So what does this mean for email encryption programs? Programs that provide encryption capabilities are subject...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
to U.S. export controls and sanctions administered by BIS under EAR, and the Commerce Control List (CCL). Most commercial encryption products have a license exception assigned to them by the BIS. This allows vendors to export them to specified destinations without always having to go the Commerce Department for special permission.
Taking PGP as an example, all PGP-enabled products fall within three types of License Exception: Mass Market (eligible for export with no license required), ENC Restricted (eligible for export to any end user in EU member countries) and ENC Unrestricted (eligible for export to any end user). None of these categories, however, allow encryption products to be exported to the following embargoed countries: Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria.
If you wish to take or send an email encryption program to Iraq, then you will have to apply for an export license from the BIS and possibly obtain authorization from other U.S. government agencies as well. The U.S. government, and vendors too, are very serious about controlling the export of encryption tools. In PGP's license agreements, for example, customers must represent that they will not export to a prohibited country or to a restricted type of user. Even the release of technology or source code to a foreign national in the United States is subject to the EAR and is deemed to be an export to the home country of the foreign national. I would contact a lawyer or PGP Corp. for further advice.
Dig Deeper on Information Security Laws, Investigations and Ethics
Related Q&A from Michael Cobb
What is BGP hijacking or IP hijacking and how do cybercriminals pull off the attacks? Expert Michael Cobb explains how enterprises can mitigate these...continue reading
Is the Dell eDellRoot security threat a serious problem and, if so, can it be prevented with self-signed root certificate authorities? Expert Michael...continue reading
What does FIPS 140-2 Level 2 certification for devices cover? Expert Michael Cobb explains the FIPS 140-2 security standard and how vendors use it in...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.