Global Export Trade

EU Dual-Use Export Regulations and Encryption

EU Dual-Use Export Regulations and Encryption

Introduction

Among the 28 member states of the European Union (EU), the circulation of goods and people has been free since 1993. However, to respect the international commitments of the EU and its members and to avoid the proliferation of nuclear, chemical, biological, and ballistic arms, the export of dual-use items is still subject to control. It is mainly carried out on the basis of European regulation.

May 5, 2009, the Council of the European Union passed the revision of Regulation 1334/2000 setting up a Community regime for the control of exports of dual use items and technologies. This regulation is replaced by the EC Regulation No 428/2009 setting up a Community regime for the control of exports, transfer, brokering and transit of dual-use items. It entered into force August 27, 2009.
The EC Council Regulation No 428/2009 has been updated on April 19, 2012 by the Council Regulation (EC) No 388/2012.

The regulation:

  • Defines (in Article 2) what is meant by "dual-use items" (which include software and technology), "export", "exporter", "export declaration", "broker" and "brokering services", "transit" the "Community General Export Authorization" and other types of export authorization that can be granted at national level;
  • Describes the scope of the Regulation:
    In addition to the dual-use items listed in Annex I to the regulation, Article 4, known as the "catch-all clause" requires authorization for exports of any items which are or may be intended for use in connection with weapons of mass destruction, as well as conventional arms if these are to be exported to destinations under an arms embargo;
  • creates a Community General Export Authorization (Article 9(1) and Annex II) for all but the most sensitive listed dual-use items for seven "like-minded" third countries;
  • for all other exports for which an authorization is required under the Regulation, leaves to the national authorities the final decision as to whether to grant a national, global or individual export license (Article 9(2)), thus striking a balance between the principle of Community competence and the legitimate concerns of Member States to remain in control of matters relating to their national security.

2. Cisco Licenses

Netherlands

In the Netherlands, the Ministry of Economic Affairs, Agriculture and Innovation is in charge of export compliance: http://www.government.nl/issues/export-controls-of-strategic-goods.

All Cisco dual-use items 5A002 and 5D002 exported from the European Union by Cisco Systems International BV need an export license from Ministry of Economic Affairs, Agriculture and Innovation.

Cisco Systems International BV in the Netherlands holds Community General Export Authorization, Global Export License, 5 Country Specific Export Licenses and 2 FTZ Specific Export License from Dutch Export authorities which cover following exports:

  • Definite sale.
  • Temporary exports.
  • Return of equipment after repair in the Netherlands.
  • Export of equipment for repair in a third country.

The Cisco Systems International BV Export Licenses are valid in all EU member States as Cisco BV is exporter and authorize the export.

United Kingdom

In the UK, the Export Control Organization depends on the Department for Business Innovation and Skills (BIS), is in charge of export compliance:
http://www.berr.gov.uk/policies/export-control-organisation
http://www.bis.gov.uk/

All Cisco dual-use items 5A002, 5D002 and 5E002 exported from the European Union by Cisco International Limited UK need an export license from BIS.
Cisco International Limited UK holds the Community General Export Authorization and 6 Open Individual Export Licenses from the British Export authorities which cover the export or transfer of products, software and/or technology. The condition of CIL UK Licenses is the UK Consignee Undertaking which must be provided by Bill to Party prior to ship the controlled item outside of EU.
The Cisco International Limited UK Export Licenses are valid in all EU member States as long as CIL is exporter and authorize the export.

Italy

In Italy, Ministry of Economic Development is in charge of export compliance: http://www.sviluppoeconomico.gov.it/index.php?option=com_content&view=article&viewType=1&idarea1=593&idarea2=0&idarea3=0&idarea4=0&
andor=AND&sectionid=0&andorcat=AND&partebassaType=0&idareaCalendario1=0&MvediT=1&showMenu=1&showCat=1&showArchiveNewsBotton=0&idmenu=2263&id=2022513

All Cisco dual-use items 5A002 and 5D002 exported from the European Union by Cisco Systems Italy S.R.L. need an export license from Ministry of Economic Development. Cisco Systems Italy S.R.L. holds Community General Export Authorization

3. Policies and Procedures

Cisco export license must not be used by Cisco customers (including distributors, partners, and systems integrators) for goods transiting within the European Union for an end destination outside of the European Union.

