ITAR and EAR Control Guide

Releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export);

A user has a decryption path to a project's data only if a resource's key has been re-encrypted to that user's public key. tiCrypt administrators, superadmins and operating-system root are cryptographically excluded from project data, and a running Secure VM has no interactive login path outside that access. Admitting only authorized U.S. persons to a project therefore leaves no non-U.S. person with a decryption path through normal use, VM access or administrative privilege.

Make the export-control determination and decide who may join the project. Key escrow is the one path that can exist outside project membership: see the row on the means of decryption.

Transmitting or otherwise transferring technical data to a U.S. person in the United States from a person in the United States;

Unclassified;

Confirm that the data is unclassified. The export-control determination is the organization's.

Secured using end-to-end encryption;

Secured using cryptographic modules (hardware or software) compliant with the Federal Information Processing Standards Publication 140-2 (FIPS 140-2) or its successors, supplemented by software implementation, cryptographic key management and other procedures and controls that are in accordance with guidance provided in current U.S. National Institute for Standards and Technology (NIST) publications, or by other cryptographic means that provide security strength that is at least comparable to the minimum 128 bits of security strength achieved by the Advanced Encryption Standard (AES-128); and

Not intentionally sent to a person in or stored in a country proscribed in § 126.1 of this subchapter; and Note 1 to paragraph (a)(5)(iv): Data in-transit via the internet is not deemed to be stored in a country it transits.

Not sent from a country proscribed in § 126.1 of this subchapter;

The provision of cryptographic protection of data, such that the data is not in an unencrypted form, between an originator (or the originator's in-country security boundary) and an intended recipient (or the recipient's in-country security boundary); and

The means of decryption are not provided to any third party.

Keys are generated on the user's client and none is stored unwrapped on the server, so the infrastructure and its administrators hold no means of decryption. Tera Insights supplies tiCrypt as software and has no access to a deployment. Key escrow is the one path that can exist outside project membership: when it is enabled, a user's private key can be reconstructed only by one member of every escrow group acting together, three groups by default, and system administrators cannot serve on the escrow team.

Choose whether the project's accounts are escrowed. If they are, make sure every escrow member who could recover a key used on the project is authorized to receive the data, and govern and log key recovery as a controlled action. With escrow off there is no recovery path, and a lost key or forgotten password leaves the data unrecoverable.

The originator and the intended recipient may be the same person. The intended recipient must be the originator, a U.S. person in the United States, or a person otherwise authorized to receive the technical data, such as by a license or other approval pursuant to this subchapter.

The ability to access technical data in encrypted form that satisfies the criteria set forth in paragraph (a)(5) of this section does not constitute the release or export of such technical data.

Access information is information that allows access to encrypted technical data subject to this subchapter in an unencrypted form. Examples include decryption keys, network access codes, and passwords.

The use of access information to cause or enable a foreign person, including yourself, to access, view, or possess unencrypted technical data; or

The use of access information to cause technical data outside of the United States to be in unencrypted form.

Set and enforce the rule on project members using tiCrypt outside the United States. Decryption happens on the member's own device.

Authorization for a release of technical data to a foreign person is required to provide access information to that foreign person, if that access information can cause or enable access, viewing, or possession of the unencrypted technical data.

U.S. person means a person who is a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20) or who is a protected individual as defined by 8 U.S.C. 1324b(a)(3). It also means any corporation, business association, partnership, society, trust, or any other entity, organization, or group that is incorporated to do business in the United States. It also includes any governmental (Federal, state, or local) entity. It does not include any foreign person as defined in § 120.63.

Foreign person means any natural person who is not a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20) or who is not a protected individual as defined by 8 U.S.C. 1324b(a)(3). It also means any foreign corporation, business association, partnership, trust, society, or any other entity or group that is not incorporated or organized to do business in the United States, as well as international organizations, foreign governments, and any agency or subdivision of foreign governments (e.g., diplomatic missions).

Releasing or otherwise transferring “technology” or source code (but not object code) to a foreign person in the United States (a “deemed export”);

A user has a decryption path to a project's data only if a resource's key has been re-encrypted to that user's public key. tiCrypt administrators, superadmins and operating-system root are cryptographically excluded from project data, and a running Secure VM has no interactive login path outside that access. Admitting only authorized U.S. persons to a project therefore leaves no non-U.S. person with a decryption path through normal use, VM access or administrative privilege.

Make the export-control determination and decide who may join the project. Key escrow is the one path that can exist outside project membership: see the row on the means of decryption.

Any act causing the “release” of “technology” or “software,” through use of “access information” or otherwise, to yourself or another person requires an authorization to the same extent an authorization would be required to export or reexport such “technology” or “software” to that person.

Transmitting or otherwise transferring “technology” or “software” to a person in the United States who is not a foreign person from another person in the United States.

Unclassified;

Confirm that the data is unclassified. The export-control determination is the organization's.

Secured using 'end-to-end encryption;'

Secured using cryptographic modules (hardware or “software”) compliant with Federal Information Processing Standards Publication 140-2 (FIPS 140-2) or its successors, supplemented by “software” implementation, cryptographic key management and other procedures and controls that are in accordance with guidance provided in current U.S. National Institute for Standards and Technology publications, or other equally or more effective cryptographic means; and

Not intentionally stored in a country listed in Country Group D:5 (see supplement no. 1 to part 740 of the EAR). Note 1 to paragraph (a)(5)(iv): Data in-transit via the internet is not deemed to be stored.

the provision of cryptographic protection of data such that the data is not in unencrypted form between an originator (or the originator's in-country security boundary) and an intended recipient (or the recipient's in-country security boundary)

the means of decryption are not provided to any third party. The originator and the recipient may be the same person.

Keys are generated on the user's client and none is stored unwrapped on the server, so the infrastructure and its administrators hold no means of decryption. Tera Insights supplies tiCrypt as software and has no access to a deployment. Key escrow is the one path that can exist outside project membership: when it is enabled, a user's private key can be reconstructed only by one member of every escrow group acting together, three groups by default, and system administrators cannot serve on the escrow team.

Choose whether the project's accounts are escrowed. If they are, make sure every escrow member who could recover a key used on the project is authorized to receive the data, and govern and log key recovery as a controlled action. With escrow off there is no recovery path, and a lost key or forgotten password leaves the data unrecoverable.

The ability to access “technology” or “software” in encrypted form that satisfies the criteria set forth in paragraph (a)(5) of this section does not constitute the release or export of such “technology” or “software.”

To the extent an authorization would be required to transfer “technology” or “software,” a comparable authorization is required to transfer “access information” if done with “knowledge” that such transfer would result in the release of such “technology” or “software” without a required authorization.

For purposes of § 734.19(a), information that allows access to encrypted technology or encrypted software in an unencrypted form. Examples include decryption keys, network access codes, and passwords.

Any natural person who is not a lawful permanent resident of the United States, citizen of the United States, or any other protected individual as defined by 8 U.S.C. 1324b(a)(3). It also means any corporation, business association, partnership, trust, society or any other entity or group that is not incorporated in the United States or organized to do business in the United States, as well as international organizations, foreign governments and any agency or subdivision of a foreign government (e.g., diplomatic mission). “Foreign person” is synonymous with “foreign national,” as used in the EAR, and “foreign person” as used in the International Traffic in Arms Regulations (22 CFR 120.16). This definition does not apply to part 760 of the EAR (Restrictive Trade Practices or Boycotts).