81_FR_35693 81 FR 35586 - Revisions to Definitions in the Export Administration Regulations

81 FR 35586 - Revisions to Definitions in the Export Administration Regulations

DEPARTMENT OF COMMERCE
Bureau of Industry and Security

Federal Register Volume 81, Issue 107 (June 3, 2016)

Page Range35586-35608
FR Document2016-12734

This final rule is part of the Administration's Export Control Reform (ECR) Initiative. The Initiative will enhance U.S. national and economic security, facilitate compliance with export controls, update the controls, and further the goal of reducing unnecessary regulatory burdens on U.S. exporters. As part of this effort, the Bureau of Industry and Security (BIS), in publishing this rule, makes revisions to the Export Administration Regulations (EAR) to include certain definitions to enhance clarity and consistency with terms also found in the International Traffic in Arms Regulations (ITAR), which is administered by the Department of State, Directorate of Defense Trade Controls (DDTC), or that DDTC expects to publish in proposed rules. This final rule also revises the Scope part of the EAR to update and clarify application of controls to electronically transmitted and stored technology and software, including by way of cloud computing. DDTC is concurrently publishing comparable amendments to certain ITAR definitions for the same reasons. Finally, this rule makes conforming changes to related provisions.

Federal Register, Volume 81 Issue 107 (Friday, June 3, 2016)
[Federal Register Volume 81, Number 107 (Friday, June 3, 2016)]
[Rules and Regulations]
[Pages 35586-35608]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2016-12734]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF COMMERCE

Bureau of Industry and Security

15 CFR Parts 734, 740, 750, and 772

[Docket No. 141016858-6004-02]
RIN 0694-AG32


Revisions to Definitions in the Export Administration Regulations

AGENCY: Bureau of Industry and Security, Commerce.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This final rule is part of the Administration's Export Control 
Reform (ECR) Initiative. The Initiative will enhance U.S. national and 
economic security, facilitate compliance with export controls, update 
the controls, and further the goal of reducing unnecessary regulatory 
burdens on U.S. exporters. As part of this effort, the Bureau of 
Industry and Security (BIS), in publishing this rule, makes revisions 
to the Export Administration Regulations (EAR) to include certain 
definitions to enhance clarity and consistency with terms also found in 
the International Traffic in Arms Regulations (ITAR), which is 
administered by the Department of State, Directorate of Defense Trade 
Controls (DDTC), or that DDTC expects to publish in proposed rules. 
This final rule also revises the Scope part of the EAR to update and 
clarify application of controls to electronically transmitted and 
stored technology and software, including by way of cloud computing. 
DDTC is concurrently publishing comparable amendments to certain ITAR 
definitions for the same reasons. Finally, this rule makes conforming 
changes to related provisions.

DATES: This rule is effective September 1, 2016.

ADDRESSES: Although there is no formal comment period, public comments 
on this final rule are welcome on a continuing basis. You may submit 
comments by either of the following methods:
     By email directly to [email protected]. Include 
RIN 0694-AG32 in the subject line.
     By mail or delivery to Regulatory Policy Division, Bureau 
of Industry and Security, U.S. Department of Commerce, Room 2099B, 14th 
Street and Pennsylvania Avenue NW., Washington, DC 20230. Refer to RIN 
0694-AG32.
    Commerce's full plan for retrospective regulatory review can be 
accessed at: http://open.commerce.gov/news/2011/08/23/commerce-plan-retrospective-analysis-existing-rules.

[[Page 35587]]


FOR FURTHER INFORMATION CONTACT: For questions on application of 
controls to electronically transmitted and stored technology and 
software, contact Bob Rarog, Senior Advisor to the Assistant Secretary 
for Export Administration, Bureau of Industry and Security at (202) 
482-9089. For other questions, contact Hillary Hess, Director, 
Regulatory Policy Division, Office of Exporter Services, Bureau of 
Industry and Security at (202) 482-2440 or [email protected].

SUPPLEMENTARY INFORMATION:

Background

    This final rule is part of the Administration's Export Control 
Reform (ECR) Initiative. The Initiative will enhance U.S. national and 
economic security, facilitate compliance with export controls, update 
the controls, and continue the process of reducing unnecessary 
regulatory burdens on U.S. exporters. As part of this effort, the 
Bureau of Industry and Security (BIS), in publishing this rule, makes 
revisions to the Export Administration Regulations (EAR) to include the 
definitions of ``access information,'' ``technology,'' ``required,'' 
``foreign person,'' ``proscribed person,'' ``published,'' results of 
``fundamental research,'' ``export,'' ``reexport,'' ``release,'' 
``transfer,'' and ``transfer (in-country)'' to enhance clarity and 
consistency with terms also found in the International Traffic in Arms 
Regulations (ITAR), which is administered by the Department of State, 
Directorate of Defense Trade Controls (DDTC). This final rule also 
revises the Scope part of the EAR to update and clarify application of 
controls to electronically transmitted and stored technology and 
software. DDTC is concurrently publishing comparable amendments to the 
ITAR's definitions of ``export,'' ``reexport,'' ``release,'' and 
``retransfer'' for the same reasons. Finally, this rule makes 
conforming changes to related provisions. DDTC anticipates publishing 
its comparable provisions pertaining to ``technical data,'' ``directly 
related,'' ``public domain,'' and the results of ``fundamental 
research'' in a separate proposed rule.
    One aspect of the ECR Initiative includes amending the export 
control regulations to facilitate enhanced compliance while reducing 
unnecessary regulatory burdens. For similar national security, foreign 
policy, including human rights, reasons, the EAR and the ITAR each 
control, inter alia, the export, reexport, and in-country transfer by 
U.S. and foreign persons of commodities, products or articles, 
technology, technical data, software, and services to various 
destinations, end users, and end uses. The two sets of regulations have 
been issued pursuant to different statutes, have been administered by 
different agencies with missions that are distinct from one another in 
certain respects, and have covered different items (or articles). For 
those reasons, and because each set of regulations has evolved 
separately over decades without much coordination between the two 
agencies regarding their structure and content, they often use 
different words, or the same words differently, to accomplish similar 
regulatory objectives.
    Many parties' export, reexport, and transfer transactions are 
regulated by both the Commerce Department's EAR and the State 
Department's ITAR, particularly now that regulatory jurisdiction over 
many types of military items has been transferred from the ITAR to the 
EAR. Using common terms and common definitions to regulate the same 
types of items or actions will facilitate enhanced compliance and 
reduce unnecessary regulatory burdens. Conversely, if different 
concerns between the two sets of export control regulations warrant 
different terms or different controls, the differences should be made 
clear for the same reason. Such clarity will benefit national security 
because it will be easier for exporters to comply with the regulations 
and for prosecutors to prosecute violations of the regulations. Such 
clarity will also enhance our economic security because it will reduce 
unnecessary regulatory burdens for exporters when attempting to 
determine the meaning of key words and phrases across similar sets of 
regulations. Finally, this rule and the rule DDTC is publishing 
concurrently address only a portion of the terms and phrases that 
warrant harmonization between the ITAR and the EAR. They are 
nonetheless a significant step toward accomplishing one of the ultimate 
objectives of the ECR initiative, which is the creation of a common 
export control list and common set of export control regulations.

Proposed Rule

    On June 3, 2015, BIS published a proposed rule entitled ``Revisions 
to Definitions in the Export Administration Regulations'' (80 FR 31505) 
(hereafter ``the June 3 proposed rule'' or ``the June 3 rule''). 
Simultaneously, the Department of State published a proposed rule 
entitled ``International Traffic in Arms: Revisions to Definitions of 
Defense Services, Technical Data, and Public Domain; Definition of 
Product of Fundamental Research; Electronic Transmission and Storage of 
Technical Data; and Related Definitions'' (80 FR 31525) (hereafter 
``the State June 3 rule'').
    BIS welcomed comments on all aspects of the June 3 rule. 
Additionally, in the preamble to the June 3 rule, BIS specifically 
solicited public comment with questions on eight issues. Two of those 
questions pertained to the definition of fundamental research; one 
pertained to whether the questions and answers in Supplement No. 1 to 
part 734 had criteria that should be retained in part 734; two 
pertained to encryption standards in the definition of ``Activities 
that are Not Exports, Reexports, or Transfers;'' and one pertained to 
the effectiveness of the proposed definition of ``peculiarly 
responsible.'' Public comments on these questions are addressed in 
their corresponding sections below.
    The two remaining questions were broadly applicable across the 
rule: Whether the proposed revisions created gaps, overlaps, or 
contradictions between the EAR and the ITAR or among various provisions 
within the EAR; and whether a 30-day delayed effective date was 
appropriate for the final rule.
    Eleven commenters cited the difference between the EAR and ITAR 
standards for prepublication review of research as a significant gap 
between the two bodies of regulations that would create compliance 
difficulties. These commenters recommended that both final rules adopt 
the EAR standard. Further discussion of this issue may be found in the 
section of the preamble describing fundamental research, below.
    Twenty-two commenters recommended a six-month delayed effective 
date from date of publication. Most of these commenters explicitly 
based the recommendation on the anticipated difficulty created by 
adoption of differing proposed EAR and ITAR standards for 
prepublication review of research. State is not publishing revisions to 
fundamental research at this time; therefore, the rationale for 
requesting a six-month delay is largely eliminated.
    One commenter recommended at least a three-month delayed effective 
date to enable non-U.S. companies to understand and prepare for 
compliance with the revisions. BIS accepts this recommendation, and 
this final rule will be effective 90 days from the date of publication.
    One commenter recommended issuing an interim final rule with a 
comment period of at least 60 days due

[[Page 35588]]

to the breadth of the proposed changes. BIS does not accept this 
recommendation, because this final rule has a 90-day delayed effective 
date, which is a longer delay than generally applies to an interim 
final rule. The State rule published concurrently with this final rule 
also has a 90-day delayed effective date. Moreover, the State 
Department plans to publish a second proposed rule seeking comment on 
most of the terms at issue.

Frequently Asked Questions

    Objectives of this final rule include streamlining, clarifying, and 
updating regulatory text. BIS has attempted to focus the regulatory 
text on control criteria, limiting notes and examples to those 
necessary to adequately convey the criteria. Many public comments 
raised questions about how criteria would be applied in particular 
situations or suggested illustrative revisions. BIS considers these 
comments helpful to compliance with the EAR and is publishing them 
along with responses on the BIS Web site as Frequently Asked Questions 
(FAQs).

Items Subject to the EAR

    The June 3 rule proposed re-titling the section ``Subject to the 
EAR'' (from ``Important EAR terms and principles''), retaining the 
definition and description of that term, and creating separate sections 
in part 734 to define ``export,'' ``reexport,'' ``release,'' and 
``transfer (in-country),'' rather than retaining them in that section. 
The June 3 rule also proposed removing Sec.  734.2(b)(7) regarding the 
listing of foreign territories and possessions in the Commerce Country 
Chart (Supplement No. 1 to part 738) because it duplicated existing 
Sec.  738.3(b).
    BIS received no comments on its proposed revisions to Sec.  734.2. 
These revisions are adopted in this final rule.

Items Not Subject to the EAR

    Section 734.3(a) describes items (i.e., commodities, software, and 
technology) subject to the EAR. Paragraph (b) describes items that are 
not subject to the EAR. The June 3 rule proposed minor revisions to 
paragraph (b)(3), which describes software and technology that are not 
subject to the EAR, to describe more fully educational and patent 
information that are not subject to the EAR, and to add a note to make 
explicit that information that is not ``technology'' as defined in the 
EAR is per se not subject to the EAR. One commenter specifically 
offered support for inclusion of the note, and no commenters objected 
to it; BIS has adopted it in this final rule.

Educational Information

    The June 3 rule proposed to move the statement in Sec.  734.9 that 
educational information released by instruction in a catalog course or 
associated teaching laboratory of an academic institution is not 
subject to the EAR to Sec.  734.3(b) and remove Sec.  734.9. The June 3 
rule also proposed to revise the description of such educational 
information as information and software that ``[c]oncern general 
scientific, mathematical, or engineering principles commonly taught in 
schools, and released by instruction in a catalog course or associated 
teaching laboratory of an academic institution'' to better match the 
existing ITAR description. The proposed revisions were not intended to 
change the scope of educational information that is not subject to the 
EAR.
    Twenty-seven commenters stated that, in spite of BIS's declared 
intent to leave the scope of this provision unchanged, the proposed 
revision in fact narrowed the scope of educational information that is 
not subject to the EAR. With the adoption of the terms in the 
comparable ITAR provision, such as ``general'' and ``commonly,'' 
commenters said that the revision could be read to make courses with 
advanced or novel content subject to the EAR and suggested either 
changing ``and released by instruction'' to ``or released by 
instruction'' or reverting to the existing wording. BIS agrees that the 
revision could be read to narrow the scope of the exclusion, and 
because this narrowing was not intended, reverts to the existing 
wording in this final rule.
    BIS received no comments on the placement of the educational 
information provision in the list of information that is per se not 
subject to the EAR rather than in a separate section. BIS adopts the 
proposed placement in this final rule.

Additional Exclusions

    This final rule adopts two additional revisions that were not in 
Sec.  734.3(b)(3) in the June 3 proposed rule. This final rule adds 
paragraphs (b)(3)(v) and (vi), two additional exclusions from the EAR: 
Items that are non-proprietary system descriptions or are telemetry 
data. These two exclusions appeared in the June 3 proposed rule as 
exclusions from the definition of technology. For discussion of public 
comments on these exclusions and BIS's response to those comments, see 
the section on ``Technology'' below.

Exports of Encryption Source Code Notes

    The June 3 rule proposed no changes to the notes to paragraphs 
(b)(2) and (b)(3) of Sec.  734.3 that a printed book or other printed 
material setting forth encryption source code is not itself subject to 
the EAR, but that encryption source code in electronic form or media 
remains subject to the EAR. It also proposed no changes to the note 
that publicly available encryption object code software classified 
under Export Control Classification Number (ECCN) 5D002 is not subject 
to the EAR when the corresponding source code meets the criteria 
specified in Sec.  740.13(e) of the EAR.
    BIS received no comments on these notes, and this final rule makes 
no changes to them.

Published Technology and Software

    Section 734.7 sets forth that technology and software is 
``published'' and thus not subject to the EAR when it becomes generally 
accessible to the interested public in any form, including through 
publication, availability at libraries, patents, distribution or 
presentation at open gatherings, and public dissemination (i.e., 
unlimited distribution) in any form (e.g., not necessarily in published 
form), including posting on the Internet on sites available to the 
public.
    The June 3 rule proposed a definition of ``published'' that 
retained the same scope, but with a simpler structure. The proposed 
Sec.  734.7(a) read: ``Except as set forth in paragraph (b), 
``technology'' or ``software'' is ``published'' and is thus not 
``technology'' or ``software'' subject to the EAR when it is not 
classified national security information and has been made available to 
the public without restrictions upon its further dissemination,'' 
followed by a list of examples of published information. The proposed 
definition was substantially the same as the wording of definitions 
adopted by the multilateral export control regimes of which the United 
States is a member: The Wassenaar Arrangement on Export Controls for 
Conventional Arms and Dual-Use Goods and Technologies (herein 
``Wassenaar Arrangement'' or ``Wassenaar''), the Nuclear Suppliers 
Group, the Missile Technology Control Regime, and the Australia Group. 
The phrase ``classified national security information'' refers to 
information that has been classified in accordance with Executive Order 
13526, 75 FR 707; 3 CFR 2010 Comp., p. 298. The relevant restrictions 
do not include copyright protections or generic property rights in the 
underlying physical medium.
    This final rule adopts the definition of ``published'' from the 
June 3 proposed rule, with the exception of adding certain information, 
intended to be

[[Page 35589]]

published, released to ``researchers conducting fundamental research'' 
(see discussion below of ``Fundamental Research''). BIS received a 
number of comments on the definition of ``published.'' Two commenters 
found helpful the addressing of Internet posting and the clarification 
that submission of manuscripts to journal editors constitutes 
``published.'' Commenters requested that BIS define ``unclassified'' 
and clarify whether university libraries are ``open to the public.'' 
``Unclassified information'' refers to information that has not been 
classified in accordance with Executive Order 13526, 75 FR 707; 3 CFR 
2010 Comp., p. 298. University libraries are open to the public. BIS 
does not implement these requests in this final rule because answering 
them does not require a change to the regulations. BIS is, however, 
addressing the questions in FAQs posted on BIS's Web site. One 
commenter stated that, as proposed, the definition of ``published'' 
``suggests that releasing (publishing) technology that is unclassified 
but subject to the EAR makes that technology no longer subject to the 
EAR.'' One commenter described allowing publication by Internet posting 
as a ``loophole'' because the site may be obscure and the duration of 
posting is not specified. Another commenter warned of ``the risk of 
intentional abuse.'' Nonetheless, BIS confirms that technology or 
software that is ``published'' as provided in Sec.  734.7 is not 
subject to the EAR.
    A commenter noted that the definition ``does not appear to address 
the case of information posted by someone other than the rightful 
owner.'' BIS agrees with this statement, but notes that such cases are 
addressed by other laws and regulations.
    BIS received thirty comments opposing a provision in the definition 
of ``public domain'' in the State June 3 rule to which there is no 
corresponding provision in the definition of ``published.'' BIS is 
making no changes to the EAR in response to these comments because they 
are outside the scope of this rule. They address concerns with the 
ITAR, not the EAR.
    As adopted in this final rule, section 734.7(b) keeps certain 
published encryption software subject to the EAR, a restriction that 
the June 3 rule proposed moving from Sec.  734.7(c) without revision.

Fundamental Research

    The June 3 rule proposed revising Sec.  734.8, which excludes most 
information resulting from fundamental research from the scope of the 
EAR, but it was not intended to change the scope of the current Sec.  
734.8.

Alternative Definitions

    In the June 3 proposed rule, BIS specifically solicited comments on 
whether the alternative definition of fundamental research suggested in 
the preamble should be adopted. BIS also specifically solicited 
comments on whether the alternative definition of applied research 
suggested in the preamble should be adopted, or whether basic and 
applied research definitions are needed given that they are subsumed by 
fundamental research.
    Issued in 1985, National Security Decision Directive (NSDD)-189 
established a definition of ``fundamental research'' that has been 
incorporated into numerous regulations, internal compliance regimes, 
and guidance documents. The June 3 proposed rule contained a definition 
of ``fundamental research'' that was identical to that in NSDD-189. 
However, in the preamble to that rule, BIS provided a simpler 
definition that was consistent with NSDD-189, but not identical. 
Specifically, the alternative definition read: `` `Fundamental 
research' means non-proprietary research in science and engineering, 
the results of which ordinarily are published and shared broadly within 
the scientific community.'' BIS believed that the scope of this wording 
was the same as that of the wording in NSDD-189 and sought comment on 
whether the final rule should adopt the simpler wording. Unlike the 
simpler alternative definition, the proposed definition of 
``fundamental research'' included references to ``basic'' and 
``applied'' research and proposed definitions of those terms, as well 
as a possible alternative definition of applied research.
    Comments on alternative definitions of fundamental research were 
mixed. Thirteen commenters generally favored a simpler definition, in 
some cases offering their own revised versions of the alternative from 
the preamble to the June 3 proposed rule. Seven commenters recommended 
retaining the NSDD-189 wording. Many commenters favored one definition 
but expressed willingness to accept another. Comments on alternative 
definitions of basic and applied research were similarly mixed, 
including instances of the same commenter offering support for more 
than one option. There was greater unanimity on the term ``non-
proprietary:'' twenty commenters objected to it, most finding it vague. 
Commenters suggested the variation, research ``for which the 
researchers have not accepted restrictions for proprietary or national 
security reasons.''
    BIS agrees with the majority of commenters that the shorter 
definition of fundamental research is clearer and covers the same 
scope. Given the wide spectrum of definitions and applications of basic 
and applied research in different bodies of regulations, BIS determined 
that the definition should address the core concept, i.e., that the 
research is to be published and shared broadly without restriction. 
Having sub-definitions of basic and applied research in the definition 
of fundamental research does not change this core concept and would, 
moreover, merely add more words and layers of interpretation that would 
not change the outcome of an analysis. Adopting the shorter definition 
drops references to basic and applied research. BIS accepted the 
comments regarding the term ``non-proprietary'' and adopted a clearer 
variation that has the same scope as that intended by the June 3 
proposed rule.
    In addition to research in science and engineering, BIS included 
the term ``mathematics'' to broaden the definition in response to a 
comment by a BIS technical advisory committee. In this final rule, BIS 
adopts the following definition of fundamental research: `` 
``Fundamental research'' means research in science, engineering, or 
mathematics, the results of which ordinarily are published and shared 
broadly within the research community, and for which the researchers 
have not accepted restrictions for proprietary or national security 
reasons.''

Software

    The June 3 proposed rule revised Sec.  734.8 to use the term 
``technology'' in place of the term ``information.'' Thirty-two 
commenters objected that ``technology'' was too limiting and 
recommended including either ``software'' or ``source code'' in 
addition to ``technology'' to describe information arising during or 
resulting from fundamental research. Many commenters pointed to the 
text of Sec.  734.3(b)(3) (not subject to the EAR), which referred to 
certain ``technology and software'' not subject to the EAR, proposed to 
be revised to ``information and software'' in the June 3 rule, as 
support for this recommendation. The commenters further argued that 
``findings resulting from fundamental research may be written in 
natural-language or computer language.'' BIS accepts these comments and 
has adopted ``technology'' and ``software'' throughout Sec.  734.8 in 
this final rule.

[[Page 35590]]

    Two commenters recommended that BIS make commodities that result 
from fundamental research not subject to the EAR. BIS does not accept 
this recommendation because the policy foundations for the exclusion 
from the EAR of fundamental research apply only to technology and 
software, not commodities.

Note on Inputs

    The June 3 proposed rule contained the following note: ``Note 1 to 
paragraph (a): The inputs used to conduct fundamental research, such as 
information, equipment, or software, are not `technology that arises 
during or results from fundamental research' except to the extent that 
such inputs are technology that arose during or resulted from earlier 
fundamental research.'' Six commenters stated that the proposed note 
arbitrarily narrows the conduct of fundamental research under NSDD-189. 
Two additional commenters seemed to find the text unclear regarding the 
nature of the inputs.
    The note regarding inputs was intended to distill varying 
provisions found in the EAR but proposed to be revised by the June 3 
rule that ultimately made the same point: Information that is not 
intended to be published is not fundamental research. For example, 
existing Sec.  734.8(b)(2) states, ``Prepublication review by a sponsor 
of university research solely to insure that the publication would not 
inadvertently divulge proprietary information that the sponsor has 
furnished to the researchers does not change the status of the research 
as fundamental research. However, release of information from a 
corporate sponsor to university researchers where the research results 
are subject to prepublication review, is subject to the EAR.'' Existing 
section 734.8(b)(4) states, ``The initial transfer of information from 
an industry sponsor to university researchers is subject to the EAR 
where the parties have agreed that the sponsor may withhold from 
publication some or all of the information so provided.''
    To clarify this distinction, BIS has adopted a simpler note in this 
final rule. Paragraph (a) establishes that the intention to publish is 
what makes research not subject to the EAR; the following Note 1 to 
paragraph (a) states: ``This paragraph does not apply to technology or 
software subject to the EAR that is released to conduct fundamental 
research.'' To support this concept, this final rule adds the following 
phrase to Sec.  734.7(a)(5) (emphasis added): ``Submission of a written 
composition, manuscript, presentation, computer-readable dataset, 
imagery, algorithm, formula, or some other representation of knowledge 
with the intention that such information will be made publicly 
available if accepted for publication or presentation: (i) To domestic 
or foreign co-authors, editors, or reviewers of journals, magazines, 
newspapers, or trade publications; (ii) To researchers conducting 
fundamental research, or (iii) To organizers of open conferences or 
other open gatherings.''

Prepublication Review

    The June 3 proposed rule listed three types of prepublication 
review in Sec.  734.8 that could be performed on the results of 
fundamental research. Three commenters supported the clear statement 
that certain prepublication review does not render research subject to 
the EAR. One commenter recommended removing the criterion that the 
research be published without delay, pointing out that ``[p]ublication 
can be (and very often is) delayed for any number of reasons having 
nothing to do with the content or sensitivity of research results'' and 
that this provision would have the unintended effect of limiting or 
even eliminating the researchers' ability to use the fundamental 
research provisions. BIS accepts this latter comment and does not adopt 
the phrase ``or delay.'' The key point is that the researcher is able 
to publish without restriction.
    One commenter suggested that Note 2 to paragraph (b) proposed in 
the June 3 rule be replaced with a similar note from the State June 3 
rule (Sec.  120.49(b) of the ITAR) regarding research voluntarily 
subjected to U.S. government review. BIS agrees with commenters that 
the ITAR text is clearer. So, this final rule adopts that ITAR text in 
Note 2 to paragraph (b). Seven commenters recommended that BIS also 
adopt the text of Note 3 from the State June 3 rule's text of Sec.  
120.49(b) of the ITAR regarding U.S. government-imposed access and 
dissemination controls. BIS agrees. With adoption of Note 3 to 
paragraph (b), paragraph (a) of Sec.  734.11, Specific National 
Security Controls, is no longer necessary. BIS includes the examples 
from paragraph (b) of Sec.  734.11, which commenters deemed helpful, in 
new Note 3 to paragraph (b) of Sec.  734.8 in this final rule. Thus, 
this rule removes Sec.  734.11 in its entirety.
    One commenter stated that the only permissible method of 
restricting government-funded research was to classify it. BIS does not 
accept this comment because it is incorrect. Indeed, BIS has the 
authority under the EAR to control unclassified technology that 
warrants control for national security, foreign policy, or other 
reasons. For example, government-funded research that does not meet the 
criteria of Sec.  734.8, such as prepublication review, remains subject 
to the EAR regardless of whether it is classified information.

Locus of Research

    The June 3 rule proposed streamlining the fundamental research 
provisions, in Sec.  734.8. Instead of organizing the provisions 
primarily by locus (specifically by the type of organization in which 
the research takes place: Universities; federal agencies or Federally 
Funded Research and Development Centers; or business entities), the 
June 3 rule proposed consolidating different provisions that involved 
the same criteria with respect to prepublication review and removing 
any reference to locus unless it made a difference to the 
jurisdictional status of the research.
    Five commenters expressed support for the applicability of the 
concept of fundamental research regardless of locus, and this final 
rule retains the consolidated structure originally proposed.
    Although not objecting to the consolidation, eleven commenters 
requested that BIS retain the Sec.  734.8(b) statement that there is a 
presumption that university-based research is fundamental research. 
Although this presumption continues to exist, BIS does not adopt the 
specific statement in this final rule. Such a presumption has no effect 
on the jurisdictional status of technology. If it meets the criteria 
for fundamental research, it is not subject to the EAR; if it does not 
meet the criteria, it is subject. However, BIS is noting in its FAQs on 
its Web site that, although university-based research is presumed to be 
fundamental research, as with all rebuttable presumptions, it is 
rebutted if the research is not within the scope of technology and 
software that arises during, or results from fundamental research as 
described in Sec.  734.8.
    Eleven commenters requested that BIS retain the Sec.  734.8(b)(2) 
through (6) criteria for universities. BIS is not doing so because 
these criteria have been incorporated into this final rule more 
concisely. To address the comment, BIS has revised its FAQs to describe 
how these criteria are within the scope of the revised definition.

Patents

    The June 3 rule proposed revising Sec.  734.10, ``Patent 
applications,'' only for clarity and did not change the scope of 
control. For the sake of structural consistency with the ITAR's 
treatment of information in patents, paragraph (a)

[[Page 35591]]

was added to state that a patent or an open (published) patent 
application available from or at any patent office is per se not 
subject to EAR. The former footnote to the Sec.  734.10 was removed 
because it would be redundant of the proposed text.
    BIS received one comment on the proposed revisions to Sec.  734.10. 
Introductory text to the section reads: `` ``Technology'' is not 
``subject to the EAR'' if it is contained in:''. The commenter 
suggested adding the phrase ``any of the following'' to this text. BIS 
agrees and is making the addition to this final rule.

Specific National Security Controls

    The June 3 rule proposed minor conforming edits to Sec.  734.11, 
describing specific national security controls. The proposed revisions 
were not intended to change the scope of the section. As discussed 
above with respect to fundamental research, BIS has adopted the 
substance of former Sec.  734.11, Specific National Security Controls, 
in new Note 3 to paragraph (b) of Sec.  734.8 in this final rule. This 
final rule removes and reserves Sec.  734.11.

Export

    The June 3 proposed rule included a new Sec.  734.13 to define 
``Export.'' Section 734.13(a) had six paragraphs, with paragraphs 
(a)(4) and (5) reserved, because the corresponding paragraphs in the 
ITAR contained provisions that were not relevant to the EAR. One 
commenter noted that paragraph (a) had a typo and should refer to Sec.  
734.18, not Sec.  734.17. BIS does not agree--the reference is to the 
subset of exports of encryption source code and object code software--
but does accept the recommendation to add a reference to Sec.  734.18 
(Activities that are not exports, reexports, or transfers) in this 
final rule.
    Proposed paragraph (a)(1) of the definition of ``export'' used the 
EAR terms ``actual shipment or transmission out of the United States,'' 
combined with the existing ITAR ``sending or taking an item outside the 
United States in any manner.''
    One commenter recommended that BIS add ``release'' after ``actual 
shipment.'' BIS does not adopt this recommendation, because release is 
a separate concept and thus a separately defined term. BIS makes no 
revisions to this paragraph (a)(1) in this final rule.
    Proposed paragraph (a)(2), specifying the concept of transfer or 
release of technology to a foreign national in the United States, or 
``deemed export,'' retains the treatment of software source code as 
technology for deemed export purposes from Sec.  734.2(b)(2)(ii). In 
this final rule, including in this paragraph (a)(2), BIS has 
substituted the term ``foreign person'' for ``foreign national.'' 
``Foreign person'' has the same scope as ``foreign national;'' it 
mirrors the ITAR term. One commenter found the term ``otherwise 
transferring'' confusing, but this final rule retains it to distinguish 
releases as a subset of transfers.
    Proposed paragraph (a)(3) included in the definition of ``export'' 
the transfer by a person in the United States of registration, control, 
or ownership (i) of a spacecraft subject to the EAR that is not 
eligible for export under License Exception STA (i.e., spacecraft that 
provide space-based logistics, assembly or servicing of any spacecraft) 
to a person in or a national of any other country, or (ii) of any other 
spacecraft subject to the EAR to a person in or a national of a Country 
Group D:5 country.
    One commenter requested BIS to confirm whether the definition would 
carve out from the definitions of ``export'' and ``reexport'' the mere 
transfer of ownership to an entity outside of a Country Group D:5 
country (e.g., as part of an on orbit transfer of ownership to an 
entity outside a D:5 country) of satellites subject to the EAR that are 
eligible for License Exception STA. BIS confirms this understanding of 
the definition and is adding an FAQ regarding the point to the BIS Web 
site.
    Proposed paragraph (a)(6) defined as an export the release or other 
transfer of the means of access to encrypted data. This paragraph was 
not adopted in this final rule (see the section discussing transfer of 
access information in Sec.  734.19 below). Without a paragraph (a)(6), 
reserved paragraphs (a)(4) and (a)(5) that appeared in the June 3 rule 
are unnecessary and, therefore, do not appear in this final rule.
    As adopted in this final rule, proposed paragraph (b) of Sec.  
734.13 is unchanged from the June 3 rule, except for the substitution 
of the term ``foreign person'' for ``foreign national.'' This paragraph 
retains BIS's deemed export rule as set forth in Sec.  734.2(b). It 
also codifies a long-standing BIS policy that when technology or source 
code is released to a foreign national, the export is ``deemed'' to 
occur to that person's most recent country of citizenship or permanent 
residency. See, e.g., 71 FR 30840 (May 31, 2006).
    Four commenters raised deemed export issues, particularly with 
respect to the difficulty of determining the ``permanent residency'' 
status of a person in a foreign country. Two of these commenters 
recommended changing ``permanent residency'' to ``legal residency'' or 
establishing criteria in the EAR. One of these commenters suggested 
making deemed exports a separate definition. BIS finds that these 
comments have merit; however, the issues they raise are too wide-
ranging and complex to be resolved in this final rule. Addressing these 
issues would constitute a novel proposal that is outside the scope of 
the proposed rule, requiring an opportunity for comment before BIS 
makes a decision as to whether to adopt it. Where practical, BIS will 
state existing policy in FAQs. For those issues not addressed by 
existing policy, BIS will develop proposed revisions and seek public 
comment.
    Proposed paragraph (c) stated that items that will transit through 
a country or countries or will be transshipped in a country or 
countries to a new country, or are intended for reexport to the new 
country are deemed to be destined to the new country. (Proposed 
paragraph (c) text was taken without change from Sec.  734.2(b)(6).)
    One commenter requested that BIS clarify ``new country.'' BIS 
accepts this comment, and adopts the term ``destination'' in this final 
rule. BIS also drops the term ``transshipped,'' because the intended 
meaning of this paragraph is captured by ``transit.'' One commenter 
recommended that BIS specify that paragraph (c) applies to items 
``subject to the EAR.'' BIS does not believe the phrase is necessary.
    Two commenters requested that BIS clarify the status of services 
under the EAR. Unlike the ITAR, the EAR do not control services as such 
except as described in Sec.  744.6(a)(2) (``Restrictions on certain 
activities of U.S. persons'') and Sec.  736.2(b)(10) (``General 
Prohibition 10''). Section 744.6(a)(2) imposes licensing requirements 
on the performance by U.S. persons of any contract, service, or 
employment regarding various activities pertaining to missiles, 
biological weapons, and chemical weapons in various countries. General 
Prohibition 10 prohibits, inter alia, servicing an item subject to the 
EAR if a violation has occurred, is about to occur, or is intended to 
occur in connection with the item. Except for these provisions, the EAR 
regulates the export, reexport, and transfer (in-country) of 
commodities, technology, and software, regardless of whether such 
activities are in connection with a service. This means that, except 
with respect to activities described in these two provisions, services 
do not need to be analyzed separately for purposes of determining 
requirements under the EAR. Moreover, the ITAR does not impose controls 
on services unless they are ``directly related'' to a ``defense

[[Page 35592]]

article,'' i.e., an article, software, or technical data described on 
the ITAR's U.S. Munitions List at 22 CFR 121.1. In response to the 
commenters, BIS has added this explanation to its FAQs. A core goal of 
the ECR initiative was to make the distinctions in the ITAR and the EAR 
regarding the scope of controls over services as such clear. Thus, 
after the publication of the FAQs, if commenters believe that 
provisions of the ITAR or the EAR, statements by government officials, 
or any other government actions contradict this point regarding the 
narrow scope of controls over services pertaining to items subject to 
the EAR, they are encouraged to contact BIS to begin the process of 
resolving the issue.

Reexport

    The June 3 rule proposed moving the definition of ``reexport'' to 
new Sec.  734.14. In general, the provisions of the proposed definition 
of ``reexport'' paralleled those of the proposed definition of export 
discussed above, except that reexports occur outside of the United 
States. Public comments on the definition of ``reexport'' and BIS 
responses also mirror those discussed above for ``export.''
    One commenter recommended that BIS specify ``subject to the EAR'' 
in paragraphs (a)(1), (a)(2), and (a)(4) of ``reexport.'' BIS accepts 
this recommendation, except for paragraph (a)(4). Paragraph (a)(4) in 
the June 3 rule proposed to define as a reexport the release or other 
transfer of the means of access to encrypted data outside of the United 
States to a foreign national. This paragraph was not adopted in this 
final rule (see the section discussing transfer of access information 
in Sec.  734.19 below).
    One commenter requested that BIS confirm that sending an item back 
to the United States is not a reexport. BIS confirms that sending items 
to the United States is not a ``reexport.'' Moreover, unlike the ITAR, 
the EAR have no provisions controlling or otherwise pertaining to the 
act of importing items into the United States. BIS will confirm these 
points in an FAQ.

