Separate the policy questions
U.S. encryption policy includes several different questions: how people and businesses protect information, how investigators obtain evidence, what security standards government systems use, and which exports, reexports or transfers require authorization. A historical statement about one question is a poor shortcut for deciding another.
For a current export question, assemble facts about the item and transaction before interpreting a rule. For a historical question, establish the date and whether the source is a report, proposal, enacted law or regulation. This guide provides a research path; a specific transaction needs its own classification and authorization review.
| Question | Starting point | What to keep distinct |
|---|---|---|
| What was proposed in the 1990s? | Dated reports and archived government statements. | A recommendation or bill versus an adopted rule. |
| How is a current encryption item treated? | BIS guidance and the applicable EAR provisions. | Classification, authorization and reporting. |
| Does a destination or end user change the answer? | Current destination, end-user and end-use controls. | A product’s classification versus a particular transaction. |
| Which technical controls should a system use? | Applicable standards and organizational requirements. | Security engineering versus permission to export. |
On a narrow screen, scroll the table sideways. Keyboard users can focus the table and use the arrow keys.
Record the source date and relevant section with each conclusion. That makes a later review possible when either the product or the rules change.
Read the 1990s debate in its own time
The 1996 National Research Council report Cryptography’s Role in Securing the Information Society examined the growing importance of encryption and the tension among privacy, commercial use, law enforcement and national security. It also discussed escrowed encryption, under which another party could hold information enabling recovery.
On September 16, 1999, President Clinton sent Congress the proposed Cyberspace Electronic Security Act. The archived transmittal letter describes the administration’s objectives. It is evidence of a proposal and its rationale; it should be read separately from the legislative history needed to establish what became law.
The January 14, 2000 Federal Register rule documents a subsequent revision of encryption export controls. Its historical text can explain the transition, while a present-day transaction must be assessed against the rules currently in force.
The enduring debate concerns who controls access to protected information and how public interests are balanced. Technical terms matter: an encryption key, a recovery arrangement, stored plaintext and an interception capability create different access paths.
Use the current BIS analysis path
The Bureau of Industry and Security’s encryption-controls guidance organizes the analysis around EAR applicability, Category 5 Part 2, License Exception ENC and mass market, reporting/review, and licenses. Its flowcharts help identify the sequence of questions. Classification and an available authorization are separate findings.
Build a product description covering hardware, software and technology separately where relevant. Describe the actual cryptographic functionality, how users can change it, distribution method, intended use and supporting vendor classification records. Marketing labels such as “secure,” “consumer” or “open source” do not answer the full regulatory analysis.
Then document the transaction: exporter, recipient, destination, end user, end use and any onward transfer. A reusable product record helps, but transaction-specific restrictions still need to be checked.
License Exception ENC appears in EAR section 740.17. The conditions depend on the relevant item and circumstances. Use the current text and linked guidance to establish classification, review or reporting obligations; do not assume that the phrase “license exception” means no conditions apply.
Prepare a reviewable fact record
- Identify the exact product, version and components. Attach the technical description and available classification documentation.
- Record the parties, destinations, end uses and proposed distribution or transfer mechanism.
- Identify the applicable jurisdiction and classification question. Document the source and date supporting the answer.
- Check the applicable authorization and its conditions, including any required classification, review, reporting or license steps.
- Record the responsible reviewer, unresolved questions and the decision. Recheck after relevant product, party, destination or rule changes.
Know when a historical answer stops helping
A dated article can explain why a policy changed. It cannot establish that its country lists, thresholds, procedures or proposed legislation remain applicable. Follow the current official material from the relevant agency and retain the exact basis for the conclusion you use.
When guidance leaves a material ambiguity, use the organization’s qualified export reviewer or the appropriate BIS inquiry process. Provide the prepared fact record so the question is concrete. Keep technical uncertainty, missing transaction facts and uncertainty about legal interpretation separate; each requires a different kind of evidence.
Keep a usable review record
Download the encryption export research fact record (plain text). Save a copy, fill it out in a text editor, and keep it with your approved project records.