There are some countries, under sanctions or embargo, to which all exports are severely restricted. (Usually only food, clothing and medicine are acceptable.) A significant agreement regarding the export of products is known as ITAR or International Traffic in Arms Regulations.
To export software you are required to obtain license. When any product is combined with other products its classification may change. For instance combining encryption with a software product may move it into the category of "munition," which means even stronger regulatory management as it is covered by ITAR. For the US rules and guidelines go here. For other countries seek local guidance.
The basic ACE/TAO/CIAO/MPC suite of products are collectively, and individually, considered dual-use technologies and open source software. On their own they have an ECCN or Export Control Classification Number that is EAR 99(S) (the "S" stands for software and is sometimes dropped). This number is obtained from the US Export Administration Regulations (EARs).
The basis for classification is that the primary products are implementations, in standard programming languages of publicly defined standards using well known published software patterns. This software does not fall under normal interpretation of mass market software (i.e. available over the counter, binary form, easy to install, use etc.) and its associated license exception "TSU" (which means Technology and Software Unrestricted).
However recent interpretations of TSU appear to now include open source. "Also in =A7740.13, to, in part, take into account the open source approach to software development, unrestricted encryption source code not subject to an express agreement for the payment of a licensing fee or royalty for commercial production or sale of any product developed using the source code can, without review, be released from 'EI' controls and exported and re-exported under License Exception TSU. Intellectual property protection (e.g., copyright, patent, or trademark) would not, by itself, be construed as an express agreement for the payment of a licensing fee or royalty for commercial production or sale of any product developed using the source code. To qualify, exporters must notify BXA of the URL or Internet address or provide a copy of the source code by the time of export. These notifications are only required for the initial export; there are no notification requirements for end-users subsequently using the source code. Notification can be made by e-mail."
How you embed this software in your systems can cause the overall product classification to change. Nothing in this information should be construed as legal advice.
If you have any suggestions, additions, comments, or questions, please let me know.
Back to the ACE home page.
Last modified 16:24:03 CST 16 December 2012