Release

    The June 3 proposed rule included a definition of ``release'' in a 
new Sec.  734.15. The proposed text provided that inspection (including 
other types of inspection in addition to visual, such as aural or 
tactile) must actually reveal technology or source code subject to the 
EAR to constitute a ``release.'' Thus, for example, merely seeing an 
item briefly is not necessarily sufficient to constitute a release of 
the technology required, for example, to develop or produce it. A 
foreign person's having theoretical or potential access to technology 
or software is similarly not a ``release'' because such access, by 
definition, does not reveal technology or software. A release would 
occur when the technology or software is revealed to the foreign 
person. The June 3 rule also proposed adding ``written'' to ``oral 
exchanges'' in paragraph (a)(2) as a means of release. No commenters 
objected to the clarification, and it remains unchanged. This final 
rule adds ``source code'' as well as ``technology'' to paragraph (a)(2) 
for consistency with paragraph (a)(1) and the definitions of deemed 
export and reexport; its omission from the June 3 rule was inadvertent.
    The proposed text also clarified, in paragraph (a)(3), that the 
application of ``technology'' and ``software'' is a ``release'' in 
situations where U.S. persons abroad use personal knowledge or 
technical experience acquired in the United States in a manner that 
reveals technology or software to foreign nationals. As indicated by 
various BIS training materials and statements of BIS officials publicly 
and in response to specific questions, this clarification makes 
explicit a long-standing BIS interpretation of the EAR. The June 3 
rule's proposed definition did not use the existing phrase ``visual 
inspection by foreign nationals of U.S.-origin equipment and 
facilities'' because such inspections do not per se release 
``technology.'' For example, merely seeing equipment does not 
necessarily mean that the seer is able to glean any technology from it 
and, in any event, not all visible information pertaining to equipment 
is necessarily ``technology'' subject to the EAR.
    Four commenters stated that this redefinition of ``release'' was 
helpful.
    Three comments expressed concern that paragraph (a)(1) is not 
sufficiently explicit in clarifying that visual inspection must 
``actually'' or ``substantively'' reveal technology in order to be 
defined as a ``release,'' or that ``actual access'' rather than 
``theoretical access'' is caught. BIS believes that the intent is clear 
and that the text only would be complicated by additional 
modifications. One commenter requested that BIS simplify the provision 
in which application of personal knowledge constitutes a release. Upon 
further consideration, BIS determined that the control criteria in that 
provision are already covered by the provisions governing inspection 
and oral or written exchanges. Therefore, BIS does not adopt this 
paragraph (a)(3) in this final rule. BIS has, however, created FAQs 
that include the points and examples contained in the foregoing 
description of the changes to the definition of ``release.''
    One commenter recommended that paragraph (a)(6) in the June 3 
rule's proposed definition of ``export,'' which addressed transfer of 
decryption keys or other such information, be moved to the definition 
of ``release.'' Related to the revisions regarding transfer of access 
information, and consistent with this commenter's recommendation, this 
final rule adopts in Sec.  734.15(b) a provision stating that the act 
of causing the ``release'' of ``technology'' or ``software,'' through 
use of ``access information'' or otherwise, to onesself or another 
person requires an authorization to the same extent an authorization 
would be required to export or reexport such ``technology'' or 
``software'' to that person.
    The purpose of this provision is to make it clear that the person 
who uses, for example, a password to access a technology database, or 
who hacks into the database, to transfer technology to himself or 
someone else is the one who caused the release of technology rather 
than the person who first placed the technology in the database through 
a technology export or an act described in new Sec.  734.18(a)(5). This 
provision codifies that basic concept that the unwitting victim of, for 
example, a database hack is not the one responsible for the theft of 
technology--the hacker is the one responsible because it is that person 
who caused the release through the use of a password or other access 
information. This provision is merely an application with respect to 
intangibles of a concept that is basic to tangible items--the export of 
an item is not the cause of a third person's later reexport of the same 
item. Placing technology into a database is not the cause of a third 
person's later transfer of the technology through the use of access 
information. The third person's use of the access information is the 
cause of the release to himself or others.
    Although the person who originally placed the technology into the 
database did not cause its release to the third person who used access 
information to later cause the technology to be released, the person 
who originally placed the technology into the database nonetheless 
would have liability in connection with the third party technology 
exfiltration if, for example, it conspired with the exfiltrator (see 
Sec.  764.2(d)) or placed the technology into the database with 
``knowledge'' that the exfiltrator would later violate the EAR by 
causing its release without a required

[[Page 35593]]

license (see Sec.  764.2(e)). Similarly, liability would arise from a 
violation of new section 734.19, which, as discussed below, states that 
providing a password or other access information to someone with 
``knowledge'' that the provision would result in the release of 
technology or software to the third person is tantamount to releasing 
the technology or software itself to the third person. BIS has created 
FAQs describing all the points in the foregoing examples.
    Finally, and in contrast to section 734.19, new section 734.15(b) 
does not contain a ``knowledge'' element. Thus, a ``release'' of 
``technology'' or ``software'' occurs when access information is used 
to transfer the ``technology'' or ``software''--resulting in liability 
if the release was not undertaken pursuant to a required authorization 
and regardless of whether the one using the access information knew it 
would be transferring controlled ``technology'' or ``software'' when it 
did so.

Transfer (In-Country)

    The June 3 rule proposed removing the definition of ``transfer (in-
country)'' from Sec.  772.1 and adding the following revised definition 
to new Sec.  734.16: ``a transfer (in-country) is a change in end use 
or end user of an item within the same foreign country.'' This revision 
was intended to eliminate any potential ambiguity regarding whether a 
change in end use or end user within a foreign country is a ``transfer 
(in-country).'' ``Transfer (in-country)'' parallels the term 
``retransfer'' in the ITAR.
    Four commenters said that this revision expands controls, and that 
such changes were beyond exporters' knowledge or control. While BIS 
acknowledges that ``end use'' was not explicitly included in the former 
definition of ``transfer (in-country),'' a change in end use is 
nonetheless a material change. When BIS and the other agencies review 
an application's description of a proposed end use and approve the 
license based on that end use, BIS is approving the transaction for the 
end use described, not all other end uses in the same country. Other 
end uses may or may not be acceptable, but a change in end use from 
that which the U.S. Government reviewed would be material in that there 
is the possibility that another end use may not have been approved. BIS 
further notes that, depending on the facts of the transaction, the 
foreign party may be responsible for obtaining authorization for the 
subsequent disposition of the item subject to the EAR. If a violation 
occurs, BIS will assess responsibility based on whether the parties 
involved violated any of the provisions of section 764.2 
(``violations'').
    To assist the commenters and others who have questions about BIS's 
policy regarding when a license or other authorization is required for 
in-country transfers, BIS has made the following the standard first 
condition on its licenses: ``Items subject to the EAR and within the 
scope of this license may not be reexported or transferred (in-country) 
unless such reexport or in-country transfer is (i) authorized by this 
license, or another license or other approval issued by the U.S. 
Government; (ii) authorized by a license exception or other 
authorization under the Export Administration Regulations (EAR); or 
(iii) to a destination, end user, and end use that would be ``NLR'' (No 
License Required) under the EAR.''

Export of Encryption Source Code and Object Code Software

    The June 3 proposed rule included a new Sec.  734.17, export of 
encryption source code and object code software, that retained the text 
of Sec.  734.2(b)(9) with only minor conforming and clarifying edits. 
Its relocation to a new, separate section, following similar 
definitions improves its accessibility to exporters.
    BIS received no comments on its proposed minor revisions to Sec.  
734.2(b)(9) or its creation of Sec.  734.17. These revisions are 
adopted in this final rule.

Activities That Are Not Exports, Reexports, or Transfers

    The June 3 proposed rule solicited public comment on two questions 
regarding the proposed definition of ``Activities that are not exports, 
reexports, or transfers.'' First, with respect to end-to-end 
encryption, BIS asked whether the illustrative standard proposed in the 
EAR rulemaking also should be adopted in the ITAR rulemaking; whether 
the safe harbor standard proposed in the ITAR rulemaking also should be 
adopted in the EAR rulemaking; or whether the two bodies of regulations 
should have different standards. Second, BIS asked whether encryption 
standards adequately address data storage and transmission issues with 
respect to export controls.
    As proposed, Sec.  734.18 gathered existing EAR exclusions from 
exports, reexports, and transfers into one place, and included a new 
exemption for encrypted technical data and software. A number of 
changes and adjustments are made in this final rule to the proposed 
text in response to comments received from the public.
    Paragraph (a)(1) in the June 3 proposed rule stated that by 
statute, launching a spacecraft, launch vehicle, payload, or other item 
into space is not an export. See 51 U.S.C. 50919(f). BIS received no 
comments on this paragraph and adopts it in this final rule.
    Paragraph (a)(2) in the June 3 proposed rule was based on text in 
former Sec.  734.2(b)(2)(ii) of the EAR, and provided that release in 
the United States of technology or software to U.S. nationals, 
permanent residents, or protected individuals would not be an export. 
In this final rule, the term ``release'' has been replaced in Sec.  
734.18(a)(2) with ``transmitting or otherwise transferring,'' and the 
previous reference to U.S. persons, permanent residents, and protected 
individuals has been eliminated in favor of a reference to a person 
``who is not a foreign person'' for reasons of clarity and brevity. The 
EAR contain three definitions of ``U.S. person,'' only one of which is 
applicable to this section. Additionally, the ITAR use the term 
``foreign person,'' and a comment from a BIS technical advisory 
committee recommended adopting the term in the EAR. ``Foreign person'' 
accordingly is defined in a new entry in Sec.  772.1.
    The change creates a structure parallel to that which is being 
adopted in the State rule published concurrently with this final rule, 
and to make clear that transmission from one U.S. person in the United 
States to another, regardless of the means or route of the 
transmission, does not constitute an export. Along the same lines, 
paragraph (a)(3) is added to clarify that the transmission between or 
among U.S. persons within the same foreign country similarly does not 
constitute an export, reexport, or transfer. The State June 3 rule 
received comments recommending these revisions, and this final rule 
adopts them in the EAR to stay parallel with the ITAR text.
    Proposed paragraph (a)(3) in the June 3 rule contained text from 
Sec.  734.2(b)(8) stating that shipments between or among the states or 
possessions of the United States are not ``exports'' or ``reexports.'' 
The words ``moving'' and ``transferring'' were inserted next to 
``shipment'' in order to avoid suggesting that the only way movement 
between or among the states or possessions would not be a controlled 
event was if they were ``shipped.'' BIS received no comments on this 
paragraph and adopts it in this final rule, renumbered as paragraph 
(a)(4).
    Paragraph (a)(5)--numbered (a)(4) in the June 3 proposed rule--
provides that technology and software that is encrypted in accordance 
with certain

[[Page 35594]]

specified criteria are not exports, reexports, or transfers even when 
they leave one country for another. In the June 3 proposed rule, this 
paragraph specifically excluded from this carve-out technology and 
software stored in countries in Country Group D:5 and Russia, for 
foreign policy reasons. In response to comments pointing out that 
Internet traffic in transit across D:5 countries and Russia may be 
technically ``stored'' temporarily on servers located in these 
countries without the knowledge of the sender, BIS has added text in 
(a)(5) specifying that the carve-out continues to apply to technology 
not authorized under the EAR for storage in these countries or intended 
for storage in these countries. Encrypted data may not be stored in 
these countries unless an appropriate authorization is available or has 
been approved. BIS has also added a note clarifying that data in-
transit via the Internet is not deemed to be stored. For a more 
complete understanding of Sec.  734.18(a)(5), see the discussion above 
of Sec.  734.15(b).
    BIS received many comments on the proposed definition of ``end-to-
end encryption,'' the presence of which is a condition of the export 
control carve-out for technology and software. Commenters observed that 
encryption and decryption services may be provided within defined 
security boundaries by organizational rather than personal systems or 
servers. BIS agrees that in such cases, the security objectives of the 
``end-to-end'' requirement in terms of eliminating access by third 
parties can still be met by expanding the definition of ``end-to-end'' 
to include transmissions between security boundaries.
    This approach has the added advantages of providing more 
flexibility and allowing the execution of shared services, such as 
virus scanning, that can enhance security. However, BIS has also 
specified that the ``security boundary'' must be in-country--that is, 
such boundaries cannot be defined as including infrastructure resources 
encompassing multiple countries. A consequence of this requirement is 
that data eligible for the carve-out must by definition be encrypted 
before crossing any national boundary and must remain encrypted at all 
times while being transmitted from one security boundary to another. 
This principle applies to transmissions within a cloud service 
infrastructure, where a transmission from one node or cloud 
infrastructure element to another could qualify for the carve-out 
provided that it was appropriately encrypted before any data crossed a 
national border.
    The June 3 proposed rule's definition of end-to-end encryption 
included a clause that specified that data not be decrypted at any 
point between the initiation of the transmission by the originator and 
its receipt by the intended recipient. The purpose of this requirement 
was to prevent unauthorized access to data in clear text by parties 
other than the originator (or the originator's company or organization) 
and the recipient, such as external service providers.
    Commenters pointed out that in many circumstances, companies and 
organizations encrypt and decrypt multiple times in the course of 
transmission between originator and recipient for technical reasons 
(for example, to initially establish communications with a VPN server 
and subsequently to transmit among servers) without release to any 
third party. As a result, the point-to-point requirement in the 
original proposal would impose an unnecessary and potentially 
disruptive burden on many encryption applications, in which data in 
clear text are never actually shared.
    To address this problem and more precisely describe BIS's original 
intent with the provision, BIS eliminated the statement in the end-to-
end definition specifying that exempted data must be encrypted by the 
originating party without decryption except by the intended recipient. 
This final rule adopts instead a requirement that the means of 
decryption may not be provided to any third party, thus permitting 
decryption and re-encryption within the security boundary of either the 
originator or recipient, provided that no third party (i.e., a party 
outside the security boundary) has the ability to access the data in 
clear text, and that no decryption takes place outside of the security 
boundaries of the originator and the recipient.
    The June 3 proposed rule's paragraph (4)(iii), which this final 
rule adopts in paragraph (5)(iii), described encryption standards that 
would qualify for the exemption. In the BIS proposed rule, use of 
encryption modules certified under the Federal Information Processing 
Standards Publication 140-2 (FIPS 140-2), supplemented by appropriate 
software implementation, cryptographic key management and other 
procedures or controls that are in accordance with guidance provided in 
current U.S. National Institute for Standards and Technology 
publications, would qualify as sufficient security.
    A number of commenters questioned the designation of the FIPS 140-2 
as an example of effective cryptography and thus a qualification for 
the control carve-out, preferring instead no reference to a standard, 
or a reference to any ``commercially reasonable'' standard.
    BIS rejects these suggestions. FIPS 140-2 is a well-understood 
cryptographic standard used for Federal Government procurement in the 
United States and Canada, as well as for many other uses, both in the 
U.S. and abroad. Citation of this standard provides a useful reference 
point for what the U.S. Federal Government considers effective 
encryption.
    The text adopted in this final rule allows for use of ``equally or 
more effective cryptographic means,'' meaning that alternative 
approaches are allowable provided that they work as well as or better 
than FIPS 140-2. In such cases, the exporter is responsible for 
ensuring that the alternative approaches work as well as or better than 
FIPS 140-2, regardless of common commercial practices.
    In the June 3 proposed rule, paragraph (c) confirmed that the mere 
ability to access ``technology'' or ``software'' while it is encrypted 
in a manner that satisfies the requirements in the section does not 
constitute the ``release'' or export of such ``technology'' or 
``software.'' This responds to a common industry question on the issue. 
This final rule adopts the proposed text with only a minor revision to 
correct a cross-reference.

Transfer of Access Information

    New Sec.  734.18(a)(5)(iii) excludes transfers of information 
encrypted to a particular standard as not being exports, reexports, or 
transfers and, thus, not subject to the EAR. Logically, providing keys 
or other information that would allow access to encrypted data 
exported, reexported, or released under this provision should be 
subject to controls much as the export, reexport, or transfer of the 
data itself. In the June 3 proposed rule, this concept was specifically 
addressed in proposed Sec.  734.13(a)(6) as part of the definition of 
``export.'' The June 3 rule also proposed adding a new paragraph (l) to 
Sec.  764.2 ``Violations'' providing that the unauthorized release of 
decryption keys or other information that would allow access to 
particular controlled technology or software would constitute a 
violation to the same extent as a violation in connection with the 
export of the underlying controlled ``technology'' or ``software.''
    Although recognizing the need to control the decryption of 
controlled technical data otherwise exempted by the encryption carve-
out, commenters noted that this construction might lead to the 
conclusion that keys and other

[[Page 35595]]

data permitting access might be controlled as separate stand-alone 
items, distinct from the underlying data that they could potentially 
release. This would pose problems with key and identity management, 
where such data are stored and transmitted separately. Controlling 
access information as a distinct item was not the intent of the 
proposal. As also discussed below with respect to the definition of 
``technology,'' one commenter stated that decryption keys and other 
such information are not technology and recommended moving the proposed 
paragraph (a)(5) text to the definition of ``release'' and control 
``accessing'' them. To address the concerns of such commenters, this 
final rule creates a new positive authorization requirement in a new 
Sec.  734.19, stating that ``[t]o the extent an authorization would be 
required to transfer ``technology'' or ``software,'' a comparable 
authorization is required to transfer access information if with 
``knowledge'' that such transfer would result in the release of such 
``technology'' or ``software'' without a required authorization.'' Five 
commenters found use of the term ``cause or permit'' inconsistent with 
BIS's principle of an export's occurring only when actual export or 
transfer takes place. This final rule replaces the former reference to 
``cause or permit'' with ``result in.''
    One commenter requested ``the removal of Sec.  764.2(l) in its 
entirety as the current language of Sec.  764.2 is adequate.'' With 
creation of new Sec.  734.19, and in light of the availability of Sec.  
764.2 to punish any violation of Sec.  734.19, BIS accepts this comment 
and does not adopt the proposed Sec.  764.2(l) in this final rule.
    To simplify this section, proposed references to ``decryption keys, 
network access codes, passwords and other information,'' are replaced 
with a new Sec.  772.1 definition of ``access information,'' which uses 
these as examples only of information that allows access to encrypted 
technology or encrypted software in an unencrypted format. In response 
to a commenter's request for a definition of ``clear text,'' this final 
rule replaces references to ``clear text'' with ``in an unencrypted 
form,'' as part of the definition of ``access information.''
    References in the June 3 proposed rule to what is termed ``access 
information'' in this final rule (e.g., references to decryption keys) 
were eliminated in the Sec.  772.1 definition of ``technology,'' the 
Sec.  734.13 definition of export, and the Sec.  734.14 definition of 
reexport.

Activities That Are Not Deemed Reexports

    The June 3 proposed rule created a new Sec.  734.20, Activities 
that are not Deemed Reexports. This section codified BIS's interagency-
cleared Deemed Reexport Guidance previously posted on the BIS Web site 
and dated October 31, 2013. This guidance was created so that the 
provisions regarding possible deemed reexports contained in Sec. Sec.  
124.16 and 126.18 of the ITAR would be available for EAR technology and 
source code in addition to legacy BIS guidance on the topic.
    Under BIS's legacy guidance and new Sec.  734.20, release of 
technology or source code by an entity outside the United States to a 
foreign national of a country other than the foreign country where the 
release takes place does not constitute a deemed reexport of such 
technology or source code if the entity is authorized to receive the 
technology or source code at issue, whether by a license, license 
exception, or in situations where no license is required under the EAR 
for such technology or source code and the foreign national's most 
recent country of citizenship or permanent residency is that of a 
country to which export from the United States of the technology or 
source code at issue would be authorized by the EAR either under a 
license exception, or in situations where no license under the EAR 
would be required.
    Release of technology or source code by an entity outside the 
United States to a foreign national of a country other than the foreign 
country where the release takes place also does not constitute a deemed 
reexport if: (i) The entity is authorized to receive the technology or 
source code at issue, whether by a license, license exception, or 
through situations where no license is required under the EAR; (ii) the 
foreign national is a bona fide regular and permanent employee (who is 
not a proscribed person) of the entity; (iii) such employee is a 
national exclusively of a country in Country Group A:5; and (iv) the 
release of technology or source code takes place entirely within the 
physical territory of any such country, or within the United States.
    For nationals other than those of Country Group A:5 countries, 
which are close military allies of the United States, other criteria 
may apply. In particular, the section specifies the situations in which 
the releases would not constitute deemed exports in a manner consistent 
with Sec.  126.18 of the ITAR. For purposes of this section, 
``substantive contacts'' has the same meaning as it has in Sec.  126.18 
of the ITAR. The proposed phrase ``permanent and regular employee'' was 
a combination of BIS's definition of ``permanent employee,'' as set 
forth in a BIS advisory opinion issued on November 19, 2007 (available 
on the BIS Web site), and the ITAR's definition of ``regular employee'' 
in Sec.  120.39. The June 3 proposed rule added specific text excluding 
persons proscribed under U.S. law to make clear that Sec.  734.20 does 
not authorize release of technology to persons proscribed under U.S. 
law, and defined ``proscribed person'' in Sec.  772.1. (Note: The U.S.-
U.K. Exchange of Notes and U.S.-Canadian Exchange of Letters referred 
to in the existing online guidance can be found on the State 
Department's Web site. The URLs for the letters are not being published 
in the EAR because URL addresses periodically change. BIS will place 
the URL references in an ``FAQ'' section of its Web site.)
    One commenter stated that due to the number of conditions contained 
in these provisions, this section should be a license exception. BIS 
does not agree. Many if not most of the transactions to which these 
provisions apply are already covered by a license or a license 
exception; this section will generally allow affected entities to 
comply with the terms of those authorizations in a rational way that 
will meet U.S. control objectives while minimizing conflict with non-
U.S. entities' domestic requirements.
    Two commenters requested that BIS replace ``is certain'' of a 
foreign person's most recent country of citizenship or permanent 
residency with ``has knowledge,'' to address concerns about ability to 
comply with such a standard. BIS agrees with this comment and adopts 
``has 'knowledge''' in this final rule.
    One commenter requested that BIS add ``or within the physical 
territory of the United States'' to certain provisions to account for 
the possibility of releases in the United States, because often 
``release of U.S.-origin technology or software could be said to take 
place partially within the United States and partially within the 
country in which the foreign person employee is located;'' BIS accepts 
this request. Another commenter requested that for releases to A:5 
nationals, BIS ``also include countries where the entity conducts 
official business or operates, which is part of Sec.  734.20(c) Release 
to other than A:5 nationals.'' BIS did not adopt this request because 
it would expand the provision too broadly.
    Two commenters requested that BIS cross reference the ``deemed 
reexport'' definition in Sec.  734.14(b). BIS accepts this request. One 
commenter asked BIS

[[Page 35596]]

to clarify that this section addresses non-U.S. entities. BIS believes 
that this is clear from context and is thus not changing the rule in 
response to this comment. However, BIS is including a description of 
the purpose of this section in its FAQs.
    Two commenters objected to the requirement that employees must be 
engaged for a year to be eligible for these provisions and asked that 
it be removed. Additionally, two commenters objected to the associated 
screening and recordkeeping requirements and asked that they be 
reduced. BIS does not accept these comments. The year-long period and 
the screening and recordkeeping requirements reduce the risk of 
diversion associated with the technology release.

Questions and Answers--Technology and Software Subject to the EAR

    The June 3 proposed rule removed Supplement No. 1 to part 734, 
``Questions and Answers--Technology and Software Subject to the EAR'' 
on the basis that the questions and answers are illustrative rather 
than regulatory, and are therefore more appropriately posted as Web 
site guidance than included in the EAR. BIS specifically solicited 
comments on whether the questions and answers in existing Supplement 
No. 1 to part 734 proposed to be removed have criteria that should be 
retained in part 734.
    Thirty commenters stated that BIS should not remove the questions 
and answers from the EAR. Reasons cited for opposing removal of the 
supplement included that the questions and answers will not have the 
same weight on the BIS Web site as they do in the EAR; that they are 
legally binding in the EAR; that their removal will create uncertainty; 
that their presence in EAR lessens the likelihood that interpretations 
will change outside the rulemaking process and promotes consistency of 
interpretation; and that other supplements contain regulatory 
information. One of these comments went on to say, ``Accordingly, 
Supplement No. 1 must not be removed unless all its substantive 
provisions are adequately incorporated into Part 734 or elsewhere in 
the regulations'' (emphasis supplied). BIS believes that the adequate 
incorporation of substantive provisions is the key point behind the 
comments. This concern drove the specific solicitation in the June 3 
rule to identify criteria in the Supplement that should be retained in 
part 734. None of the thirty comments opposing removal of this 
Supplement from the EAR identified any substantive provisions that were 
not adequately incorporated into part 734 or elsewhere in the EAR. BIS 
is publishing on its Web site FAQs that will cover the same guidance 
that was found in Supplement No. 1, in addition to answers to other 
questions generated by the public comments to the proposed rule. 
Questions regarding how regulations apply to specific fact patterns are 
better set out in FAQs. In sum, although Supplement No. 1 will no 
longer be in the EAR, all its content will be placed into FAQs on BIS's 
Web site in addition to the other FAQs referred to in this preamble.

Technology

    In the June 3 proposed rule, paragraph (a)(1) of the definition of 
technology reads as follows: ``Information necessary for the 
``development,'' ``production,'' ``use,'' operation, installation, 
maintenance, repair, overhaul, or refurbishing (or other terms 
specified in ECCNs on the CCL that control ``technology'') of an item. 
``Technology'' may be in any tangible or intangible form, such as 
written or oral communications, blueprints, drawings, photographs, 
plans, diagrams, models, formulae, tables, engineering designs and 
specifications, computer-aided design files, manuals or documentation, 
electronic media or information gleaned through visual inspection.''
    A note addressed modification of items. Proposed paragraphs (a)(2) 
through (a)(4) of the definition were held in reserve to allow for the 
eventual mirroring of the corresponding ITAR paragraph structure while 
not including provisions that were not relevant to the EAR. Proposed 
paragraph (a)(5) described access information. Proposed paragraph (b) 
described exclusions from the definition of technology.

Required vs. Necessary

    For the definition of ``technology,'' four commenters recommended 
that ``necessary'' be revised to read ``required'' to match the 
proposed ITAR definition. BIS does not adopt these recommendations. 
``Required'' is a defined term that describes certain technology on the 
Commerce Control List, and not all technology that is subject to the 
EAR is controlled on the Commerce Control List. One commenter 
recommended restoring a note from the definition that existed in the 
EAR prior to publication of this rule, to the effect that technology 
not elsewhere specified on the Commerce Control List is designated as 
EAR99 unless it is not subject to the EAR. BIS does not accept this 
recommendation in this final rule because a regulatory change is not 
required to make the same point. BIS will, however, add an FAQ stating 
that ``technology'' subject to the EAR and that is not described on the 
CCL is designated EAR99. One commenter recommended including a note 
that refers to the General Technology Note. BIS accepts this comment 
and includes the reference in this final rule.

``Use'' Elements

    As explained in the preamble to the June 3 rule, the proposed 
definition of ``technology'' was based on the Wassenaar Arrangement 
definition of technology, including the Wassenaar-defined sub-
definitions of ``development,'' ``production,'' and ``use,'' which are 
currently defined in Sec.  772.1. (No changes were proposed to the 
definitions of ``development,'' ``production,'' and ``use'' in the June 
3 rule, and none are made in this final rule.) The June 3 rule proposed 
no change to BIS's long-standing policy that all six activities in the 
definition of ``use'' (operation, installation (including on-site 
installation), maintenance (checking), repair, overhaul and 
refurbishing) must be present for an item to be classified under an 
ECCN paragraph that uses ``use'' to describe the ``technology'' 
controlled. (See 71 FR 30842, May 31, 2006.) Drawing from this existing 
framework, the proposed definition of ``technology'' included the terms 
``operation, installation, maintenance, repair, overhaul, or 
refurbishing (or other terms specified in ECCNs on the CCL that control 
`technology') of an item'' because such words are used to describe 
technology controlled in multiple ECCNs, often with ``or'' rather than 
the ``and'' found in ``use.''
    One commenter recommended inserting a Note in the definition of 
technology that states the BIS policy that all six elements are 
necessary for ``use'' technology. BIS does not adopt this 
recommendation in this final rule because the definition of ``use'' 
links the six elements with the conjunctive ``and'' rather than the 
disjunctive ``or.'' BIS nonetheless makes this point in an FAQ 
pertaining to the word ``use'' in the definition of ``technology.'' One 
commenter recommended removing the term ``installation'' from the 
definition based on its use in the context of the definition of defense 
services. BIS does not accept this comment. Many entries on the 
Commerce Control List explicitly control installation technology, and 
it is also an element of ``use'' technology. Three commenters 
recommended that BIS remove the separate listing of the six ``use'' 
elements or limit them to control of 600 series items. BIS does not 
accept these recommendations. The six elements may be listed separately 
in

[[Page 35597]]

entries on the Commerce Control List and are not limited to 600 series 
entries.

Information Gleaned Through Visual Inspection

    One commenter suggested dropping ``or information gleaned through 
visual inspection'' because it was a form or method of transfer, not 
what constitutes technology. BIS adopts the recommendation in this 
comment in part. ``Information gleaned through visual inspection'' is 
an example of a form of technology, with visual inspection as the 
method of transfer. The list to which this example belongs, however, 
illustrates rather than defines ``technology;'' therefore, BIS adopts 
the text as Note 1 to the definition of ``technology'' in this final 
rule, limiting the definition to what constitutes technology and 
illustrating the forms in a note.
    Another commenter suggested using ``revealed'' instead of 
``gleaned,'' first to align with ``release,'' and second, because ``use 
of the term `glean' implies the value of the information is based on 
the capability of the viewer, which is unknowable and unquantifiable. 
The use of the term `reveal' is a more objective measure of what is 
provided by the visual inspection.'' BIS agrees and has adopted the 
term ``revealed'' in this final rule.

Modification Note

    The June 3 rule proposed adding a note to address a common industry 
question about modification. The note read as follows: ``The 
modification of an existing item creates a new item and technology for 
the modification is technical data for the development of the new 
item.''
    Three commenters suggested revisions to this note. Two commenters 
described the note as overbroad or confusing. One commenter recommended 
adding ``production'' as well as ``development.'' In this final rule, 
BIS has adopted a revision that clarifies and narrows the description 
of the technology for modification, and includes ``production'' 
technology. The revised note reads as follows: ``The modification of 
the design of an existing item creates a new item and technology for 
the modified design is technology for the development or production of 
the new item.'' BIS created this note to address the fact that multiple 
variations of a product are usually created by one or more companies, 
and companies often struggle with how to classify the technology that 
is and is not common to the variations. Consider, for example, a 
company that makes a 9A991.d civil aircraft switch. It later modifies 
the switch so that it would work in a military aircraft. The modified 
switch--the ``dash one'' model--is, in this example, specially designed 
for a military aircraft and thus controlled under ECCN 9A610.x. The 
technology that is common to both switches is 9E991, but the additional 
or different technology to make the 9A610.x switch is controlled under 
9E610. That is, the technology additional or different that is required 
to make the 9A991.d commercial aircraft switch into a 9A610.x switch is 
the technology for the new, modified item. This example is contained in 
an FAQ posted on the BIS Web site.

Decryption Keys

    One commenter stated that decryption keys and other such 
information are not technology and recommended moving the proposed 
paragraph (a)(5) text to the definition of ``release'' and control 
``accessing'' them. Another commenter pointed out that keys may also be 
hardware or software. BIS agrees with these comments; therefore, BIS 
does not adopt proposed paragraph (a)(5) in this final rule and adds 
text to the definition of ``release'' regarding transfer of ``access 
information'' (see also discussion above).

Exclusions

    The June 3 rule proposed adding three exclusions to clarify the 
limits of the scope of the definition of ``technology:'' non-
proprietary general system descriptions; information on basic function 
or purpose of an item; and telemetry data as defined in note 2 to 
Category 9, Product Group E (see Supplement No. 1 to Part 774 of the 
EAR).
    The first two exclusions paralleled exclusions in the ITAR and the 
third, the exclusion of telemetry data, mirrored specific exclusions 
added to both the ITAR and the EAR as part of recent changes regarding 
the scope of U.S. export controls pertaining to satellites and related 
items. See 79 FR 27417 (May 13, 2014).
    One commenter recommended excluding Build/Design-to-Specifications 
from the definition of technology and adding sub-definitions of 
different forms of technology. BIS does not accept this recommendation 
in this final rule because such specifications are not always outside 
the scope of the EAR's definition of ``development'' or ``production'' 
technology. However, BIS will incorporate information on this topic 
into its FAQs. Five commenters objected to use of the term ``non-
proprietary,'' arguing that certain proprietary system descriptions 
should not be subject to the EAR. One commenter thought that the term 
``systems'' was too narrow. BIS did not adopt these recommendations. 
Whether a particular technology is one that the possessor would readily 
share with competitors provides a fairly reliable test of whether that 
technology is subject to the EAR. With respect to the breadth of the 
term ``system,'' BIS notes that this exclusion is not the only 
provision in the EAR under which technology may be determined to be not 
subject. BIS did remove the modifier ``general,'' because of its 
potential to be ambiguous and subjective. BIS also did not adopt in 
this final rule the exclusion for ``information on basic function or 
purpose of an item,'' because the phrase was too vague and 
substantively already addressed by other provisions.
    One commenter questioned the scope of these exclusions from the 
definition of technology and another questioned how the exclusions from 
the definition should be read in conjunction with the provisions in the 
Scope part that make items not subject to the EAR. Based on these 
comments, and as noted earlier in the preamble to this final rule, the 
exclusion of ``information on basic function or purpose of an item'' is 
not adopted and the remaining two exclusions are moved from the 
definition of technology to Sec.  734.3(b)(3).

Required

    The June 3 proposed rule retained the existing EAR definition of 
``required'' in Sec.  772.1, but added notes clarifying the application 
of the term. It removed parenthetical references in the existing 
definition to CCL Categories 4, 5, 6, and 9 to avoid the suggestion 
that BIS applies the definition of ``required'' only to the uses of the 
term in these categories. BIS has never had a separate definition of 
``required'' used elsewhere in the EAR, and this removal merely 
eliminated a potential ambiguity and reflects long-standing BIS policy 
that ``required'' applies generally to ``technology'' entries on the 
CCL. (See, e.g., the Advisory Opinion dated December 27, 2010 on the 
BIS Web site.) BIS received one comment praising the removal of the 
references and none objecting to it; the revision is adopted in this 
final rule. The definition of ``required'' contained an illustrative 
example. BIS did not propose any revisions to this example in the June 
3 rule. In this final rule, however, BIS revises the example to make 
clear that technology that is peculiarly responsible for the 
characteristics of the item that make it controlled is thus 
``required'' technology. This subtle change thus responds to the 
question of which

[[Page 35598]]

technology is ``peculiarly responsible'' but without changing the well-
established definition of ``required'' that is central to the scope of 
the technology and software controls in the EAR. This revision also 
addresses issues raised by commenters, discussed more fully below, with 
respect to the proposed definition of ``peculiarly responsible.''
    To address common questions BIS has received regarding the meaning 
of the word ``required,'' the June 3 rule proposed adding two notes. 
The first stated that the references to ``characteristics'' and 
``functions'' are not limited to entries on the CCL that use specific 
technical parameters to describe the scope of what is controlled. The 
``characteristics'' and ``functions'' of an item listed are, absent a 
specific regulatory definition, a standard dictionary's definition of 
the item. The first note also included examples of this point. The 
second note referred to the fact that the ITAR and the EAR often divide 
within each set of regulations or between each set of regulations (a) 
controls on parts, components, accessories, attachments, and software 
and (b) controls on the end items, systems, equipment, or other 
articles into which those parts, components, accessories, attachments, 
and software are to be installed or incorporated. The note also 
referred to jurisdiction over technology. The public comments on these 
parts of the notes were favorable and the first note is included in 
this final rule without modification, except that it is now designated 
as Note 2 to the definition of ``required.'' The second note is split 
into Notes 1 and 3 to the definition of ``required,'' and the text is 
modified from the June 3 proposal as discussed below.
    A core tenet of ECR is that the jurisdictional status of the 
technical data/technology for an article that moves from the USML to 
the EAR follows the article. BIS and DDTC recognize the need to clarify 
the jurisdictional line for such technical data/technology. To help 
those making jurisdictional self-determinations for technical data/
technology pertaining to articles affected by the reform effort, BIS 
and DDTC had proposed in their respective June 3 rules common 
definitions of ``required'' and ``peculiarly responsible'' so that the 
regulatory line between technical data subject to the ITAR and 
technology subject to the EAR would be bright. Based on a review of the 
comments, BIS and DDTC have, however, decided not to publish their 
proposed common definitions of ``required'' and ``peculiarly 
responsible.'' (See discussion of the public comments on ``peculiarly 
responsible'' below.) Rather, DDTC and BIS have determined that a 
better way for the ITAR to address this bright-line objective is for 
DDTC to publish, and get public comments on, a proposed definition of 
``directly related'' that will eventually lead to a final ITAR 
definition acceptable to both DDTC and BIS. The reason for this 
approach is that, with the exception of technical data specifically 
enumerated on the USML, technical data is subject to the ITAR only if 
it is ``directly related'' to a defense article. This means, by 
definition, that technology that is indirectly related to, or only 
``related to,'' a defense article, such as by merely being capable for 
use with, used in connection with, or somehow having something 
generally to do with the eventual functioning of a defense article, is 
not subject to the ITAR and is, thus, subject to the EAR. For example, 
technology required for the production of a 9A610.x aircraft 
component--which, by definition, means that that it is specially 
designed for a USML VIII(a) aircraft--does not become subject to the 
ITAR merely because it generally relates to a defense article by virtue 
of being a component that will be or is integrated into and necessary 
for the functioning of the aircraft subject to the ITAR. It is 
technology required for the aircraft component subject to the EAR, not 
the whole of the USML aircraft or another defense article, and thus 
subject to the EAR. On the other hand, technical data that is directly 
related to the production of a component subject to the ITAR does not 
become subject to the EAR merely because, for example, it is developed 
or manufactured with equipment subject to the EAR.
    Wanting to nonetheless respond to the comments seeking guidance 
regarding the jurisdictional status of technology pertaining to items 
that have moved to the CCL from the USML and to further advance the 
effort of creating a truly bright line jurisdictional rule, BIS is 
publishing with this rule as a third note to ``required'' its guidance 
on the topic because the meaning of ``required'' is central to such 
determinations. Specifically, unclassified technology not specifically 
enumerated on the USML is ``subject to the EAR'' if it is ``required'' 
for the ``development,'' ``production,'' ``use,'' operation, 
installation, maintenance, repair, overhaul, or refurbishing (or other 
terms specified in ECCNs on the CCL that control ``technology'') of a 
commodity or software that is ``subject to the EAR.'' If such 
information is technical data that is not ``required'' for an item 
subject to the EAR and directly related to a defense article, then it 
is subject to the ITAR. If the application of industry-standard or 
dictionary definitions of ``directly related'' does not resolve doubts 
about whether any unit of technical data is, as a matter of law, 
``directly related'' (as opposed to indirectly related) to a defense 
article, one should contact DDTC for resolution of the doubt through 
established procedures in the ITAR's Part 120.

