Open Source and the EAR
Open source software that performs encryption functions is subject to the EAR but benefits from specific exclusions and exceptions. The key regulatory provisions are the publicly available exclusion in §734.3(b)(3), the published encryption source code provisions in §742.15(b), and License Exception TSU (Technology and Software Unrestricted) in §740.13(e).
Understanding how these provisions interact is critical for open source developers and organizations that distribute encryption-capable software. The analysis differs depending on whether you are distributing source code, compiled binaries, or both.
The Publicly Available Exclusion
Encryption source code that is publicly available — meaning published and available to the public without restrictions on further dissemination — is excluded from ECCN 5D002 and instead classified under ECCN 5D002.c. However, this classification still requires a notification to BIS and the ENC Encryption Request Coordinator before or concurrent with making the code publicly available.
The notification requirement is a one-time filing that provides BIS with the URL where the source code can be accessed. This is a common compliance requirement that many open source projects overlook.
Compiled Binaries and Object Code
While encryption source code benefits from the publicly available exclusion, compiled binaries and object code do not. A compiled encryption application must be classified independently — typically under 5D002 or 5D992 — and the standard EAR requirements apply, including license requirements, license exception eligibility, and encryption review filings.
This means that the same encryption library may have different classifications depending on the form of distribution: source code on GitHub may qualify for the publicly available exclusion, while the compiled binary distributed through an app store must be separately classified and may require ENC filings.