Encryption technology offers both substantial benefits (by protecting the confidentiality, authenticity, and integrity of business and personal information) and substantial risks (by making it easier for criminals and terrorists to conceal communications regarding illegal behavior). While most countries recognize the benefits of encryption, the associated risks have led many governments to impose controls on the import, sale, use, and/or export of encryption software, hardware and technical information. Companies that operate in a multinational environment can pay a significant price if they are not familiar with these controls.
For instance, in the United States encryption controls cover export, but not import, domestic sale, or use, of encryption products. A violation of regulations related to the export of encryption may be punishable by civil monetary penalties, denial of export privileges, and criminal fines. US law may be violated not only if a US-origin product is exported from the United States without authorization, but also if it is “re-exported” from another country to a third country.
Outside the United States, numerous governments restrict the import, use, sale, and/or export of encryption. Some countries impose severe sanctions for a violation of their restrictions. Others use informal sanctions to address perceived misuse of encryption technology. In other instances, governments have blocked communications or confiscated encryption hardware or software. Finally, many companies have encountered substantial delays or the inability to deploy or sell encryption products in countries with established control regimes–typically because of a lack of familiarity with recent changes in local regulations and procedures.
An accurate understanding of international encryption regulation can help a company avoid costs and delays. Understanding the relevant laws and regulations also substantially reduces the risk of unintentional violations. In addition, an appreciation of the application and approval processes can allow companies to plan ahead on a global basis.