Ben Halpert / June 2007
Mobile Enterprise

Millions of personal records have been compromised due to unprotected data on laptops that have been lost or stolen. As a result of these unfortunate events, many organizations require that their laptops be protected by encrypting the hard drives contained therein. Today, this reaction appears to be an easy decision.

Prior to 1996, however, such a decision would have had vast implications on an organization’s mobile workforce that was U.S. based and global in reach. It wasn’t until the Clinton administration’s tenure that products containing

encryption features were no longer classified as prohibited dual-use munitions from an export-control perspective. Although the United States has removed many restrictions on the export of encryption products, not all countries have the same view.

If you already use products that contain encryption capabilities (such as VPN clients, Web browsers and hard drive encryption solutions) and your organization has an international presence, compliance to internal import and export controls is required. Most product developers that utilize cryptographic algorithms take the initiative to gain import and export approval from the governing bodies in many countries. Simply request a copy of the license or letter of approval from the product developer as needed. If you’re utilizing a product with cryptographic features and approval has not already been applied for and granted, the onus to gain import and

export clearance is on your organization.

Although the international Wassenaar Arrangement is in place to ease the burden of importing and exporting cryptographic-enabled products, not all countries participate. The Crypto Law Survey provides import and export control requirements listed by country and includes contact information for each country’s cryptographic governing body. In the United States, the Bureau of Industry and Security (BIS) in the Department of Commerce is tasked with administering such controls.

I am not a lawyer, and nor did I sleep at a Holiday Inn Express last night, so please consult your legal counsel about the impacts of import and export control laws in countries where you conduct business.

Return to Publications >