united-states legal-terms encryption export sanctions
Are encryption apps (iOS) exempt from US Export Regulations if released to the US App Store only?
<p>Note: The original question in iTunes Connect regarding exemptions has since been changed to reflect recent changes made to their FAQ as follows:</p>

<blockquote>
  <p>Does your app meet any of the following: (a) Qualifies for one or more
  exemptions provided under category 5 part 2, (b) Use of encryption is
  limited to encryption within the operating system (iOS or macOS), (c)
  Only makes call(s) over HTTPS, (d) App is made available only in the
  U.S. and/or Canada.</p>
</blockquote>

<p><strong>TL;DR</strong> - In short, the answer to my original question per Apple Export Compliance is yes, "(under option d), encryption apps are now exempt from Export Regulations if sold in the U.S. and Canada app stores <em>exclusively</em>."</p>

<hr>

<p>I have an iOS app built and ready to ship which allows the user to perform symmetric encryption using arbitrary length keys (i.e. > 56 bits).
 I've been reading up on US export regulations and am looking to extend my research here as well.</p>

<p><strong>Question:</strong> If I have an iOS app that performs <a href="http://isilonsystems.org/emc-plus/rsa-labs/standards-initiatives/cryptography-export-controlled.htm" rel="nofollow noreferrer">"strong" encryption</a> but I only make it available to <a href="https://developer.apple.com/library/content/documentation/LanguagesUtilities/Conceptual/iTunesConnect_Guide/Appendices/AppStoreTerritories.html" rel="nofollow noreferrer">select territories</a> (i.e. US), can I answer "Yes" to the following question?</p>

<blockquote>
  <p><strong>Does your app qualify for any of the exemptions provided in Category
  5, Part 2 of the U.S. Export Administration Regulations?</strong></p>
  
  <p>Make sure
  that your app meets the criteria of the exemption listed here. You are
  responsible for the proper classification of your product. Incorrectly
  classifying your app may lead to you being in violation of U.S. export
  laws and could make you subject to penalties, including your app being
  removed from the App Store. Read the FAQ thoroughly before answering
  the questions.</p>
  
  <p>You can select Yes for question #2 if the encryption of your app is:</p>
  
  <ul>
  <li>(a) Specially designed for medical end-use</li>
  <li>(b) Limited to intellectual
  property and copyright protection</li>
  <li>(c) Limited to authentication,
  digital signature, or the decryption of data or files</li>
  <li>(d) Specially
  designed and limited for banking use or "money transactions"; or</li>
  <li>(e)
  Limited to "fixed" data compression or coding techniques</li>
  </ul>
  
  <p>You can also select Yes if your app meets the descriptions provided in
  Note 4 for Category 5, Part 2 of the U.S. Export Administration
  Regulations.</p>
</blockquote>

<p>I should also point out that it's quite possible (and perhaps easy) to VPN into the US to download an app only being sold within the US and I guess this is where my main question lies - is this considered "exporting" and thus subject to US Export regulations as well?</p>

<p><strong>Update (12/2/16)</strong> - Just received the following confirmation from Apple Export Compliance:</p>

<blockquote>
  <p>The [redacted] app presently uploaded into your account CAN BE legally
  released to US and Canada only, it will not be necessary to go through
  Export Regulations.</p>
</blockquote>

<p>They have also rephrased the question "Does your app qualify for any of the exemptions...?" to the following: </p>

<blockquote>
  <p>Does your app meet any of the following: (a) Qualifies for one or more
  exemptions provided under category 5 part 2, (b) Use of encryption is
  limited to encryption within the operating system (iOS or macOS), (c)
  Only makes call(s) over HTTPS, (d) App is made available only in the
  U.S. and/or Canada.</p>
</blockquote>

<hr>

<p><strong>Update (12/1/16)</strong> - In addition to the research below, a list of "Sample Scenarios" are given in <em>iTunes Connect Resources and Help</em>, one of which states:</p>

<blockquote>
  <p>A developer chooses to release his app in the U.S. and
  Canada only.
  -- No U.S. CCATS or ERN is required. No France Import Declaration is required.</p>
</blockquote>

<p>The following statement (mentioned earlier in the same page) should also be taken into consideration regarding exemptions:</p>

<blockquote>
  <p>All liabilities associated with misinterpretation of the export
  regulations or claiming exemption inaccurately are borne by owners and
  developers of the apps.</p>
</blockquote>

