One of the puzzling situations that are not explicitly answered by the Commerce Control List (CCL), or other part of the EAR, are the software/hardware bundles commonly exported overseas.
Looking at the plain language of the CCL, one may reason that the hardware having encryption (PC or the server), typically under 4A994 category, must also be crosschecked pursuant to Category 4 Note 3 (“Computers, related equipment and ‘software’ performing cryptographic, cryptoanalytic, certifiable multi-level security or certifiable user isolation functions, or that limit electromagnetic compatibility [EMC], must also be evaluated against the performance characteristics in Category 5, Part 2 [‘Information Security’]). Category 5, Part 2 may tell you Category 5 applies in lieu of Category 4, but does not tell you what to do if both controls within Category 5 are applicable. Publicly available information, such as “Classification of computer preloaded with TSU-eligible encryption software” advisory opinion, is not very helpful because one may interpret it as limited to TSU exceptions only. Phone conversations with BIS team did not help much either, as I received conflicting answers (depending on the person I spoke with) regarding the reporting requirements – ranging from reporting of two ECCNs per one commodity to single ECCN relating to hardware portion.
To resolve this issue, I drafted an advisory opinion request (which is not published as of the time of this writing) to confront the issue directly. I realize that some of the biggest trade names in the industry do not have the answer to this, so the reproduction of the advisory opinion below may be helpful to the trade community.
Advisory Opinion Request
Inquiry
1) When the product is a bundled software and hardware item, where hardware is controlled under 5A002, and software is controlled under 5D002, what ECCN(s) must be reported to BIS upon export?
2) Same question as above, but the ECCN for hardware is 5A992 and the product is exported to non AT1 country. The software ECCN remains the same, 5D002.
Response
If 5D002 software is loaded onto 5A002 hardware, then the ECCN is 5A002.
If 5D002 software is loaded onto 5A992 hardware, then the ECCN is also 5A002.
Hope this answers your question.
Regards.
Aaron Amundson
Bureau of Industry and Security
Tel: (202) 482-5299
Fax: (202) 501-0784
aamundso@bis.doc.gov
