Twitter Facebook Google RSS

Use Caution When Traveling With Encryption Software 


By Jeffrey G. Richardson 

If you bring a laptop or smartphone outside of the United States, you need a basic understanding of how international export control laws may apply to your device’s encryption software.

Encryption software that is resident on a laptop or a smartphone is subject to export control regulations by the Commerce Department’s Bureau of Industry and Security, which enforces the export administration regulations. This is a separate issue from any technical data that may be resident on a device, which is governed by International Traffic in Arms Regulations. 

The level of regulation and available license exceptions under the export administration regulations for encryption software depends on its technical specifications and the public availability of the source code.

First, laptops with pre-loaded encryption software may qualify for the temporary exports-tools of the trade (TMP) license exception, permitting the outbound export of a laptop for professional use purposes. The TMP exception applies to symmetric commercial-grade encryption with a key length of fewer than 64 bits. It does not apply to items containing cryptography functionality such as dual-use cryptanalytic or quantum. To comply with a TMP license, the item must be used for professional purposes, returned within 12 months, and be kept under effective control of the exporter, such as in a hotel safe when not in use. The exporter must take precautions against the unauthorized release of controlled technology. The TMP license exception is not available to embargoed countries, such as Cuba, Iran, Syria and Sudan.

Also, depending on the encryption grade and the traveler’s expected use of the item with encryption software, license exceptions are available under the export regulations, including encryption commodities and technology for higher grade encryption.

Outbound U.S. regulations are not the only consideration for those traveling with encryption software. Many countries regulate the inbound use of encryption software. In China, for example, the State Cryptography Administration (SCA) serves as the national authority for regulating encryption products and has promulgated multiple rules on encryption controls. Although thousands of individuals carry laptops and smartphones with encryption in and out of China daily, it is not risk free. Under SCA policy, standard mass-market products are not subject to the encryption regulations, but the encryption regulations remain incongruent with this policy and provide the latent underpinning for broader enforcement.

The policy predates the rise of smartphones and certain advancements in encryption software commonplace on laptops. If traveling to China with encryption software, one should consider checking the encryption regulations and following up with any applicable encryption license applications.

Through the Wassenaar arrangement, participating countries have created a “personal use” exemption for people traveling with encryption software. Wassenaar is an international export control agreement that contributes to regional and international security by promoting transparency in the transfers of conventional arms, dual-use items and technologies among the participating countries.

Under the personal-use exemption for encryption software, a traveler may have encryption software on his device, so long as he does not create, enhance, share, sell or distribute the encryption technology while traveling through the participating country. The following countries permit this exemption: Argentina, Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, Mexico, Netherlands, New Zealand, Norway, Poland, Portugal, Republic of Korea, Romania, Slovakia, Slovenia, South Africa, Spain, Sweden, Switzerland, Turkey, United Kingdom and the United States.

Unfortunately, not all the Wassenaar participant countries allow the personal-use exemption. Neither the Russian Federation nor Ukraine permits the entry of encryption devices that are allowed under the arrangement. Specifically, Russia retains broad inbound encryption license requirements, which boasts some of the most restrictive encryption regulations in the world. It controls the import, export and use of encryption technology. The Russian Federation requires a temporary import license for use of laptops with encryption technology.

The U.S. State Department advises those persons traveling to Russia that taking laptops into that nation is unrestricted, but software may be inspected upon leaving. Any computer or software containing sensitive or encrypted data may be confiscated by Russian authorities.

Of the many countries that regulate the use of inbound encryption software, Israel, too, recognizes a personal-use exemption. But Israeli customs personnel may request the password to confirm the data is personal. The State Department warns those traveling to Israel with audio-visual or data storage and processing equipment, and other electronic devices to expect additional security-related delays, and some travelers have had equipment and devices confiscated for long periods. In some cases, the State Department said, travelers reported that equipment retained by Israeli authorities had been damaged, destroyed, lost or never returned.

The State Department also warns that Israeli security officials have requested access to travelers’ personal email accounts or other social media accounts as a condition of entry. Travelers should have no expectation of privacy for any data stored on such devices or accounts.

When traveling to a country with restrictive encryption practices, it is best to take only what is needed, and know what you are taking. To be safe, a traveler can request a “loaner laptop” from his employer or simply remove the encryption software from the laptop before traveling.

Jeffrey G. Richardson is a senior attorney for Miller, Canfield, Paddock and Stone PLC’s export controls practice group in Troy, Mich.

Photo Credit: Thinkstock
Reader Comments

Re: Use Caution When Traveling With Encryption Software

Great post about exporting encryption and how most everything already has some form of encryption built into it. Keep up the good work!

Darren Chaker on 11/25/2015 at 17:29

Submit Your Reader's Comment Below
The content of this field is kept private and will not be shown publicly.
Please enter the text displayed in the image.
The picture contains 6 characters.
*Legal Notice

NDIA is not responsible for screening, policing, editing, or monitoring your or another user's postings and encourages all of its users to use reasonable discretion and caution in evaluating or reviewing any posting. Moreover, and except as provided below with respect to NDIA's right and ability to delete or remove a posting (or any part thereof), NDIA does not endorse, oppose, or edit any opinion or information provided by you or another user and does not make any representation with respect to, nor does it endorse the accuracy, completeness, timeliness, or reliability of any advice, opinion, statement, or other material displayed, uploaded, or distributed by you or any other user. Nevertheless, NDIA reserves the right to delete or take other action with respect to postings (or parts thereof) that NDIA believes in good faith violate this Legal Notice and/or are potentially harmful or unlawful. If you violate this Legal Notice, NDIA may, in its sole discretion, delete the unacceptable content from your posting, remove or delete the posting in its entirety, issue you a warning, and/or terminate your use of the NDIA site. Moreover, it is a policy of NDIA to take appropriate actions under the Digital Millennium Copyright Act and other applicable intellectual property laws. If you become aware of postings that violate these rules regarding acceptable behavior or content, you may contact NDIA at 703.522.1820.

  Bookmark and Share