BIS Eliminates Most Reporting Requirements For Open Source And Mass Market Encryption

Today, the Bureau of Industry & Security (BIS) is amending the Export Administration Regulations (EAR) to eliminate most reporting requirements related to open source encryption software and certain "mass market" encryption items.  Today's rule also revises the Commerce Control List (CCL) to implement updates from the December 2019 Wassenaar Arrangement (WA) Plenary meeting.

Open source software changes

Previously, software source code published online that called, contained, or used encryption functionality often remained subject to the EAR (and its licensing requirements) until the author of the code submitted an email notification report to the U.S. government.  Today's amendment eliminates the reporting requirement for source code that uses standard cryptography, releasing source code from the EAR's licensing requirements once the code is published online.  Under the new rules, only source code that implements proprietary or unpublished encryption must be