Peculiarly Responsible

    In the June 3 rule, BIS proposed a definition of the term 
``peculiarly responsible'' that was modeled on the catch-and-release 
structure BIS adopted for the definition of ``specially designed.'' 
Thus, under the proposed definition, an item was ``peculiarly 
responsible'' for achieving or exceeding any referenced controlled 
performance levels, characteristics, or functions if it was used in 
``development,'' ``production,'' ``use,'' operation, installation, 
maintenance, repair, overhaul, or refurbishing of an item subject to 
the EAR unless (a) the Department of Commerce had determined otherwise 
in a commodity classification determination, (b) the item was identical 
to information used in or with a commodity or software that was or had 
been in production and was EAR99 or described in an ECCN controlled 
only for Anti-Terrorism (AT) reasons, (c) the item had been or was 
being developed for use in or with general purpose commodities or 
software, or (d) the item had been or was being developed with 
``knowledge'' that it would be for use in or with commodities or 
software described (i) in an ECCN controlled for AT-only reasons and 
also EAR99 commodities or software or (ii) exclusively for use in or 
with EAR99 commodities or software.
    BIS specifically solicited comments on whether the proposed 
definition of ``peculiarly responsible'' effectively explained how 
items may be ``required'' or ``specially designed'' for particular 
functions. Two commenters offered support for the definition but still 
suggested revisions. Twelve additional commenters objected to the 
definition, describing it as confusing and stating that it dramatically 
expanded the scope of control beyond the existing ``required'' 
technology definition. BIS agrees with these comments and does not 
adopt the proposed definition of ``peculiarly responsible'' in this 
final rule. As described above, in this final rule, peculiarly 
responsible is defined within the scope of the already existing 
definition of required, thus providing a definition while guaranteeing 
no expansion of scope.

[[Page 35599]]

Temporary Export of Technology

    The June 3 proposed rule included amended text in the temporary 
export of technology provisions of License Exception TMP by revising 
Sec.  740.9(a)(3) to clarify that the ``U.S. employer'' and ``U.S. 
persons or their employees'' using this license exception are not 
foreign subsidiaries. The proposed paragraph streamlined current text 
without changing the scope. In this final rule, BIS substitutes 
``foreign person'' for ``foreign national'' in this section for reasons 
discussed elsewhere in this preamble, except where ``natural person'' 
was meant and BIS substituted ``individual'' for clarity (and in so 
doing responded to a comment on including foreign nationals in 
paragraph (a)(3)(iii)). BIS also added authority to reexport or 
transfer (in-country) to the authority to export; the absence of these 
terms from the June 3 proposed rule was an oversight.
    One commenter stated that BIS should provide for use of this 
license exception by non-U.S. persons. Another commenter recommended 
that BIS expand the scope of the license exception to include foreign 
subsidiaries and affiliates. BIS does not adopt these recommendations. 
Because of the risks associated with securing temporary exports of 
technology, BIS is not broadening the provisions for foreign persons 
beyond those employed by U.S. companies or to allow use by foreign 
companies.
    BIS received two comments on the recordkeeping provision in 
paragraph (a)(3)(v), with one requesting that it be clarified and one 
requesting that it be removed in view of the existing broad 
recordkeeping requirements in the EAR. BIS agrees with these comments 
and does not adopt the recordkeeping provision in this final rule.
    One commenter asked BIS to clarify if TMP is available for remote 
access to U.S. servers. Another commenter asked BIS to clarify if 
taking an encrypted device is an export. BIS is not including these 
changes in regulatory text, because these are applications of the rule 
that are more appropriate to FAQs. However, BIS is confirming in its 
FAQs that TMP is available for remote access if its provisions are met. 
BIS is also confirming in its FAQs that taking an encrypted device is 
an export and referring to a different paragraph of Sec.  740.9 for 
authorizing export of devices. Devices are commodities and therefore 
not eligible for paragraph (a)(3), which authorizes only technology.
    One commenter recommended that BIS remove a requirement to encrypt 
the technology, saying that the list of techniques for securing the 
data required all to be used. BIS accepts this comment, and this final 
rule adds ``may'' before ``include'' to make clear that the list is 
illustrative. One commenter recommended allowing obfuscation/
tokenization to protect data. BIS agrees that done properly, this is an 
effective security measure, and will add an FAQ on the topic to its Web 
site.

Scope of a License

    The June 3 rule proposed implementing in the EAR the interagency-
agreed boilerplate notification for all licenses that was posted on the 
BIS Web site and began appearing on licenses December 8, 2014. It was a 
slight revision to the former Sec.  750.7(a), which stated that 
licenses authorize only the transaction(s) described in the license 
application and the license application support documents. The proposed 
revision also codified the existing interpretation that a license 
authorizing the release of technology to an entity also authorizes the 
release of the same technology to the entity's foreign nationals who 
are permanent and regular employees of the entity's facility or 
facilities authorized on the license, except to the extent a license 
condition limits or prohibits the release of the technology to 
nationals of specific countries or country groups.
    Two commenters requested that BIS drop the modifier ``permanent 
and'' from ``regular employees.'' BIS does not adopt this request due 
to risk of diversion associated with non-permanent and non-regular 
employees. See further discussion of this issue above with respect to 
activities that are not deemed reexports. The phrase ``under U.S. law'' 
that modified ``proscribed persons'' in the June 3 rule is not adopted 
in this final rule for reasons discussed in connection with the 
definition of ``proscribed persons'' below. Except for that change, 
this final rule adopts the text proposed in the June 3 rule.

Removals From and Additions to EAR's List of Definitions in Sec.  772.1

    This final rule creates stand-alone sections in the EAR to address 
the scope and meaning of ``publicly available information,'' ``publicly 
available technology and software,'' and ``technical data.'' To avoid 
redundancy, this rule removes those definitions from Sec.  772.1. In 
light of the changes described above, the definitions of ``export,'' 
``reexport,'' ``required,'' ``technology,'' and ``transfer'' are 
revised accordingly. A clarifying note is added at the bottom of the 
definition explaining that the use of ``transfer'' does not apply to 
the unrelated ``transfers of licenses'' provision in Sec.  750.10 or 
the antiboycott provisions in Supplement No. 8 to part 760 of the EAR. 
It also states that the term ``transfer'' may be included on licenses 
issued by BIS. In that regard, the changes that can be made to a BIS 
license are the non-material changes described in Sec.  750.7(c). Any 
other change to a BIS license without authorization is a violation of 
the EAR. See Sec. Sec.  750.7(c) and 764.2(e). Finally, consistent with 
the explanations above, definitions for the terms ``access 
information,'' ``foreign person,'' ``fundamental research,'' 
``proscribed person,'' ``publicly available encryption software,'' 
``published,'' and ``release'' are added to Sec.  772.1.
    One commenter stated that the definition of proscribed persons was 
overbroad, catching those individuals sanctioned under U.S. law without 
an export control nexus and recommended deleting ``under US law.'' BIS 
agrees with this comment. One commenter recommended striking 
``scientific'' from the definition of ``basic scientific research'' in 
part 772 and adding definitions of applied and fundamental research to 
part 772. BIS does not accept this recommendation. The definition of 
``basic scientific research'' reflects a Wassenaar Arrangement 
definition; it is retained in this final rule. A definition for applied 
research is not adopted because it is not necessary as a result of the 
adoption of a simplified definition of fundamental research, and as 
fundamental research is defined in Sec.  734.8, use of a cross 
reference in part 772 is appropriate.

Issues Raised by Public Comments That Are Outside the Scope of This 
Rule

    One commenter requested that BIS clarify treatment of U.S.-origin 
chemical materials that are substantially transformed and exempt Japan 
and other like-minded countries from reexport controls. One commenter 
requested that BIS expand controls on missile production and drop Fiji 
from Country Group D:5. One commenter appended comments on a separate 
BIS proposed rule for which the comment period was already closed. One 
commenter stated that items classified under Export Control 
Classification Number 0A998 will no longer be subject to the EAR under 
the new note to Sec.  734.3(b)(3). One commenter requested that BIS 
drop the term ``serial'' from the definition of ``production,'' which 
was not revised by this rule. Although these comments are outside the 
scope of this rule and thus not addressed in this notice, BIS 
nonetheless encourages the

[[Page 35600]]

public to submit thoughts, suggestions, and comments to BIS about the 
EAR and the export control system. BIS cannot commit to addressing them 
in every case, but nonetheless encourages as much industry 
participation as possible in the development and drafting of the 
regulations.

Export Administration Act

    Since August 21, 2001, the Export Administration Act of 1979, as 
amended, has been in lapse. However, the President, through Executive 
Order 13222 of August 17, 2001, 3 CFR, 2001 Comp., p. 783 (2002), as 
amended by Executive Order 13637 of March 8, 2013, 78 FR 16129 (March 
13, 2013), and as extended by the Notice of August 7, 2015 (80 FR 48233 
(Aug. 11, 2015) has continued the EAR in effect under the International 
Emergency Economic Powers Act (50 U.S.C. 1701 et seq.). BIS continues 
to carry out the provisions of the Export Administration Act, as 
appropriate and to the extent permitted by law, pursuant to Executive 
Order 13222 as amended by Executive Order 13637.

Regulatory Requirements

    1. Executive Orders 13563 and 12866 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distribute impacts, and equity). Executive 
Order 13563 emphasizes the importance of quantifying both costs and 
benefits, of reducing costs, of harmonizing rules, and of promoting 
flexibility. This final rule has been designated a ``significant 
regulatory action,'' although not economically significant, under 
section 3(f) of Executive Order 12866. Accordingly, this final rule has 
been reviewed by the Office of Management and Budget (OMB).
    2. This final rule does not contain information collections subject 
to the requirements of the Paperwork Reduction Act of 1995 (44 U.S.C. 
3501 et seq.) (PRA). Notwithstanding any other provision of law, no 
person is required to respond to, nor is subject to a penalty for 
failure to comply with, a collection of information, subject to the 
requirements of the PRA, unless that collection of information displays 
a currently valid OMB control number.
    3. This final rule does not contain policies with Federalism 
implications as that term is defined under E.O. 13132.
    4. Pursuant to the Regulatory Flexibility Act, as amended by the 
Small Business Regulatory Enforcement Fairness Act of 1996, 5 U.S.C. 
601 et seq., BIS has prepared the following final Regulatory 
Flexibility Act analysis of the impact that this final rule will have 
on small entities.

Statement of the Objectives of, and Legal Basis for, the Final Rule; 
Identification of All Relevant Federal Rules Which May Duplicate, 
Overlap, or Conflict With the Final Rule

    The objective of this final rule (and a final rule being published 
simultaneously by the Department of State) is to provide greater 
clarity and precision in the EAR and the ITAR by providing, where 
warranted and possible, common definitions and common terms to regulate 
the same types of actions and issues. This final rule also seeks to 
express some concepts more clearly.
    The final rule alters definitions in the EAR. It also updates and 
clarifies application of controls to electronically transmitted 
technology and software.
    The legal basis for this proposed rule is 50 U.S.C. 4601 et seq.; 
50 U.S.C. 1701 et seq.; E.O. 12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 
950; E.O. 13020, 61 FR 54079, 3 CFR, 1996 Comp., p. 219; E.O. 13026, 61 
FR 58767, 3 CFR, 1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 
2001 Comp., p. 783; E.O. 13637, 78 FR 16129, 3 CFR, 2014 Comp., p. 223; 
Notice of August 7, 2015, 80 FR 48233 (August 11, 2015); Notice of 
November 12, 2015, 80 FR 70667 (November 13, 2015).
    No other Federal rules duplicate, overlap, or conflict with this 
final rule.

Comments in Response to the Initial Regulatory Flexibility Analysis

    BIS received one comment from the public in response to the Initial 
Regulatory Flexibility Analysis (IRFA). The comment stated that while 
the proposed regulatory text indicated that the extent to which release 
of access information could be a violation of the EAR was limited by 
whether the party acted with knowledge, text in the IRFA regarding the 
impact of this provision created tension by stating that other 
provisions in the EAR could be used to bring charges for that same type 
of misconduct. The comment requested that BIS provide clarification in 
the final rule. BIS addressed this comment by not adopting Sec.  
764.2(l), the provision that would have established the violation at 
issue in the final rule. The Chief Counsel for Advocacy of the Small 
Business Administration filed no comments in response to the proposed 
rule.

Number and Description of Small Entities to Which This Rule Will Apply

    This final rule will apply to all persons engaged in the export, 
reexport, or transfer of commodities, technology, or software subject 
to the EAR. BIS does not maintain data from which it can determine how 
many of those persons are small entities as identified in the Small 
Business Administration size standards. Nevertheless, BIS recognizes 
that some of those persons are likely to be small entities.

Description of the Projected Reporting, Recordkeeping, and Other 
Compliance Requirements of the Final Rule

    This final rule is unlikely to increase the number of transactions 
that must be reported to BIS because EAR reporting requirements apply 
only in five specific situations, none of which will change as a result 
of this final rule. Those situations are: Exports of items on the 
Wassenaar Arrangement Sensitive List that do not require a license; 
Exports of High Performance Computers; Exports of certain thermal 
imaging cameras that do not require a license; Certain exports of 
Conventional Arms; and 600 series major defense equipment. Because 
recordkeeping requirements already apply to all transactions that are 
subject to the EAR, BIS expects that this final rule will not expand 
recordkeeping requirements.
    It is possible that some of these changes will increase the number 
of licenses that some small entities will have to seek from BIS, 
although BIS is not aware of any specific instance in which additional 
licenses will be required.
    The following discussion describes the changes made by this final 
rule. It is divided into two sections: Changes that BIS believes will 
not impose any new regulatory obligations; and Changes that are not 
intended to imposed any new regulatory obligation, but that BIS cannot 
state with certainty will not do so.

Changes That BIS Believes Will Not Impose Any New Regulatory Burden

    This final rule makes certain changes to clarify and streamline the 
definitions of comparable terms, phrases, and concepts between the EAR 
and the ITAR. Many of these changes are technical in nature and attempt 
to consolidate and re-phrase the definitions to enhance readability and 
to parallel the structure of the ITAR's definition of the same term. 
There are a small number of new provisions, but these changes do not 
impose any new regulatory burdens. Specifically, this final rule makes 
the following changes:

[[Page 35601]]

    Removes Sec.  734.2(b) which formerly defined export, reexport, 
release, transfer (in country) and export of encryption source code or 
object code software, because those terms are defined in separate 
sections. Section 734.2(b) also stated the policy of applying license 
requirements that apply to a country to its dependencies and 
possessions; this policy is currently stated elsewhere in the EAR.
    Creates new separate sections defining export, reexport, release 
and export of encryption source code or object code software. Those 
terms are clarified and presented in a more organized manner, but 
substantively unchanged from the former regulatory text.
    Creates a new section identifying activities that are not exports, 
reexports, or transfers. This section restates the transactions that 
are excluded from the definition of export in former regulatory text 
and adds two additional activities that are expressly declared not to 
be exports, reexports or transfers: Space launches; and sending, taking 
or storing certain technology or software abroad using specified 
cryptographic techniques. The former, although it was not included in 
past regulatory text, states an exclusion already set forth in a 
statute (see 51 U.S.C. 50919(f)) and is consistent with past BIS 
practice of not treating a space launch as an export, reexport or 
transfer. The latter is, in fact, new. However, by removing the 
transactions it describes from the definitions of exports, reexports, 
or transfers, it removes existing license requirements from those 
transactions.
    Clarifies without substantively changing the provisions related to 
patent applications and adds specific text stating that technology 
contained in a patent available from or at any patent office is not 
subject to the EAR. The addition reflects BIS's long-standing 
interpretation. To the extent that it could be characterized as new, 
its only effect would be to appear to release from the EAR technology 
that some readers of the EAR might have (erroneously) concluded was 
subject to the EAR.
    Adds text to License Exception TMP to emphasize that foreign 
subsidiaries of U.S. companies are neither U.S. employers nor ``U.S. 
persons or their employees'' as those terms are used in the license 
exception. This additional text adds no restriction that is not already 
imposed by the definition of ``U.S. persons'' that currently appears in 
the text of License Exception TMP.
    Adds text codifying in the EAR limits on transactions authorized by 
a license that currently are imposed by conditions on the license 
itself.
    Adds text specifying that to the extent an authorization would be 
required to transfer technology or software, a comparable authorization 
is required to transfer access information (e.g., decryption keys, 
network access codes, and passwords) with ``knowledge'' that such 
transfer would result in the unauthorized release of such technology or 
software.

Changes That Are Not Intended To Impose Any Regulatory Obligation, But 
That BIS Cannot State With Certainty Would Not Do So

    This final rule revises the definitions of the two existing terms 
``required'' and ``transfer (in-country).'' It also adopts BIS's 
interpretative guidance regarding deemed reexports as regulatory text. 
These changes are not intended to impose any regulatory obligations on 
regulated entities, but BIS cannot state with certainty that there will 
be no impact. This final rule makes the following changes:
    Adds to the EAR a definition of ``proscribed person.'' This 
definition does not create any new regulated class. It simply provides 
a clear, shorthand reference to a person who is already prohibited from 
receiving items or participating in a transaction that is subject to 
the EAR without authorization, such as persons on the Entity List.
    Removes from the definition of the term ``required'' references to 
CCL Categories 4, 5, 6 and 9 to accurately reflect BIS's long-standing 
interpretation that its definition applies wherever the EAR imposes a 
license requirement for technology ``required'' for a particular 
process or activity.
    In the definition of ``transfer (in-country),'' replaces the phrase 
``shipment, transmission, or release of items subject to the EAR from 
one person to another person that occurs outside the United States 
within a single foreign country'' with ``a change in end use or end 
user of an item within the same foreign country.'' This new text will 
parallel the term ``retransfer'' in the ITAR and will eliminate any 
potential ambiguity that a change in end use or end user within a 
foreign country is or is not a ``transfer (in-country).''
    Each of the foregoing changes serves the overall policy goals of 
reducing uncertainty and harmonizing, to the extent warranted and 
possible, the requirements of the ITAR and the EAR. In most instances, 
reduced uncertainty will be beneficial to persons who have to comply 
with the regulations, particularly persons who engage in transactions 
subject to both sets of regulations. They will be able to make 
decisions more quickly and have less need to contact BIS for advice. 
Additionally, by making these terms more explicit, the possibility of 
their being interpreted contrary to BIS's intent is reduced. Such 
contrary interpretations would have three undesirable effects. First, 
they would undermine the national security and foreign policy 
objectives that the EAR are intended to implement. Second, persons who 
are interpreting the regulations in a less restrictive manner than BIS 
intends may seek fewer licenses from BIS than their competitors who are 
interpreting the regulations consistent with BIS's intent or who are 
obtaining advice from BIS, thereby gaining a commercial advantage to 
the detriment of the relevant national security or foreign policy 
interests. Third, unnecessary regulatory complexity and unnecessary 
differences between the terminology of the ITAR and that of the EAR 
could discourage small entities from even attempting to export. The 
beneficial effects of making these terms more explicit justify the 
economic impact that might be incurred by small entities that will have 
to change their conduct because their contrary interpretations can no 
longer be relied on given the clearer and more explicit terms in the 
regulations.
    This final rule also adds to the EAR a description of activities 
that are not deemed reexports. This description formerly appeared as 
interpretative guidance on BIS's Web site and closely tracks the 
regulatory text of the ITAR. Deemed reexports are releases of 
technology or software source code within a single foreign country by a 
party located outside the United States to a national of a country 
other than the country in which the releasing party is located. The new 
section describes three situations in which that party may release the 
technology or source code without obtaining a license from BIS.
    By adopting this guidance as regulatory text that closely tracks 
the text governing the same activities in the ITAR, BIS reduces both 
complexity and unnecessary differences between the two sets of 
regulations with the salutary effects of faster decision making, 
reduced need to contact BIS for advice, and reduced possibility that 
small entities would be discouraged from exporting as noted above.

[[Page 35602]]

Description of Any Significant Alternatives to the Final Rule That 
Accomplish the Stated Objectives of Applicable Statutes and That 
Minimize Any Significant Economic Impact of the Final Rule on Small 
Entities

    As required by 5 U.S.C. 603(c), BIS's analysis considered 
significant alternatives. Those alternatives are: (1) The preferred 
alternative of altering definitions and updating and clarifying 
application of controls to electronically transmitted technology and 
software; (2) Maintaining the status quo and not revising the 
definitions or updating and clarifying application of controls to 
electronically transmitted technology and software; and (3) 
Establishing a size threshold below which entities would not be subject 
to the changes proposed by this rulemaking.
    By altering definitions and updating and clarifying application of 
controls to electronically transmitted technology and software as this 
final rule does, BIS reduces uncertainty for all parties engaged in 
transactions that are subject to the EAR. Potential ambiguities are 
reduced; decisions can be made more quickly; the need to contact BIS 
for advice is reduced; and the possibility of inconsistent 
interpretations providing one party commercial advantages over others 
is reduced. Persons (including small entities) engaged in transactions 
that are subject to the ITAR and transactions that are subject to the 
EAR face fewer actual or apparent inconsistencies that must be 
addressed in their regulatory compliance programs. Although small 
entities, along with all other parties, will need to become familiar 
with the revised terminology, in the long run, compliance costs are 
likely to be reduced when compared to the present situation where the 
ITAR and the EAR use different terminology to regulate the same types 
of activity in the same manner. Therefore, BIS adopted this 
alternative.
    If BIS had chosen to maintain the status quo, small entities and 
other parties would not have to incur the cost and effort of becoming 
familiar with the revised regulations, and any party who was 
interpreting the regulations in a way that would clearly be precluded 
by the more explicit interpretations would not incur the cost of 
complying with the regulations consistent with their underlying intent 
and in the way that BIS believes most regulated parties do. However, 
the benefits of these proposed changes would be lost. Those benefits, 
greater clarity, consistency between the ITAR and the EAR, and reduced 
possibility of inconsistent application of the regulations by similarly 
situated regulated parties, would be foregone. Therefore, BIS has not 
adopted this alternative.
    If BIS had chosen to create a size threshold exempting small 
entities as currently defined by the SBA size standards from the 
changes imposed by this final rule, those entities would face a more 
complicated regulatory environment than larger entities. The small 
entities would continue to be subject to the EAR as a whole but without 
the benefit of the clarifications introduced by this final rule. The 
only way to make a size threshold beneficial to entities falling below 
the threshold would be to exempt them from all or at least many of the 
requirements of the EAR. However, doing so would create a major 
loophole allowing commodities, software, and technology that are 
controlled for export for national security or foreign policy reasons 
to go, without restriction, to any party abroad, undermining the 
interests that the regulations are intended to protect. Therefore, BIS 
has not adopted this alternative.

List of Subjects

15 CFR Parts 734 and 772

    Exports.

15 CFR Parts 740 and 750

    Administrative practice and procedure, Exports, Reporting and 
recordkeeping requirements.

    For the reasons stated in the preamble, parts 734, 740, 750, and 
772 of the Export Administration Regulations (15 CFR subchapter C) are 
amended as follows:

PART 734--SCOPE OF THE EXPORT ADMINISTRATION REGULATIONS

0
1. The authority citation for part 734 continues to read as follows:

    Authority:  50 U.S.C. 4601 et seq.; 50 U.S.C. 1701 et seq.; E.O. 
12938, 59 FR 59099, 3 CFR, 1994 Comp., p. 950; E.O. 13020, 61 FR 
54079, 3 CFR, 1996 Comp., p. 219; E.O. 13026, 61 FR 58767, 3 CFR, 
1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 
783; E.O. 13637, 78 FR 16129, 3 CFR, 2014 Comp., p. 223; Notice of 
August 7, 2015, 80 FR 48233 (August 11, 2015); Notice of November 
12, 2015, 80 FR 70667 (November 13, 2015).

0
2. Section 734.2 is amended by revising the heading to read as follows 
and by removing and reserving paragraph (b).


Sec.  734.2  Subject to the EAR.

* * * * *

0
3. Section 734.3 is amended by revising paragraph (b) introductory 
text, paragraph (b)(3), the Note to paragraphs (b)(2) and (b)(3), and 
adding a Note to paragraph (b)(3) to read as follows.


Sec.  734.3  Items subject to the EAR.

* * * * *
    (b) The following are not subject to the EAR:
* * * * *
    (3) Information and ``software'' that:
    (i) Are published, as described in Sec.  734.7;
    (ii) Arise during, or result from, fundamental research, as 
described in Sec.  734.8;
    (iii) Are released by instruction in a catalog course or associated 
teaching laboratory of an academic institution;
    (iv) Appear in patents or open (published) patent applications 
available from or at any patent office, unless covered by an invention 
secrecy order, or are otherwise patent information as described in 
Sec.  734.10;
    (v) Are non-proprietary system descriptions; or
    (vi) Are telemetry data as defined in Note 2 to Category 9, Product 
Group E (see Supplement No. 1 to part 774 of the EAR).

    Note to paragraphs (b)(2) and (b)(3): A printed book or other 
printed material setting forth encryption source code is not itself 
subject to the EAR (see Sec.  734.3(b)(2)). However, notwithstanding 
Sec.  734.3(b)(2), encryption source code in electronic form or 
media (e.g., computer diskette or CD ROM) remains subject to the EAR 
(see Sec.  734.17)). Publicly available encryption object code 
``software'' classified under ECCN 5D002 is not subject to the EAR 
when the corresponding source code meets the criteria specified in 
Sec.  740.13(e) of the EAR.


    Note to paragraph (b)(3): Except as set forth in part 760 of 
this title, information that is not within the scope of the 
definition of ``technology'' (see Sec.  772.1 of the EAR) is not 
subject to the EAR.

* * * * *

0
4. Section 734.7 is revised to read as follows:


Sec.  734.7  Published.

    (a) Except as set forth in paragraph (b) of this section, 
unclassified ``technology'' or ``software'' is ``published,'' and is 
thus not ``technology'' or ``software'' subject to the EAR, when it has 
been made available to the public without restrictions upon its further 
dissemination such as through any of the following:
    (1) Subscriptions available without restriction to any individual 
who desires to obtain or purchase the published information;
    (2) Libraries or other public collections that are open and 
available

[[Page 35603]]

to the public, and from which the public can obtain tangible or 
intangible documents;
    (3) Unlimited distribution at a conference, meeting, seminar, trade 
show, or exhibition, generally accessible to the interested public;
    (4) Public dissemination (i.e., unlimited distribution) in any form 
(e.g., not necessarily in published form), including posting on the 
Internet on sites available to the public; or
    (5) Submission of a written composition, manuscript, presentation, 
computer-readable dataset, formula, imagery, algorithms, or some other 
representation of knowledge with the intention that such information 
will be made publicly available if accepted for publication or 
presentation:
    (i) To domestic or foreign co-authors, editors, or reviewers of 
journals, magazines, newspapers or trade publications;
    (ii) To researchers conducting fundamental research; or
    (iii) To organizers of open conferences or other open gatherings.
    (b) Published encryption software classified under ECCN 5D002 
remains subject to the EAR unless it is publicly available encryption 
object code software classified under ECCN 5D002 and the corresponding 
source code meets the criteria specified in Sec.  740.13(e) of the EAR.

0
5. Section 734.8 is revised to read as follows:


Sec.  734.8  ``Technology'' or ``software'' that arises during, or 
results from, fundamental research.

    (a) Fundamental research. ``Technology'' or ``software'' that 
arises during, or results from, fundamental research and is intended to 
be published is not subject to the EAR.

    Note 1 to paragraph (a): This paragraph does not apply to 
``technology'' or ``software'' subject to the EAR that is released 
to conduct fundamental research. (See Sec.  734.7(a)(5)(ii) for 
information released to researchers that is ``published.'')


    Note 2 to paragraph (a): There are instances in the conduct of 
research where a researcher, institution or company may decide to 
restrict or protect the release or publication of ``technology'' or 
``software'' contained in research results. Once a decision is made 
to maintain such ``technology'' or ``software'' as restricted or 
proprietary, the ``technology'' or ``software,'' if within the scope 
of Sec.  734.3(a), becomes subject to the EAR.

    (b) Prepublication review. ``Technology'' or ``software'' that 
arises during, or results, from fundamental research is intended to be 
published to the extent that the researchers are free to publish the 
``technology'' or ``software'' contained in the research without 
restriction. ``Technology'' or ``software'' that arises during or 
results from fundamental research subject to prepublication review is 
still intended to be published when:
    (1) Prepublication review is conducted solely to ensure that 
publication would not compromise patent rights, so long as the review 
causes no more than a temporary delay in publication of the research 
results;
    (2) Prepublication review is conducted by a sponsor of research 
solely to insure that the publication would not inadvertently divulge 
proprietary information that the sponsor has furnished to the 
researchers; or
    (3) With respect to research conducted by scientists or engineers 
working for a Federal agency or a Federally Funded Research and 
Development Center (FFRDC), the review is conducted within any 
appropriate system devised by the agency or the FFRDC to control the 
release of information by such scientists and engineers.

    Note 1 to paragraph (b): Although ``technology'' or ``software'' 
arising during or resulting from fundamental research is not 
considered intended to be published if researchers accept 
restrictions on its publication, such ``technology'' or ``software'' 
will nonetheless qualify as ``technology'' or ``software'' arising 
during or resulting from fundamental research once all such 
restrictions have expired or have been removed.


    Note 2 to paragraph (b):  Research that is voluntarily subjected 
to U.S. government prepublication review is considered ``intended to 
be published'' when the research is released consistent with the 
prepublication review and any resulting controls.


    Note 3 to paragraph (b): ``Technology'' or ``software'' 
resulting from U.S. government funded research that is subject to 
government-imposed access and dissemination or other specific 
national security controls qualifies as ``technology'' or 
``software'' resulting from fundamental research, provided that all 
government-imposed national security controls have been satisfied 
and the researchers are free to publish the ``technology'' or 
``software'' contained in the research without restriction. Examples 
of specific national security controls include requirements for 
prepublication review by the Government, with right to withhold 
permission for publication; restrictions on prepublication 
dissemination of information to non-U.S. citizens or other 
categories of persons; or restrictions on participation of non-U.S. 
citizens or other categories of persons in the research. A general 
reference to one or more export control laws or regulations or a 
general reminder that the Government retains the right to classify 
is not a specific national security control.

    (c) Fundamental research definition. Fundamental research means 
research in science, engineering, or mathematics, the results of which 
ordinarily are published and shared broadly within the research 
community, and for which the researchers have not accepted restrictions 
for proprietary or national security reasons.


Sec.  734.9--[Removed  and Reserved]

0
6. Section 734.9 is removed and reserved.

0
7. Section 734.10 is revised to read as follows:


Sec.  734.10  Patents.

    ``Technology'' is not subject to the EAR if it is contained in any 
of the following:
    (a) A patent or an open (published) patent application available 
from or at any patent office;
    (b) A published patent or patent application prepared wholly from 
foreign-origin ``technology'' where the application is being sent to 
the foreign inventor to be executed and returned to the United States 
for subsequent filing in the U.S. Patent and Trademark Office;
    (c) A patent application, or an amendment, modification, supplement 
or division of an application, and authorized for filing in a foreign 
country in accordance with the regulations of the Patent and Trademark 
Office, 37 CFR part 5; or
    (d) A patent application when sent to a foreign country before or 
within six months after the filing of a United States patent 
application for the purpose of obtaining the signature of an inventor 
who was in the United States when the invention was made or who is a 
co-inventor with a person residing in the United States.


Sec.  734.11--[Removed  and Reserved]

0
8. Section 734.11 is removed and reserved.

0
9. Section 734.13 is added to read as follows:


Sec.  734.13  Export.

    (a) Except as set forth in Sec. Sec.  734.17 or 734.18, Export 
means:
    (1) An actual shipment or transmission out of the United States, 
including the sending or taking of an item out of the United States, in 
any manner;
    (2) Releasing or otherwise transferring ``technology'' or source 
code (but not object code) to a foreign person in the United States (a 
``deemed export'');

[[Page 35604]]

    (3) Transferring by a person in the United States of registration, 
control, or ownership of:
    (i) A spacecraft subject to the EAR that is not eligible for export 
under License Exception STA (i.e., spacecraft that provide space-based 
logistics, assembly or servicing of any spacecraft) to a person in or a 
national of any other country; or
    (ii) Any other spacecraft subject to the EAR to a person in or a 
national of a Country Group D:5 country.
    (b) Any release in the United States of ``technology'' or source 
code to a foreign person is a deemed export to the foreign person's 
most recent country of citizenship or permanent residency.
    (c) The export of an item that will transit through a country or 
countries to a destination identified in the EAR is deemed to be an 
export to that destination.

0
10. Section 734.14 is added to read as follows:


Sec.  734.14  Reexport.

    (a) Except as set forth in Sec. Sec.  734.18 and 734.20, Reexport 
means:
    (1) An actual shipment or transmission of an item subject to the 
EAR from one foreign country to another foreign country, including the 
sending or taking of an item to or from such countries in any manner;
    (2) Releasing or otherwise transferring ``technology'' or source 
code subject to the EAR to a foreign person of a country other than the 
foreign country where the release or transfer takes place (a deemed 
reexport);
    (3) Transferring by a person outside the United States of 
registration, control, or ownership of:
    (i) A spacecraft subject to the EAR that is not eligible for 
reexport under License Exception STA (i.e., spacecraft that provide 
space-based logistics, assembly or servicing of any spacecraft) to a 
person in or a national of any other country; or
    (ii) Any other spacecraft subject to the EAR to a person in or a 
national of a Country Group D:5 country.
    (b) Any release outside of the United States of ``technology'' or 
source code subject to the EAR to a foreign person of another country 
is a deemed reexport to the foreign person's most recent country of 
citizenship or permanent residency, except as described in Sec.  
734.20.
    (c) The reexport of an item subject to the EAR that will transit 
through a country or countries to a destination identified in the EAR 
is deemed to be a reexport to that destination.

0
11. Section 734.15 is added to read as follows:


Sec.  734.15  Release.

    (a) Except as set forth in Sec.  734.18, ``technology'' and 
``software'' are ``released'' through:
    (1) Visual or other inspection by a foreign person of items that 
reveals ``technology'' or source code subject to the EAR to a foreign 
person; or
    (2) Oral or written exchanges with a foreign person of 
``technology'' or source code in the United States or abroad.
    (b) Any act causing the ``release'' of ``technology'' or 
``software,'' through use of ``access information'' or otherwise, to 
yourself or another person requires an authorization to the same extent 
an authorization would be required to export or reexport such 
``technology'' or ``software'' to that person.

0
12. Section 734.16 is added to read as follows:


Sec.  734.16  Transfer (in-country).

    Except as set forth in Sec.  734.18(a)(3), a Transfer (in-country) 
is a change in end use or end user of an item within the same foreign 
country. Transfer (in-country) is synonymous with In-country transfer.

0
13. Section 734.17 is added to read as follows:


Sec.  734.17  Export of encryption source code and object code 
software.

    (a) For purposes of the EAR, the Export of encryption source code 
and object code ``software'' means:
    (1) An actual shipment, transfer, or transmission out of the United 
States (see also paragraph (b) of this section); or
    (2) A transfer of such ``software'' in the United States to an 
embassy or affiliate of a foreign country.
    (b) The export of encryption source code and object code 
``software'' controlled for ``EI'' reasons under ECCN 5D002 on the 
Commerce Control List (see Supplement No. 1 to part 774 of the EAR) 
includes:
    (1) Downloading, or causing the downloading of, such ``software'' 
to locations (including electronic bulletin boards, Internet file 
transfer protocol, and World Wide Web sites) outside the U.S., or
    (2) Making such ``software'' available for transfer outside the 
United States, over wire, cable, radio, electromagnetic, photo optical, 
photoelectric or other comparable communications facilities accessible 
to persons outside the United States, including transfers from 
electronic bulletin boards, Internet file transfer protocol and World 
Wide Web sites, unless the person making the ``software'' available 
takes precautions adequate to prevent unauthorized transfer of such 
code. See Sec.  740.13(e) of the EAR for notification requirements for 
exports or reexports of encryption source code ``software'' considered 
to be publicly available or published consistent with the provisions of 
Sec.  734.3(b)(3). Publicly available encryption ``software'' in object 
code that corresponds to encryption source code made eligible for 
License Exception TSU under Sec.  740.13(e) of the EAR is not subject 
to the EAR.
    (c) Subject to the General Prohibitions described in part 736 of 
the EAR, such precautions for Internet transfers of products eligible 
for export under Sec.  740.17(b)(2) of the EAR (encryption ``software'' 
products, certain encryption source code and general purpose encryption 
toolkits) shall include such measures as:
    (1) The access control system, either through automated means or 
human intervention, checks the address of every system outside of the 
U.S. or Canada requesting or receiving a transfer and verifies such 
systems do not have a domain name or Internet address of a foreign 
government end-user (e.g., ``.gov,'' ``.gouv,'' ``.mil'' or similar 
addresses);
    (2) The access control system provides every requesting or 
receiving party with notice that the transfer includes or would include 
cryptographic ``software'' subject to export controls under the Export 
Administration Regulations, and anyone receiving such a transfer cannot 
export the ``software'' without a license or other authorization; and
    (3) Every party requesting or receiving a transfer of such 
``software'' must acknowledge affirmatively that the ``software'' is 
not intended for use by a government end user, as defined in part 772 
of the EAR, and he or she understands the cryptographic ``software'' is 
subject to export controls under the Export Administration Regulations 
and anyone receiving the transfer cannot export the ``software'' 
without a license or other authorization. BIS will consider 
acknowledgments in electronic form provided they are adequate to assure 
legal undertakings similar to written acknowledgments.

0
14. Section 734.18 is added to read as follows:


Sec.  734.18  Activities that are not exports, reexports, or transfers.

    (a) Activities that are not exports, reexports, or transfers. The 
following activities are not exports, reexports, or transfers:
    (1) Launching a spacecraft, launch vehicle, payload, or other item 
into space.

[[Page 35605]]

    (2) Transmitting or otherwise transferring ``technology'' or 
``software'' to a person in the United States who is not a foreign 
person from another person in the United States.
    (3) Transmitting or otherwise making a transfer (in-country) within 
the same foreign country of ``technology'' or ``software'' between or 
among only persons who are not ``foreign persons,'' so long as the 
transmission or transfer does not result in a release to a foreign 
person or to a person prohibited from receiving the ``technology'' or 
``software.''
    (4) Shipping, moving, or transferring items between or among the 
United States, the District of Columbia, the Commonwealth of Puerto 
Rico, or the Commonwealth of the Northern Mariana Islands or any 
territory, dependency, or possession of the United States as listed in 
Schedule C, Classification Codes and Descriptions for U.S. Export 
Statistics, issued by the Bureau of the Census.
    (5) Sending, taking, or storing ``technology'' or ``software'' that 
is:
    (i) Unclassified;
    (ii) Secured using `end-to-end encryption;'
    (iii) Secured using cryptographic modules (hardware or 
``software'') compliant with Federal Information Processing Standards 
Publication 140-2 (FIPS 140-2) or its successors, supplemented by 
``software'' implementation, cryptographic key management and other 
procedures and controls that are in accordance with guidance provided 
in current U.S. National Institute for Standards and Technology 
publications, or other equally or more effective cryptographic means; 
and
    (iv) Not intentionally stored in a country listed in Country Group 
D:5 (see Supplement No. 1 to part 740 of the EAR) or in the Russian 
Federation.

