Are encryption apps (iOS) exempt from US Export Regulations if released to the US App Store only?

Question

Note: The original question in iTunes Connect regarding exemptions has since been changed to reflect recent changes made to their FAQ as follows:

Does your app meet any of the following: (a) Qualifies for one or more exemptions provided under category 5 part 2, (b) Use of encryption is limited to encryption within the operating system (iOS or macOS), (c) Only makes call(s) over HTTPS, (d) App is made available only in the U.S. and/or Canada.

TL;DR - In short, the answer to my original question per Apple Export Compliance is yes, "(under option d), encryption apps are now exempt from Export Regulations if sold in the U.S. and Canada app stores exclusively."

---

I have an iOS app built and ready to ship which allows the user to perform symmetric encryption using arbitrary length keys (i.e. > 56 bits). I've been reading up on US export regulations and am looking to extend my research here as well.

Question: If I have an iOS app that performs "strong" encryption but I only make it available to select territories (i.e. US), can I answer "Yes" to the following question?

Does your app qualify for any of the exemptions provided in Category 5, Part 2 of the U.S. Export Administration Regulations?

Make sure that your app meets the criteria of the exemption listed here. You are responsible for the proper classification of your product. Incorrectly classifying your app may lead to you being in violation of U.S. export laws and could make you subject to penalties, including your app being removed from the App Store. Read the FAQ thoroughly before answering the questions.

You can select Yes for question #2 if the encryption of your app is:

• (a) Specially designed for medical end-use
• (b) Limited to intellectual property and copyright protection
• (c) Limited to authentication, digital signature, or the decryption of data or files
• (d) Specially designed and limited for banking use or "money transactions"; or
• (e) Limited to "fixed" data compression or coding techniques

You can also select Yes if your app meets the descriptions provided in Note 4 for Category 5, Part 2 of the U.S. Export Administration Regulations.

I should also point out that it's quite possible (and perhaps easy) to VPN into the US to download an app only being sold within the US and I guess this is where my main question lies - is this considered "exporting" and thus subject to US Export regulations as well?

Answer 1

Update (12/2/16) - Just received the following confirmation from Apple Export Compliance:

The [redacted] app presently uploaded into your account CAN BE legally released to US and Canada only, it will not be necessary to go through Export Regulations.

They have also rephrased the question "Does your app qualify for any of the exemptions...?" to the following:

Does your app meet any of the following: (a) Qualifies for one or more exemptions provided under category 5 part 2, (b) Use of encryption is limited to encryption within the operating system (iOS or macOS), (c) Only makes call(s) over HTTPS, (d) App is made available only in the U.S. and/or Canada.

---

Update (12/1/16) - In addition to the research below, a list of "Sample Scenarios" are given in iTunes Connect Resources and Help, one of which states:

A developer chooses to release his app in the U.S. and Canada only. -- No U.S. CCATS or ERN is required. No France Import Declaration is required.

The following statement (mentioned earlier in the same page) should also be taken into consideration regarding exemptions:

All liabilities associated with misinterpretation of the export regulations or claiming exemption inaccurately are borne by owners and developers of the apps.

---

So it appears the correct answer is likely not:

N.B. to Note 3 (Cryptography Note): You must submit a classification request or self classification report to BIS for mass market encryption commodities and software eligible for the Cryptography Note employing a key length greater than 64 bits for the symmetric algorithm ... in accordance with the requirements of § 740.17(b) of the EAR in order to be released from the “EI” and “NS” controls of ECCN 5A002 or 5D002.

Furthermore, under Note 4:

Category 5 - Part 2 does not apply to items incorporating or using "cryptography" and meeting all of the following:

a. The primary function or set of functions is not any of the following:

1. “Information security”;
2. A computer, including operating systems, parts and components therefor;
3. Sending, receiving or storing information (except in support of entertainment, mass commercial broadcasts, digital rights management or medical records management); or
4. Networking (includes operation, administration, management and provisioning);

b. The cryptographic functionality is limited to supporting their primary function or set of functions; and

c. When necessary, details of the items are accessible and will be provided, upon request, to the appropriate authority in the exporter's country in order to ascertain compliance with conditions described in paragraphs a. and b. above.

I suppose there could be clarification under this note, but if I understand it correctly, an iOS app having the sole purpose of performing symmetric encryption with keys greater than 56 bits would have the primary function of:

• "Information security"
• Being "a computer"

Barring clarification on these points that would qualify for exemption, NLR, etc. self-classification would likely be [any of the following]:

• 5D002.a.1.a (software) - Designed or modified to use "cryptography" employing digital techniques performing any cryptographic function other than authentication, digital signature, or execution of copy-protected "software," and having ... A "symmetric algorithm" employing a key length in excess of 56-bits

Encryption registration may have also been required prior to September 20, 2016 (see linked reference). "Companies no longer are required to submit an encryption registration to BIS before self-classifying and exporting certain encryption items..." (Wiley Rein LLP)

References:

• Commerce Control List: Category 5 Part 2 (Cryptographic "Information Security") - BIS
• Export Compliance - f5
• License Exception ENC (740.17) - BIS
• Information Security Updates (September 20, 2016)
• BIS Publishes New Encryption Rule - Wiley Rein LLP

Answer 2

I had to appeal the decision. Stating: I answered Yes to Question 2 because the app was only being released in Canada and the US.

(Company Name) only intends to release the app “(app name)” in the U.S. and Canada. We will produce the approval documents in case we happen to release the app in other countries at a later point.

I also added a document to the appeal stating the same on official stationary.

The appeal was reviewed and accepted!

Answer 3

If your app doesn't qualify for some exemption then it doesn't qualify. If it's sold in the USA only, then you may not need to qualify for the exemption, but claiming you do qualify would be a lie.

There's also the problem that people can be outside the USA and buy from the US app store. First, American residents with a US account on holiday outside the USA. Second, non-residents who somehow managed to sign up to a US account. So if you lied about qualifying for an exemption, and for these reasons you are not allowed to sell at all, then lying might get you into trouble.

PS. Don't know why this question came up 6 years later, but also look at "(b) Use of encryption is limited to encryption within the operating system (iOS or macOS), (c) Only makes call(s) over HTTPS" so you are free to use any encryption method provided by iOS or macOS, but not something else you or someone else created, and you are free to use https, which encrypt data transmitted over the internet.