On March 10, 2010, the Treasury Department’s Office of Foreign Assets Control (“OFAC”) published a final rule authorizing the export to Iran and Sudan of certain services and software incident to personal internet-based communications. OFAC also authorized the export to Cuba of similar services, but not related software. While this rule had been anticipated for months regarding Iran – in light of a December 2009 announcement by the US State Department – OFAC has decided to extend all or some of the same benefits to Sudan and Cuba.
As we reported in December, the State Department waived the requirement under Section 1606 of the Iran-Iraq Arms Non-Proliferation Act of 1992 to impose certain sanctions on Iran, finding that doing so met the Act’s standard of being “essential to the national interest of the United States.” The State Department determined that it was essential to US national interests to allow the free download to Iran of mass market software necessary for the exchange of personal communications and sharing of information over the internet, and recommended that OFAC issue a general license covering these downloads and related services.
OFAC has now implemented the waiver by issuing a final rule for Iran, Sudan, and Cuba – authorizing the export of certain services and (in the case of Iran and Sudan) software incident to the exchange of personal internet-based communications. The State Department was not required by statute to issue this waiver for Sudan or Cuba. OFAC decided to include Sudan in the rule because the considerations at issue for Iran – that personal internet-based communications are a tool for change, allowing citizens to share information, organize demonstrations, and promote democracy – apply equally to Sudan. Regarding Cuba, OFAC explained that this rule is in furtherance of the President’s initiative to promote democracy in Cuba by, among other things, increasing the flow of information to the Cuban people.
This final rule – effective March 8, 2010 -- amends the Iranian Transactions Regulations, Sudanese Sanctions Regulations, and Cuban Assets Control Regulations as follows:
- Services to Iran, Sudan and Cuba: It authorizes the export from the United States or by a US person, wherever located, to persons in Iran, Sudan, and Cuba of services incident to the exchange of personal communications over the Internet, such as instant messaging, chat and email, social networking, sharing of photos and movies, web browsing, and blogging.
- Software to Iran and Sudan: It authorizes the export from the United States or by a US person, wherever located, to persons in Iran and Sudan of software necessary to enable the services listed above, as long as the software is classified as either (1) EAR99 under the Export Administration Regulations (“EAR”); (2) not subject to the EAR; or (3) mass market software under ECCN 5D992.
- The covered services and software must be publicly available for free.
The preamble to the rule explains that the general license for Cuba does not cover software because the export of goods and technology to Cuba is subject to a separate authorization by the US Department of Commerce under the EAR. The Cuban Assets Control Regulations already permit all transactions ordinarily incident to the export of items to Cuba if the export is authorized under the EAR.
The following activities are not authorized by the final rule:
- The direct or indirect export of services or software with knowledge or reason to know that such services of software are intended for the Governments of Iran, Sudan, or Cuba.
- The direct or indirect export to Iran or Sudan of any goods or technology listed on the Commerce Control List of the EAR, except for 5D992 mass market software necessary to enable the services listed above. The rule for Cuba prohibits the export of any items to Cuba.
- The direct or indirect export of Internet connectivity services or telecommunications transmission facilities, such as satellite links. (Note that separate general licenses related to the provision of telecommunication services to Cuba are contained in Section 515.542 of the Cuban Assets Control Regulations.)
- The direct or indirect export of web-hosting services that are for purposes other than personal communications (i.e., commercial communications) or of domain name registration services.
OFAC has also provided that it may issue specific licenses on a case-by-case basis for export to Iran or Sudan of “other services and software incident to the sharing of information over the Internet,” along as the software is not subject to the EAR, or is classified as EAR99 or 5D992 mass market software. The corresponding provision for Cuba applies to “other services incident to the sharing of information over the Internet.” These provisions would presumably apply to items not available for free, non-mass market software classified as 5D992 or 5D002, or potentially items incident to the exchange of non-personal communications over the Internet.
Relationship to EAR Provisions
The ultimate effect of this rule depends upon the interplay between OFAC rules and the EAR, enforced by the Commerce Department’s Bureau of Industry and Security (“BIS”). The effect for Iran is clear because Section 746.7 of the EAR provides that if OFAC authorizes an action that is regulated by both agencies, then separate BIS authorization is not needed. However, since the EAR do not contain a similar rule for Sudan, technically a BIS license may still be required to export 5D992 software to Sudan. On the other hand, since BIS has not made any public statements about the effect of this final rule, it is possible that the agency will rely on its September 2009 advisory opinion, which permits the publication of “mass market” encryption software on the Internet where it may be freely and anonymously downloaded by anyone, including sanctioned country nationals. While BIS’ position on exports to Sudan is currently unclear, no software exports to Cuba are permitted at all without further action by BIS.
While the gist of this rule has been known since the State Department’s announcement in December, OFAC’s rule provides additional detail on the scope of the general license. Comparing the State Department’s waiver to OFAC’s final rule elucidates several points that should be considered by exporters.
- First, the State Department’s waiver mainly dealt with software, and not related services. The general license makes clear that incidental transactions – such as software updates, related communications with the service provider, and use of these companies’ internet-based communications services themselves – are permitted. In fact, OFAC’s rule is structured primarily to authorize the export of personal internet-based communications services, and then certain software that is necessary to enable the services. While the rule does not explicitly address transactions ordinarily incident to the export of software, it is likely that any transaction incident to the export of software would also be covered by the provision authorizing the export of services incident to the exchange of personal internet-based communications.
- Second, the rule clarifies – and somewhat expands – the reference in the State Department’s waiver to “mass market” software. Under the EAR, mass market software is generally defined as products available to the public by being sold, without restriction, from stock through electronic transactions. Under this final rule, covered mass market software must have been reviewed and classified by the Commerce Department as mass market software under ECCN 5D992. However, the rule also covers software classified under EAR99, which includes many software products that do not include encryption or other information security functions. In addition, the rule covers items not subject to the EAR, which in this context might include certain publicly-available software with weak or no encryption, and foreign-made items with de minimis US content that are exported from third countries to Iran or Sudan.
- Third, OFAC’s rule does not reflect the State Department’s vague reference to dual-use software involving “low-level encryption elements.” Currently, the Commerce Department classifies products as “mass market” encryption software without regard to the level (or strength) of encryption included within the product. OFAC’s final rule is thus clearer than the State Department waiver with respect to the covered encryption software.
- Finally, while the State Department’s waiver appeared to deal mainly with text-based communications, OFAC’s final rule applies to voice, image, and video communications as well. OFAC specifically included within its rule the sharing of photos and movies, as well as web browsing.
This final rule is consistent with recent US Government policy that seeks to promote the free flow of information to ordinary citizens in sanctioned countries such as Iran and Cuba, while simultaneously enforcing strict economic sanctions against those countries. The main change for US exporters is that they may now distribute certain EAR99 or 5D992 mass market software to users in Iran and Sudan (and related to services to users in Iran, Sudan, and Cuba), as long as the products are not intended for use by the governments of those countries. However, please note that BIS’ position on the export of 5D992 software to Sudan is not entirely clear, and the exports of software to Cuba are outside the scope of this new rule. Exporters are urged to exercise caution in interpreting the scope of this rule in order to maintain compliance with OFAC regulations.