Understanding export regulations
This information is provided for your convenience, and is not a substitute for professional legal advice.
What is an ECCN?
An ECCN is an alphanumeric reference (for example, 5D992) that the United States Export Administration Regulations use to identify items for export control purposes. An ECCN is used to categorize products based on the type of commodity, technology, or software and its respective technical parameters, such as the encryption algorithm a product uses, the processing capabilities of an integrated circuit, or positioning accuracy in machine tools.
Depending on the country where you develop your apps and the type of encryption that your apps use, you might need to provide the ECCN and provide other supporting documentation, including a CCATS, if available. BlackBerry uses this information to verify that the product complies with applicable export regulations.
When do I need an ECCN?
You need to submit an ECCN if your app uses cryptography or information security features, and if you or your organization meets any of the following criteria:
- You are a vendor located in the United States
Even if your app is made available only in the United States, by submitting your app to BlackBerry World, you are making an export to BlackBerry.
- The app was developed in the United States
- The app uses software or code that was created by organizations or individuals that are located in the United States
BlackBerry does not make additional requirements to the export control regulations that are issued by the United States government.
- HTTPS, SSL, TLS
- MAC, hashing
- Digital signatures
Signing your app with a BlackBerry ID token or code signing key for API access is not considered encryption for the purposes of export controls as related to BlackBerry World.
Getting an ECCN
- (Recommended) Classify the cryptographic features by contacting
the Bureau of Industry and Security (BIS).
You can call BIS at (202) 482-0707 for help from the Information Technology Controls Division at BIS, or check for a local contact number or to submit a request for assistance.
- Classify the cryptographic features yourself by reading documentation and resources from the Bureau of Industry and Security.
- Classify the cryptographic features by contacting an export controls lawyer.
- Request the appropriate ECCN from the Bureau of Industry and Security by applying for a CCATS number.
To contact the Bureau of Industry and Security, access the Bureau's documentation, and to learn more about exporting and classification, visit www.bis.doc.gov and http://www.bis.doc.gov/index.php/exporter-portal.
BlackBerry is unable to help you determine which ECCN is correct for a product.
What is an ERN?
If your app uses cryptographic features that are not limited to authentication, password protection, digital signatures, copy protection, or banking transactions, your organization might also require an Encryption Registration Number, or "ERN" from the Bureau of Industry and Security. One registration statement is required per organization, not per product. Obtaining an ERN is a quick and easy process that typically takes less than 30 minutes.
For more information about contacting the Bureau of Industry and Security and obtaining an ERN, visit www.bis.doc.gov to read http://www.bis.doc.gov/index.php/policy-guidance/encryption/registration.
How do I set export controls?
Related resources for ECCN and ERN
For more information about export controls and obtaining an ECCN and ERN, see the following resources:
- Items removed from encryption controls.
- Get information, news, and links about export licensing from the Bureau of Industry and Security home page.
- Download the unofficial electronic Export Administration Regulation files to confirm that your organization meets the policies and regulations of the Bureau of Industry and Security.