Administration of Export Controls on Encryption Products

This executive order establishes special export control rules for encryption products being transferred from State Department munitions oversight to Commerce Department dual-use regulations. It exempts encryption controls from normal foreign-availability review requirements, gives multiple agencies including Justice veto authority over encryption export licenses, excludes encryption software from being treated as 'technology,' and mandates that technical assistance exports be controlled as strictly as under arms export laws.

Federal Register Open PDF 61 FR 58767

Impact dates

Date TBD
EO provisions take effect upon placement of encryption products on Commerce Control List

Key directives

Exempt encryption export controls from EAA foreign-availability provisions (Section 1(a))
Add Justice Department as voting member of Export Administration Review Board and ACEP for encryption products (Section 1(b))
State, Defense, Energy, Justice, and ACDA must review all encryption export license applications (Section 1(b))
Encryption software shall not be treated as 'technology' under EAA/EAR definitions (Section 1(c))
Commerce Secretary must control export of assistance/training to foreign persons at AECA levels (Section 1(d))
Controls may include measures promoting strong encryption and key recovery infrastructure (Section 1(e))
EO effective upon placement of encryption products on Commerce Control List (Section 2)

Who is ordered

Timeline

Immediate

EO takes effect upon placement of any encryption products on Commerce Control List

Near term (90d)

Commerce Department rulemaking on controlling technical assistance exports
Interagency review procedures implementation for encryption licenses

Long term

Development of key recovery management infrastructure
Ongoing multi-agency oversight of encryption exports
Potential shift in global encryption market competitiveness

Risks & tensions

Foreign-availability exemption may face WTO or trade agreement challenges despite discretionary safety valve
Multi-agency veto structure (5 agencies) likely to slow licensing and create interagency friction
Software-as-not-technology classification creates definitional tension with broader export control framework
Key recovery infrastructure mandate implies government access to encrypted communications, raising unresolved civil liberties tensions not addressed in text
Judicial review bar (Section 3) limits recourse for denied exporters but legal challenge to bar itself possible