    Note to paragraph (a)(4)(iv): Data in-transit via the Internet 
is not deemed to be stored.

    (b) Definitions. For purposes of this section, End-to-end 
encryption means (i) the provision of cryptographic protection of data 
such that the data is not in unencrypted form between an originator (or 
the originator's in-country security boundary) and an intended 
recipient (or the recipient's in-country security boundary), and (ii) 
the means of decryption are not provided to any third party. The 
originator and the recipient may be the same person.
    (c) Ability to access ``technology'' or ``software'' in encrypted 
form. The ability to access ``technology'' or ``software'' in encrypted 
form that satisfies the criteria set forth in paragraph (a)(5) of this 
section does not constitute the release or export of such 
``technology'' or ``software.''

0
15. Section 734.19 is added to read as follows:


Sec.  734.19  Transfer of access information.

    To the extent an authorization would be required to transfer 
``technology'' or ``software,'' a comparable authorization is required 
to transfer access information if done with ``knowledge'' that such 
transfer would result in the release of such ``technology'' or 
``software'' without a required authorization.

0
16. Section 734.20 is added to read as follows:


Sec.  734.20  Activities that are not deemed reexports.

    The following activities are not deemed reexports (see ``deemed 
reexport'' definition in Sec.  734.14(b)):
    (a) Authorized Release of ``technology'' or source code. Release of 
``technology'' or source code by an entity outside the United States to 
a foreign person of a country other than the foreign country where the 
release takes place if:
    (1) The entity is authorized to receive the ``technology'' or 
source code at issue, whether by a license, license exception, or 
situation where no license is required under the EAR for such 
``technology'' or source code; and
    (2) The entity has ``knowledge'' that the foreign national's most 
recent country of citizenship or permanent residency is that of a 
country to which export from the United States of the ``technology'' or 
source code at issue would be authorized by the EAR either under a 
license exception or in situations where no license under the EAR would 
be required.
    (b) Release to Country Group A:5 nationals. Without limiting the 
scope of paragraph (a), release of ``technology'' or source code by an 
entity outside the United States to a foreign person of a country other 
than the foreign country where the release takes place if:
    (1) The entity is authorized to receive the ``technology'' or 
source code at issue, whether by a license, license exception, or 
through situations where no license is required under the EAR;
    (2) The foreign person is a bona fide `permanent and regular 
employee' of the entity and is not a proscribed person (see Sec.  772.1 
for definition of proscribed person);
    (3) Such employee is a national exclusively of a country in Country 
Group A:5; and
    (4) The release of ``technology'' or source code takes place 
entirely within the physical territory of any such country, or within 
the United States.
    (c) Release to other than Country Group A:5 nationals. Without 
limiting the scope of paragraph (a), release of ``technology'' or 
source code by an entity outside the United States to a foreign person 
of a country other than the foreign country where the release takes 
place if:
    (1) The entity is authorized to receive the ``technology'' or 
source code at issue, whether by a license, license exception, or 
situations where no license is required under the EAR;
    (2) The foreign person is a bona fide `permanent and regular 
employee' of the entity and is not a proscribed person (see Sec.  772.1 
for definition of proscribed person);
    (3) The release takes place entirely within the physical territory 
of the country where the entity is located, conducts official business, 
or operates, or within the United States;
    (4) The entity has effective procedures to prevent diversion to 
destinations, entities, end users, and end uses contrary to the EAR; 
and
    (5) Any one of the following six (i.e., paragraphs (c)(5)(i), (ii), 
(iii), (iv), (v), or (vi) of this section) situations is applicable:
    (i) The foreign person has a security clearance approved by the 
host nation government of the entity outside the United States;
    (ii) The entity outside the United States:
    (A) Has in place a process to screen the foreign person employee 
and to have the employee execute a non-disclosure agreement that 
provides assurances that the employee will not disclose, transfer, or 
reexport controlled ``technology'' contrary to the EAR;
    (B) Screens the employee for substantive contacts with countries 
listed in Country Group D:5 (see Supplement No. 1 to part 740 of the 
EAR). Although nationality does not, in and of itself, prohibit access 
to ``technology'' or source code subject to the EAR, an employee who 
has substantive contacts with foreign persons from countries listed in 
Country Group D:5 shall be presumed to raise a risk of diversion, 
unless BIS determines otherwise;
    (C) Maintains a technology security or clearance plan that includes 
procedures for screening employees for such substantive contacts;
    (D) Maintains records of such screenings for the longer of five 
years or the duration of the individual's employment with the entity; 
and
    (E) Will make such plans and records available to BIS or its agents 
for civil

[[Page 35606]]

and criminal law enforcement purposes upon request;
    (iii) The entity is a U.K. entity implementing Sec.  126.18 of the 
ITAR (22 CFR 126.18) pursuant to the U.S.-U.K. Exchange of Notes 
regarding Sec.  126.18 of the ITAR for which the U.K. has provided 
appropriate implementation guidance;
    (iv) The entity is a Canadian entity implementing Sec.  126.18 of 
the ITAR pursuant to the U.S.-Canadian Exchange of Letters regarding 
Sec.  126.18 of the ITAR for which Canada has provided appropriate 
implementation guidance;
    (v) The entity is an Australian entity implementing the exemption 
at paragraph 3.7b of the ITAR Agreements Guidelines; or
    (vi) The entity is a Dutch entity implementing the exemption at 
paragraph 3.7c of the ITAR Agreements Guidelines.
    (d) Definitions--(1) Substantive contacts include regular travel to 
countries in Country Group D:5; recent or continuing contact with 
agents, brokers, and nationals of such countries; continued 
demonstrated allegiance to such countries; maintenance of business 
relationships with persons from such countries; maintenance of a 
residence in such countries; receiving salary or other continuing 
monetary compensation from such countries; or acts otherwise indicating 
a risk of diversion.
    (2) Permanent and regular employee is an individual who:
    (i) Is permanently (i.e., for not less than a year) employed by an 
entity, or
    (ii) Is a contract employee who:
    (A) Is in a long-term contractual relationship with the company 
where the individual works at the entity's facilities or at locations 
assigned by the entity (such as a remote site or on travel);
    (B) Works under the entity's direction and control such that the 
company must determine the individual's work schedule and duties;
    (C) Works full time and exclusively for the entity; and
    (D) Executes a nondisclosure certification for the company that he 
or she will not disclose confidential information received as part of 
his or her work for the entity.

    Note to paragraph (d)(2): If the contract employee has been 
seconded to the entity by a staffing agency, then the staffing 
agency must not have any role in the work the individual performs 
other than to provide the individual for that work. The staffing 
agency also must not have access to any controlled ``technology'' or 
source code other than that authorized by the applicable regulations 
or a license.

Supplement No. 1 to Part 734 [Removed and Reserved]

0
17. Supplement No. 1 to part 734 is removed and reserved.

PART 740-- LICENSE EXCEPTIONS

0
18. The authority citation for part 740 continues to read as follows:

    Authority: 50 U.S.C. 4601 et seq.; 50 U.S.C. 1701 et seq.; 22 
U.S.C. 7201 et seq.; E.O. 13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 
228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of 
August 7, 2015, 80 FR 48233 (August 11, 2015).

0
19. In Sec.  740.9, paragraph (a)(3) is revised to read as follows:


Sec.  740.9  Temporary imports, exports, reexports, and transfers (in-
country) (TMP).

* * * * *
    (a) * * *
    (3) ``Technology,'' regardless of media or format, may be exported, 
reexported, or transferred (in-country) by or to a U.S. person, or a 
foreign person employee of a U.S. person traveling or on temporary 
assignment abroad, subject to the following restrictions:
    (i) Foreign persons may only export, reexport, transfer (in 
country) or receive such ``technology'' as they are authorized to 
receive through a license, license exception other than TMP or because 
no license is required.
    (ii) ``Technology'' exported, reexported, or transferred under this 
authorization may only be possessed or used by a U.S. person or 
authorized foreign person. Sufficient security precautions must be 
taken to prevent the unauthorized release of the ``technology.'' Such 
security precautions may include encryption of the ``technology,'' the 
use of secure network connections, such as Virtual Private Networks, 
the use of passwords or other access restrictions on the electronic 
device or media on which the ``technology'' is stored, and the use of 
firewalls and other network security measures to prevent unauthorized 
access.
    (iii) The individual is an employee of the U.S. Government or is 
directly employed by a U.S. person and not, e.g., by a foreign 
subsidiary.
    (iv) ``Technology'' authorized under this exception may not be used 
for foreign production purposes or for technical assistance unless 
authorized through a license or license exception other than TMP.
* * * * *

PART 750--APPLICATION PROCESSING, ISSUANCE, AND DENIAL

0
20. The authority citation for 15 CFR part 750 continues to read as 
follows:

    Authority: 50 U.S.C. 4601 et seq.; 50 U.S.C. 1701 et seq.; Sec 
1503, Pub. L. 108-11, 117 Stat. 559; E.O. 13026, 61 FR 58767, 3 CFR, 
1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 
783; E.O. 13637, 78 FR 16129, 3 CFR, 2013 Comp., p. 223; 
Presidential Determination 2003-23, 68 FR 26459, 3 CFR, 2004 Comp., 
p. 320; Notice of August 7, 2015, 80 FR 48233 (August 11, 2015).

0
21. Section 750.7 is amended by revising paragraph (a) to read as 
follows:


Sec.  750.7  Issuance of licenses.

    (a) Scope. Unless limited by a condition set out in a license, the 
export, reexport, or transfer (in-country) authorized by a license is 
for the item(s), end-use(s), and parties described in the license 
application and any letters of explanation. The applicant must inform 
the other parties identified on the license, such as the ultimate 
consignees and end users, of the license's scope and of the specific 
conditions applicable to them. BIS grants licenses in reliance on 
representations the applicant made in or submitted in connection with 
the license application, letters of explanation, and other documents 
submitted. A BIS license authorizing the release of ``technology'' to 
an entity also authorizes the release of the same ``technology'' to the 
entity's foreign persons who are permanent and regular employees (and 
who are not proscribed persons) of the entity's facility or facilities 
authorized on the license, except to the extent a license condition 
limits or prohibits the release of the ``technology'' to foreign 
persons of specific countries or country groups.
* * * * *

PART 772--DEFINITIONS OF TERMS

0
22. The authority citation for part 772 continues to read as follows:

    Authority: 50 U.S.C. 4601 et seq.; 50 U.S.C. 1701 et seq.; E.O. 
13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 783; Notice of August 7, 
2015, 80 FR 48233 (August 11, 2015).

0
23. Section 772.1 is amended by:
0
a. Adding in alphabetical order a definition for ``Access 
information'';
0
b. Revising the definition of ``Export'';
0
c. Adding in alphabetical order definitions for ``Foreign person,'' 
``Fundamental research,'' ``Proscribed person,'' and ``Publicly 
available encryption software'';
0
d. Removing the definitions of ``Publicly available information'' and

[[Page 35607]]

``Publicly available technology and software'';
0
e. Adding in alphabetical order a definition for ``Published'';
0
f. Revising the definition of ``Reexport'';
0
g. Adding in alphabetical order a definition for ``Release'';
0
h. Revising the definition of ``Required'';
0
i. Removing the definition of ``Technical data''; and
0
j. Revising the definitions of ``Technology,'' and ``Transfer.''
    The revisions and additions read as follows:


Sec.  772.1  Definitions of terms as used in the Export Administration 
Regulations (EAR).

* * * * *
    Access information. Information that allows access to encrypted 
technology or encrypted software in an unencrypted form. Examples 
include decryption keys, network access codes, and passwords.
* * * * *
    Export. See Sec.  734.13 of the EAR.
* * * * *
    Foreign person. Any natural person who is not a lawful permanent 
resident of the United States, citizen of the United States, or any 
other protected individual as defined by 8 U.S.C. 1324b(a)(3). It also 
means any corporation, business association, partnership, trust, 
society or any other entity or group that is not incorporated in the 
United States or organized to do business in the United States, as well 
as international organizations, foreign governments and any agency or 
subdivision of a foreign government (e.g., diplomatic mission). 
``Foreign person'' is synonymous with ``foreign national,'' as used in 
the EAR, and ``foreign person'' as used in the International Traffic in 
Arms Regulations (22 CFR 120.16). This definition does not apply to 
part 760 of the EAR (Restrictive Trade Practices or Boycotts).
* * * * *
    Fundamental research. See Sec.  734.8 of the EAR.
* * * * *
    Proscribed person. A person who is prohibited from receiving the 
items at issue or participating in a transaction that is subject to the 
EAR without authorization under the EAR, such as persons on the Entity 
List or denied persons.
    Publicly available encryption software. See Sec.  740.13(e) of the 
EAR.
    Published. See Sec.  734.7 of the EAR.
* * * * *
    Reexport. See Sec.  734.14 of the EAR.
    Release. See Sec.  734.15 of the EAR.
* * * * *
    Required. (General Technology Note) --As applied to ``technology'' 
or ``software,'' refers to only that portion of ``technology'' or 
``software'' which is peculiarly responsible for achieving or exceeding 
the controlled performance levels, characteristics or functions. Such 
``required'' ``technology'' or ``software'' may be shared by different 
products. For example, assume product ``X'' is controlled on the CCL if 
it operates at or above 400 MHz and is not controlled if it operates 
below 400 MHz. If production technologies ``A,'' ``B,'' and ``C'' allow 
production at no more than 399 MHz, then technologies ``A,'' ``B,'' and 
``C'' are not ``required'' to produce the controlled product ``X''. If 
technologies ``A,'' ``B,'' ``C,'' ``D,'' and ``E'' are used together, a 
manufacturer can produce product ``X'' that operates at or above 400 
MHz. In this example, technologies ``D'' and ``E'' are peculiarly 
responsible for making the controlled product and are thus ``required'' 
technology under the General Technology Note. (See the General 
Technology Note.)

    Note 1 to the definition of Required:  The ITAR and the EAR 
often divide within each set of regulations or between each set of 
regulations:
    (a) Controls on parts, components, accessories, attachments, and 
software; and
    (b) Controls on the end items, systems, equipment, or other 
items into which those parts, components, accessories, attachments, 
and software are to be installed or incorporated.


    Note 2 to the definition of Required:  The references to 
``characteristics'' and ``functions'' are not limited to entries on 
the CCL that use specific technical parameters to describe the scope 
of what is controlled. The ``characteristics'' and ``functions'' of 
an item listed are, absent a specific regulatory definition, a 
standard dictionary's definition of the item. For example, ECCN 
9A610.a controls military aircraft specially designed for a military 
use that are not enumerated in USML paragraph VIII(a). No 
performance level is identified in the entry, but the control 
characteristic of the aircraft is that it is specially designed 
``for military use.'' Thus, any technology, regardless of 
significance, peculiar to making an aircraft ``for military use'' as 
opposed to, for example, an aircraft controlled under ECCN 9A991.a, 
would be technical data ``required'' for an aircraft specially 
designed for military use thus controlled under ECCN 9E610.


    Note 3 to the definition of Required:  Unclassified technology 
not specifically enumerated on the USML is ``subject to the EAR'' if 
it is ``required'' for the ``development,'' ``production,'' ``use,'' 
operation, installation, maintenance, repair, overhaul, or 
refurbishing (or other terms specified in ECCNs on the CCL that 
control ``technology'') of a commodity or software that is subject 
to the EAR. Thus, for example, if unclassified technology not 
specifically enumerated on the USML is ``required'' for the 
development or production of a 9A610.x aircraft component that is to 
be integrated or installed in a USML VIII(a) aircraft, then the 
``technology'' is controlled under ECCN 9E610, not USML VIII(i). 
Conversely, technical data directly related to, for example, the 
development or production of a component subject to the ITAR does 
not become subject to the EAR merely because it is developed or 
produced with equipment subject to the EAR.

* * * * *
    Technology. Technology means:
    Information necessary for the ``development,'' ``production,'' 
``use,'' operation, installation, maintenance, repair, overhaul, or 
refurbishing (or other terms specified in ECCNs on the CCL that control 
``technology'') of an item.
    N.B.: Controlled ``technology'' is defined in the General 
Technology Note and in the Commerce Control List (Supplement No. 1 to 
part 774 of the EAR).

    Note 1 to definition of Technology:  ``Technology'' may be in 
any tangible or intangible form, such as written or oral 
communications, blueprints, drawings, photographs, plans, diagrams, 
models, formulae, tables, engineering designs and specifications, 
computer-aided design files, manuals or documentation, electronic 
media or information revealed through visual inspection;


    Note 2 to definition of Technology:  The modification of the 
design of an existing item creates a new item and technology for the 
modified design is technology for the development or production of 
the new item.

* * * * *
    Transfer. A shipment, transmission, or release of items subject to 
the EAR either within the United States or outside the United States. 
For In-country transfer/Transfer (in-country), see Sec.  734.16 of the 
EAR.

    Note to definition of Transfer:  This definition of ``transfer'' 
does not apply to Sec.  750.10 of the EAR or Supplement No. 8 to 
part 760 of the EAR. The term ``transfer'' may also be included on 
licenses issued by BIS. In that regard, the changes that can be made 
to a BIS license are the non-material changes described in Sec.  
750.7(c) of the EAR. Any other change to a BIS license without 
authorization is a violation of the EAR. See Sec. Sec.  750.7(c) and 
764.2(e) of the EAR.

* * * * *


[[Page 35608]]


    Dated: May 23, 2016.
Kevin J. Wolf,
Assistant Secretary for Export Administration.
[FR Doc. 2016-12734 Filed 6-2-16; 8:45 am]
 BILLING CODE 3510-33-P



                                                35586                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                ■ 9. Amend subpart 1274.9 by adding                        (3) Reporting procedures. Enter in the              DEPARTMENT OF COMMERCE
                                                § 1274.944 to read as follows:                          SAM Entity Management area the
                                                                                                        information that SAM requires about                    Bureau of Industry and Security
                                                § 1274.944 Award term and condition for
                                                                                                        each proceeding described in paragraph
                                                recipient integrity and performance matters.
                                                                                                        (a)(4) of this section. You do not need                15 CFR Parts 734, 740, 750, and 772
                                                   (a) Reporting of matters related to                  to submit the information a second time
                                                recipient integrity and performance—(1)                 under assistance awards that you                       [Docket No. 141016858–6004–02]
                                                General reporting requirement. (i) If the               received if you already provided the
                                                total value of your currently active                    information through SAM, because you
                                                                                                                                                               RIN 0694–AG32
                                                grants, cooperative agreements, and
                                                                                                        were required to do so under Federal                   Revisions to Definitions in the Export
                                                procurement contracts from all Federal
                                                                                                        procurement contracts that you were                    Administration Regulations
                                                awarding agencies exceeds $10,000,000
                                                                                                        awarded.
                                                for any period during the period of                                                                            AGENCY:  Bureau of Industry and
                                                performance of this Federal award, then                    (4) Reporting frequency. During any
                                                                                                        period of time when you are subject to                 Security, Commerce.
                                                you as the recipient during that period
                                                                                                        the requirement in paragraph (a)(1) of                 ACTION: Final rule.
                                                of time must maintain the currency of
                                                information reported in FAPIIS about                    this section, you must report
                                                                                                                                                               SUMMARY:    This final rule is part of the
                                                civil, criminal, or administrative                      proceedings information through SAM
                                                                                                                                                               Administration’s Export Control Reform
                                                proceedings described in paragraph                      for the most recent five year period,
                                                                                                                                                               (ECR) Initiative. The Initiative will
                                                (a)(2) of this section. This is a statutory             either to report new information about
                                                                                                                                                               enhance U.S. national and economic
                                                requirement under section 872 of Public                 any proceeding(s) that you have not
                                                                                                                                                               security, facilitate compliance with
                                                Law 110–417, as amended (41 U.S.C.                      reported previously or affirm that there
                                                                                                                                                               export controls, update the controls, and
                                                2313).                                                  is no new information to report.
                                                                                                                                                               further the goal of reducing unnecessary
                                                   (ii) As required by section 3010 of                  Recipients that have Federal contract,
                                                                                                                                                               regulatory burdens on U.S. exporters. As
                                                Public Law 111–212, all information                     grant, and cooperative agreement
                                                                                                                                                               part of this effort, the Bureau of Industry
                                                posted in FAPIIS on or after April 15,                  awards with a cumulative total value
                                                                                                                                                               and Security (BIS), in publishing this
                                                2011, except past performance reviews                   greater than $10,000,000 must disclose
                                                                                                                                                               rule, makes revisions to the Export
                                                required for Federal procurement                        semiannually any information about the
                                                                                                                                                               Administration Regulations (EAR) to
                                                contracts, will be publicly available.                  criminal, civil, and administrative
                                                   (2) Proceedings about which you must                                                                        include certain definitions to enhance
                                                                                                        proceedings.
                                                report. Submit the information required                                                                        clarity and consistency with terms also
                                                                                                           (5) Definitions. For purposes of this               found in the International Traffic in
                                                about each proceeding that—                             section:
                                                   (i) Is in connection with the award or                                                                      Arms Regulations (ITAR), which is
                                                performance of a grant, cooperative                        (i) Administrative proceeding means a               administered by the Department of
                                                agreement, or procurement contract                      non-judicial process that is adjudicatory              State, Directorate of Defense Trade
                                                from the Federal Government;                            in nature in order to make a                           Controls (DDTC), or that DDTC expects
                                                   (ii) Reached its final disposition                   determination of fault or liability (e.g.,             to publish in proposed rules. This final
                                                during the most recent five year period;                Securities and Exchange Commission                     rule also revises the Scope part of the
                                                and                                                     Administrative proceedings, Civilian                   EAR to update and clarify application of
                                                   (iii) Is one of the following:                       Board of Contract Appeals proceedings,                 controls to electronically transmitted
                                                   (A) A criminal proceeding that                       and Armed Services Board of Contract                   and stored technology and software,
                                                resulted in a conviction, as defined in                 Appeals proceedings). This includes                    including by way of cloud computing.
                                                paragraph (a)(5)(ii) of this section.                   proceedings at the Federal and State                   DDTC is concurrently publishing
                                                   (B) A civil proceeding that resulted in              level but only in connection with                      comparable amendments to certain
                                                a finding of fault and liability and                    performance of a Federal contract or                   ITAR definitions for the same reasons.
                                                payment of a monetary fine, penalty,                    grant. It does not include audits, site                Finally, this rule makes conforming
                                                reimbursement, restitution, or damages                  visits, corrective plans, or inspection of             changes to related provisions.
                                                of $5,000 or more.                                      deliverables.                                          DATES: This rule is effective September
                                                   (C) An administrative proceeding, as                                                                        1, 2016.
                                                                                                           (ii) Conviction, for purposes of this
                                                defined in paragraph (a)(5)(i) of this
                                                                                                        award term and condition, means a                      ADDRESSES: Although there is no formal
                                                award term and condition, that resulted
                                                in a finding of fault and liability and                 judgment or conviction of a criminal                   comment period, public comments on
                                                your payment of either a monetary fine                  offense by any court of competent                      this final rule are welcome on a
                                                or penalty of $5,000 or more or                         jurisdiction, whether entered upon a                   continuing basis. You may submit
                                                reimbursement, restitution, or damages                  verdict or a plea, and includes a                      comments by either of the following
                                                in excess of $100,000.                                  conviction entered upon a plea of nolo                 methods:
                                                   (D) Any other criminal, civil, or                    contendere.                                               • By email directly to
                                                administrative proceeding if—                              (6) Total value of currently active                 publiccomments@bis.doc.gov. Include
                                                   (1) It could have led to an outcome                  grants, cooperative agreements, and                    RIN 0694–AG32 in the subject line.
                                                described in paragraph (a)(2)(iii)(A), (B),             procurement contracts includes—                           • By mail or delivery to Regulatory
                                                or (C) of this section;                                                                                        Policy Division, Bureau of Industry and
                                                                                                           (i) Only the Federal share of the
                                                   (2) It had a different disposition                                                                          Security, U.S. Department of Commerce,
                                                                                                        funding under any Federal award with
                                                arrived at by consent or compromise                                                                            Room 2099B, 14th Street and
                                                                                                        a recipient cost share or match; and
mstockstill on DSK3G9T082PROD with RULES




                                                with an acknowledgment of fault on                                                                             Pennsylvania Avenue NW., Washington,
                                                your part; and                                             (ii) The value of all expected funding              DC 20230. Refer to RIN 0694–AG32.
                                                   (3) The requirement in this award                    increments under a Federal award and                      Commerce’s full plan for retrospective
                                                term and condition to disclose                          options, even if not yet exercised.                    regulatory review can be accessed at:
                                                information about the proceeding does                      (b) [Reserved]                                      http://open.commerce.gov/news/2011/
                                                not conflict with applicable laws and                   [FR Doc. 2016–12850 Filed 6–2–16; 8:45 am]             08/23/commerce-plan-retrospective-
                                                regulations.                                            BILLING CODE 7510–13–P                                 analysis-existing-rules.


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00006   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                                      Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations                                          35587

                                                FOR FURTHER INFORMATION CONTACT:     For                technical data, software, and services to              Domain; Definition of Product of
                                                questions on application of controls to                 various destinations, end users, and end               Fundamental Research; Electronic
                                                electronically transmitted and stored                   uses. The two sets of regulations have                 Transmission and Storage of Technical
                                                technology and software, contact Bob                    been issued pursuant to different                      Data; and Related Definitions’’ (80 FR
                                                Rarog, Senior Advisor to the Assistant                  statutes, have been administered by                    31525) (hereafter ‘‘the State June 3
                                                Secretary for Export Administration,                    different agencies with missions that are              rule’’).
                                                Bureau of Industry and Security at (202)                distinct from one another in certain                      BIS welcomed comments on all
                                                482–9089. For other questions, contact                  respects, and have covered different                   aspects of the June 3 rule. Additionally,
                                                Hillary Hess, Director, Regulatory Policy               items (or articles). For those reasons,                in the preamble to the June 3 rule, BIS
                                                Division, Office of Exporter Services,                  and because each set of regulations has                specifically solicited public comment
                                                Bureau of Industry and Security at (202)                evolved separately over decades without                with questions on eight issues. Two of
                                                482–2440 or rpd2@bis.doc.gov.                           much coordination between the two                      those questions pertained to the
                                                SUPPLEMENTARY INFORMATION:                              agencies regarding their structure and                 definition of fundamental research; one
                                                                                                        content, they often use different words,               pertained to whether the questions and
                                                Background                                              or the same words differently, to                      answers in Supplement No. 1 to part
                                                   This final rule is part of the                       accomplish similar regulatory                          734 had criteria that should be retained
                                                Administration’s Export Control Reform                  objectives.                                            in part 734; two pertained to encryption
                                                (ECR) Initiative. The Initiative will                      Many parties’ export, reexport, and                 standards in the definition of ‘‘Activities
                                                enhance U.S. national and economic                      transfer transactions are regulated by                 that are Not Exports, Reexports, or
                                                security, facilitate compliance with                    both the Commerce Department’s EAR                     Transfers;’’ and one pertained to the
                                                export controls, update the controls, and               and the State Department’s ITAR,                       effectiveness of the proposed definition
                                                                                                        particularly now that regulatory                       of ‘‘peculiarly responsible.’’ Public
                                                continue the process of reducing
                                                                                                        jurisdiction over many types of military               comments on these questions are
                                                unnecessary regulatory burdens on U.S.
                                                                                                        items has been transferred from the                    addressed in their corresponding
                                                exporters. As part of this effort, the
                                                                                                        ITAR to the EAR. Using common terms                    sections below.
                                                Bureau of Industry and Security (BIS),                                                                            The two remaining questions were
                                                                                                        and common definitions to regulate the
                                                in publishing this rule, makes revisions                                                                       broadly applicable across the rule:
                                                                                                        same types of items or actions will
                                                to the Export Administration                                                                                   Whether the proposed revisions created
                                                                                                        facilitate enhanced compliance and
                                                Regulations (EAR) to include the                                                                               gaps, overlaps, or contradictions
                                                                                                        reduce unnecessary regulatory burdens.
                                                definitions of ‘‘access information,’’                                                                         between the EAR and the ITAR or
                                                                                                        Conversely, if different concerns
                                                ‘‘technology,’’ ‘‘required,’’ ‘‘foreign                                                                        among various provisions within the
                                                                                                        between the two sets of export control
                                                person,’’ ‘‘proscribed person,’’                        regulations warrant different terms or                 EAR; and whether a 30-day delayed
                                                ‘‘published,’’ results of ‘‘fundamental                 different controls, the differences                    effective date was appropriate for the
                                                research,’’ ‘‘export,’’ ‘‘reexport,’’                   should be made clear for the same                      final rule.
                                                ‘‘release,’’ ‘‘transfer,’’ and ‘‘transfer (in-          reason. Such clarity will benefit                         Eleven commenters cited the
                                                country)’’ to enhance clarity and                       national security because it will be                   difference between the EAR and ITAR
                                                consistency with terms also found in the                easier for exporters to comply with the                standards for prepublication review of
                                                International Traffic in Arms                           regulations and for prosecutors to                     research as a significant gap between the
                                                Regulations (ITAR), which is                            prosecute violations of the regulations.               two bodies of regulations that would
                                                administered by the Department of                       Such clarity will also enhance our                     create compliance difficulties. These
                                                State, Directorate of Defense Trade                     economic security because it will                      commenters recommended that both
                                                Controls (DDTC). This final rule also                   reduce unnecessary regulatory burdens                  final rules adopt the EAR standard.
                                                revises the Scope part of the EAR to                    for exporters when attempting to                       Further discussion of this issue may be
                                                update and clarify application of                       determine the meaning of key words                     found in the section of the preamble
                                                controls to electronically transmitted                  and phrases across similar sets of                     describing fundamental research, below.
                                                and stored technology and software.                     regulations. Finally, this rule and the                   Twenty-two commenters
                                                DDTC is concurrently publishing                         rule DDTC is publishing concurrently                   recommended a six-month delayed
                                                comparable amendments to the ITAR’s                     address only a portion of the terms and                effective date from date of publication.
                                                definitions of ‘‘export,’’ ‘‘reexport,’’                phrases that warrant harmonization                     Most of these commenters explicitly
                                                ‘‘release,’’ and ‘‘retransfer’’ for the same            between the ITAR and the EAR. They                     based the recommendation on the
                                                reasons. Finally, this rule makes                       are nonetheless a significant step toward              anticipated difficulty created by
                                                conforming changes to related                           accomplishing one of the ultimate                      adoption of differing proposed EAR and
                                                provisions. DDTC anticipates publishing                 objectives of the ECR initiative, which is             ITAR standards for prepublication
                                                its comparable provisions pertaining to                 the creation of a common export control                review of research. State is not
                                                ‘‘technical data,’’ ‘‘directly related,’’               list and common set of export control                  publishing revisions to fundamental
                                                ‘‘public domain,’’ and the results of                   regulations.                                           research at this time; therefore, the
                                                ‘‘fundamental research’’ in a separate                                                                         rationale for requesting a six-month
                                                proposed rule.                                          Proposed Rule
                                                                                                                                                               delay is largely eliminated.
                                                   One aspect of the ECR Initiative                        On June 3, 2015, BIS published a                       One commenter recommended at least
                                                includes amending the export control                    proposed rule entitled ‘‘Revisions to                  a three-month delayed effective date to
                                                regulations to facilitate enhanced                      Definitions in the Export                              enable non-U.S. companies to
                                                compliance while reducing unnecessary                   Administration Regulations’’ (80 FR                    understand and prepare for compliance
mstockstill on DSK3G9T082PROD with RULES




                                                regulatory burdens. For similar national                31505) (hereafter ‘‘the June 3 proposed                with the revisions. BIS accepts this
                                                security, foreign policy, including                     rule’’ or ‘‘the June 3 rule’’).                        recommendation, and this final rule will
                                                human rights, reasons, the EAR and the                  Simultaneously, the Department of State                be effective 90 days from the date of
                                                ITAR each control, inter alia, the export,              published a proposed rule entitled                     publication.
                                                reexport, and in-country transfer by U.S.               ‘‘International Traffic in Arms:                          One commenter recommended
                                                and foreign persons of commodities,                     Revisions to Definitions of Defense                    issuing an interim final rule with a
                                                products or articles, technology,                       Services, Technical Data, and Public                   comment period of at least 60 days due


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00007   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                35588                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                to the breadth of the proposed changes.                 Educational Information                                (b)(3) of § 734.3 that a printed book or
                                                BIS does not accept this                                   The June 3 rule proposed to move the                other printed material setting forth
                                                recommendation, because this final rule                 statement in § 734.9 that educational                  encryption source code is not itself
                                                has a 90-day delayed effective date,                    information released by instruction in a               subject to the EAR, but that encryption
                                                which is a longer delay than generally                  catalog course or associated teaching                  source code in electronic form or media
                                                applies to an interim final rule. The                   laboratory of an academic institution is               remains subject to the EAR. It also
                                                State rule published concurrently with                  not subject to the EAR to § 734.3(b) and               proposed no changes to the note that
                                                this final rule also has a 90-day delayed               remove § 734.9. The June 3 rule also                   publicly available encryption object
                                                effective date. Moreover, the State                     proposed to revise the description of                  code software classified under Export
                                                Department plans to publish a second                    such educational information as                        Control Classification Number (ECCN)
                                                proposed rule seeking comment on most                   information and software that                          5D002 is not subject to the EAR when
                                                of the terms at issue.                                  ‘‘[c]oncern general scientific,                        the corresponding source code meets
                                                                                                        mathematical, or engineering principles                the criteria specified in § 740.13(e) of
                                                Frequently Asked Questions
                                                                                                        commonly taught in schools, and                        the EAR.
                                                   Objectives of this final rule include                                                                         BIS received no comments on these
                                                                                                        released by instruction in a catalog
                                                streamlining, clarifying, and updating                                                                         notes, and this final rule makes no
                                                                                                        course or associated teaching laboratory
                                                regulatory text. BIS has attempted to                                                                          changes to them.
                                                                                                        of an academic institution’’ to better
                                                focus the regulatory text on control
                                                                                                        match the existing ITAR description.                   Published Technology and Software
                                                criteria, limiting notes and examples to
                                                                                                        The proposed revisions were not                           Section 734.7 sets forth that
                                                those necessary to adequately convey
                                                                                                        intended to change the scope of                        technology and software is ‘‘published’’
                                                the criteria. Many public comments                      educational information that is not
                                                raised questions about how criteria                                                                            and thus not subject to the EAR when
                                                                                                        subject to the EAR.                                    it becomes generally accessible to the
                                                would be applied in particular                             Twenty-seven commenters stated that,
                                                situations or suggested illustrative                                                                           interested public in any form, including
                                                                                                        in spite of BIS’s declared intent to leave
                                                revisions. BIS considers these comments                                                                        through publication, availability at
                                                                                                        the scope of this provision unchanged,
                                                helpful to compliance with the EAR and                                                                         libraries, patents, distribution or
                                                                                                        the proposed revision in fact narrowed
                                                is publishing them along with responses                                                                        presentation at open gatherings, and
                                                                                                        the scope of educational information
                                                on the BIS Web site as Frequently Asked                                                                        public dissemination (i.e., unlimited
                                                                                                        that is not subject to the EAR. With the
                                                Questions (FAQs).                                                                                              distribution) in any form (e.g., not
                                                                                                        adoption of the terms in the comparable
                                                                                                                                                               necessarily in published form),
                                                Items Subject to the EAR                                ITAR provision, such as ‘‘general’’ and
                                                                                                                                                               including posting on the Internet on
                                                                                                        ‘‘commonly,’’ commenters said that the
                                                   The June 3 rule proposed re-titling the                                                                     sites available to the public.
                                                                                                        revision could be read to make courses                    The June 3 rule proposed a definition
                                                section ‘‘Subject to the EAR’’ (from
                                                                                                        with advanced or novel content subject                 of ‘‘published’’ that retained the same
                                                ‘‘Important EAR terms and principles’’),                to the EAR and suggested either
                                                retaining the definition and description                                                                       scope, but with a simpler structure. The
                                                                                                        changing ‘‘and released by instruction’’               proposed § 734.7(a) read: ‘‘Except as set
                                                of that term, and creating separate                     to ‘‘or released by instruction’’ or
                                                sections in part 734 to define ‘‘export,’’                                                                     forth in paragraph (b), ‘‘technology’’ or
                                                                                                        reverting to the existing wording. BIS                 ‘‘software’’ is ‘‘published’’ and is thus
                                                ‘‘reexport,’’ ‘‘release,’’ and ‘‘transfer (in-          agrees that the revision could be read to
                                                country),’’ rather than retaining them in                                                                      not ‘‘technology’’ or ‘‘software’’ subject
                                                                                                        narrow the scope of the exclusion, and                 to the EAR when it is not classified
                                                that section. The June 3 rule also                      because this narrowing was not
                                                proposed removing § 734.2(b)(7)                                                                                national security information and has
                                                                                                        intended, reverts to the existing wording              been made available to the public
                                                regarding the listing of foreign territories            in this final rule.
                                                and possessions in the Commerce                                                                                without restrictions upon its further
                                                                                                           BIS received no comments on the
                                                Country Chart (Supplement No. 1 to                                                                             dissemination,’’ followed by a list of
                                                                                                        placement of the educational
                                                part 738) because it duplicated existing                                                                       examples of published information. The
                                                                                                        information provision in the list of
                                                § 738.3(b).                                                                                                    proposed definition was substantially
                                                                                                        information that is per se not subject to
                                                   BIS received no comments on its                                                                             the same as the wording of definitions
                                                                                                        the EAR rather than in a separate
                                                proposed revisions to § 734.2. These                    section. BIS adopts the proposed                       adopted by the multilateral export
                                                revisions are adopted in this final rule.               placement in this final rule.                          control regimes of which the United
                                                                                                                                                               States is a member: The Wassenaar
                                                Items Not Subject to the EAR                            Additional Exclusions                                  Arrangement on Export Controls for
                                                   Section 734.3(a) describes items (i.e.,                 This final rule adopts two additional               Conventional Arms and Dual-Use Goods
                                                commodities, software, and technology)                  revisions that were not in § 734.3(b)(3)               and Technologies (herein ‘‘Wassenaar
                                                subject to the EAR. Paragraph (b)                       in the June 3 proposed rule. This final                Arrangement’’ or ‘‘Wassenaar’’), the
                                                describes items that are not subject to                 rule adds paragraphs (b)(3)(v) and (vi),               Nuclear Suppliers Group, the Missile
                                                the EAR. The June 3 rule proposed                       two additional exclusions from the EAR:                Technology Control Regime, and the
                                                minor revisions to paragraph (b)(3),                    Items that are non-proprietary system                  Australia Group. The phrase ‘‘classified
                                                which describes software and                            descriptions or are telemetry data. These              national security information’’ refers to
                                                technology that are not subject to the                  two exclusions appeared in the June 3                  information that has been classified in
                                                EAR, to describe more fully educational                 proposed rule as exclusions from the                   accordance with Executive Order 13526,
                                                and patent information that are not                     definition of technology. For discussion               75 FR 707; 3 CFR 2010 Comp., p. 298.
                                                subject to the EAR, and to add a note to                of public comments on these exclusions                 The relevant restrictions do not include
mstockstill on DSK3G9T082PROD with RULES




