Why Encryption Gets Special Treatment
Encryption technology occupies a unique position in export controls. Because strong encryption can protect military communications and intelligence operations, it has been controlled since the Cold War era. Today, Category 5 Part 2 of the Commerce Control List specifically addresses information security items, including hardware, software, and technology that incorporate or enable cryptographic functionality.
The General Information Security Note (GISN) in the EAR requires that any item performing or incorporating cryptographic functionality must be evaluated against Category 5 Part 2, regardless of the item's primary function. This means a medical device with encrypted data transmission, a commercial drone with AES-encrypted telemetry, or an IoT sensor with TLS capabilities must all be checked against 5A002/5D002.
ECCN 5A002 and 5D002
ECCN 5A002 covers information security systems, equipment, and components that use cryptography for data confidentiality with algorithms exceeding 56 bits for symmetric key or 512 bits for asymmetric key. ECCN 5D002 covers software with equivalent capabilities. These ECCNs capture the widest range of encryption items.
Key technical thresholds include: symmetric algorithms with key lengths greater than 56 bits (virtually all modern encryption), asymmetric algorithms with key lengths exceeding 512 bits for factoring or 112 bits for elliptic curve, and any custom or proprietary cryptographic algorithms.
Mass Market Classification (5A992/5D992)
Many consumer and commercial encryption products qualify for the mass market classification under ECCN 5A992 or 5D992. To qualify, the item must be generally available to the public by being sold from stock at retail points of sale without restriction, and the cryptographic functionality cannot be easily changed by the user. Items classified as 5A992/5D992 are eligible for export to most destinations without a license.
The ENC License Exception
License Exception ENC (§740.17) provides several pathways for exporting encryption items without a license. ENC §740.17(b)(1) allows exports to most commercial end-users after a one-time classification review and filing with BIS. ENC §740.17(b)(3) covers mass market encryption after a self-classification filing. Understanding which ENC provision applies is essential for technology companies exporting globally.