Understanding export regulations
You can restrict the distribution of your products to users from specific countries, or to users that use specific wireless service providers. You specify distribution options when you submit a product to RIM for approval.
Depending on the country where you develop your products and the type of encryption that your products use, you might need to provide the ECCN for a product, or you might need to upload a copy of the product's CCATS document. RIM requires this information to verify that the product complies with international export regulations.
An ECCN is an alphanumeric reference (for example, 5D992) that the United States Export Administration Regulations use to identify items for export control purposes. An ECCN is used to categorize products based on the type of commodity, technology, or software and its respective technical parameters, such as the type of encryption the product uses.
You must submit an ECCN if your product uses cryptography or information security features, and if your organization meets any of the following criteria:
- You are a vendor located in the United States
- The product was developed in the United States
- The product uses software or code that was created by organizations or individuals that are located in the United States
- Calling web-based libraries to invoke encryption
- HTTPS, SSL, TLS
- MAC, hashing
- Digital signatures
If your product uses crytographic features that are not limited to authentication, password protection, digital signatures, copy protection, or banking transactions, your organization might also require an ERN from the Bureau of Industry and Security.
To determine if your organization requires an ERN, review Note 4 on What items are removed from encryption controls?
Obtain an ECCN
- Classify the cryptographic features yourself by reading documentation and resources from the Bureau of Industry and Security.
- Classify the cryptographic features by contacting the Bureau of Industry and Security.
- Classify the cryptographic features by contacting an export control lawyer.
- Request the appropriate ECCN from the Bureau of Industry and Security by applying for a Commodity Classification Automated Tracking System (CCATS) number.
You must verify that your product complies with the Export Administration Regulations, Category 5, Part 2: Information Security.
For more information about contacting the Bureau of Industry and Security, to access the Bureau's documentation, or to apply for a CCATS number, visit www.bis.doc.gov and www.bis.doc.gov/encryption/default.htm.
RIM cannot help determine which ECCN is correct for a product. For more information about United States Export Administration Regulations, visit www.bis.doc.gov to read FAQs on Export Licensing and ECCN Questions and Answers.
Related resources for ECCN and ERN
For more information about export controls and obtaining an ECCN and ERN, see the following resources:
Bureau of Industry and Security
Visit the Bureau of Industry and Security home page for information, news, and links about export licensing.
United States Export Administration Regulations
Visit the Bureau of Industry and Security policies and regulations page to download the unofficial electronic Export Administration Regulation files that you can use to confirm that your organization meets regulations.
United States Regulatory Guidance
Visit the Bureau of Industry and Security encryption page for information and FAQs for developers whose products are classified as Category 5.
United States Department of Commerce, Bureau of Industry and Security Contacts
Visit the Information Technology Controls Division page to find contact information for the Information Technology Controls Division of the Bureau of Industry and Security.