                                                make explicit that information that is                  and BIS’s response to those comments,                  copyright protections or generic
                                                not ‘‘technology’’ as defined in the EAR                see the section on ‘‘Technology’’ below.               property rights in the underlying
                                                is per se not subject to the EAR. One                                                                          physical medium.
                                                commenter specifically offered support                  Exports of Encryption Source Code                         This final rule adopts the definition of
                                                for inclusion of the note, and no                       Notes                                                  ‘‘published’’ from the June 3 proposed
                                                commenters objected to it; BIS has                        The June 3 rule proposed no changes                  rule, with the exception of adding
                                                adopted it in this final rule.                          to the notes to paragraphs (b)(2) and                  certain information, intended to be


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00008   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                                      Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations                                          35589

                                                published, released to ‘‘researchers                    it was not intended to change the scope                have not accepted restrictions for
                                                conducting fundamental research’’ (see                  of the current § 734.8.                                proprietary or national security
                                                discussion below of ‘‘Fundamental                                                                              reasons.’’
                                                                                                        Alternative Definitions                                    BIS agrees with the majority of
                                                Research’’). BIS received a number of
                                                comments on the definition of                              In the June 3 proposed rule, BIS                    commenters that the shorter definition
                                                ‘‘published.’’ Two commenters found                     specifically solicited comments on                     of fundamental research is clearer and
                                                helpful the addressing of Internet                      whether the alternative definition of                  covers the same scope. Given the wide
                                                posting and the clarification that                      fundamental research suggested in the                  spectrum of definitions and applications
                                                submission of manuscripts to journal                    preamble should be adopted. BIS also                   of basic and applied research in
                                                editors constitutes ‘‘published.’’                      specifically solicited comments on                     different bodies of regulations, BIS
                                                Commenters requested that BIS define                    whether the alternative definition of                  determined that the definition should
                                                ‘‘unclassified’’ and clarify whether                    applied research suggested in the                      address the core concept, i.e., that the
                                                university libraries are ‘‘open to the                  preamble should be adopted, or whether                 research is to be published and shared
                                                public.’’ ‘‘Unclassified information’’                  basic and applied research definitions                 broadly without restriction. Having sub-
                                                refers to information that has not been                 are needed given that they are                         definitions of basic and applied research
                                                classified in accordance with Executive                 subsumed by fundamental research.                      in the definition of fundamental
                                                Order 13526, 75 FR 707; 3 CFR 2010                         Issued in 1985, National Security                   research does not change this core
                                                Comp., p. 298. University libraries are                 Decision Directive (NSDD)–189                          concept and would, moreover, merely
                                                open to the public. BIS does not                        established a definition of ‘‘fundamental              add more words and layers of
                                                implement these requests in this final                  research’’ that has been incorporated                  interpretation that would not change the
                                                rule because answering them does not                    into numerous regulations, internal                    outcome of an analysis. Adopting the
                                                                                                        compliance regimes, and guidance                       shorter definition drops references to
                                                require a change to the regulations. BIS
                                                                                                        documents. The June 3 proposed rule                    basic and applied research. BIS
                                                is, however, addressing the questions in
                                                                                                        contained a definition of ‘‘fundamental                accepted the comments regarding the
                                                FAQs posted on BIS’s Web site. One
                                                                                                        research’’ that was identical to that in               term ‘‘non-proprietary’’ and adopted a
                                                commenter stated that, as proposed, the
                                                                                                        NSDD–189. However, in the preamble to                  clearer variation that has the same scope
                                                definition of ‘‘published’’ ‘‘suggests that
                                                                                                        that rule, BIS provided a simpler                      as that intended by the June 3 proposed
                                                releasing (publishing) technology that is
                                                                                                        definition that was consistent with                    rule.
                                                unclassified but subject to the EAR
                                                                                                        NSDD–189, but not identical.                               In addition to research in science and
                                                makes that technology no longer subject
                                                                                                        Specifically, the alternative definition               engineering, BIS included the term
                                                to the EAR.’’ One commenter described
                                                                                                        read: ‘‘ ‘Fundamental research’ means                  ‘‘mathematics’’ to broaden the definition
                                                allowing publication by Internet posting                non-proprietary research in science and                in response to a comment by a BIS
                                                as a ‘‘loophole’’ because the site may be               engineering, the results of which                      technical advisory committee. In this
                                                obscure and the duration of posting is                  ordinarily are published and shared                    final rule, BIS adopts the following
                                                not specified. Another commenter                        broadly within the scientific                          definition of fundamental research:
                                                warned of ‘‘the risk of intentional                     community.’’ BIS believed that the                     ‘‘ ‘‘Fundamental research’’ means
                                                abuse.’’ Nonetheless, BIS confirms that                 scope of this wording was the same as                  research in science, engineering, or
                                                technology or software that is                          that of the wording in NSDD–189 and                    mathematics, the results of which
                                                ‘‘published’’ as provided in § 734.7 is                 sought comment on whether the final                    ordinarily are published and shared
                                                not subject to the EAR.                                 rule should adopt the simpler wording.                 broadly within the research community,
                                                   A commenter noted that the                           Unlike the simpler alternative                         and for which the researchers have not
                                                definition ‘‘does not appear to address                 definition, the proposed definition of                 accepted restrictions for proprietary or
                                                the case of information posted by                       ‘‘fundamental research’’ included                      national security reasons.’’
                                                someone other than the rightful owner.’’                references to ‘‘basic’’ and ‘‘applied’’
                                                BIS agrees with this statement, but notes               research and proposed definitions of                   Software
                                                that such cases are addressed by other                  those terms, as well as a possible                        The June 3 proposed rule revised
                                                laws and regulations.                                   alternative definition of applied                      § 734.8 to use the term ‘‘technology’’ in
                                                   BIS received thirty comments                         research.                                              place of the term ‘‘information.’’ Thirty-
                                                opposing a provision in the definition of                  Comments on alternative definitions                 two commenters objected that
                                                ‘‘public domain’’ in the State June 3 rule              of fundamental research were mixed.                    ‘‘technology’’ was too limiting and
                                                to which there is no corresponding                      Thirteen commenters generally favored                  recommended including either
                                                provision in the definition of                          a simpler definition, in some cases                    ‘‘software’’ or ‘‘source code’’ in addition
                                                ‘‘published.’’ BIS is making no changes                 offering their own revised versions of                 to ‘‘technology’’ to describe information
                                                to the EAR in response to these                         the alternative from the preamble to the               arising during or resulting from
                                                comments because they are outside the                   June 3 proposed rule. Seven                            fundamental research. Many
                                                scope of this rule. They address                        commenters recommended retaining the                   commenters pointed to the text of
                                                concerns with the ITAR, not the EAR.                    NSDD–189 wording. Many commenters                      § 734.3(b)(3) (not subject to the EAR),
                                                   As adopted in this final rule, section               favored one definition but expressed                   which referred to certain ‘‘technology
                                                734.7(b) keeps certain published                        willingness to accept another.                         and software’’ not subject to the EAR,
                                                encryption software subject to the EAR,                 Comments on alternative definitions of                 proposed to be revised to ‘‘information
                                                a restriction that the June 3 rule                      basic and applied research were                        and software’’ in the June 3 rule, as
                                                proposed moving from § 734.7(c)                         similarly mixed, including instances of                support for this recommendation. The
mstockstill on DSK3G9T082PROD with RULES




                                                without revision.                                       the same commenter offering support                    commenters further argued that
                                                                                                        for more than one option. There was                    ‘‘findings resulting from fundamental
                                                Fundamental Research
                                                                                                        greater unanimity on the term ‘‘non-                   research may be written in natural-
                                                  The June 3 rule proposed revising                     proprietary:’’ twenty commenters                       language or computer language.’’ BIS
                                                § 734.8, which excludes most                            objected to it, most finding it vague.                 accepts these comments and has
                                                information resulting from fundamental                  Commenters suggested the variation,                    adopted ‘‘technology’’ and ‘‘software’’
                                                research from the scope of the EAR, but                 research ‘‘for which the researchers                   throughout § 734.8 in this final rule.


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00009   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                35590                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                  Two commenters recommended that                       presentation, computer-readable dataset,               foreign policy, or other reasons. For
                                                BIS make commodities that result from                   imagery, algorithm, formula, or some                   example, government-funded research
                                                fundamental research not subject to the                 other representation of knowledge with                 that does not meet the criteria of § 734.8,
                                                EAR. BIS does not accept this                           the intention that such information will               such as prepublication review, remains
                                                recommendation because the policy                       be made publicly available if accepted                 subject to the EAR regardless of whether
                                                foundations for the exclusion from the                  for publication or presentation: (i) To                it is classified information.
                                                EAR of fundamental research apply only                  domestic or foreign co-authors, editors,
                                                                                                                                                               Locus of Research
                                                to technology and software, not                         or reviewers of journals, magazines,
                                                commodities.                                            newspapers, or trade publications; (ii)                   The June 3 rule proposed streamlining
                                                                                                        To researchers conducting fundamental                  the fundamental research provisions, in
                                                Note on Inputs                                                                                                 § 734.8. Instead of organizing the
                                                                                                        research, or (iii) To organizers of open
                                                   The June 3 proposed rule contained                   conferences or other open gatherings.’’                provisions primarily by locus
                                                the following note: ‘‘Note 1 to paragraph                                                                      (specifically by the type of organization
                                                (a): The inputs used to conduct                         Prepublication Review                                  in which the research takes place:
                                                fundamental research, such as                             The June 3 proposed rule listed three                Universities; federal agencies or
                                                information, equipment, or software, are                types of prepublication review in                      Federally Funded Research and
                                                not ‘technology that arises during or                   § 734.8 that could be performed on the                 Development Centers; or business
                                                results from fundamental research’                      results of fundamental research. Three                 entities), the June 3 rule proposed
                                                except to the extent that such inputs are               commenters supported the clear                         consolidating different provisions that
                                                technology that arose during or resulted                statement that certain prepublication                  involved the same criteria with respect
                                                from earlier fundamental research.’’ Six                review does not render research subject                to prepublication review and removing
                                                commenters stated that the proposed                     to the EAR. One commenter                              any reference to locus unless it made a
                                                note arbitrarily narrows the conduct of                 recommended removing the criterion                     difference to the jurisdictional status of
                                                fundamental research under NSDD–189.                    that the research be published without                 the research.
                                                Two additional commenters seemed to                     delay, pointing out that ‘‘[p]ublication                  Five commenters expressed support
                                                find the text unclear regarding the                     can be (and very often is) delayed for                 for the applicability of the concept of
                                                nature of the inputs.                                   any number of reasons having nothing                   fundamental research regardless of
                                                   The note regarding inputs was                        to do with the content or sensitivity of               locus, and this final rule retains the
                                                intended to distill varying provisions                  research results’’ and that this provision             consolidated structure originally
                                                found in the EAR but proposed to be                     would have the unintended effect of                    proposed.
                                                revised by the June 3 rule that                         limiting or even eliminating the                          Although not objecting to the
                                                ultimately made the same point:                         researchers’ ability to use the                        consolidation, eleven commenters
                                                Information that is not intended to be                  fundamental research provisions. BIS                   requested that BIS retain the § 734.8(b)
                                                published is not fundamental research.                  accepts this latter comment and does                   statement that there is a presumption
                                                For example, existing § 734.8(b)(2)                     not adopt the phrase ‘‘or delay.’’ The                 that university-based research is
                                                states, ‘‘Prepublication review by a                    key point is that the researcher is able               fundamental research. Although this
                                                sponsor of university research solely to                to publish without restriction.                        presumption continues to exist, BIS
                                                insure that the publication would not                     One commenter suggested that Note 2                  does not adopt the specific statement in
                                                inadvertently divulge proprietary                       to paragraph (b) proposed in the June 3                this final rule. Such a presumption has
                                                information that the sponsor has                        rule be replaced with a similar note                   no effect on the jurisdictional status of
                                                furnished to the researchers does not                   from the State June 3 rule (§ 120.49(b) of             technology. If it meets the criteria for
                                                change the status of the research as                    the ITAR) regarding research voluntarily               fundamental research, it is not subject to
                                                fundamental research. However, release                  subjected to U.S. government review.                   the EAR; if it does not meet the criteria,
                                                of information from a corporate sponsor                 BIS agrees with commenters that the                    it is subject. However, BIS is noting in
                                                to university researchers where the                     ITAR text is clearer. So, this final rule              its FAQs on its Web site that, although
                                                research results are subject to                         adopts that ITAR text in Note 2 to                     university-based research is presumed
                                                prepublication review, is subject to the                paragraph (b). Seven commenters                        to be fundamental research, as with all
                                                EAR.’’ Existing section 734.8(b)(4)                     recommended that BIS also adopt the                    rebuttable presumptions, it is rebutted if
                                                states, ‘‘The initial transfer of                       text of Note 3 from the State June 3                   the research is not within the scope of
                                                information from an industry sponsor to                 rule’s text of § 120.49(b) of the ITAR                 technology and software that arises
                                                university researchers is subject to the                regarding U.S. government-imposed                      during, or results from fundamental
                                                EAR where the parties have agreed that                  access and dissemination controls. BIS                 research as described in § 734.8.
                                                the sponsor may withhold from                           agrees. With adoption of Note 3 to                        Eleven commenters requested that BIS
                                                publication some or all of the                          paragraph (b), paragraph (a) of § 734.11,              retain the § 734.8(b)(2) through (6)
                                                information so provided.’’                              Specific National Security Controls, is                criteria for universities. BIS is not doing
                                                   To clarify this distinction, BIS has                 no longer necessary. BIS includes the                  so because these criteria have been
                                                adopted a simpler note in this final rule.              examples from paragraph (b) of § 734.11,               incorporated into this final rule more
                                                Paragraph (a) establishes that the                      which commenters deemed helpful, in                    concisely. To address the comment, BIS
                                                intention to publish is what makes                      new Note 3 to paragraph (b) of § 734.8                 has revised its FAQs to describe how
                                                research not subject to the EAR; the                    in this final rule. Thus, this rule                    these criteria are within the scope of the
                                                following Note 1 to paragraph (a) states:               removes § 734.11 in its entirety.                      revised definition.
                                                ‘‘This paragraph does not apply to                        One commenter stated that the only
mstockstill on DSK3G9T082PROD with RULES




                                                technology or software subject to the                   permissible method of restricting                      Patents
                                                EAR that is released to conduct                         government-funded research was to                        The June 3 rule proposed revising
                                                fundamental research.’’ To support this                 classify it. BIS does not accept this                  § 734.10, ‘‘Patent applications,’’ only for
                                                concept, this final rule adds the                       comment because it is incorrect. Indeed,               clarity and did not change the scope of
                                                following phrase to § 734.7(a)(5)                       BIS has the authority under the EAR to                 control. For the sake of structural
                                                (emphasis added): ‘‘Submission of a                     control unclassified technology that                   consistency with the ITAR’s treatment
                                                written composition, manuscript,                        warrants control for national security,                of information in patents, paragraph (a)


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00010   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                                      Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations                                           35591

                                                was added to state that a patent or an                  final rule, including in this paragraph                in the EAR. One of these commenters
                                                open (published) patent application                     (a)(2), BIS has substituted the term                   suggested making deemed exports a
                                                available from or at any patent office is               ‘‘foreign person’’ for ‘‘foreign national.’’           separate definition. BIS finds that these
                                                per se not subject to EAR. The former                   ‘‘Foreign person’’ has the same scope as               comments have merit; however, the
                                                footnote to the § 734.10 was removed                    ‘‘foreign national;’’ it mirrors the ITAR              issues they raise are too wide-ranging
                                                because it would be redundant of the                    term. One commenter found the term                     and complex to be resolved in this final
                                                proposed text.                                          ‘‘otherwise transferring’’ confusing, but              rule. Addressing these issues would
                                                    BIS received one comment on the                     this final rule retains it to distinguish              constitute a novel proposal that is
                                                proposed revisions to § 734.10.                         releases as a subset of transfers.                     outside the scope of the proposed rule,
                                                Introductory text to the section reads:                    Proposed paragraph (a)(3) included in               requiring an opportunity for comment
                                                ‘‘ ‘‘Technology’’ is not ‘‘subject to the               the definition of ‘‘export’’ the transfer by           before BIS makes a decision as to
                                                EAR’’ if it is contained in:’’. The                     a person in the United States of                       whether to adopt it. Where practical,
                                                commenter suggested adding the phrase                   registration, control, or ownership (i) of             BIS will state existing policy in FAQs.
                                                ‘‘any of the following’’ to this text. BIS              a spacecraft subject to the EAR that is                For those issues not addressed by
                                                agrees and is making the addition to this               not eligible for export under License                  existing policy, BIS will develop
                                                final rule.                                             Exception STA (i.e., spacecraft that                   proposed revisions and seek public
                                                                                                        provide space-based logistics, assembly                comment.
                                                Specific National Security Controls                     or servicing of any spacecraft) to a                      Proposed paragraph (c) stated that
                                                  The June 3 rule proposed minor                        person in or a national of any other                   items that will transit through a country
                                                conforming edits to § 734.11, describing                country, or (ii) of any other spacecraft               or countries or will be transshipped in
                                                specific national security controls. The                subject to the EAR to a person in or a                 a country or countries to a new country,
                                                proposed revisions were not intended to                 national of a Country Group D:5                        or are intended for reexport to the new
                                                change the scope of the section. As                     country.                                               country are deemed to be destined to
                                                discussed above with respect to                            One commenter requested BIS to                      the new country. (Proposed paragraph
                                                fundamental research, BIS has adopted                   confirm whether the definition would                   (c) text was taken without change from
                                                the substance of former § 734.11,                       carve out from the definitions of                      § 734.2(b)(6).)
                                                Specific National Security Controls, in                 ‘‘export’’ and ‘‘reexport’’ the mere                      One commenter requested that BIS
                                                new Note 3 to paragraph (b) of § 734.8                  transfer of ownership to an entity                     clarify ‘‘new country.’’ BIS accepts this
                                                in this final rule. This final rule removes             outside of a Country Group D:5 country                 comment, and adopts the term
                                                and reserves § 734.11.                                  (e.g., as part of an on orbit transfer of              ‘‘destination’’ in this final rule. BIS also
                                                                                                        ownership to an entity outside a D:5                   drops the term ‘‘transshipped,’’ because
                                                Export                                                  country) of satellites subject to the EAR              the intended meaning of this paragraph
                                                   The June 3 proposed rule included a                  that are eligible for License Exception                is captured by ‘‘transit.’’ One
                                                new § 734.13 to define ‘‘Export.’’                      STA. BIS confirms this understanding of                commenter recommended that BIS
                                                Section 734.13(a) had six paragraphs,                   the definition and is adding an FAQ                    specify that paragraph (c) applies to
                                                with paragraphs (a)(4) and (5) reserved,                regarding the point to the BIS Web site.               items ‘‘subject to the EAR.’’ BIS does not
                                                because the corresponding paragraphs                       Proposed paragraph (a)(6) defined as                believe the phrase is necessary.
                                                in the ITAR contained provisions that                   an export the release or other transfer of                Two commenters requested that BIS
                                                were not relevant to the EAR. One                       the means of access to encrypted data.                 clarify the status of services under the
                                                commenter noted that paragraph (a) had                  This paragraph was not adopted in this                 EAR. Unlike the ITAR, the EAR do not
                                                a typo and should refer to § 734.18, not                final rule (see the section discussing                 control services as such except as
                                                § 734.17. BIS does not agree—the                        transfer of access information in                      described in § 744.6(a)(2) (‘‘Restrictions
                                                reference is to the subset of exports of                § 734.19 below). Without a paragraph                   on certain activities of U.S. persons’’)
                                                encryption source code and object code                  (a)(6), reserved paragraphs (a)(4) and                 and § 736.2(b)(10) (‘‘General Prohibition
                                                software—but does accept the                            (a)(5) that appeared in the June 3 rule                10’’). Section 744.6(a)(2) imposes
                                                recommendation to add a reference to                    are unnecessary and, therefore, do not                 licensing requirements on the
                                                § 734.18 (Activities that are not exports,              appear in this final rule.                             performance by U.S. persons of any
                                                reexports, or transfers) in this final rule.               As adopted in this final rule,                      contract, service, or employment
                                                   Proposed paragraph (a)(1) of the                     proposed paragraph (b) of § 734.13 is                  regarding various activities pertaining to
                                                definition of ‘‘export’’ used the EAR                   unchanged from the June 3 rule, except                 missiles, biological weapons, and
                                                terms ‘‘actual shipment or transmission                 for the substitution of the term ‘‘foreign             chemical weapons in various countries.
                                                out of the United States,’’ combined                    person’’ for ‘‘foreign national.’’ This                General Prohibition 10 prohibits, inter
                                                with the existing ITAR ‘‘sending or                     paragraph retains BIS’s deemed export                  alia, servicing an item subject to the
                                                taking an item outside the United States                rule as set forth in § 734.2(b). It also               EAR if a violation has occurred, is about
                                                in any manner.’’                                        codifies a long-standing BIS policy that               to occur, or is intended to occur in
                                                   One commenter recommended that                       when technology or source code is                      connection with the item. Except for
                                                BIS add ‘‘release’’ after ‘‘actual                      released to a foreign national, the export             these provisions, the EAR regulates the
                                                shipment.’’ BIS does not adopt this                     is ‘‘deemed’’ to occur to that person’s                export, reexport, and transfer (in-
                                                recommendation, because release is a                    most recent country of citizenship or                  country) of commodities, technology,
                                                separate concept and thus a separately                  permanent residency. See, e.g., 71 FR                  and software, regardless of whether
                                                defined term. BIS makes no revisions to                 30840 (May 31, 2006).                                  such activities are in connection with a
                                                this paragraph (a)(1) in this final rule.                  Four commenters raised deemed                       service. This means that, except with
mstockstill on DSK3G9T082PROD with RULES




                                                   Proposed paragraph (a)(2), specifying                export issues, particularly with respect               respect to activities described in these
                                                the concept of transfer or release of                   to the difficulty of determining the                   two provisions, services do not need to
                                                technology to a foreign national in the                 ‘‘permanent residency’’ status of a                    be analyzed separately for purposes of
                                                United States, or ‘‘deemed export,’’                    person in a foreign country. Two of                    determining requirements under the
                                                retains the treatment of software source                these commenters recommended                           EAR. Moreover, the ITAR does not
                                                code as technology for deemed export                    changing ‘‘permanent residency’’ to                    impose controls on services unless they
                                                purposes from § 734.2(b)(2)(ii). In this                ‘‘legal residency’’ or establishing criteria           are ‘‘directly related’’ to a ‘‘defense


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00011   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                35592                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                article,’’ i.e., an article, software, or               a release of the technology required, for              in this final rule. BIS has, however,
                                                technical data described on the ITAR’s                  example, to develop or produce it. A                   created FAQs that include the points
                                                U.S. Munitions List at 22 CFR 121.1. In                 foreign person’s having theoretical or                 and examples contained in the foregoing
                                                response to the commenters, BIS has                     potential access to technology or                      description of the changes to the
                                                added this explanation to its FAQs. A                   software is similarly not a ‘‘release’’                definition of ‘‘release.’’
                                                core goal of the ECR initiative was to                  because such access, by definition, does                  One commenter recommended that
                                                make the distinctions in the ITAR and                   not reveal technology or software. A                   paragraph (a)(6) in the June 3 rule’s
                                                the EAR regarding the scope of controls                 release would occur when the                           proposed definition of ‘‘export,’’ which
                                                over services as such clear. Thus, after                technology or software is revealed to the              addressed transfer of decryption keys or
                                                the publication of the FAQs, if                         foreign person. The June 3 rule also                   other such information, be moved to the
                                                commenters believe that provisions of                   proposed adding ‘‘written’’ to ‘‘oral                  definition of ‘‘release.’’ Related to the
                                                the ITAR or the EAR, statements by                      exchanges’’ in paragraph (a)(2) as a                   revisions regarding transfer of access
                                                government officials, or any other                      means of release. No commenters                        information, and consistent with this
                                                government actions contradict this point                objected to the clarification, and it                  commenter’s recommendation, this final
                                                regarding the narrow scope of controls                  remains unchanged. This final rule adds                rule adopts in § 734.15(b) a provision
                                                over services pertaining to items subject               ‘‘source code’’ as well as ‘‘technology’’              stating that the act of causing the
                                                to the EAR, they are encouraged to                      to paragraph (a)(2) for consistency with               ‘‘release’’ of ‘‘technology’’ or ‘‘software,’’
                                                contact BIS to begin the process of                     paragraph (a)(1) and the definitions of                through use of ‘‘access information’’ or
                                                resolving the issue.                                    deemed export and reexport; its                        otherwise, to onesself or another person
                                                                                                        omission from the June 3 rule was                      requires an authorization to the same
                                                Reexport                                                                                                       extent an authorization would be
                                                                                                        inadvertent.
                                                   The June 3 rule proposed moving the                     The proposed text also clarified, in                required to export or reexport such
                                                definition of ‘‘reexport’’ to new § 734.14.             paragraph (a)(3), that the application of              ‘‘technology’’ or ‘‘software’’ to that
                                                In general, the provisions of the                       ‘‘technology’’ and ‘‘software’’ is a                   person.
                                                proposed definition of ‘‘reexport’’                     ‘‘release’’ in situations where U.S.                      The purpose of this provision is to
                                                paralleled those of the proposed                        persons abroad use personal knowledge                  make it clear that the person who uses,
                                                definition of export discussed above,                   or technical experience acquired in the                for example, a password to access a
                                                except that reexports occur outside of                  United States in a manner that reveals                 technology database, or who hacks into
                                                the United States. Public comments on                   technology or software to foreign                      the database, to transfer technology to
                                                the definition of ‘‘reexport’’ and BIS                  nationals. As indicated by various BIS                 himself or someone else is the one who
                                                responses also mirror those discussed                   training materials and statements of BIS               caused the release of technology rather
                                                above for ‘‘export.’’                                   officials publicly and in response to                  than the person who first placed the
                                                   One commenter recommended that                       specific questions, this clarification                 technology in the database through a
                                                BIS specify ‘‘subject to the EAR’’ in                   makes explicit a long-standing BIS                     technology export or an act described in
                                                paragraphs (a)(1), (a)(2), and (a)(4) of                interpretation of the EAR. The June 3                  new § 734.18(a)(5). This provision
                                                ‘‘reexport.’’ BIS accepts this                          rule’s proposed definition did not use                 codifies that basic concept that the
                                                recommendation, except for paragraph                    the existing phrase ‘‘visual inspection                unwitting victim of, for example, a
                                                (a)(4). Paragraph (a)(4) in the June 3 rule             by foreign nationals of U.S.-origin                    database hack is not the one responsible
                                                proposed to define as a reexport the                    equipment and facilities’’ because such                for the theft of technology—the hacker
                                                release or other transfer of the means of               inspections do not per se release                      is the one responsible because it is that
                                                access to encrypted data outside of the                 ‘‘technology.’’ For example, merely                    person who caused the release through
                                                United States to a foreign national. This               seeing equipment does not necessarily                  the use of a password or other access
                                                paragraph was not adopted in this final                 mean that the seer is able to glean any                information. This provision is merely an
                                                rule (see the section discussing transfer               technology from it and, in any event,                  application with respect to intangibles
                                                of access information in § 734.19                       not all visible information pertaining to              of a concept that is basic to tangible
                                                below).                                                 equipment is necessarily ‘‘technology’’                items—the export of an item is not the
                                                   One commenter requested that BIS                     subject to the EAR.                                    cause of a third person’s later reexport
                                                confirm that sending an item back to the                   Four commenters stated that this                    of the same item. Placing technology
                                                United States is not a reexport. BIS                    redefinition of ‘‘release’’ was helpful.               into a database is not the cause of a
                                                confirms that sending items to the                         Three comments expressed concern                    third person’s later transfer of the
                                                United States is not a ‘‘reexport.’’                    that paragraph (a)(1) is not sufficiently              technology through the use of access
                                                Moreover, unlike the ITAR, the EAR                      explicit in clarifying that visual                     information. The third person’s use of
                                                have no provisions controlling or                       inspection must ‘‘actually’’ or                        the access information is the cause of
                                                otherwise pertaining to the act of                      ‘‘substantively’’ reveal technology in                 the release to himself or others.
                                                importing items into the United States.                 order to be defined as a ‘‘release,’’ or                  Although the person who originally
                                                BIS will confirm these points in an                     that ‘‘actual access’’ rather than                     placed the technology into the database
                                                FAQ.                                                    ‘‘theoretical access’’ is caught. BIS                  did not cause its release to the third
                                                                                                        believes that the intent is clear and that             person who used access information to
                                                Release                                                 the text only would be complicated by                  later cause the technology to be
                                                   The June 3 proposed rule included a                  additional modifications. One                          released, the person who originally
                                                definition of ‘‘release’’ in a new                      commenter requested that BIS simplify                  placed the technology into the database
                                                § 734.15. The proposed text provided                    the provision in which application of                  nonetheless would have liability in
mstockstill on DSK3G9T082PROD with RULES




                                                that inspection (including other types of               personal knowledge constitutes a                       connection with the third party
                                                inspection in addition to visual, such as               release. Upon further consideration, BIS               technology exfiltration if, for example, it
                                                aural or tactile) must actually reveal                  determined that the control criteria in                conspired with the exfiltrator (see
                                                technology or source code subject to the                that provision are already covered by                  § 764.2(d)) or placed the technology into
                                                EAR to constitute a ‘‘release.’’ Thus, for              the provisions governing inspection and                the database with ‘‘knowledge’’ that the
                                                example, merely seeing an item briefly                  oral or written exchanges. Therefore,                  exfiltrator would later violate the EAR
                                                is not necessarily sufficient to constitute             BIS does not adopt this paragraph (a)(3)               by causing its release without a required


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00012   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                                      Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations                                          35593

                                                license (see § 764.2(e)). Similarly,                    violated any of the provisions of section                 Paragraph (a)(1) in the June 3
                                                liability would arise from a violation of               764.2 (‘‘violations’’).                                proposed rule stated that by statute,
                                                new section 734.19, which, as discussed                    To assist the commenters and others                 launching a spacecraft, launch vehicle,
                                                below, states that providing a password                 who have questions about BIS’s policy                  payload, or other item into space is not
                                                or other access information to someone                  regarding when a license or other                      an export. See 51 U.S.C. 50919(f). BIS
                                                with ‘‘knowledge’’ that the provision                   authorization is required for in-country               received no comments on this paragraph
                                                would result in the release of                          transfers, BIS has made the following                  and adopts it in this final rule.
                                                technology or software to the third                     the standard first condition on its                       Paragraph (a)(2) in the June 3
                                                person is tantamount to releasing the                   licenses: ‘‘Items subject to the EAR and               proposed rule was based on text in
                                                technology or software itself to the third              within the scope of this license may not               former § 734.2(b)(2)(ii) of the EAR, and
                                                person. BIS has created FAQs describing                 be reexported or transferred (in-country)              provided that release in the United
                                                all the points in the foregoing examples.               unless such reexport or in-country                     States of technology or software to U.S.
                                                   Finally, and in contrast to section                  transfer is (i) authorized by this license,            nationals, permanent residents, or
                                                734.19, new section 734.15(b) does not                  or another license or other approval                   protected individuals would not be an
                                                contain a ‘‘knowledge’’ element. Thus, a                issued by the U.S. Government; (ii)                    export. In this final rule, the term
                                                ‘‘release’’ of ‘‘technology’’ or ‘‘software’’           authorized by a license exception or                   ‘‘release’’ has been replaced in
                                                occurs when access information is used                  other authorization under the Export                   § 734.18(a)(2) with ‘‘transmitting or
                                                to transfer the ‘‘technology’’ or                       Administration Regulations (EAR); or                   otherwise transferring,’’ and the
                                                ‘‘software’’—resulting in liability if the              (iii) to a destination, end user, and end              previous reference to U.S. persons,
                                                release was not undertaken pursuant to                  use that would be ‘‘NLR’’ (No License                  permanent residents, and protected
                                                a required authorization and regardless                 Required) under the EAR.’’                             individuals has been eliminated in favor
                                                of whether the one using the access                                                                            of a reference to a person ‘‘who is not
                                                                                                        Export of Encryption Source Code and
                                                information knew it would be                                                                                   a foreign person’’ for reasons of clarity
                                                                                                        Object Code Software
                                                transferring controlled ‘‘technology’’ or                                                                      and brevity. The EAR contain three
                                                                                                          The June 3 proposed rule included a                  definitions of ‘‘U.S. person,’’ only one of
                                                ‘‘software’’ when it did so.
                                                                                                        new § 734.17, export of encryption                     which is applicable to this section.
                                                Transfer (In-Country)                                   source code and object code software,                  Additionally, the ITAR use the term
                                                                                                        that retained the text of § 734.2(b)(9)                ‘‘foreign person,’’ and a comment from
                                                   The June 3 rule proposed removing
                                                                                                        with only minor conforming and                         a BIS technical advisory committee
                                                the definition of ‘‘transfer (in-country)’’
                                                                                                        clarifying edits. Its relocation to a new,             recommended adopting the term in the
                                                from § 772.1 and adding the following
                                                                                                        separate section, following similar                    EAR. ‘‘Foreign person’’ accordingly is
                                                revised definition to new § 734.16: ‘‘a
                                                                                                        definitions improves its accessibility to              defined in a new entry in § 772.1.
                                                transfer (in-country) is a change in end                                                                          The change creates a structure parallel
                                                                                                        exporters.
                                                use or end user of an item within the                     BIS received no comments on its                      to that which is being adopted in the
                                                same foreign country.’’ This revision                   proposed minor revisions to                            State rule published concurrently with
                                                was intended to eliminate any potential                 § 734.2(b)(9) or its creation of § 734.17.             this final rule, and to make clear that
                                                ambiguity regarding whether a change                    These revisions are adopted in this final              transmission from one U.S. person in
                                                in end use or end user within a foreign                 rule.                                                  the United States to another, regardless
                                                country is a ‘‘transfer (in-country).’’                                                                        of the means or route of the
                                                ‘‘Transfer (in-country)’’ parallels the                 Activities That Are Not Exports,
                                                                                                                                                               transmission, does not constitute an
                                                term ‘‘retransfer’’ in the ITAR.                        Reexports, or Transfers
                                                                                                                                                               export. Along the same lines, paragraph
                                                   Four commenters said that this                          The June 3 proposed rule solicited                  (a)(3) is added to clarify that the
                                                revision expands controls, and that such                public comment on two questions                        transmission between or among U.S.
                                                changes were beyond exporters’                          regarding the proposed definition of                   persons within the same foreign country
                                                knowledge or control. While BIS                         ‘‘Activities that are not exports,                     similarly does not constitute an export,
                                                acknowledges that ‘‘end use’’ was not                   reexports, or transfers.’’ First, with                 reexport, or transfer. The State June 3
                                                explicitly included in the former                       respect to end-to-end encryption, BIS                  rule received comments recommending
                                                definition of ‘‘transfer (in-country),’’ a              asked whether the illustrative standard                these revisions, and this final rule
                                                change in end use is nonetheless a                      proposed in the EAR rulemaking also                    adopts them in the EAR to stay parallel
                                                material change. When BIS and the                       should be adopted in the ITAR                          with the ITAR text.
                                                other agencies review an application’s                  rulemaking; whether the safe harbor                       Proposed paragraph (a)(3) in the June
                                                description of a proposed end use and                   standard proposed in the ITAR                          3 rule contained text from § 734.2(b)(8)
                                                approve the license based on that end                   rulemaking also should be adopted in                   stating that shipments between or
                                                use, BIS is approving the transaction for               the EAR rulemaking; or whether the two                 among the states or possessions of the
                                                the end use described, not all other end                bodies of regulations should have                      United States are not ‘‘exports’’ or
                                                uses in the same country. Other end                     different standards. Second, BIS asked                 ‘‘reexports.’’ The words ‘‘moving’’ and
                                                uses may or may not be acceptable, but                  whether encryption standards                           ‘‘transferring’’ were inserted next to
                                                a change in end use from that which the                 adequately address data storage and                    ‘‘shipment’’ in order to avoid suggesting
                                                U.S. Government reviewed would be                       transmission issues with respect to                    that the only way movement between or
                                                material in that there is the possibility               export controls.                                       among the states or possessions would
                                                that another end use may not have been                     As proposed, § 734.18 gathered                      not be a controlled event was if they
                                                approved. BIS further notes that,                       existing EAR exclusions from exports,                  were ‘‘shipped.’’ BIS received no
mstockstill on DSK3G9T082PROD with RULES