  • Definition of Exporter

 According to Article 2.3 of the CE 428/2009 "exporter" shall mean any natural or legal person or partnership:
(i) on whose behalf an export declaration is made, that is to say the person who, at the time when the declaration is accepted, holds the contract with the consignee in the third country and has the power for determining the sending of the item out of the customs territory of the Community. If no export contract has been concluded or if the holder of the contract does not act on its own behalf, the exporter shall mean the person who has the power for determining the sending of the item out of the customs territory of the Community;
(ii) which decides to transmit or make available software or technology by electronic media including by fax, telephone, electronic mail or by any other electronic means to a destination outside the Community.
Where the benefit of a right to dispose of the dual-use item belongs to a person established outside the Community pursuant to the contract on which the export is based, the exporter shall be considered to be the contracting party established in the Community.

  • Documentation and Statement

 These commodities, technology, or software were exported in accordance with the U.S. Export Administration Regulations, EU 428/2009 export regulations and local laws. Diversion contrary to or local laws prohibited. Parties receiving these goods agree not to use any export and/or re-export licenses or authorizations that Cisco or its affiliates holds for securing their own activities unless specifically authorized by Cisco's Global Export Trade and where legally compliant. By accepting delivery of any portion of this shipment, the recipient and/or their appointed agent agree to comply with U.S., EU 428/2009, and local export, re-export, transfer, and transshipment regulations. Cisco product trade information for export or re-export may be found at:

http://tools.cisco.com/legal/export/pepd/Search.do.

4. Encryption

Cisco products containing encryption – enabled features are classified 5A002a1 and 5D002c1.

European Union has Common dual-use goods list (including encryption items in Category 5) defined by EC Regulation No 428/2009.
But each member States have additional regulations concerning the import, supply, use or export of encryption items and made the encryption note concerning Mass Market encryption items.

France

French national regulation :

  1. Law number 2004-575 dated 21 June 2004 on confidence in the digital economy.
  2. Decree number 2007-663 dated 2 Mai 2007 on application of art. 30, 31 and 36 of the Law number 2004-575 dated 21 June 2004 on confidence in the digital economy.
  3. Decree number 2001-1192 dated 13 December 2001 on export, import and transfer controls of dual-use items and technologies, modified by Decree number 2010-292 dated 18 March 2010.
  4. Ordinance dated 13 December 2001 on controls of dual-use items and technologies exports to non member States and the transfer to the Member States of the European Union, modified by Ordinance dated 18 March 2010.
  5. Ordinance dated 13 December 2001 on issuance of an international import certificate and a certificate of delivery verification for import of dual-use items and technologies, modified by Ordinance dated 18 March 2010.

The French Network and Information Security Agency (FNISA), in French Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI) is competent in encryption items area. ANSSI decides the classification of each product.
In fact, in order to obtain a license for encryption, items, those items are subject to prior export authorization issued by the ANSSI.

the license "dual use items" for cryptology products is subject to obtaining a specific export authorization issued by the ANSSI. - Removed

List of ANSSI Declarations and Authorizations for Cisco products you can see in this website:
http://www.cisco.com/web/about/doing_business/legal/global_export_trade/docs/French_ANSSI.xls

 ANSSI Contact:

Secrétariat général de la défense et de la sécurité nationale (SGDSN)
Agence nationale de la sécurité des systèmes d'information (ANSSI)
51, boulevard de la Tour-Maubourg
75 700 PARIS 07 SP
Tel. : 01.71.75.84.05
Télécopie : 01.71.75.84.00
Mél : secretariatanssi@ssi.gouv.fr

Cisco do not export encryption items from France but receive these authorizations for our partners.
As per article 30-I from the law number 2004-575 dated 21 June 2004 on confidence in the digital economy; the use of encryption items in France is free. The supply, import and export are subject either to declaration or authorization.

  • Overview of the French Regulations Use, Transfer from an EU Member States Import and Supply of encryption in France.
Encryption item (Annex 1 of Decree 2007-663)
Use
Import & Transfer from EU Member State
Supply
Hand carry for personal use (cat. 8)
Hand carry for demonstration (cat. 12).
Free
Free
N/A
Authentication or integrity control   (cat. 1 to 7; 9 & 10; 11).
Free
Free
Free
Not covered by any of the categories above.
Free
Declaration
Declaration
  • Overview of the French Regulations Export, Transfer from France of encryption item.
Encryption item   
(See Annexes of Decree 2007-663)
Transfer to EU  Member  States
Export to 1 of the 7 countries  (Australia, Canada, Japan, New Zealand, Norway, Switzerland and USA)
Export to other countries
Item performing only authentication or integrity control (cat. 1 to 7; 8; 13 of annex)
Free
Free
Free

Mass Market (cat. 3 of annex 2)

Declaration
Declaration
Declaration

Using encryption key of large size (cat. 1 of annex 2)

Declaration
Declaration CGEA (Community General Export Authorisation) License
Authorization Individual or Global Export License

  Crypto analytic items

Authorization
Individual or Global Export License
Authorization
Individual or Global Export License
Authorization Individual or Global Export License