data' stored within;
                            2. Has been, or can only be, personalised for public or commercial transactions or individual identification; and
                            3. Where the cryptographic capability is not user‑accessible;
                           Technical Note:
                           For the purposes of 5A002.a. Note a.1.b.1., 'personal data' includes any data specific to a particular person or entity, such as the amount of money stored and data necessary for "authentication".
                       2. 'Readers/writers' specially designed or modified, and limited, for items specified by paragraph a.1. of this Note;
                       Technical Note:
                       For the purposes of 5A002.a. Note a.1.b.2., 'readers/writers' include equipment that communicates with smart cards or electronically readable documents through a network.
                   b. Cryptographic equipment specially designed and limited for banking use or 'money transactions';
                   Technical Note
                   For the purposes of 5A002.a. Note b., 'money transactions' includes the collection and settlement of fares or credit functions.
                   c. Portable or mobile radiotelephones for civil use (e.g., for use with commercial civil cellular radio communication systems) that are not capable of transmitting encrypted data directly to another radiotelephone or equipment (other than Radio Access Network (RAN) equipment), nor of passing encrypted data through RAN equipment (e.g., Radio Network Controller (RNC) or Base Station Controller (BSC));
                   d. Cordless telephone equipment not capable of end‑to‑end encryption where the maximum effective range of unboosted cordless operation (i.e., a single, unrelayed hop between terminal and home base station) is less than 400 metres according to the manufacturer's specifications;
                   e. Portable or mobile radiotelephones and similar client wireless devices for civil use, that implement only published or commercial cryptographic standards (except for anti‑piracy functions, which may be non‑published) and also meet the provisions of paragraphs a.2. to a.4. of the Cryptography Note (Note 3 in Category 5 – Part 2), that have been customised for a specific civil industry application with features that do not affect the cryptographic functionality of these original non‑customised devices;
                   f. Items, where the "information security" functionality is limited to wireless "personal area network" functionality implementing only published or commercial cryptographic standards;
                   g. Mobile telecommunications Radio Access Network (RAN) equipment designed for civil use, which also meet the provisions of paragraphs a.2. to a.4. of the Cryptography Note (Note 3 in Category 5 – Part 2), having an RF output power limited to 0.1W (20 dBm) or less, and supporting 16 or fewer concurrent users;
                   h. Routers, switches, gateways or relays, where the "information security" functionality is limited to the tasks