                                                depending on the facts of the                           reexports, and transfers into one place,               comments on this paragraph and adopts
                                                transaction, the foreign party may be                   and included a new exemption for                       it in this final rule, renumbered as
                                                responsible for obtaining authorization                 encrypted technical data and software.                 paragraph (a)(4).
                                                for the subsequent disposition of the                   A number of changes and adjustments                       Paragraph (a)(5)—numbered (a)(4) in
                                                item subject to the EAR. If a violation                 are made in this final rule to the                     the June 3 proposed rule—provides that
                                                occurs, BIS will assess responsibility                  proposed text in response to comments                  technology and software that is
                                                based on whether the parties involved                   received from the public.                              encrypted in accordance with certain


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00013   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                35594                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                specified criteria are not exports,                        The June 3 proposed rule’s definition               carve-out, preferring instead no
                                                reexports, or transfers even when they                  of end-to-end encryption included a                    reference to a standard, or a reference to
                                                leave one country for another. In the                   clause that specified that data not be                 any ‘‘commercially reasonable’’
                                                June 3 proposed rule, this paragraph                    decrypted at any point between the                     standard.
                                                specifically excluded from this carve-                  initiation of the transmission by the                     BIS rejects these suggestions. FIPS
                                                out technology and software stored in                   originator and its receipt by the                      140–2 is a well-understood
                                                countries in Country Group D:5 and                      intended recipient. The purpose of this                cryptographic standard used for Federal
                                                Russia, for foreign policy reasons. In                  requirement was to prevent                             Government procurement in the United
                                                response to comments pointing out that                  unauthorized access to data in clear text              States and Canada, as well as for many
                                                Internet traffic in transit across D:5                  by parties other than the originator (or               other uses, both in the U.S. and abroad.
                                                countries and Russia may be technically                 the originator’s company or                            Citation of this standard provides a
                                                ‘‘stored’’ temporarily on servers located               organization) and the recipient, such as               useful reference point for what the U.S.
                                                in these countries without the                          external service providers.                            Federal Government considers effective
                                                knowledge of the sender, BIS has added                     Commenters pointed out that in many                 encryption.
                                                text in (a)(5) specifying that the carve-               circumstances, companies and                              The text adopted in this final rule
                                                out continues to apply to technology not                organizations encrypt and decrypt                      allows for use of ‘‘equally or more
                                                authorized under the EAR for storage in                 multiple times in the course of                        effective cryptographic means,’’
                                                these countries or intended for storage                 transmission between originator and                    meaning that alternative approaches are
                                                in these countries. Encrypted data may                  recipient for technical reasons (for                   allowable provided that they work as
                                                not be stored in these countries unless                 example, to initially establish                        well as or better than FIPS 140–2. In
                                                an appropriate authorization is available               communications with a VPN server and                   such cases, the exporter is responsible
                                                or has been approved. BIS has also                      subsequently to transmit among servers)                for ensuring that the alternative
                                                added a note clarifying that data in-                   without release to any third party. As a               approaches work as well as or better
                                                transit via the Internet is not deemed to               result, the point-to-point requirement in              than FIPS 140–2, regardless of common
                                                be stored. For a more complete                          the original proposal would impose an                  commercial practices.
                                                                                                        unnecessary and potentially disruptive                    In the June 3 proposed rule, paragraph
                                                understanding of § 734.18(a)(5), see the
                                                                                                        burden on many encryption                              (c) confirmed that the mere ability to
                                                discussion above of § 734.15(b).
                                                                                                        applications, in which data in clear text              access ‘‘technology’’ or ‘‘software’’
                                                   BIS received many comments on the                                                                           while it is encrypted in a manner that
                                                                                                        are never actually shared.
                                                proposed definition of ‘‘end-to-end                                                                            satisfies the requirements in the section
                                                                                                           To address this problem and more
                                                encryption,’’ the presence of which is a                                                                       does not constitute the ‘‘release’’ or
                                                                                                        precisely describe BIS’s original intent
                                                condition of the export control carve-out               with the provision, BIS eliminated the                 export of such ‘‘technology’’ or
                                                for technology and software.                            statement in the end-to-end definition                 ‘‘software.’’ This responds to a common
                                                Commenters observed that encryption                     specifying that exempted data must be                  industry question on the issue. This
                                                and decryption services may be                          encrypted by the originating party                     final rule adopts the proposed text with
                                                provided within defined security                        without decryption except by the                       only a minor revision to correct a cross-
                                                boundaries by organizational rather than                intended recipient. This final rule                    reference.
                                                personal systems or servers. BIS agrees                 adopts instead a requirement that the
                                                that in such cases, the security                                                                               Transfer of Access Information
                                                                                                        means of decryption may not be
                                                objectives of the ‘‘end-to-end’’                        provided to any third party, thus                         New § 734.18(a)(5)(iii) excludes
                                                requirement in terms of eliminating                     permitting decryption and re-encryption                transfers of information encrypted to a
                                                access by third parties can still be met                within the security boundary of either                 particular standard as not being exports,
                                                by expanding the definition of ‘‘end-to-                the originator or recipient, provided that             reexports, or transfers and, thus, not
                                                end’’ to include transmissions between                  no third party (i.e., a party outside the              subject to the EAR. Logically, providing
                                                security boundaries.                                    security boundary) has the ability to                  keys or other information that would
                                                   This approach has the added                          access the data in clear text, and that no             allow access to encrypted data exported,
                                                advantages of providing more flexibility                decryption takes place outside of the                  reexported, or released under this
                                                and allowing the execution of shared                    security boundaries of the originator                  provision should be subject to controls
                                                services, such as virus scanning, that                  and the recipient.                                     much as the export, reexport, or transfer
                                                can enhance security. However, BIS has                     The June 3 proposed rule’s paragraph                of the data itself. In the June 3 proposed
                                                also specified that the ‘‘security                      (4)(iii), which this final rule adopts in              rule, this concept was specifically
                                                boundary’’ must be in-country—that is,                  paragraph (5)(iii), described encryption               addressed in proposed § 734.13(a)(6) as
                                                such boundaries cannot be defined as                    standards that would qualify for the                   part of the definition of ‘‘export.’’ The
                                                including infrastructure resources                      exemption. In the BIS proposed rule,                   June 3 rule also proposed adding a new
                                                encompassing multiple countries. A                      use of encryption modules certified                    paragraph (l) to § 764.2 ‘‘Violations’’
                                                consequence of this requirement is that                 under the Federal Information                          providing that the unauthorized release
                                                data eligible for the carve-out must by                 Processing Standards Publication 140–2                 of decryption keys or other information
                                                definition be encrypted before crossing                 (FIPS 140–2), supplemented by                          that would allow access to particular
                                                any national boundary and must remain                   appropriate software implementation,                   controlled technology or software would
                                                encrypted at all times while being                      cryptographic key management and                       constitute a violation to the same extent
                                                transmitted from one security boundary                  other procedures or controls that are in               as a violation in connection with the
                                                to another. This principle applies to                   accordance with guidance provided in                   export of the underlying controlled
mstockstill on DSK3G9T082PROD with RULES




                                                transmissions within a cloud service                    current U.S. National Institute for                    ‘‘technology’’ or ‘‘software.’’
                                                infrastructure, where a transmission                    Standards and Technology publications,                    Although recognizing the need to
                                                from one node or cloud infrastructure                   would qualify as sufficient security.                  control the decryption of controlled
                                                element to another could qualify for the                   A number of commenters questioned                   technical data otherwise exempted by
                                                carve-out provided that it was                          the designation of the FIPS 140–2 as an                the encryption carve-out, commenters
                                                appropriately encrypted before any data                 example of effective cryptography and                  noted that this construction might lead
                                                crossed a national border.                              thus a qualification for the control                   to the conclusion that keys and other


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00014   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                                      Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations                                           35595

                                                data permitting access might be                         Activities That Are Not Deemed                         phrase ‘‘permanent and regular
                                                controlled as separate stand-alone items,               Reexports                                              employee’’ was a combination of BIS’s
                                                distinct from the underlying data that                     The June 3 proposed rule created a                  definition of ‘‘permanent employee,’’ as
                                                they could potentially release. This                    new § 734.20, Activities that are not                  set forth in a BIS advisory opinion
                                                would pose problems with key and                        Deemed Reexports. This section                         issued on November 19, 2007 (available
                                                identity management, where such data                    codified BIS’s interagency-cleared                     on the BIS Web site), and the ITAR’s
                                                are stored and transmitted separately.                  Deemed Reexport Guidance previously                    definition of ‘‘regular employee’’ in
                                                Controlling access information as a                     posted on the BIS Web site and dated                   § 120.39. The June 3 proposed rule
                                                distinct item was not the intent of the                 October 31, 2013. This guidance was                    added specific text excluding persons
                                                proposal. As also discussed below with                  created so that the provisions regarding               proscribed under U.S. law to make clear
                                                respect to the definition of                                                                                   that § 734.20 does not authorize release
                                                                                                        possible deemed reexports contained in
                                                ‘‘technology,’’ one commenter stated                                                                           of technology to persons proscribed
                                                                                                        §§ 124.16 and 126.18 of the ITAR would
                                                that decryption keys and other such                                                                            under U.S. law, and defined ‘‘proscribed
                                                                                                        be available for EAR technology and
                                                information are not technology and                                                                             person’’ in § 772.1. (Note: The U.S.-U.K.
                                                                                                        source code in addition to legacy BIS
                                                recommended moving the proposed                                                                                Exchange of Notes and U.S.-Canadian
                                                                                                        guidance on the topic.
                                                paragraph (a)(5) text to the definition of                                                                     Exchange of Letters referred to in the
                                                                                                           Under BIS’s legacy guidance and new
                                                ‘‘release’’ and control ‘‘accessing’’ them.                                                                    existing online guidance can be found
                                                                                                        § 734.20, release of technology or source
                                                To address the concerns of such                                                                                on the State Department’s Web site. The
                                                                                                        code by an entity outside the United
                                                commenters, this final rule creates a                                                                          URLs for the letters are not being
                                                                                                        States to a foreign national of a country
                                                new positive authorization requirement                                                                         published in the EAR because URL
                                                                                                        other than the foreign country where the
                                                in a new § 734.19, stating that ‘‘[t]o the                                                                     addresses periodically change. BIS will
                                                                                                        release takes place does not constitute a
                                                extent an authorization would be                                                                               place the URL references in an ‘‘FAQ’’
                                                                                                        deemed reexport of such technology or
                                                required to transfer ‘‘technology’’ or                                                                         section of its Web site.)
                                                                                                        source code if the entity is authorized to                One commenter stated that due to the
                                                ‘‘software,’’ a comparable authorization                receive the technology or source code at
                                                is required to transfer access                                                                                 number of conditions contained in these
                                                                                                        issue, whether by a license, license                   provisions, this section should be a
                                                information if with ‘‘knowledge’’ that                  exception, or in situations where no
                                                such transfer would result in the release                                                                      license exception. BIS does not agree.
                                                                                                        license is required under the EAR for                  Many if not most of the transactions to
                                                of such ‘‘technology’’ or ‘‘software’’                  such technology or source code and the
                                                without a required authorization.’’ Five                                                                       which these provisions apply are
                                                                                                        foreign national’s most recent country of              already covered by a license or a license
                                                commenters found use of the term                        citizenship or permanent residency is
                                                ‘‘cause or permit’’ inconsistent with                                                                          exception; this section will generally
                                                                                                        that of a country to which export from                 allow affected entities to comply with
                                                BIS’s principle of an export’s occurring                the United States of the technology or
                                                only when actual export or transfer                                                                            the terms of those authorizations in a
                                                                                                        source code at issue would be                          rational way that will meet U.S. control
                                                takes place. This final rule replaces the               authorized by the EAR either under a
                                                former reference to ‘‘cause or permit’’                                                                        objectives while minimizing conflict
                                                                                                        license exception, or in situations where              with non-U.S. entities’ domestic
                                                with ‘‘result in.’’                                     no license under the EAR would be                      requirements.
                                                   One commenter requested ‘‘the                        required.                                                 Two commenters requested that BIS
                                                removal of § 764.2(l) in its entirety as                   Release of technology or source code                replace ‘‘is certain’’ of a foreign person’s
                                                the current language of § 764.2 is                      by an entity outside the United States to              most recent country of citizenship or
                                                adequate.’’ With creation of new                        a foreign national of a country other                  permanent residency with ‘‘has
                                                § 734.19, and in light of the availability              than the foreign country where the                     knowledge,’’ to address concerns about
                                                of § 764.2 to punish any violation of                   release takes place also does not                      ability to comply with such a standard.
                                                § 734.19, BIS accepts this comment and                  constitute a deemed reexport if: (i) The               BIS agrees with this comment and
                                                does not adopt the proposed § 764.2(l)                  entity is authorized to receive the                    adopts ‘‘has ’knowledge’’’ in this final
                                                in this final rule.                                     technology or source code at issue,                    rule.
                                                   To simplify this section, proposed                   whether by a license, license exception,                  One commenter requested that BIS
                                                references to ‘‘decryption keys, network                or through situations where no license                 add ‘‘or within the physical territory of
                                                access codes, passwords and other                       is required under the EAR; (ii) the                    the United States’’ to certain provisions
                                                information,’’ are replaced with a new                  foreign national is a bona fide regular                to account for the possibility of releases
                                                § 772.1 definition of ‘‘access                          and permanent employee (who is not a                   in the United States, because often
                                                information,’’ which uses these as                      proscribed person) of the entity; (iii)                ‘‘release of U.S.-origin technology or
                                                examples only of information that                       such employee is a national exclusively                software could be said to take place
                                                allows access to encrypted technology                   of a country in Country Group A:5; and                 partially within the United States and
                                                or encrypted software in an                             (iv) the release of technology or source               partially within the country in which
                                                unencrypted format. In response to a                    code takes place entirely within the                   the foreign person employee is located;’’
                                                commenter’s request for a definition of                 physical territory of any such country,                BIS accepts this request. Another
                                                ‘‘clear text,’’ this final rule replaces                or within the United States.                           commenter requested that for releases to
                                                references to ‘‘clear text’’ with ‘‘in an                  For nationals other than those of                   A:5 nationals, BIS ‘‘also include
                                                unencrypted form,’’ as part of the                      Country Group A:5 countries, which are                 countries where the entity conducts
                                                definition of ‘‘access information.’’                   close military allies of the United States,            official business or operates, which is
                                                   References in the June 3 proposed                    other criteria may apply. In particular,               part of § 734.20(c) Release to other than
mstockstill on DSK3G9T082PROD with RULES




                                                rule to what is termed ‘‘access                         the section specifies the situations in                A:5 nationals.’’ BIS did not adopt this
                                                information’’ in this final rule (e.g.,                 which the releases would not constitute                request because it would expand the
                                                references to decryption keys) were                     deemed exports in a manner consistent                  provision too broadly.
                                                eliminated in the § 772.1 definition of                 with § 126.18 of the ITAR. For purposes                   Two commenters requested that BIS
                                                ‘‘technology,’’ the § 734.13 definition of              of this section, ‘‘substantive contacts’’              cross reference the ‘‘deemed reexport’’
                                                export, and the § 734.14 definition of                  has the same meaning as it has in                      definition in § 734.14(b). BIS accepts
                                                reexport.                                               § 126.18 of the ITAR. The proposed                     this request. One commenter asked BIS


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00015   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                35596                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                to clarify that this section addresses                  into part 734 or elsewhere in the EAR.                 ‘‘technology’’ subject to the EAR and
                                                non-U.S. entities. BIS believes that this               BIS is publishing on its Web site FAQs                 that is not described on the CCL is
                                                is clear from context and is thus not                   that will cover the same guidance that                 designated EAR99. One commenter
                                                changing the rule in response to this                   was found in Supplement No. 1, in                      recommended including a note that
                                                comment. However, BIS is including a                    addition to answers to other questions                 refers to the General Technology Note.
                                                description of the purpose of this                      generated by the public comments to the                BIS accepts this comment and includes
                                                section in its FAQs.                                    proposed rule. Questions regarding how                 the reference in this final rule.
                                                   Two commenters objected to the                       regulations apply to specific fact
                                                requirement that employees must be                                                                             ‘‘Use’’ Elements
                                                                                                        patterns are better set out in FAQs. In
                                                engaged for a year to be eligible for these             sum, although Supplement No. 1 will                       As explained in the preamble to the
                                                provisions and asked that it be removed.                no longer be in the EAR, all its content               June 3 rule, the proposed definition of
                                                Additionally, two commenters objected                   will be placed into FAQs on BIS’s Web                  ‘‘technology’’ was based on the
                                                to the associated screening and                         site in addition to the other FAQs                     Wassenaar Arrangement definition of
                                                recordkeeping requirements and asked                    referred to in this preamble.                          technology, including the Wassenaar-
                                                that they be reduced. BIS does not                                                                             defined sub-definitions of
                                                accept these comments. The year-long                    Technology                                             ‘‘development,’’ ‘‘production,’’ and
                                                period and the screening and                               In the June 3 proposed rule, paragraph              ‘‘use,’’ which are currently defined in
                                                recordkeeping requirements reduce the                   (a)(1) of the definition of technology                 § 772.1. (No changes were proposed to
                                                risk of diversion associated with the                   reads as follows: ‘‘Information necessary              the definitions of ‘‘development,’’
                                                technology release.                                     for the ‘‘development,’’ ‘‘production,’’               ‘‘production,’’ and ‘‘use’’ in the June 3
                                                                                                        ‘‘use,’’ operation, installation,                      rule, and none are made in this final
                                                Questions and Answers—Technology                        maintenance, repair, overhaul, or                      rule.) The June 3 rule proposed no
                                                and Software Subject to the EAR                         refurbishing (or other terms specified in              change to BIS’s long-standing policy
                                                   The June 3 proposed rule removed                     ECCNs on the CCL that control                          that all six activities in the definition of
                                                Supplement No. 1 to part 734,                           ‘‘technology’’) of an item. ‘‘Technology’’             ‘‘use’’ (operation, installation (including
                                                ‘‘Questions and Answers—Technology                      may be in any tangible or intangible                   on-site installation), maintenance
                                                and Software Subject to the EAR’’ on the                form, such as written or oral                          (checking), repair, overhaul and
                                                basis that the questions and answers are                communications, blueprints, drawings,                  refurbishing) must be present for an
                                                illustrative rather than regulatory, and                photographs, plans, diagrams, models,                  item to be classified under an ECCN
                                                are therefore more appropriately posted                 formulae, tables, engineering designs                  paragraph that uses ‘‘use’’ to describe
                                                as Web site guidance than included in                   and specifications, computer-aided                     the ‘‘technology’’ controlled. (See 71 FR
                                                the EAR. BIS specifically solicited                     design files, manuals or documentation,                30842, May 31, 2006.) Drawing from
                                                comments on whether the questions and                   electronic media or information gleaned                this existing framework, the proposed
                                                answers in existing Supplement No. 1 to                 through visual inspection.’’                           definition of ‘‘technology’’ included the
                                                part 734 proposed to be removed have                       A note addressed modification of                    terms ‘‘operation, installation,
                                                criteria that should be retained in part                items. Proposed paragraphs (a)(2)                      maintenance, repair, overhaul, or
                                                734.                                                    through (a)(4) of the definition were                  refurbishing (or other terms specified in
                                                   Thirty commenters stated that BIS                    held in reserve to allow for the eventual              ECCNs on the CCL that control
                                                should not remove the questions and                     mirroring of the corresponding ITAR                    ‘technology’) of an item’’ because such
                                                answers from the EAR. Reasons cited for                 paragraph structure while not including                words are used to describe technology
                                                opposing removal of the supplement                      provisions that were not relevant to the               controlled in multiple ECCNs, often
                                                included that the questions and answers                 EAR. Proposed paragraph (a)(5)                         with ‘‘or’’ rather than the ‘‘and’’ found
                                                will not have the same weight on the                    described access information. Proposed                 in ‘‘use.’’
                                                BIS Web site as they do in the EAR; that                paragraph (b) described exclusions from                   One commenter recommended
                                                they are legally binding in the EAR; that               the definition of technology.                          inserting a Note in the definition of
                                                their removal will create uncertainty;                                                                         technology that states the BIS policy
                                                that their presence in EAR lessens the                  Required vs. Necessary                                 that all six elements are necessary for
                                                likelihood that interpretations will                       For the definition of ‘‘technology,’’               ‘‘use’’ technology. BIS does not adopt
                                                change outside the rulemaking process                   four commenters recommended that                       this recommendation in this final rule
                                                and promotes consistency of                             ‘‘necessary’’ be revised to read                       because the definition of ‘‘use’’ links the
                                                interpretation; and that other                          ‘‘required’’ to match the proposed ITAR                six elements with the conjunctive ‘‘and’’
                                                supplements contain regulatory                          definition. BIS does not adopt these                   rather than the disjunctive ‘‘or.’’ BIS
                                                information. One of these comments                      recommendations. ‘‘Required’’ is a                     nonetheless makes this point in an FAQ
                                                went on to say, ‘‘Accordingly,                          defined term that describes certain                    pertaining to the word ‘‘use’’ in the
                                                Supplement No. 1 must not be removed                    technology on the Commerce Control                     definition of ‘‘technology.’’ One
                                                unless all its substantive provisions are               List, and not all technology that is                   commenter recommended removing the
                                                adequately incorporated into Part 734 or                subject to the EAR is controlled on the                term ‘‘installation’’ from the definition
                                                elsewhere in the regulations’’ (emphasis                Commerce Control List. One commenter                   based on its use in the context of the
                                                supplied). BIS believes that the                        recommended restoring a note from the                  definition of defense services. BIS does
                                                adequate incorporation of substantive                   definition that existed in the EAR prior               not accept this comment. Many entries
                                                provisions is the key point behind the                  to publication of this rule, to the effect             on the Commerce Control List explicitly
                                                comments. This concern drove the                        that technology not elsewhere specified                control installation technology, and it is
mstockstill on DSK3G9T082PROD with RULES




                                                specific solicitation in the June 3 rule to             on the Commerce Control List is                        also an element of ‘‘use’’ technology.
                                                identify criteria in the Supplement that                designated as EAR99 unless it is not                   Three commenters recommended that
                                                should be retained in part 734. None of                 subject to the EAR. BIS does not accept                BIS remove the separate listing of the
                                                the thirty comments opposing removal                    this recommendation in this final rule                 six ‘‘use’’ elements or limit them to
                                                of this Supplement from the EAR                         because a regulatory change is not                     control of 600 series items. BIS does not
                                                identified any substantive provisions                   required to make the same point. BIS                   accept these recommendations. The six
                                                that were not adequately incorporated                   will, however, add an FAQ stating that                 elements may be listed separately in


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00016   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                                      Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations                                          35597

                                                entries on the Commerce Control List                    switch so that it would work in a                      descriptions should not be subject to the
                                                and are not limited to 600 series entries.              military aircraft. The modified switch—                EAR. One commenter thought that the
                                                                                                        the ‘‘dash one’’ model—is, in this                     term ‘‘systems’’ was too narrow. BIS did
                                                Information Gleaned Through Visual
                                                                                                        example, specially designed for a                      not adopt these recommendations.
                                                Inspection
                                                                                                        military aircraft and thus controlled                  Whether a particular technology is one
                                                   One commenter suggested dropping                     under ECCN 9A610.x. The technology                     that the possessor would readily share
                                                ‘‘or information gleaned through visual                 that is common to both switches is                     with competitors provides a fairly
                                                inspection’’ because it was a form or                   9E991, but the additional or different                 reliable test of whether that technology
                                                method of transfer, not what constitutes                technology to make the 9A610.x switch                  is subject to the EAR. With respect to
                                                technology. BIS adopts the                              is controlled under 9E610. That is, the                the breadth of the term ‘‘system,’’ BIS
                                                recommendation in this comment in                       technology additional or different that is             notes that this exclusion is not the only
                                                part. ‘‘Information gleaned through                     required to make the 9A991.d                           provision in the EAR under which
                                                visual inspection’’ is an example of a                  commercial aircraft switch into a                      technology may be determined to be not
                                                form of technology, with visual                         9A610.x switch is the technology for the               subject. BIS did remove the modifier
                                                inspection as the method of transfer.                   new, modified item. This example is                    ‘‘general,’’ because of its potential to be
                                                The list to which this example belongs,                 contained in an FAQ posted on the BIS                  ambiguous and subjective. BIS also did
                                                however, illustrates rather than defines                Web site.                                              not adopt in this final rule the exclusion
                                                ‘‘technology;’’ therefore, BIS adopts the                                                                      for ‘‘information on basic function or
                                                text as Note 1 to the definition of                     Decryption Keys
                                                                                                                                                               purpose of an item,’’ because the phrase
                                                ‘‘technology’’ in this final rule, limiting                One commenter stated that decryption                was too vague and substantively already
                                                the definition to what constitutes                      keys and other such information are not                addressed by other provisions.
                                                technology and illustrating the forms in                technology and recommended moving                         One commenter questioned the scope
                                                a note.                                                 the proposed paragraph (a)(5) text to the              of these exclusions from the definition
                                                   Another commenter suggested using                    definition of ‘‘release’’ and control                  of technology and another questioned
                                                ‘‘revealed’’ instead of ‘‘gleaned,’’ first to           ‘‘accessing’’ them. Another commenter                  how the exclusions from the definition
                                                align with ‘‘release,’’ and second,                     pointed out that keys may also be                      should be read in conjunction with the
                                                because ‘‘use of the term ‘glean’ implies               hardware or software. BIS agrees with                  provisions in the Scope part that make
                                                the value of the information is based on                these comments; therefore, BIS does not                items not subject to the EAR. Based on
                                                the capability of the viewer, which is                  adopt proposed paragraph (a)(5) in this                these comments, and as noted earlier in
                                                unknowable and unquantifiable. The                      final rule and adds text to the definition             the preamble to this final rule, the
                                                use of the term ‘reveal’ is a more                      of ‘‘release’’ regarding transfer of                   exclusion of ‘‘information on basic
                                                objective measure of what is provided                   ‘‘access information’’ (see also                       function or purpose of an item’’ is not
                                                by the visual inspection.’’ BIS agrees                  discussion above).                                     adopted and the remaining two
                                                and has adopted the term ‘‘revealed’’ in                                                                       exclusions are moved from the
                                                this final rule.                                        Exclusions
                                                                                                                                                               definition of technology to § 734.3(b)(3).
                                                                                                           The June 3 rule proposed adding three
                                                Modification Note                                       exclusions to clarify the limits of the                Required
                                                   The June 3 rule proposed adding a                    scope of the definition of ‘‘technology:’’                The June 3 proposed rule retained the
                                                note to address a common industry                       non-proprietary general system                         existing EAR definition of ‘‘required’’ in
                                                question about modification. The note                   descriptions; information on basic                     § 772.1, but added notes clarifying the
                                                read as follows: ‘‘The modification of an               function or purpose of an item; and                    application of the term. It removed
                                                existing item creates a new item and                    telemetry data as defined in note 2 to                 parenthetical references in the existing
                                                technology for the modification is                      Category 9, Product Group E (see                       definition to CCL Categories 4, 5, 6, and
                                                technical data for the development of                   Supplement No. 1 to Part 774 of the                    9 to avoid the suggestion that BIS
                                                the new item.’’                                         EAR).                                                  applies the definition of ‘‘required’’ only
                                                   Three commenters suggested                              The first two exclusions paralleled                 to the uses of the term in these
                                                revisions to this note. Two commenters                  exclusions in the ITAR and the third,                  categories. BIS has never had a separate
                                                described the note as overbroad or                      the exclusion of telemetry data,                       definition of ‘‘required’’ used elsewhere
                                                confusing. One commenter                                mirrored specific exclusions added to                  in the EAR, and this removal merely
                                                recommended adding ‘‘production’’ as                    both the ITAR and the EAR as part of                   eliminated a potential ambiguity and
                                                well as ‘‘development.’’ In this final                  recent changes regarding the scope of                  reflects long-standing BIS policy that
                                                rule, BIS has adopted a revision that                   U.S. export controls pertaining to                     ‘‘required’’ applies generally to
                                                clarifies and narrows the description of                satellites and related items. See 79 FR                ‘‘technology’’ entries on the CCL. (See,
                                                the technology for modification, and                    27417 (May 13, 2014).                                  e.g., the Advisory Opinion dated
                                                includes ‘‘production’’ technology. The                    One commenter recommended                           December 27, 2010 on the BIS Web site.)
                                                revised note reads as follows: ‘‘The                    excluding Build/Design-to-                             BIS received one comment praising the
                                                modification of the design of an existing               Specifications from the definition of                  removal of the references and none
                                                item creates a new item and technology                  technology and adding sub-definitions                  objecting to it; the revision is adopted in
                                                for the modified design is technology for               of different forms of technology. BIS                  this final rule. The definition of
                                                the development or production of the                    does not accept this recommendation in                 ‘‘required’’ contained an illustrative
                                                new item.’’ BIS created this note to                    this final rule because such                           example. BIS did not propose any
                                                address the fact that multiple variations               specifications are not always outside the              revisions to this example in the June 3
mstockstill on DSK3G9T082PROD with RULES




                                                of a product are usually created by one                 scope of the EAR’s definition of                       rule. In this final rule, however, BIS
                                                or more companies, and companies                        ‘‘development’’ or ‘‘production’’                      revises the example to make clear that
                                                often struggle with how to classify the                 technology. However, BIS will                          technology that is peculiarly responsible
                                                technology that is and is not common to                 incorporate information on this topic                  for the characteristics of the item that
                                                the variations. Consider, for example, a                into its FAQs. Five commenters objected                make it controlled is thus ‘‘required’’
                                                company that makes a 9A991.d civil                      to use of the term ‘‘non-proprietary,’’                technology. This subtle change thus
                                                aircraft switch. It later modifies the                  arguing that certain proprietary system                responds to the question of which


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00017   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                35598                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                technology is ‘‘peculiarly responsible’’                ‘‘peculiarly responsible’’ below.) Rather,             defense article, then it is subject to the
                                                but without changing the well-                          DDTC and BIS have determined that a                    ITAR. If the application of industry-
                                                established definition of ‘‘required’’ that             better way for the ITAR to address this                standard or dictionary definitions of
                                                is central to the scope of the technology               bright-line objective is for DDTC to                   ‘‘directly related’’ does not resolve
                                                and software controls in the EAR. This                  publish, and get public comments on, a                 doubts about whether any unit of
                                                revision also addresses issues raised by                proposed definition of ‘‘directly related’’            technical data is, as a matter of law,
                                                commenters, discussed more fully                        that will eventually lead to a final ITAR              ‘‘directly related’’ (as opposed to
                                                below, with respect to the proposed                     definition acceptable to both DDTC and                 indirectly related) to a defense article,
                                                definition of ‘‘peculiarly responsible.’’               BIS. The reason for this approach is                   one should contact DDTC for resolution
                                                   To address common questions BIS has                  that, with the exception of technical                  of the doubt through established
                                                received regarding the meaning of the                   data specifically enumerated on the                    procedures in the ITAR’s Part 120.
                                                word ‘‘required,’’ the June 3 rule                      USML, technical data is subject to the
                                                proposed adding two notes. The first                                                                           Peculiarly Responsible
                                                                                                        ITAR only if it is ‘‘directly related’’ to
                                                stated that the references to                           a defense article. This means, by                         In the June 3 rule, BIS proposed a
                                                ‘‘characteristics’’ and ‘‘functions’’ are               definition, that technology that is                    definition of the term ‘‘peculiarly
                                                not limited to entries on the CCL that                  indirectly related to, or only ‘‘related               responsible’’ that was modeled on the
                                                use specific technical parameters to                    to,’’ a defense article, such as by merely             catch-and-release structure BIS adopted
                                                describe the scope of what is controlled.               being capable for use with, used in                    for the definition of ‘‘specially
                                                The ‘‘characteristics’’ and ‘‘functions’’ of            connection with, or somehow having                     designed.’’ Thus, under the proposed
                                                an item listed are, absent a specific                   something generally to do with the                     definition, an item was ‘‘peculiarly
                                                regulatory definition, a standard                       eventual functioning of a defense                      responsible’’ for achieving or exceeding
                                                dictionary’s definition of the item. The                article, is not subject to the ITAR and is,            any referenced controlled performance
                                                first note also included examples of this               thus, subject to the EAR. For example,                 levels, characteristics, or functions if it
                                                point. The second note referred to the                  technology required for the production                 was used in ‘‘development,’’
                                                fact that the ITAR and the EAR often                    of a 9A610.x aircraft component—                       ‘‘production,’’ ‘‘use,’’ operation,
                                                divide within each set of regulations or                which, by definition, means that that it               installation, maintenance, repair,
                                                between each set of regulations (a)                     is specially designed for a USML VIII(a)               overhaul, or refurbishing of an item
                                                controls on parts, components,                          aircraft—does not become subject to the                subject to the EAR unless (a) the
                                                accessories, attachments, and software                                                                         Department of Commerce had
                                                                                                        ITAR merely because it generally relates
                                                and (b) controls on the end items,                                                                             determined otherwise in a commodity
                                                                                                        to a defense article by virtue of being a
                                                systems, equipment, or other articles                                                                          classification determination, (b) the item
                                                                                                        component that will be or is integrated
                                                into which those parts, components,                                                                            was identical to information used in or
                                                                                                        into and necessary for the functioning of
                                                accessories, attachments, and software                                                                         with a commodity or software that was
                                                                                                        the aircraft subject to the ITAR. It is
                                                are to be installed or incorporated. The                                                                       or had been in production and was
                                                                                                        technology required for the aircraft
                                                note also referred to jurisdiction over                                                                        EAR99 or described in an ECCN
                                                                                                        component subject to the EAR, not the
                                                technology. The public comments on                                                                             controlled only for Anti-Terrorism (AT)
                                                                                                        whole of the USML aircraft or another
                                                these parts of the notes were favorable                                                                        reasons, (c) the item had been or was
                                                                                                        defense article, and thus subject to the
                                                and the first note is included in this                                                                         being developed for use in or with
                                                                                                        EAR. On the other hand, technical data                 general purpose commodities or
                                                final rule without modification, except                 that is directly related to the production
                                                that it is now designated as Note 2 to the                                                                     software, or (d) the item had been or
                                                                                                        of a component subject to the ITAR does                was being developed with ‘‘knowledge’’
                                                definition of ‘‘required.’’ The second
                                                                                                        not become subject to the EAR merely                   that it would be for use in or with
                                                note is split into Notes 1 and 3 to the
                                                                                                        because, for example, it is developed or               commodities or software described (i) in
                                                definition of ‘‘required,’’ and the text is
                                                                                                        manufactured with equipment subject to                 an ECCN controlled for AT-only reasons
                                                modified from the June 3 proposal as
                                                                                                        the EAR.                                               and also EAR99 commodities or
                                                discussed below.
                                                   A core tenet of ECR is that the                         Wanting to nonetheless respond to the               software or (ii) exclusively for use in or
                                                jurisdictional status of the technical                  comments seeking guidance regarding                    with EAR99 commodities or software.
                                                data/technology for an article that                     the jurisdictional status of technology                   BIS specifically solicited comments
                                                moves from the USML to the EAR                          pertaining to items that have moved to                 on whether the proposed definition of
                                                follows the article. BIS and DDTC                       the CCL from the USML and to further                   ‘‘peculiarly responsible’’ effectively
                                                recognize the need to clarify the                       advance the effort of creating a truly                 explained how items may be ‘‘required’’
                                                jurisdictional line for such technical                  bright line jurisdictional rule, BIS is                or ‘‘specially designed’’ for particular
                                                data/technology. To help those making                   publishing with this rule as a third note              functions. Two commenters offered
                                                jurisdictional self-determinations for                  to ‘‘required’’ its guidance on the topic              support for the definition but still
                                                technical data/technology pertaining to                 because the meaning of ‘‘required’’ is                 suggested revisions. Twelve additional
                                                articles affected by the reform effort, BIS             central to such determinations.                        commenters objected to the definition,
                                                and DDTC had proposed in their                          Specifically, unclassified technology not              describing it as confusing and stating
                                                respective June 3 rules common                          specifically enumerated on the USML is                 that it dramatically expanded the scope
                                                definitions of ‘‘required’’ and                         ‘‘subject to the EAR’’ if it is ‘‘required’’           of control beyond the existing
                                                ‘‘peculiarly responsible’’ so that the                  for the ‘‘development,’’ ‘‘production,’’               ‘‘required’’ technology definition. BIS
                                                regulatory line between technical data                  ‘‘use,’’ operation, installation,                      agrees with these comments and does
                                                subject to the ITAR and technology                      maintenance, repair, overhaul, or                      not adopt the proposed definition of
mstockstill on DSK3G9T082PROD with RULES




                                                subject to the EAR would be bright.                     refurbishing (or other terms specified in              ‘‘peculiarly responsible’’ in this final
                                                Based on a review of the comments, BIS                  ECCNs on the CCL that control                          rule. As described above, in this final
                                                and DDTC have, however, decided not                     ‘‘technology’’) of a commodity or                      rule, peculiarly responsible is defined
                                                to publish their proposed common                        software that is ‘‘subject to the EAR.’’ If            within the scope of the already existing
                                                definitions of ‘‘required’’ and                         such information is technical data that                definition of required, thus providing a
                                                ‘‘peculiarly responsible.’’ (See                        is not ‘‘required’’ for an item subject to             definition while guaranteeing no
                                                discussion of the public comments on                    the EAR and directly related to a                      expansion of scope.