<hr>

<p>So it appears the correct answer is <em>likely not</em>:</p>

<blockquote>
  <p><strong>N.B. to Note 3 (Cryptography Note):</strong> You must submit a classification request or self classification report
  to BIS for mass market encryption commodities and software eligible
  for the Cryptography Note employing a key length greater than 64 bits
  for the symmetric algorithm ... in accordance with the requirements of § 740.17(b) of the EAR in order to be released from the “EI” and “NS” controls of ECCN 5A002 or 5D002.</p>
</blockquote>

<p>Furthermore, under <em>Note 4</em>:</p>

<blockquote>
  <p>Category 5 - Part 2 does not apply to items incorporating or
  using "cryptography" and meeting all of the following:</p>
  
  <p>a. The primary
  function or set of functions is not any of the following:</p>
  
  <ol>
  <li>“Information security”;</li>
  <li>A computer, including operating systems, parts and components therefor;</li>
  <li>Sending, receiving or storing information (except in support of entertainment, mass commercial broadcasts, digital rights management
  or medical records management); or</li>
  <li>Networking (includes operation, administration, management and provisioning);</li>
  </ol>
  
  <p>b. The cryptographic functionality is limited to
  supporting their primary function or set of functions; and</p>
  
  <p>c. When
  necessary, details of the items are accessible and will be provided,
  upon request, to the appropriate authority in the exporter's country
  in order to ascertain compliance with conditions described in
  paragraphs a. and b. above.</p>
</blockquote>

<p>I suppose there could be clarification under this note, but if I understand it correctly, an iOS app having the sole purpose of performing symmetric encryption with keys greater than 56 bits would have the <em>primary function</em> of:</p>

<ul>
<li>"Information security"</li>
<li>Being "a computer"</li>
</ul>

<p>Barring clarification on these points that would qualify for exemption, NLR, etc. self-classification would likely be [any of the following]:</p>

<ul>
<li><strong>5D002.a.1.a</strong> (software) - Designed or modified to use "cryptography" employing digital techniques performing any cryptographic function other than authentication, digital signature, or execution of copy-protected "software," and having ... A "symmetric algorithm" employing a key length in excess of 56-bits</li>
</ul>

<p>Encryption registration may have also been required <em>prior to</em> September 20, 2016 (see linked reference). "Companies no longer are required to submit an encryption registration to BIS before self-classifying and exporting certain encryption items..." (Wiley Rein LLP)</p>

<p>References:</p>

<ul>
<li><a href="https://www.bis.doc.gov/index.php/documents/regulations-docs/federal-register-notices/federal-register-2014/951-ccl5-pt2/file" rel="nofollow noreferrer">Commerce Control List: Category 5 Part 2 (Cryptographic "Information Security")</a> - BIS</li>
<li><a href="https://f5.com/about-us/policies/export-compliance" rel="nofollow noreferrer">Export Compliance</a> - f5</li>
<li><a href="https://www.bis.doc.gov/index.php/forms-documents/encryption/98-license-exception-enc/file" rel="nofollow noreferrer">License Exception ENC (740.17)</a> - BIS</li>
<li><a href="https://www.bis.doc.gov/InformationSecurity2016-updates" rel="nofollow noreferrer">Information Security Updates (September 20, 2016)</a></li>
<li><a href="http://www.wileyrein.com/newsroom-articles-BIS-Publishes-New-Encryption-Rule.html" rel="nofollow noreferrer">BIS Publishes New Encryption Rule</a> - Wiley Rein LLP</li>
</ul>

<p>I had to appeal the decision.
Stating: 
I answered Yes to Question 2 because the app was only being released
in Canada and the US. </p>

<p>(Company Name) only intends to release the app “(app name)” in the U.S. and Canada. We will produce the approval documents in case we happen to release the app in other countries at a later point.  </p>

<p>I also added a document to the appeal stating the same on official stationary. </p>

<p>The appeal was reviewed and accepted!</p>

<p>If your app doesn't qualify for some exemption then it doesn't qualify. If it's sold in the USA only, then you may not <em>need</em> to qualify for the exemption, but claiming you <em>do</em> qualify would be a lie.</p>
<p>There's also the problem that people can be outside the USA and buy from the US app store. First, American residents with a US account on holiday outside the USA. Second, non-residents who somehow managed to sign up to a US account. So if you lied about qualifying for an exemption, and for these reasons you are not allowed to sell at all, then lying might get you into trouble.</p>
<p>PS. Don't know why this question came up 6 years later, but also look at &quot;(b) Use of encryption is limited to encryption within the operating system (iOS or macOS), (c) Only makes call(s) over HTTPS&quot; so you are free to use any encryption method provided by iOS or macOS, but not something else you or someone else created, and you are free to use https, which encrypt data transmitted over the internet.</p>
