Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Okay - so I have been extensively looking into US export/import laws relating to encryption software (5D992), however I have a few questions about the laws and their applicability.

  1. So, the laws obviously apply to encryption software distributed online, say through iTunes or Windows Store, however "designed for installation by the user without further substantial support by the supplier" is stated within Supplement No. 1 to Part 774 Note 3 - would that mean an applicaiton that is mearly a "iframe" (for want of a better way to descibe it) would not meet that requirement?

  2. Are cloud services subject to the export laws on encryption software?

I do know if I did a standard iPhone app that used AES-256 I would need to apply for a license, however in my above situations, it becomes somewhat messy and confusing. Especially the "designed for installation by the user without further substantial support by the supplier".

(I'll provide this link for reference to the "designed for installation by the user without further substantial support by the supplier" within

I'm basically trying to determine if my cloud service may or may not need a license for US export/import.

If you guys want more info just let me know and i'll do my best to reply.

Thanks in advance.

share|improve this question

closed as off-topic by Rory Alsop Jul 12 '13 at 19:14

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

Remember the old joke about "The man who represents himself in court has a fool for a lawer?" I think he gets to look down on people who take legal advice from the internet. The consequences for breaking these regulations are significant enough that it really makes sense to talk to someone qualified. – Mark C. Wallace Jul 12 '13 at 17:06
Sorry - as mentioned, we aren't in a position to give legal advice, so this is off topic. – Rory Alsop Jul 12 '13 at 19:14

I would ask a lawyer rather than the Internet, but it was my understanding that you it is the software containing the algorithms that you can't export. As long as your cloud is running in the US and you don't use any client side encryption that falls under export control, you are probably ok, since your system is doing the encryption and the UI they get doesn't contain the algorithms, but I'd double check with a lawyer about that because I am not one.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.