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00018   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                                      Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations                                         35599

                                                Temporary Export of Technology                          technology, saying that the list of                    of ‘‘transfer’’ does not apply to the
                                                   The June 3 proposed rule included                    techniques for securing the data                       unrelated ‘‘transfers of licenses’’
                                                amended text in the temporary export of                 required all to be used. BIS accepts this              provision in § 750.10 or the antiboycott
                                                technology provisions of License                        comment, and this final rule adds                      provisions in Supplement No. 8 to part
                                                Exception TMP by revising § 740.9(a)(3)                 ‘‘may’’ before ‘‘include’’ to make clear               760 of the EAR. It also states that the
                                                to clarify that the ‘‘U.S. employer’’ and               that the list is illustrative. One                     term ‘‘transfer’’ may be included on
                                                ‘‘U.S. persons or their employees’’ using               commenter recommended allowing                         licenses issued by BIS. In that regard,
                                                this license exception are not foreign                  obfuscation/tokenization to protect data.              the changes that can be made to a BIS
                                                subsidiaries. The proposed paragraph                    BIS agrees that done properly, this is an              license are the non-material changes
                                                                                                        effective security measure, and will add               described in § 750.7(c). Any other
                                                streamlined current text without
                                                                                                        an FAQ on the topic to its Web site.                   change to a BIS license without
                                                changing the scope. In this final rule,
                                                                                                                                                               authorization is a violation of the EAR.
                                                BIS substitutes ‘‘foreign person’’ for                  Scope of a License
                                                                                                                                                               See §§ 750.7(c) and 764.2(e). Finally,
                                                ‘‘foreign national’’ in this section for                   The June 3 rule proposed                            consistent with the explanations above,
                                                reasons discussed elsewhere in this                     implementing in the EAR the                            definitions for the terms ‘‘access
                                                preamble, except where ‘‘natural                        interagency-agreed boilerplate                         information,’’ ‘‘foreign person,’’
                                                person’’ was meant and BIS substituted                  notification for all licenses that was                 ‘‘fundamental research,’’ ‘‘proscribed
                                                ‘‘individual’’ for clarity (and in so doing             posted on the BIS Web site and began                   person,’’ ‘‘publicly available encryption
                                                responded to a comment on including                     appearing on licenses December 8, 2014.                software,’’ ‘‘published,’’ and ‘‘release’’
                                                foreign nationals in paragraph                          It was a slight revision to the former                 are added to § 772.1.
                                                (a)(3)(iii)). BIS also added authority to               § 750.7(a), which stated that licenses                    One commenter stated that the
                                                reexport or transfer (in-country) to the                authorize only the transaction(s)                      definition of proscribed persons was
                                                authority to export; the absence of these               described in the license application and               overbroad, catching those individuals
                                                terms from the June 3 proposed rule was                 the license application support                        sanctioned under U.S. law without an
                                                an oversight.                                           documents. The proposed revision also                  export control nexus and recommended
                                                   One commenter stated that BIS                        codified the existing interpretation that              deleting ‘‘under US law.’’ BIS agrees
                                                should provide for use of this license                  a license authorizing the release of                   with this comment. One commenter
                                                exception by non-U.S. persons. Another                  technology to an entity also authorizes                recommended striking ‘‘scientific’’ from
                                                commenter recommended that BIS                          the release of the same technology to the              the definition of ‘‘basic scientific
                                                expand the scope of the license                         entity’s foreign nationals who are                     research’’ in part 772 and adding
                                                exception to include foreign                            permanent and regular employees of the                 definitions of applied and fundamental
                                                subsidiaries and affiliates. BIS does not               entity’s facility or facilities authorized             research to part 772. BIS does not accept
                                                adopt these recommendations. Because                    on the license, except to the extent a                 this recommendation. The definition of
                                                of the risks associated with securing                   license condition limits or prohibits the              ‘‘basic scientific research’’ reflects a
                                                temporary exports of technology, BIS is                 release of the technology to nationals of              Wassenaar Arrangement definition; it is
                                                not broadening the provisions for                       specific countries or country groups.                  retained in this final rule. A definition
                                                foreign persons beyond those employed                      Two commenters requested that BIS                   for applied research is not adopted
                                                by U.S. companies or to allow use by                    drop the modifier ‘‘permanent and’’                    because it is not necessary as a result of
                                                foreign companies.                                      from ‘‘regular employees.’’ BIS does not               the adoption of a simplified definition
                                                   BIS received two comments on the                     adopt this request due to risk of                      of fundamental research, and as
                                                recordkeeping provision in paragraph                    diversion associated with non-                         fundamental research is defined in
                                                (a)(3)(v), with one requesting that it be               permanent and non-regular employees.                   § 734.8, use of a cross reference in part
                                                clarified and one requesting that it be                 See further discussion of this issue                   772 is appropriate.
                                                removed in view of the existing broad                   above with respect to activities that are
                                                recordkeeping requirements in the EAR.                  not deemed reexports. The phrase                       Issues Raised by Public Comments That
                                                BIS agrees with these comments and                      ‘‘under U.S. law’’ that modified                       Are Outside the Scope of This Rule
                                                does not adopt the recordkeeping                        ‘‘proscribed persons’’ in the June 3 rule                 One commenter requested that BIS
                                                provision in this final rule.                           is not adopted in this final rule for                  clarify treatment of U.S.-origin chemical
                                                   One commenter asked BIS to clarify if                reasons discussed in connection with                   materials that are substantially
                                                TMP is available for remote access to                   the definition of ‘‘proscribed persons’’               transformed and exempt Japan and
                                                U.S. servers. Another commenter asked                   below. Except for that change, this final              other like-minded countries from
                                                BIS to clarify if taking an encrypted                   rule adopts the text proposed in the                   reexport controls. One commenter
                                                device is an export. BIS is not including               June 3 rule.                                           requested that BIS expand controls on
                                                these changes in regulatory text, because                                                                      missile production and drop Fiji from
                                                these are applications of the rule that                 Removals From and Additions to EAR’s                   Country Group D:5. One commenter
                                                are more appropriate to FAQs. However,                  List of Definitions in § 772.1                         appended comments on a separate BIS
                                                BIS is confirming in its FAQs that TMP                     This final rule creates stand-alone                 proposed rule for which the comment
                                                is available for remote access if its                   sections in the EAR to address the scope               period was already closed. One
                                                provisions are met. BIS is also                         and meaning of ‘‘publicly available                    commenter stated that items classified
                                                confirming in its FAQs that taking an                   information,’’ ‘‘publicly available                    under Export Control Classification
                                                encrypted device is an export and                       technology and software,’’ and                         Number 0A998 will no longer be subject
                                                referring to a different paragraph of                   ‘‘technical data.’’ To avoid redundancy,               to the EAR under the new note to
mstockstill on DSK3G9T082PROD with RULES




                                                § 740.9 for authorizing export of                       this rule removes those definitions from               § 734.3(b)(3). One commenter requested
                                                devices. Devices are commodities and                    § 772.1. In light of the changes described             that BIS drop the term ‘‘serial’’ from the
                                                therefore not eligible for paragraph                    above, the definitions of ‘‘export,’’                  definition of ‘‘production,’’ which was
                                                (a)(3), which authorizes only                           ‘‘reexport,’’ ‘‘required,’’ ‘‘technology,’’            not revised by this rule. Although these
                                                technology.                                             and ‘‘transfer’’ are revised accordingly.              comments are outside the scope of this
                                                   One commenter recommended that                       A clarifying note is added at the bottom               rule and thus not addressed in this
                                                BIS remove a requirement to encrypt the                 of the definition explaining that the use              notice, BIS nonetheless encourages the


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00019   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                35600                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                public to submit thoughts, suggestions,                 Small Business Regulatory Enforcement                  Number and Description of Small
                                                and comments to BIS about the EAR and                   Fairness Act of 1996, 5 U.S.C. 601 et                  Entities to Which This Rule Will Apply
                                                the export control system. BIS cannot                   seq., BIS has prepared the following                     This final rule will apply to all
                                                commit to addressing them in every                      final Regulatory Flexibility Act analysis              persons engaged in the export, reexport,
                                                case, but nonetheless encourages as                     of the impact that this final rule will                or transfer of commodities, technology,
                                                much industry participation as possible                 have on small entities.                                or software subject to the EAR. BIS does
                                                in the development and drafting of the                                                                         not maintain data from which it can
                                                regulations.                                            Statement of the Objectives of, and
                                                                                                        Legal Basis for, the Final Rule;                       determine how many of those persons
                                                Export Administration Act                               Identification of All Relevant Federal                 are small entities as identified in the
                                                                                                        Rules Which May Duplicate, Overlap, or                 Small Business Administration size
                                                   Since August 21, 2001, the Export
                                                                                                        Conflict With the Final Rule                           standards. Nevertheless, BIS recognizes
                                                Administration Act of 1979, as
                                                                                                                                                               that some of those persons are likely to
                                                amended, has been in lapse. However,                       The objective of this final rule (and a             be small entities.
                                                the President, through Executive Order                  final rule being published
                                                13222 of August 17, 2001, 3 CFR, 2001                   simultaneously by the Department of                    Description of the Projected Reporting,
                                                Comp., p. 783 (2002), as amended by                     State) is to provide greater clarity and               Recordkeeping, and Other Compliance
                                                Executive Order 13637 of March 8,                       precision in the EAR and the ITAR by                   Requirements of the Final Rule
                                                2013, 78 FR 16129 (March 13, 2013),                     providing, where warranted and                            This final rule is unlikely to increase
                                                and as extended by the Notice of August                 possible, common definitions and                       the number of transactions that must be
                                                7, 2015 (80 FR 48233 (Aug. 11, 2015)                    common terms to regulate the same                      reported to BIS because EAR reporting
                                                has continued the EAR in effect under                   types of actions and issues. This final                requirements apply only in five specific
                                                the International Emergency Economic                    rule also seeks to express some concepts               situations, none of which will change as
                                                Powers Act (50 U.S.C. 1701 et seq.). BIS                more clearly.                                          a result of this final rule. Those
                                                continues to carry out the provisions of                   The final rule alters definitions in the            situations are: Exports of items on the
                                                the Export Administration Act, as                       EAR. It also updates and clarifies                     Wassenaar Arrangement Sensitive List
                                                appropriate and to the extent permitted                 application of controls to electronically              that do not require a license; Exports of
                                                by law, pursuant to Executive Order                     transmitted technology and software.                   High Performance Computers; Exports
                                                13222 as amended by Executive Order                                                                            of certain thermal imaging cameras that
                                                                                                           The legal basis for this proposed rule
                                                13637.                                                                                                         do not require a license; Certain exports
                                                                                                        is 50 U.S.C. 4601 et seq.; 50 U.S.C. 1701
                                                Regulatory Requirements                                 et seq.; E.O. 12938, 59 FR 59099, 3 CFR,               of Conventional Arms; and 600 series
                                                                                                        1994 Comp., p. 950; E.O. 13020, 61 FR                  major defense equipment. Because
                                                   1. Executive Orders 13563 and 12866                                                                         recordkeeping requirements already
                                                direct agencies to assess all costs and                 54079, 3 CFR, 1996 Comp., p. 219; E.O.
                                                                                                        13026, 61 FR 58767, 3 CFR, 1996                        apply to all transactions that are subject
                                                benefits of available regulatory                                                                               to the EAR, BIS expects that this final
                                                alternatives and, if regulation is                      Comp., p. 228; E.O. 13222, 66 FR 44025,
                                                                                                        3 CFR, 2001 Comp., p. 783; E.O. 13637,                 rule will not expand recordkeeping
                                                necessary, to select regulatory                                                                                requirements.
                                                approaches that maximize net benefits                   78 FR 16129, 3 CFR, 2014 Comp., p.
                                                                                                        223; Notice of August 7, 2015, 80 FR                      It is possible that some of these
                                                (including potential economic,                                                                                 changes will increase the number of
                                                environmental, public health and safety                 48233 (August 11, 2015); Notice of
                                                                                                        November 12, 2015, 80 FR 70667                         licenses that some small entities will
                                                effects, distribute impacts, and equity).                                                                      have to seek from BIS, although BIS is
                                                Executive Order 13563 emphasizes the                    (November 13, 2015).
                                                                                                                                                               not aware of any specific instance in
                                                importance of quantifying both costs                       No other Federal rules duplicate,
                                                                                                                                                               which additional licenses will be
                                                and benefits, of reducing costs, of                     overlap, or conflict with this final rule.             required.
                                                harmonizing rules, and of promoting                     Comments in Response to the Initial                       The following discussion describes
                                                flexibility. This final rule has been                   Regulatory Flexibility Analysis                        the changes made by this final rule. It
                                                designated a ‘‘significant regulatory                                                                          is divided into two sections: Changes
                                                action,’’ although not economically                        BIS received one comment from the                   that BIS believes will not impose any
                                                significant, under section 3(f) of                      public in response to the Initial                      new regulatory obligations; and Changes
                                                Executive Order 12866. Accordingly,                     Regulatory Flexibility Analysis (IRFA).                that are not intended to imposed any
                                                this final rule has been reviewed by the                The comment stated that while the                      new regulatory obligation, but that BIS
                                                Office of Management and Budget                         proposed regulatory text indicated that                cannot state with certainty will not do
                                                (OMB).                                                  the extent to which release of access                  so.
                                                   2. This final rule does not contain                  information could be a violation of the
                                                information collections subject to the                  EAR was limited by whether the party                   Changes That BIS Believes Will Not
                                                requirements of the Paperwork                           acted with knowledge, text in the IRFA                 Impose Any New Regulatory Burden
                                                Reduction Act of 1995 (44 U.S.C. 3501                   regarding the impact of this provision                    This final rule makes certain changes
                                                et seq.) (PRA). Notwithstanding any                     created tension by stating that other                  to clarify and streamline the definitions
                                                other provision of law, no person is                    provisions in the EAR could be used to                 of comparable terms, phrases, and
                                                required to respond to, nor is subject to               bring charges for that same type of                    concepts between the EAR and the
                                                a penalty for failure to comply with, a                 misconduct. The comment requested                      ITAR. Many of these changes are
                                                collection of information, subject to the               that BIS provide clarification in the final            technical in nature and attempt to
                                                requirements of the PRA, unless that                    rule. BIS addressed this comment by not                consolidate and re-phrase the
mstockstill on DSK3G9T082PROD with RULES




                                                collection of information displays a                    adopting § 764.2(l), the provision that                definitions to enhance readability and to
                                                currently valid OMB control number.                     would have established the violation at                parallel the structure of the ITAR’s
                                                   3. This final rule does not contain                  issue in the final rule. The Chief                     definition of the same term. There are a
                                                policies with Federalism implications as                Counsel for Advocacy of the Small                      small number of new provisions, but
                                                that term is defined under E.O. 13132.                  Business Administration filed no                       these changes do not impose any new
                                                   4. Pursuant to the Regulatory                        comments in response to the proposed                   regulatory burdens. Specifically, this
                                                Flexibility Act, as amended by the                      rule.                                                  final rule makes the following changes:


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00020   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                                      Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations                                        35601

                                                   Removes § 734.2(b) which formerly                       Adds text specifying that to the extent             decisions more quickly and have less
                                                defined export, reexport, release,                      an authorization would be required to                  need to contact BIS for advice.
                                                transfer (in country) and export of                     transfer technology or software, a                     Additionally, by making these terms
                                                encryption source code or object code                   comparable authorization is required to                more explicit, the possibility of their
                                                software, because those terms are                       transfer access information (e.g.,                     being interpreted contrary to BIS’s
                                                defined in separate sections. Section                   decryption keys, network access codes,                 intent is reduced. Such contrary
                                                734.2(b) also stated the policy of                      and passwords) with ‘‘knowledge’’ that                 interpretations would have three
                                                applying license requirements that                      such transfer would result in the                      undesirable effects. First, they would
                                                apply to a country to its dependencies                  unauthorized release of such technology                undermine the national security and
                                                and possessions; this policy is currently               or software.                                           foreign policy objectives that the EAR
                                                stated elsewhere in the EAR.
                                                   Creates new separate sections                        Changes That Are Not Intended To                       are intended to implement. Second,
                                                defining export, reexport, release and                  Impose Any Regulatory Obligation, But                  persons who are interpreting the
                                                export of encryption source code or                     That BIS Cannot State With Certainty                   regulations in a less restrictive manner
                                                object code software. Those terms are                   Would Not Do So                                        than BIS intends may seek fewer
                                                clarified and presented in a more                          This final rule revises the definitions             licenses from BIS than their competitors
                                                organized manner, but substantively                     of the two existing terms ‘‘required’’ and             who are interpreting the regulations
                                                unchanged from the former regulatory                    ‘‘transfer (in-country).’’ It also adopts              consistent with BIS’s intent or who are
                                                text.                                                   BIS’s interpretative guidance regarding                obtaining advice from BIS, thereby
                                                   Creates a new section identifying                    deemed reexports as regulatory text.                   gaining a commercial advantage to the
                                                activities that are not exports, reexports,             These changes are not intended to                      detriment of the relevant national
                                                or transfers. This section restates the                 impose any regulatory obligations on                   security or foreign policy interests.
                                                transactions that are excluded from the                 regulated entities, but BIS cannot state               Third, unnecessary regulatory
                                                definition of export in former regulatory               with certainty that there will be no                   complexity and unnecessary differences
                                                text and adds two additional activities                 impact. This final rule makes the                      between the terminology of the ITAR
                                                that are expressly declared not to be                   following changes:                                     and that of the EAR could discourage
                                                exports, reexports or transfers: Space                     Adds to the EAR a definition of
                                                                                                                                                               small entities from even attempting to
                                                launches; and sending, taking or storing                ‘‘proscribed person.’’ This definition
                                                                                                        does not create any new regulated class.               export. The beneficial effects of making
                                                certain technology or software abroad
                                                                                                        It simply provides a clear, shorthand                  these terms more explicit justify the
                                                using specified cryptographic
                                                techniques. The former, although it was                 reference to a person who is already                   economic impact that might be incurred
                                                not included in past regulatory text,                   prohibited from receiving items or                     by small entities that will have to
                                                states an exclusion already set forth in                participating in a transaction that is                 change their conduct because their
                                                a statute (see 51 U.S.C. 50919(f)) and is               subject to the EAR without                             contrary interpretations can no longer
                                                consistent with past BIS practice of not                authorization, such as persons on the                  be relied on given the clearer and more
                                                treating a space launch as an export,                   Entity List.                                           explicit terms in the regulations.
                                                reexport or transfer. The latter is, in fact,              Removes from the definition of the                     This final rule also adds to the EAR
                                                new. However, by removing the                           term ‘‘required’’ references to CCL                    a description of activities that are not
                                                transactions it describes from the                      Categories 4, 5, 6 and 9 to accurately                 deemed reexports. This description
                                                definitions of exports, reexports, or                   reflect BIS’s long-standing interpretation             formerly appeared as interpretative
                                                transfers, it removes existing license                  that its definition applies wherever the
                                                                                                                                                               guidance on BIS’s Web site and closely
                                                requirements from those transactions.                   EAR imposes a license requirement for
                                                                                                                                                               tracks the regulatory text of the ITAR.
                                                   Clarifies without substantively                      technology ‘‘required’’ for a particular
                                                                                                                                                               Deemed reexports are releases of
                                                changing the provisions related to                      process or activity.
                                                patent applications and adds specific                      In the definition of ‘‘transfer (in-                technology or software source code
                                                text stating that technology contained in               country),’’ replaces the phrase                        within a single foreign country by a
                                                a patent available from or at any patent                ‘‘shipment, transmission, or release of                party located outside the United States
                                                office is not subject to the EAR. The                   items subject to the EAR from one                      to a national of a country other than the
                                                addition reflects BIS’s long-standing                   person to another person that occurs                   country in which the releasing party is
                                                interpretation. To the extent that it                   outside the United States within a single              located. The new section describes three
                                                could be characterized as new, its only                 foreign country’’ with ‘‘a change in end               situations in which that party may
                                                effect would be to appear to release from               use or end user of an item within the                  release the technology or source code
                                                the EAR technology that some readers of                 same foreign country.’’ This new text                  without obtaining a license from BIS.
                                                the EAR might have (erroneously)                        will parallel the term ‘‘retransfer’’ in the              By adopting this guidance as
                                                concluded was subject to the EAR.                       ITAR and will eliminate any potential                  regulatory text that closely tracks the
                                                   Adds text to License Exception TMP                   ambiguity that a change in end use or                  text governing the same activities in the
                                                to emphasize that foreign subsidiaries of               end user within a foreign country is or                ITAR, BIS reduces both complexity and
                                                U.S. companies are neither U.S.                         is not a ‘‘transfer (in-country).’’
                                                                                                                                                               unnecessary differences between the
                                                employers nor ‘‘U.S. persons or their                      Each of the foregoing changes serves
                                                                                                        the overall policy goals of reducing                   two sets of regulations with the salutary
                                                employees’’ as those terms are used in
                                                                                                        uncertainty and harmonizing, to the                    effects of faster decision making,
                                                the license exception. This additional
                                                text adds no restriction that is not                    extent warranted and possible, the                     reduced need to contact BIS for advice,
mstockstill on DSK3G9T082PROD with RULES




                                                already imposed by the definition of                    requirements of the ITAR and the EAR.                  and reduced possibility that small
                                                ‘‘U.S. persons’’ that currently appears in              In most instances, reduced uncertainty                 entities would be discouraged from
                                                the text of License Exception TMP.                      will be beneficial to persons who have                 exporting as noted above.
                                                   Adds text codifying in the EAR limits                to comply with the regulations,
                                                on transactions authorized by a license                 particularly persons who engage in
                                                that currently are imposed by                           transactions subject to both sets of
                                                conditions on the license itself.                       regulations. They will be able to make


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00021   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                35602                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                Description of Any Significant                          the regulations by similarly situated                  paragraph (b)(3), the Note to paragraphs
                                                Alternatives to the Final Rule That                     regulated parties, would be foregone.                  (b)(2) and (b)(3), and adding a Note to
                                                Accomplish the Stated Objectives of                     Therefore, BIS has not adopted this                    paragraph (b)(3) to read as follows.
                                                Applicable Statutes and That Minimize                   alternative.
                                                Any Significant Economic Impact of the                     If BIS had chosen to create a size                  § 734.3   Items subject to the EAR.
                                                Final Rule on Small Entities                            threshold exempting small entities as                  *      *    *     *     *
                                                                                                        currently defined by the SBA size                        (b) The following are not subject to
                                                   As required by 5 U.S.C. 603(c), BIS’s                                                                       the EAR:
                                                analysis considered significant                         standards from the changes imposed by
                                                alternatives. Those alternatives are: (1)               this final rule, those entities would face             *      *    *     *     *
                                                                                                        a more complicated regulatory                            (3) Information and ‘‘software’’ that:
                                                The preferred alternative of altering
                                                                                                        environment than larger entities. The                    (i) Are published, as described in
                                                definitions and updating and clarifying
                                                                                                        small entities would continue to be                    § 734.7;
                                                application of controls to electronically                                                                        (ii) Arise during, or result from,
                                                transmitted technology and software; (2)                subject to the EAR as a whole but
                                                                                                        without the benefit of the clarifications              fundamental research, as described in
                                                Maintaining the status quo and not                                                                             § 734.8;
                                                revising the definitions or updating and                introduced by this final rule. The only
                                                                                                        way to make a size threshold beneficial                  (iii) Are released by instruction in a
                                                clarifying application of controls to                                                                          catalog course or associated teaching
                                                electronically transmitted technology                   to entities falling below the threshold
                                                                                                        would be to exempt them from all or at                 laboratory of an academic institution;
                                                and software; and (3) Establishing a size                                                                        (iv) Appear in patents or open
                                                threshold below which entities would                    least many of the requirements of the
                                                                                                        EAR. However, doing so would create a                  (published) patent applications
                                                not be subject to the changes proposed                                                                         available from or at any patent office,
                                                by this rulemaking.                                     major loophole allowing commodities,
                                                                                                        software, and technology that are                      unless covered by an invention secrecy
                                                   By altering definitions and updating                                                                        order, or are otherwise patent
                                                and clarifying application of controls to               controlled for export for national
                                                                                                        security or foreign policy reasons to go,              information as described in § 734.10;
                                                electronically transmitted technology                                                                            (v) Are non-proprietary system
                                                and software as this final rule does, BIS               without restriction, to any party abroad,
                                                                                                        undermining the interests that the                     descriptions; or
                                                reduces uncertainty for all parties                                                                              (vi) Are telemetry data as defined in
                                                engaged in transactions that are subject                regulations are intended to protect.
                                                                                                                                                               Note 2 to Category 9, Product Group E
                                                to the EAR. Potential ambiguities are                   Therefore, BIS has not adopted this
                                                                                                                                                               (see Supplement No. 1 to part 774 of the
                                                reduced; decisions can be made more                     alternative.
                                                                                                                                                               EAR).
                                                quickly; the need to contact BIS for                    List of Subjects                                          Note to paragraphs (b)(2) and (b)(3): A
                                                advice is reduced; and the possibility of                                                                      printed book or other printed material setting
                                                inconsistent interpretations providing                  15 CFR Parts 734 and 772
                                                                                                                                                               forth encryption source code is not itself
                                                one party commercial advantages over                      Exports.                                             subject to the EAR (see § 734.3(b)(2)).
                                                others is reduced. Persons (including                                                                          However, notwithstanding § 734.3(b)(2),
                                                                                                        15 CFR Parts 740 and 750
                                                small entities) engaged in transactions                                                                        encryption source code in electronic form or
                                                that are subject to the ITAR and                          Administrative practice and                          media (e.g., computer diskette or CD ROM)
                                                transactions that are subject to the EAR                procedure, Exports, Reporting and                      remains subject to the EAR (see § 734.17)).
                                                face fewer actual or apparent                           recordkeeping requirements.                            Publicly available encryption object code
                                                                                                                                                               ‘‘software’’ classified under ECCN 5D002 is
                                                inconsistencies that must be addressed                    For the reasons stated in the
                                                                                                                                                               not subject to the EAR when the
                                                in their regulatory compliance                          preamble, parts 734, 740, 750, and 772                 corresponding source code meets the criteria
                                                programs. Although small entities, along                of the Export Administration                           specified in § 740.13(e) of the EAR.
                                                with all other parties, will need to                    Regulations (15 CFR subchapter C) are
                                                become familiar with the revised                        amended as follows:                                       Note to paragraph (b)(3): Except as set
                                                terminology, in the long run,                                                                                  forth in part 760 of this title, information that
                                                compliance costs are likely to be                       PART 734—SCOPE OF THE EXPORT                           is not within the scope of the definition of
                                                reduced when compared to the present                    ADMINISTRATION REGULATIONS                             ‘‘technology’’ (see § 772.1 of the EAR) is not
                                                                                                                                                               subject to the EAR.
                                                situation where the ITAR and the EAR
                                                                                                        ■ 1. The authority citation for part 734
                                                use different terminology to regulate the                                                                      *     *    *     *      *
                                                                                                        continues to read as follows:
                                                same types of activity in the same                                                                             ■ 4. Section 734.7 is revised to read as
                                                manner. Therefore, BIS adopted this                        Authority: 50 U.S.C. 4601 et seq.; 50
                                                                                                        U.S.C. 1701 et seq.; E.O. 12938, 59 FR 59099,
                                                                                                                                                               follows:
                                                alternative.
                                                   If BIS had chosen to maintain the                    3 CFR, 1994 Comp., p. 950; E.O. 13020, 61              § 734.7   Published.
                                                status quo, small entities and other                    FR 54079, 3 CFR, 1996 Comp., p. 219; E.O.
                                                                                                        13026, 61 FR 58767, 3 CFR, 1996 Comp., p.                 (a) Except as set forth in paragraph (b)
                                                parties would not have to incur the cost                228; E.O. 13222, 66 FR 44025, 3 CFR, 2001              of this section, unclassified
                                                and effort of becoming familiar with the                Comp., p. 783; E.O. 13637, 78 FR 16129, 3              ‘‘technology’’ or ‘‘software’’ is
                                                revised regulations, and any party who                  CFR, 2014 Comp., p. 223; Notice of August              ‘‘published,’’ and is thus not
                                                was interpreting the regulations in a                   7, 2015, 80 FR 48233 (August 11, 2015);                ‘‘technology’’ or ‘‘software’’ subject to
                                                way that would clearly be precluded by                  Notice of November 12, 2015, 80 FR 70667               the EAR, when it has been made
                                                the more explicit interpretations would                 (November 13, 2015).                                   available to the public without
                                                not incur the cost of complying with the                ■ 2. Section 734.2 is amended by                       restrictions upon its further
                                                regulations consistent with their                       revising the heading to read as follows                dissemination such as through any of
mstockstill on DSK3G9T082PROD with RULES




                                                underlying intent and in the way that                   and by removing and reserving                          the following:
                                                BIS believes most regulated parties do.                 paragraph (b).                                            (1) Subscriptions available without
                                                However, the benefits of these proposed                                                                        restriction to any individual who
                                                changes would be lost. Those benefits,                  § 734.2    Subject to the EAR.
                                                                                                                                                               desires to obtain or purchase the
                                                greater clarity, consistency between the                *     *    *     *     *                               published information;
                                                ITAR and the EAR, and reduced                           ■ 3. Section 734.3 is amended by                          (2) Libraries or other public
                                                possibility of inconsistent application of              revising paragraph (b) introductory text,              collections that are open and available


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00022   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                                      Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations                                               35603

                                                to the public, and from which the public                to publish the ‘‘technology’’ or                       the right to classify is not a specific national
                                                can obtain tangible or intangible                       ‘‘software’’ contained in the research                 security control.
                                                documents;                                              without restriction. ‘‘Technology’’ or                   (c) Fundamental research definition.
                                                   (3) Unlimited distribution at a                      ‘‘software’’ that arises during or results             Fundamental research means research
                                                conference, meeting, seminar, trade                     from fundamental research subject to                   in science, engineering, or mathematics,
                                                show, or exhibition, generally accessible               prepublication review is still intended                the results of which ordinarily are
                                                to the interested public;                               to be published when:                                  published and shared broadly within
                                                   (4) Public dissemination (i.e.,                         (1) Prepublication review is                        the research community, and for which
                                                unlimited distribution) in any form (e.g.,              conducted solely to ensure that                        the researchers have not accepted
                                                not necessarily in published form),                     publication would not compromise                       restrictions for proprietary or national
                                                including posting on the Internet on                    patent rights, so long as the review                   security reasons.
                                                sites available to the public; or                       causes no more than a temporary delay
                                                   (5) Submission of a written                          in publication of the research results;                § 734.9—[Removed       and Reserved]
                                                composition, manuscript, presentation,                     (2) Prepublication review is
                                                                                                                                                               ■ 6. Section 734.9 is removed and
                                                computer-readable dataset, formula,                     conducted by a sponsor of research
                                                                                                                                                               reserved.
                                                imagery, algorithms, or some other                      solely to insure that the publication
                                                representation of knowledge with the                    would not inadvertently divulge                        ■ 7. Section 734.10 is revised to read as
                                                intention that such information will be                 proprietary information that the sponsor               follows:
                                                made publicly available if accepted for                 has furnished to the researchers; or                   § 734.10   Patents.
                                                publication or presentation:                               (3) With respect to research
                                                   (i) To domestic or foreign co-authors,               conducted by scientists or engineers                      ‘‘Technology’’ is not subject to the
                                                editors, or reviewers of journals,                      working for a Federal agency or a                      EAR if it is contained in any of the
                                                magazines, newspapers or trade                          Federally Funded Research and                          following:
                                                publications;                                           Development Center (FFRDC), the                           (a) A patent or an open (published)
                                                   (ii) To researchers conducting                       review is conducted within any                         patent application available from or at
                                                fundamental research; or                                appropriate system devised by the                      any patent office;
                                                   (iii) To organizers of open conferences              agency or the FFRDC to control the                        (b) A published patent or patent
                                                or other open gatherings.                               release of information by such scientists              application prepared wholly from
                                                   (b) Published encryption software                    and engineers.                                         foreign-origin ‘‘technology’’ where the
                                                classified under ECCN 5D002 remains                        Note 1 to paragraph (b): Although                   application is being sent to the foreign
                                                subject to the EAR unless it is publicly                ‘‘technology’’ or ‘‘software’’ arising during or       inventor to be executed and returned to
                                                available encryption object code                        resulting from fundamental research is not             the United States for subsequent filing
                                                software classified under ECCN 5D002                    considered intended to be published if                 in the U.S. Patent and Trademark Office;
                                                and the corresponding source code                       researchers accept restrictions on its                    (c) A patent application, or an
                                                meets the criteria specified in                         publication, such ‘‘technology’’ or ‘‘software’’       amendment, modification, supplement
                                                § 740.13(e) of the EAR.                                 will nonetheless qualify as ‘‘technology’’ or          or division of an application, and
                                                                                                        ‘‘software’’ arising during or resulting from
                                                ■ 5. Section 734.8 is revised to read as
                                                                                                        fundamental research once all such
                                                                                                                                                               authorized for filing in a foreign country
                                                follows:                                                restrictions have expired or have been                 in accordance with the regulations of
                                                                                                        removed.                                               the Patent and Trademark Office, 37
                                                § 734.8 ‘‘Technology’’ or ‘‘software’’ that                                                                    CFR part 5; or
                                                arises during, or results from, fundamental                Note 2 to paragraph (b): Research that is
                                                research.                                                                                                         (d) A patent application when sent to
                                                                                                        voluntarily subjected to U.S. government               a foreign country before or within six
                                                   (a) Fundamental research.                            prepublication review is considered
                                                                                                                                                               months after the filing of a United States
                                                ‘‘Technology’’ or ‘‘software’’ that arises              ‘‘intended to be published’’ when the
                                                                                                        research is released consistent with the               patent application for the purpose of
                                                during, or results from, fundamental
                                                                                                        prepublication review and any resulting                obtaining the signature of an inventor
                                                research and is intended to be published
                                                                                                        controls.                                              who was in the United States when the
                                                is not subject to the EAR.
                                                                                                                                                               invention was made or who is a co-
                                                   Note 1 to paragraph (a): This paragraph                 Note 3 to paragraph (b): ‘‘Technology’’ or          inventor with a person residing in the
                                                does not apply to ‘‘technology’’ or ‘‘software’’        ‘‘software’’ resulting from U.S. government            United States.
                                                subject to the EAR that is released to conduct          funded research that is subject to
                                                fundamental research. (See § 734.7(a)(5)(ii)            government-imposed access and                          § 734.11—[Removed        and Reserved]
                                                for information released to researchers that is         dissemination or other specific national
                                                ‘‘published.’’)                                         security controls qualifies as ‘‘technology’’ or       ■ 8. Section 734.11 is removed and
                                                                                                        ‘‘software’’ resulting from fundamental                reserved.
                                                   Note 2 to paragraph (a): There are                   research, provided that all government-                ■ 9. Section 734.13 is added to read as
                                                instances in the conduct of research where a            imposed national security controls have been
                                                                                                                                                               follows:
                                                researcher, institution or company may                  satisfied and the researchers are free to
                                                decide to restrict or protect the release or            publish the ‘‘technology’’ or ‘‘software’’             § 734.13   Export.
                                                publication of ‘‘technology’’ or ‘‘software’’           contained in the research without restriction.
                                                contained in research results. Once a                   Examples of specific national security                    (a) Except as set forth in §§ 734.17 or
                                                decision is made to maintain such                       controls include requirements for                      734.18, Export means:
                                                ‘‘technology’’ or ‘‘software’’ as restricted or         prepublication review by the Government,                  (1) An actual shipment or
                                                proprietary, the ‘‘technology’’ or ‘‘software,’’        with right to withhold permission for                  transmission out of the United States,
mstockstill on DSK3G9T082PROD with RULES




                                                if within the scope of § 734.3(a), becomes              publication; restrictions on prepublication            including the sending or taking of an
                                                subject to the EAR.                                     dissemination of information to non-U.S.               item out of the United States, in any
                                                                                                        citizens or other categories of persons; or
                                                   (b) Prepublication review.                                                                                  manner;
                                                                                                        restrictions on participation of non-U.S.
                                                ‘‘Technology’’ or ‘‘software’’ that arises              citizens or other categories of persons in the            (2) Releasing or otherwise transferring
                                                during, or results, from fundamental                    research. A general reference to one or more           ‘‘technology’’ or source code (but not
                                                research is intended to be published to                 export control laws or regulations or a                object code) to a foreign person in the
                                                the extent that the researchers are free                general reminder that the Government retains           United States (a ‘‘deemed export’’);


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00023   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                35604                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                   (3) Transferring by a person in the                  § 734.15    Release.                                   transfer of such code. See § 740.13(e) of
                                                United States of registration, control, or                 (a) Except as set forth in § 734.18,                the EAR for notification requirements
                                                ownership of:                                           ‘‘technology’’ and ‘‘software’’ are                    for exports or reexports of encryption
                                                   (i) A spacecraft subject to the EAR                  ‘‘released’’ through:                                  source code ‘‘software’’ considered to be
                                                that is not eligible for export under                      (1) Visual or other inspection by a                 publicly available or published
                                                License Exception STA (i.e., spacecraft                 foreign person of items that reveals                   consistent with the provisions of
                                                that provide space-based logistics,                     ‘‘technology’’ or source code subject to               § 734.3(b)(3). Publicly available
                                                assembly or servicing of any spacecraft)                the EAR to a foreign person; or                        encryption ‘‘software’’ in object code
                                                to a person in or a national of any other                  (2) Oral or written exchanges with a                that corresponds to encryption source
                                                country; or                                             foreign person of ‘‘technology’’ or                    code made eligible for License
                                                   (ii) Any other spacecraft subject to the             source code in the United States or                    Exception TSU under § 740.13(e) of the
                                                EAR to a person in or a national of a                   abroad.                                                EAR is not subject to the EAR.
                                                Country Group D:5 country.                                 (b) Any act causing the ‘‘release’’ of                 (c) Subject to the General Prohibitions
                                                   (b) Any release in the United States of              ‘‘technology’’ or ‘‘software,’’ through use            described in part 736 of the EAR, such
                                                ‘‘technology’’ or source code to a foreign              of ‘‘access information’’ or otherwise, to             precautions for Internet transfers of
                                                person is a deemed export to the foreign                yourself or another person requires an                 products eligible for export under
                                                person’s most recent country of                         authorization to the same extent an                    § 740.17(b)(2) of the EAR (encryption
                                                citizenship or permanent residency.                     authorization would be required to                     ‘‘software’’ products, certain encryption
                                                   (c) The export of an item that will                  export or reexport such ‘‘technology’’ or              source code and general purpose
                                                transit through a country or countries to               ‘‘software’’ to that person.                           encryption toolkits) shall include such
                                                a destination identified in the EAR is                  ■ 12. Section 734.16 is added to read as               measures as:
                                                deemed to be an export to that                          follows:                                                  (1) The access control system, either
                                                destination.                                                                                                   through automated means or human
                                                ■ 10. Section 734.14 is added to read as                § 734.16    Transfer (in-country).                     intervention, checks the address of
                                                follows:                                                   Except as set forth in § 734.18(a)(3), a            every system outside of the U.S. or
                                                                                                        Transfer (in-country) is a change in end               Canada requesting or receiving a
                                                § 734.14   Reexport.                                    use or end user of an item within the                  transfer and verifies such systems do
                                                   (a) Except as set forth in §§ 734.18 and             same foreign country. Transfer (in-                    not have a domain name or Internet
                                                734.20, Reexport means:                                 country) is synonymous with In-country                 address of a foreign government end-
                                                   (1) An actual shipment or                            transfer.                                              user (e.g., ‘‘.gov,’’ ‘‘.gouv,’’ ‘‘.mil’’ or
                                                transmission of an item subject to the                  ■ 13. Section 734.17 is added to read as               similar addresses);
                                                EAR from one foreign country to                         follows:                                                  (2) The access control system
                                                another foreign country, including the                                                                         provides every requesting or receiving
                                                sending or taking of an item to or from                 § 734.17 Export of encryption source code              party with notice that the transfer
                                                such countries in any manner;                           and object code software.                              includes or would include
                                                   (2) Releasing or otherwise transferring                 (a) For purposes of the EAR, the                    cryptographic ‘‘software’’ subject to
                                                ‘‘technology’’ or source code subject to                Export of encryption source code and                   export controls under the Export
                                                the EAR to a foreign person of a country                object code ‘‘software’’ means:                        Administration Regulations, and anyone
                                                other than the foreign country where the                   (1) An actual shipment, transfer, or                receiving such a transfer cannot export
                                                release or transfer takes place (a deemed               transmission out of the United States                  the ‘‘software’’ without a license or
                                                reexport);                                              (see also paragraph (b) of this section);              other authorization; and
                                                   (3) Transferring by a person outside                 or                                                        (3) Every party requesting or receiving
                                                the United States of registration, control,                (2) A transfer of such ‘‘software’’ in              a transfer of such ‘‘software’’ must
                                                or ownership of:                                        the United States to an embassy or                     acknowledge affirmatively that the
                                                   (i) A spacecraft subject to the EAR                  affiliate of a foreign country.                        ‘‘software’’ is not intended for use by a
                                                that is not eligible for reexport under                    (b) The export of encryption source                 government end user, as defined in part
                                                License Exception STA (i.e., spacecraft                 code and object code ‘‘software’’                      772 of the EAR, and he or she
                                                that provide space-based logistics,                     controlled for ‘‘EI’’ reasons under ECCN               understands the cryptographic
                                                assembly or servicing of any spacecraft)                5D002 on the Commerce Control List                     ‘‘software’’ is subject to export controls
                                                to a person in or a national of any other               (see Supplement No. 1 to part 774 of the               under the Export Administration
                                                country; or                                             EAR) includes:                                         Regulations and anyone receiving the
                                                   (ii) Any other spacecraft subject to the                (1) Downloading, or causing the                     transfer cannot export the ‘‘software’’
                                                EAR to a person in or a national of a                   downloading of, such ‘‘software’’ to                   without a license or other authorization.
                                                Country Group D:5 country.                              locations (including electronic bulletin               BIS will consider acknowledgments in
                                                   (b) Any release outside of the United                boards, Internet file transfer protocol,               electronic form provided they are
                                                States of ‘‘technology’’ or source code                 and World Wide Web sites) outside the                  adequate to assure legal undertakings
                                                subject to the EAR to a foreign person                  U.S., or                                               similar to written acknowledgments.
                                                of another country is a deemed reexport                    (2) Making such ‘‘software’’ available
                                                                                                                                                               ■ 14. Section 734.18 is added to read as
                                                to the foreign person’s most recent                     for transfer outside the United States,
                                                                                                                                                               follows:
                                                country of citizenship or permanent                     over wire, cable, radio, electromagnetic,
                                                residency, except as described in                       photo optical, photoelectric or other                  § 734.18 Activities that are not exports,
                                                § 734.20.                                               comparable communications facilities                   reexports, or transfers.
mstockstill on DSK3G9T082PROD with RULES




                                                   (c) The reexport of an item subject to               accessible to persons outside the United                  (a) Activities that are not exports,
                                                the EAR that will transit through a                     States, including transfers from                       reexports, or transfers. The following
                                                country or countries to a destination                   electronic bulletin boards, Internet file              activities are not exports, reexports, or
                                                identified in the EAR is deemed to be                   transfer protocol and World Wide Web                   transfers:
                                                a reexport to that destination.                         sites, unless the person making the                       (1) Launching a spacecraft, launch
                                                ■ 11. Section 734.15 is added to read as                ‘‘software’’ available takes precautions               vehicle, payload, or other item into
                                                follows:                                                adequate to prevent unauthorized                       space.


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00024   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                                      Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations                                              35605

                                                   (2) Transmitting or otherwise                        constitute the release or export of such               the physical territory of any such
                                                transferring ‘‘technology’’ or ‘‘software’’             ‘‘technology’’ or ‘‘software.’’                        country, or within the United States.
                                                to a person in the United States who is                 ■ 15. Section 734.19 is added to read as                  (c) Release to other than Country
                                                not a foreign person from another                       follows:                                               Group A:5 nationals. Without limiting
                                                person in the United States.                                                                                   the scope of paragraph (a), release of
                                                   (3) Transmitting or otherwise making                 § 734.19    Transfer of access information.            ‘‘technology’’ or source code by an
                                                a transfer (in-country) within the same                    To the extent an authorization would                entity outside the United States to a
                                                foreign country of ‘‘technology’’ or                    be required to transfer ‘‘technology’’ or              foreign person of a country other than
                                                ‘‘software’’ between or among only                      ‘‘software,’’ a comparable authorization               the foreign country where the release
                                                persons who are not ‘‘foreign persons,’’                is required to transfer access                         takes place if:
                                                so long as the transmission or transfer                 information if done with ‘‘knowledge’’                    (1) The entity is authorized to receive
                                                does not result in a release to a foreign               that such transfer would result in the                 the ‘‘technology’’ or source code at
                                                person or to a person prohibited from                   release of such ‘‘technology’’ or                      issue, whether by a license, license
                                                receiving the ‘‘technology’’ or                         ‘‘software’’ without a required                        exception, or situations where no
                                                ‘‘software.’’                                           authorization.                                         license is required under the EAR;
                                                   (4) Shipping, moving, or transferring                                                                          (2) The foreign person is a bona fide
                                                                                                        ■ 16. Section 734.20 is added to read as
                                                items between or among the United                                                                              ‘permanent and regular employee’ of the
                                                                                                        follows:
                                                States, the District of Columbia, the                                                                          entity and is not a proscribed person
                                                Commonwealth of Puerto Rico, or the                     § 734.20 Activities that are not deemed                (see § 772.1 for definition of proscribed
                                                Commonwealth of the Northern Mariana                    reexports.                                             person);
                                                Islands or any territory, dependency, or                   The following activities are not                       (3) The release takes place entirely
                                                possession of the United States as listed               deemed reexports (see ‘‘deemed                         within the physical territory of the
                                                in Schedule C, Classification Codes and                 reexport’’ definition in § 734.14(b)):                 country where the entity is located,
                                                Descriptions for U.S. Export Statistics,                   (a) Authorized Release of                           conducts official business, or operates,
                                                issued by the Bureau of the Census.                     ‘‘technology’’ or source code. Release of              or within the United States;
                                                   (5) Sending, taking, or storing                      ‘‘technology’’ or source code by an                       (4) The entity has effective procedures
                                                ‘‘technology’’ or ‘‘software’’ that is:                 entity outside the United States to a                  to prevent diversion to destinations,
                                                   (i) Unclassified;                                    foreign person of a country other than                 entities, end users, and end uses
                                                   (ii) Secured using ‘end-to-end                       the foreign country where the release                  contrary to the EAR; and
                                                encryption;’                                            takes place if:                                           (5) Any one of the following six (i.e.,
                                                   (iii) Secured using cryptographic                                                                           paragraphs (c)(5)(i), (ii), (iii), (iv), (v), or
                                                                                                           (1) The entity is authorized to receive
                                                modules (hardware or ‘‘software’’)                                                                             (vi) of this section) situations is
                                                                                                        the ‘‘technology’’ or source code at
                                                compliant with Federal Information                                                                             applicable:
                                                                                                        issue, whether by a license, license
                                                Processing Standards Publication 140–2                                                                            (i) The foreign person has a security
                                                                                                        exception, or situation where no license
                                                (FIPS 140–2) or its successors,                                                                                clearance approved by the host nation
                                                                                                        is required under the EAR for such
                                                supplemented by ‘‘software’’                                                                                   government of the entity outside the
                                                                                                        ‘‘technology’’ or source code; and
                                                implementation, cryptographic key                                                                              United States;
                                                                                                           (2) The entity has ‘‘knowledge’’ that                  (ii) The entity outside the United
                                                management and other procedures and                     the foreign national’s most recent
                                                controls that are in accordance with                                                                           States:
                                                                                                        country of citizenship or permanent                       (A) Has in place a process to screen
                                                guidance provided in current U.S.                       residency is that of a country to which
                                                National Institute for Standards and                                                                           the foreign person employee and to have
                                                                                                        export from the United States of the                   the employee execute a non-disclosure
                                                Technology publications, or other                       ‘‘technology’’ or source code at issue
                                                equally or more effective cryptographic                                                                        agreement that provides assurances that
                                                                                                        would be authorized by the EAR either                  the employee will not disclose, transfer,
                                                means; and                                              under a license exception or in
                                                   (iv) Not intentionally stored in a                                                                          or reexport controlled ‘‘technology’’
                                                                                                        situations where no license under the                  contrary to the EAR;
                                                country listed in Country Group D:5 (see                EAR would be required.
                                                Supplement No. 1 to part 740 of the                                                                               (B) Screens the employee for
                                                                                                           (b) Release to Country Group A:5                    substantive contacts with countries
                                                EAR) or in the Russian Federation.                      nationals. Without limiting the scope of               listed in Country Group D:5 (see
                                                  Note to paragraph (a)(4)(iv): Data in-transit         paragraph (a), release of ‘‘technology’’ or            Supplement No. 1 to part 740 of the
                                                via the Internet is not deemed to be stored.            source code by an entity outside the                   EAR). Although nationality does not, in
                                                   (b) Definitions. For purposes of this                United States to a foreign person of a                 and of itself, prohibit access to
                                                section, End-to-end encryption means (i)                country other than the foreign country                 ‘‘technology’’ or source code subject to
                                                the provision of cryptographic                          where the release takes place if:                      the EAR, an employee who has
                                                protection of data such that the data is                   (1) The entity is authorized to receive             substantive contacts with foreign
                                                not in unencrypted form between an                      the ‘‘technology’’ or source code at                   persons from countries listed in Country
                                                originator (or the originator’s in-country              issue, whether by a license, license                   Group D:5 shall be presumed to raise a
                                                security boundary) and an intended                      exception, or through situations where                 risk of diversion, unless BIS determines
                                                recipient (or the recipient’s in-country                no license is required under the EAR;                  otherwise;
                                                security boundary), and (ii) the means of                  (2) The foreign person is a bona fide                  (C) Maintains a technology security or
                                                decryption are not provided to any third                ‘permanent and regular employee’ of the                clearance plan that includes procedures
                                                party. The originator and the recipient                 entity and is not a proscribed person                  for screening employees for such
mstockstill on DSK3G9T082PROD with RULES




                                                may be the same person.                                 (see § 772.1 for definition of proscribed              substantive contacts;
                                                   (c) Ability to access ‘‘technology’’ or              person);                                                  (D) Maintains records of such
                                                ‘‘software’’ in encrypted form. The                        (3) Such employee is a national                     screenings for the longer of five years or
                                                ability to access ‘‘technology’’ or                     exclusively of a country in Country                    the duration of the individual’s
                                                ‘‘software’’ in encrypted form that                     Group A:5; and                                         employment with the entity; and
                                                satisfies the criteria set forth in                        (4) The release of ‘‘technology’’ or                   (E) Will make such plans and records
                                                paragraph (a)(5) of this section does not               source code takes place entirely within                available to BIS or its agents for civil


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00025   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                35606                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                and criminal law enforcement purposes                   Supplement No. 1 to Part 734 [Removed                  PART 750—APPLICATION
                                                upon request;                                           and Reserved]                                          PROCESSING, ISSUANCE, AND
                                                   (iii) The entity is a U.K. entity                                                                           DENIAL
                                                implementing § 126.18 of the ITAR (22                   ■ 17. Supplement No. 1 to part 734 is
                                                CFR 126.18) pursuant to the U.S.-U.K.                   removed and reserved.                                  ■ 20. The authority citation for 15 CFR
                                                Exchange of Notes regarding § 126.18 of                                                                        part 750 continues to read as follows:
                                                the ITAR for which the U.K. has                         PART 740— LICENSE EXCEPTIONS                             Authority: 50 U.S.C. 4601 et seq.; 50 U.S.C.
                                                provided appropriate implementation                                                                            1701 et seq.; Sec 1503, Pub. L. 108–11, 117
                                                guidance;                                               ■ 18. The authority citation for part 740              Stat. 559; E.O. 13026, 61 FR 58767, 3 CFR,
                                                   (iv) The entity is a Canadian entity                 continues to read as follows:                          1996 Comp., p. 228; E.O. 13222, 66 FR 44025,
                                                implementing § 126.18 of the ITAR                                                                              3 CFR, 2001 Comp., p. 783; E.O. 13637, 78
                                                                                                          Authority: 50 U.S.C. 4601 et seq.; 50 U.S.C.         FR 16129, 3 CFR, 2013 Comp., p. 223;
                                                pursuant to the U.S.-Canadian Exchange                  1701 et seq.; 22 U.S.C. 7201 et seq.; E.O.             Presidential Determination 2003–23, 68 FR
                                                of Letters regarding § 126.18 of the ITAR               13026, 61 FR 58767, 3 CFR, 1996 Comp., p.              26459, 3 CFR, 2004 Comp., p. 320; Notice of
                                                for which Canada has provided                           228; E.O. 13222, 66 FR 44025, 3 CFR, 2001              August 7, 2015, 80 FR 48233 (August 11,
                                                appropriate implementation guidance;                    Comp., p. 783; Notice of August 7, 2015, 80            2015).
                                                   (v) The entity is an Australian entity               FR 48233 (August 11, 2015).                            ■ 21. Section 750.7 is amended by
                                                implementing the exemption at                                                                                  revising paragraph (a) to read as follows:
                                                paragraph 3.7b of the ITAR Agreements                   ■ 19. In § 740.9, paragraph (a)(3) is
                                                Guidelines; or                                          revised to read as follows:                            § 750.7   Issuance of licenses.
                                                   (vi) The entity is a Dutch entity                    § 740.9 Temporary imports, exports,                       (a) Scope. Unless limited by a
                                                implementing the exemption at                           reexports, and transfers (in-country) (TMP).           condition set out in a license, the
                                                paragraph 3.7c of the ITAR Agreements                   *       *    *     *    *                              export, reexport, or transfer (in-country)
                                                Guidelines.                                                                                                    authorized by a license is for the item(s),
                                                   (d) Definitions—(1) Substantive                         (a) * * *                                           end-use(s), and parties described in the
                                                contacts include regular travel to                         (3) ‘‘Technology,’’ regardless of media             license application and any letters of
                                                countries in Country Group D:5; recent                  or format, may be exported, reexported,                explanation. The applicant must inform
                                                or continuing contact with agents,                      or transferred (in-country) by or to a                 the other parties identified on the
                                                brokers, and nationals of such countries;               U.S. person, or a foreign person                       license, such as the ultimate consignees
                                                continued demonstrated allegiance to                    employee of a U.S. person traveling or                 and end users, of the license’s scope and
                                                such countries; maintenance of business                 on temporary assignment abroad,                        of the specific conditions applicable to
                                                relationships with persons from such                    subject to the following restrictions:                 them. BIS grants licenses in reliance on
                                                countries; maintenance of a residence in                   (i) Foreign persons may only export,                representations the applicant made in or
                                                such countries; receiving salary or other               reexport, transfer (in country) or receive             submitted in connection with the
                                                continuing monetary compensation                        such ‘‘technology’’ as they are                        license application, letters of
                                                from such countries; or acts otherwise                  authorized to receive through a license,               explanation, and other documents
                                                indicating a risk of diversion.                         license exception other than TMP or                    submitted. A BIS license authorizing the
                                                   (2) Permanent and regular employee                                                                          release of ‘‘technology’’ to an entity also
                                                                                                        because no license is required.
                                                is an individual who:                                                                                          authorizes the release of the same
                                                                                                           (ii) ‘‘Technology’’ exported,                       ‘‘technology’’ to the entity’s foreign
                                                   (i) Is permanently (i.e., for not less
                                                than a year) employed by an entity, or                  reexported, or transferred under this                  persons who are permanent and regular
                                                                                                        authorization may only be possessed or                 employees (and who are not proscribed
                                                   (ii) Is a contract employee who:
                                                                                                        used by a U.S. person or authorized                    persons) of the entity’s facility or
                                                   (A) Is in a long-term contractual
                                                                                                        foreign person. Sufficient security                    facilities authorized on the license,
                                                relationship with the company where
                                                                                                        precautions must be taken to prevent                   except to the extent a license condition
                                                the individual works at the entity’s
                                                                                                        the unauthorized release of the                        limits or prohibits the release of the
                                                facilities or at locations assigned by the
                                                                                                        ‘‘technology.’’ Such security precautions              ‘‘technology’’ to foreign persons of
                                                entity (such as a remote site or on
                                                                                                        may include encryption of the                          specific countries or country groups.
                                                travel);
                                                                                                        ‘‘technology,’’ the use of secure network              *      *     *    *     *
                                                   (B) Works under the entity’s direction               connections, such as Virtual Private
                                                and control such that the company must
                                                                                                        Networks, the use of passwords or other                PART 772—DEFINITIONS OF TERMS
                                                determine the individual’s work
                                                                                                        access restrictions on the electronic
                                                schedule and duties;                                                                                           ■ 22. The authority citation for part 772
                                                                                                        device or media on which the
                                                   (C) Works full time and exclusively                  ‘‘technology’’ is stored, and the use of               continues to read as follows:
                                                for the entity; and                                     firewalls and other network security                     Authority: 50 U.S.C. 4601 et seq.; 50 U.S.C.
                                                   (D) Executes a nondisclosure                         measures to prevent unauthorized                       1701 et seq.; E.O. 13222, 66 FR 44025, 3 CFR,
                                                certification for the company that he or                access.                                                2001 Comp., p. 783; Notice of August 7,
                                                she will not disclose confidential                                                                             2015, 80 FR 48233 (August 11, 2015).
                                                information received as part of his or                     (iii) The individual is an employee of
                                                                                                        the U.S. Government or is directly                     ■  23. Section 772.1 is amended by:
                                                her work for the entity.                                                                                       ■  a. Adding in alphabetical order a
                                                                                                        employed by a U.S. person and not, e.g.,
                                                   Note to paragraph (d)(2): If the contract                                                                   definition for ‘‘Access information’’;
                                                                                                        by a foreign subsidiary.
                                                employee has been seconded to the entity by                                                                    ■ b. Revising the definition of ‘‘Export’’;
mstockstill on DSK3G9T082PROD with RULES




                                                a staffing agency, then the staffing agency                (iv) ‘‘Technology’’ authorized under                ■ c. Adding in alphabetical order
                                                must not have any role in the work the                  this exception may not be used for                     definitions for ‘‘Foreign person,’’
                                                individual performs other than to provide the           foreign production purposes or for
                                                individual for that work. The staffing agency                                                                  ‘‘Fundamental research,’’ ‘‘Proscribed
                                                                                                        technical assistance unless authorized                 person,’’ and ‘‘Publicly available
                                                also must not have access to any controlled
                                                                                                        through a license or license exception                 encryption software’’;
                                                ‘‘technology’’ or source code other than that
                                                authorized by the applicable regulations or a           other than TMP.                                        ■ d. Removing the definitions of
                                                license.                                                *       *    *     *    *                              ‘‘Publicly available information’’ and


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00026   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                                      Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations                                             35607

                                                ‘‘Publicly available technology and                        Release. See § 734.15 of the EAR.                   specified in ECCNs on the CCL that control
                                                software’’;                                             *      *     *     *     *                             ‘‘technology’’) of a commodity or software
                                                ■ e. Adding in alphabetical order a                        Required. (General Technology Note)                 that is subject to the EAR. Thus, for example,
                                                definition for ‘‘Published’’;                           —As applied to ‘‘technology’’ or                       if unclassified technology not specifically
                                                ■ f. Revising the definition of                         ‘‘software,’’ refers to only that portion of           enumerated on the USML is ‘‘required’’ for
                                                ‘‘Reexport’’;                                           ‘‘technology’’ or ‘‘software’’ which is                the development or production of a 9A610.x
                                                ■ g. Adding in alphabetical order a                                                                            aircraft component that is to be integrated or
                                                                                                        peculiarly responsible for achieving or
                                                definition for ‘‘Release’’;                                                                                    installed in a USML VIII(a) aircraft, then the
                                                                                                        exceeding the controlled performance
                                                ■ h. Revising the definition of                                                                                ‘‘technology’’ is controlled under ECCN
                                                                                                        levels, characteristics or functions. Such
                                                ‘‘Required’’;                                                                                                  9E610, not USML VIII(i). Conversely,
                                                                                                        ‘‘required’’ ‘‘technology’’ or ‘‘software’’
                                                ■ i. Removing the definition of                                                                                technical data directly related to, for
                                                                                                        may be shared by different products. For
                                                ‘‘Technical data’’; and                                                                                        example, the development or production of
                                                                                                        example, assume product ‘‘X’’ is
                                                ■ j. Revising the definitions of                                                                               a component subject to the ITAR does not
                                                                                                        controlled on the CCL if it operates at                become subject to the EAR merely because it
                                                ‘‘Technology,’’ and ‘‘Transfer.’’                       or above 400 MHz and is not controlled
                                                   The revisions and additions read as                                                                         is developed or produced with equipment
                                                                                                        if it operates below 400 MHz. If                       subject to the EAR.
                                                follows:
                                                                                                        production technologies ‘‘A,’’ ‘‘B,’’ and
                                                § 772.1 Definitions of terms as used in the             ‘‘C’’ allow production at no more than                 *     *     *     *     *
                                                Export Administration Regulations (EAR).                399 MHz, then technologies ‘‘A,’’ ‘‘B,’’                  Technology. Technology means:
                                                *      *    *     *     *                               and ‘‘C’’ are not ‘‘required’’ to produce
                                                                                                        the controlled product ‘‘X’’. If                          Information necessary for the
                                                   Access information. Information that
                                                                                                        technologies ‘‘A,’’ ‘‘B,’’ ‘‘C,’’ ‘‘D,’’ and           ‘‘development,’’ ‘‘production,’’ ‘‘use,’’
                                                allows access to encrypted technology
                                                                                                        ‘‘E’’ are used together, a manufacturer                operation, installation, maintenance,
                                                or encrypted software in an
                                                unencrypted form. Examples include                      can produce product ‘‘X’’ that operates                repair, overhaul, or refurbishing (or
                                                decryption keys, network access codes,                  at or above 400 MHz. In this example,                  other terms specified in ECCNs on the
                                                and passwords.                                          technologies ‘‘D’’ and ‘‘E’’ are peculiarly            CCL that control ‘‘technology’’) of an
                                                                                                        responsible for making the controlled                  item.
                                                *      *    *     *     *
                                                   Export. See § 734.13 of the EAR.                     product and are thus ‘‘required’’                         N.B.: Controlled ‘‘technology’’ is
                                                                                                        technology under the General                           defined in the General Technology Note
                                                *      *    *     *     *                               Technology Note. (See the General
                                                   Foreign person. Any natural person                                                                          and in the Commerce Control List
                                                                                                        Technology Note.)                                      (Supplement No. 1 to part 774 of the
                                                who is not a lawful permanent resident
                                                of the United States, citizen of the                      Note 1 to the definition of Required: The            EAR).
                                                United States, or any other protected                   ITAR and the EAR often divide within each                 Note 1 to definition of Technology:
                                                                                                        set of regulations or between each set of
                                                individual as defined by 8 U.S.C.                                                                              ‘‘Technology’’ may be in any tangible or
                                                                                                        regulations:
                                                1324b(a)(3). It also means any                            (a) Controls on parts, components,                   intangible form, such as written or oral
                                                corporation, business association,                      accessories, attachments, and software; and            communications, blueprints, drawings,
                                                partnership, trust, society or any other                  (b) Controls on the end items, systems,              photographs, plans, diagrams, models,
                                                entity or group that is not incorporated                equipment, or other items into which those             formulae, tables, engineering designs and
                                                in the United States or organized to do                 parts, components, accessories, attachments,           specifications, computer-aided design files,
                                                business in the United States, as well as               and software are to be installed or                    manuals or documentation, electronic media
                                                international organizations, foreign                    incorporated.                                          or information revealed through visual
                                                governments and any agency or                                                                                  inspection;
                                                                                                           Note 2 to the definition of Required: The
                                                subdivision of a foreign government                     references to ‘‘characteristics’’ and
                                                (e.g., diplomatic mission). ‘‘Foreign                                                                            Note 2 to definition of Technology: The
                                                                                                        ‘‘functions’’ are not limited to entries on the        modification of the design of an existing item
                                                person’’ is synonymous with ‘‘foreign                   CCL that use specific technical parameters to
                                                                                                                                                               creates a new item and technology for the
                                                national,’’ as used in the EAR, and                     describe the scope of what is controlled. The
                                                                                                                                                               modified design is technology for the
                                                ‘‘foreign person’’ as used in the                       ‘‘characteristics’’ and ‘‘functions’’ of an item
                                                                                                        listed are, absent a specific regulatory               development or production of the new item.
                                                International Traffic in Arms
                                                Regulations (22 CFR 120.16). This                       definition, a standard dictionary’s definition
                                                                                                        of the item. For example, ECCN 9A610.a
                                                                                                                                                               *     *     *     *    *
                                                definition does not apply to part 760 of
                                                                                                        controls military aircraft specially designed             Transfer. A shipment, transmission,
                                                the EAR (Restrictive Trade Practices or
                                                                                                        for a military use that are not enumerated in          or release of items subject to the EAR
                                                Boycotts).                                              USML paragraph VIII(a). No performance                 either within the United States or
                                                *      *    *     *     *                               level is identified in the entry, but the control      outside the United States. For In-
                                                   Fundamental research. See § 734.8 of                 characteristic of the aircraft is that it is
                                                                                                                                                               country transfer/Transfer (in-country),
                                                the EAR.                                                specially designed ‘‘for military use.’’ Thus,
                                                                                                        any technology, regardless of significance,            see § 734.16 of the EAR.
                                                *      *    *     *     *
                                                                                                        peculiar to making an aircraft ‘‘for military             Note to definition of Transfer: This
                                                   Proscribed person. A person who is                   use’’ as opposed to, for example, an aircraft
                                                prohibited from receiving the items at                                                                         definition of ‘‘transfer’’ does not apply to
                                                                                                        controlled under ECCN 9A991.a, would be                § 750.10 of the EAR or Supplement No. 8 to
                                                issue or participating in a transaction                 technical data ‘‘required’’ for an aircraft            part 760 of the EAR. The term ‘‘transfer’’ may
                                                that is subject to the EAR without                      specially designed for military use thus
                                                                                                                                                               also be included on licenses issued by BIS.
                                                authorization under the EAR, such as                    controlled under ECCN 9E610.
                                                                                                                                                               In that regard, the changes that can be made
mstockstill on DSK3G9T082PROD with RULES




                                                persons on the Entity List or denied
                                                                                                           Note 3 to the definition of Required:               to a BIS license are the non-material changes
                                                persons.
                                                                                                        Unclassified technology not specifically               described in § 750.7(c) of the EAR. Any other
                                                   Publicly available encryption
                                                                                                        enumerated on the USML is ‘‘subject to the             change to a BIS license without authorization
                                                software. See § 740.13(e) of the EAR.                   EAR’’ if it is ‘‘required’’ for the                    is a violation of the EAR. See §§ 750.7(c) and
                                                   Published. See § 734.7 of the EAR.                   ‘‘development,’’ ‘‘production,’’ ‘‘use,’’              764.2(e) of the EAR.
                                                *      *    *     *     *                               operation, installation, maintenance, repair,
                                                   Reexport. See § 734.14 of the EAR.                   overhaul, or refurbishing (or other terms              *       *    *     *     *


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00027   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1


                                                35608                 Federal Register / Vol. 81, No. 107 / Friday, June 3, 2016 / Rules and Regulations

                                                  Dated: May 23, 2016.                                  Manual Part III—Basin Regulations—                     of the Code of Federal Regulations as
                                                Kevin J. Wolf,                                          Water Supply Charges, which uses a                     follows:
                                                Assistant Secretary for Export                          unique numbering system, the
                                                Administration.                                         corresponding sections of the Code of                  PART 420—BASIN REGULATIONS—
                                                [FR Doc. 2016–12734 Filed 6–2–16; 8:45 am]              Federal Regulations were never updated                 WATER SUPPLY CHARGES
                                                BILLING CODE 3510–33–P                                  to include them. This final rule adds the
                                                                                                                                                               ■ 1. The authority citation for part 420
                                                                                                        approved changes to the federal code.
                                                                                                                                                               continues to read as follows:
                                                                                                          Notice of the proposed revisions was
                                                                                                        published in the Federal Register at 70                  Authority: Delaware River Basin Compact,
                                                DELAWARE RIVER BASIN
                                                                                                        FR 60496, October 18, 2005. Notice also                75 Stat. 688.
                                                COMMISSION
                                                                                                        appeared in the Delaware Register of                   ■ 2. Revise § 420.31(d) through (f) to
                                                18 CFR Part 420                                         Regulations, 9 DE Reg. 674, November 1,                read as follows:
                                                                                                        2005; New Jersey Register, 37 N.J.R.                   § 420.31   Certificate of entitlement.
                                                Clarifying Language in the Basin                        4206, November 7, 2005; New York
                                                Regulations—Water Supply Charges                        State Register, November 2, 2005 (page                 *      *     *     *     *
                                                Relating to Certificates of Entitlement                 4); and Pennsylvania Bulletin, 35 Pa.B.                  (d) Limitations. (1) A certificate of
                                                                                                        6094, Nov. 5, 2005. The Commission                     entitlement is granted to a specific user
                                                AGENCY:  Delaware River Basin                                                                                  for water withdrawals or diversions at a
                                                Commission.                                             held a public hearing on the proposed
                                                                                                        revisions on December 7, 2005 and                      specific facility in the amount of the
                                                ACTION: Final rule.                                                                                            Legal Entitlement as defined in
                                                                                                        accepted written comments on them
                                                                                                        through January 10, 2006. The changes                  § 420.23(b).
                                                SUMMARY:   The Delaware River Basin                                                                              (2) A certificate of entitlement shall
                                                Commission is codifying revisions to its                were adopted by unanimous vote
                                                                                                                                                               not be applied, transferred or modified
                                                Basin Regulations—Water Supply                          approving Resolution No. 2006–2 at the
                                                                                                                                                               to apply to a facility other than the
                                                Charges. The revisions involve no                       Commission’s public business meeting
                                                                                                                                                               facility initially specified in the
                                                changes in the substance or                             on March 1, 2006.
                                                                                                                                                               certificate.
                                                administration of the rule. They were                   Additional Materials                                     (3) A certificate of entitlement may
                                                made in order to clarify the language of                                                                       not be transferred from the certificate
                                                the rule to conform to the Commission’s                    Additional materials can be found on
                                                                                                                                                               holder to another user, except as
                                                decisions and practices so as to provide                the Commission’s Web site,
                                                                                                                                                               provided in the exceptions set forth in
                                                better notice to users regarding how the                www.drbc.net. These include: the notice
                                                                                                                                                               paragraph (f) of this section.
                                                Commission implements its                               of the proposed amendments published                     (4) A certificate of entitlement does
                                                entitlements program and to avoid                       in the Federal Register, at http://nj.gov/             not exempt the certificate holder from
                                                future controversy.                                     drbc/library/documents/water-charges-                  paying water supply charges for any
                                                DATES: This final rule is effective July 5,             codify/1_FR_PropRule_                                  portion of water withdrawals or
                                                2016.                                                   CertsEntitle101805.pdf; and in the state               diversions used outside the facility
                                                FOR FURTHER INFORMATION CONTACT:
                                                                                                        registers at http://www.nj.gov/drbc/                   specified in the certificate and any
                                                Pamela Bush, 609–477–7203.                              about/regulations/other-                               additional service area to which the
                                                                                                        rulemakings.html; the text of the draft                facility supplied water as of October 27,
                                                SUPPLEMENTARY INFORMATION:
                                                                                                        revisions as proposed, at http://nj.gov/               1961 or at the facility specified in the
                                                Background                                              drbc/library/documents/water-charges-                  certificate by a user other than the
                                                   The Delaware River Basin                             codify/6_ProposedText_                                 certificate holder. For purposes of this
                                                Commission (‘‘DRBC’’ or                                 WaterSupplyChargingRegs_Art5.2.pdf;                    paragraph (d)(4), a certificate holder
                                                ‘‘Commission’’) is a federal-interstate                 Resolution No. 2006–2, adopting the                    claiming an exemption from charges for
                                                compact agency charged with managing                    revisions as final, at http://nj.gov/drbc/             water supplied within a service area
                                                the water resources of the Delaware                     library/documents/water-charges-                       shall submit proof satisfactory to the
                                                River Basin on a regional basis without                 codify/7_Res2006-02_CertEntitle_                       Commission identifying the facility’s
                                                regard to political boundaries. Its                     adopted030106.pdf; and the Minutes of                  service area as of October 27, 1961. In
                                                members are the governors of the four                   the Commission’s business meeting of                   the absence of proof of the service area
                                                basin states—Delaware, New Jersey,                      March 1, 2006, explaining the                          as of October 27, 1961, the service area
                                                New York and Pennsylvania—and the                       differences between the proposed and                   defined in the Commission docket, if
                                                North Atlantic Division Commander of                    adopted rule text, at http://nj.gov/drbc/              any, for the facility in effect at the time
                                                the U.S. Army Corps of Engineers,                       library/documents/water-charges-                       the certificate was issued shall be
                                                representing the federal government.                    codify/8_Min_030106_note-pgs18-                        deemed to be the facility’s service area.
                                                   By Resolution No. 2006–2 on March                    21.pdf.                                                In the absence of proof of a service area,
                                                1, 2006, the Commission approved                           With adoption of this final rule, the               the certificate shall only exempt the
                                                revisions to its Basin Regulations—                     Commission will reference the CFR                      certificate holder from paying water
                                                Water Supply Charges, 18 CFR part 420,                  version of the Basin Regulations—Water                 supply charges for water used at the
                                                to clarify the language of the rule to                  Supply Charges for most purposes. For                  facility.
                                                conform to the Commission’s decisions                   the foreseeable future, however, both                    (e) Termination of certificate. (1) A
                                                and practices, in order to provide better               versions will remain posted on the                     certificate of entitlement terminates
                                                notice to users regarding how the                       Commission’s Web site, at http://                      pursuant to this section and without the
mstockstill on DSK3G9T082PROD with RULES




                                                Commission implements its                               www.nj.gov/drbc/about/regulations/.                    need for Commission action if at least
                                                entitlements program and to avoid                       List of Subjects in 18 CFR Part 420                    one of the following occurs:
                                                future controversy. The revisions                                                                                (i) The certificate holder dissolves or
                                                involved no changes in the substance or                   Water supply.                                        otherwise ceases to exist;
                                                administration of the rule. Although the                  For the reasons set forth in the                       (ii) The certificate holder ceases the
                                                adopted revisions were incorporated                     preamble, the Delaware River Basin                     withdrawals or diversions at the facility
                                                into the Commission’s Administrative                    Commission amends part 420 of title 18                 to which the certificate of entitlement


                                           VerDate Sep<11>2014   21:04 Jun 02, 2016   Jkt 238001   PO 00000   Frm 00028   Fmt 4700   Sfmt 4700   E:\FR\FM\03JNR1.SGM   03JNR1



Document Created: 2018-02-08 07:29:35
Document Modified: 2018-02-08 07:29:35
CategoryRegulatory Information
CollectionFederal Register
sudoc ClassAE 2.7:
GS 4.107:
AE 2.106:
PublisherOffice of the Federal Register, National Archives and Records Administration
SectionRules and Regulations
ActionFinal rule.
DatesThis rule is effective September 1, 2016.
ContactFor questions on application of controls to electronically transmitted and stored technology and software, contact Bob Rarog, Senior Advisor to the Assistant Secretary for Export Administration, Bureau of Industry and Security at (202) 482-9089. For other questions, contact Hillary Hess, Director, Regulatory Policy Division, Office of Exporter Services, Bureau of Industry and Security at (202) 482-2440 or [email protected]
FR Citation81 FR 35586 
RIN Number0694-AG32
CFR Citation15 CFR 734
15 CFR 740
15 CFR 750
15 CFR 772
CFR AssociatedExports; Administrative Practice and Procedure and Reporting and Recordkeeping Requirements

2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR