{"id":370,"date":"2019-12-27T16:24:28","date_gmt":"2019-12-27T16:24:28","guid":{"rendered":"http:\/\/exportcompliancesolutions.com\/blog\/?p=370"},"modified":"2019-12-27T16:24:28","modified_gmt":"2019-12-27T16:24:28","slug":"ddtc-issues-long-awaited-itar-cloud-rule","status":"publish","type":"post","link":"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/","title":{"rendered":"DDTC Issues Long-Awaited ITAR Cloud Rule"},"content":{"rendered":"

On December 26, 2019, the Department of State, Directorate of Defense Trade Controls (DDTC) published an Interim Final Rule (84 FR 70887<\/a>) describing when data controlled by the International Traffic in Arms Regulations (ITAR) may be transmitted electronically without triggering a requirement for an export authorization.\u00a0 The new rule is intended to clearly permit the use of cloud services and other electronic transmissions when technical requirements are met.<\/p>\n

Rule Proposed in 2015 Effective March 2020<\/strong><\/p>\n

In an effort to modernize and harmonize export regulations, the Departments of Commerce and State originally published parallel proposed rules on June 3, 2015 (80 FR 31505<\/a> and 80 FR 31525<\/a>).\u00a0 One year later, on June 3, 2016, the Department of Commerce published a final rule (81 FR 35586<\/a>) establishing that secured, unclassified transmissions would not be considered exports, reexports, or transfers when specific conditions were met.\u00a0 The Department of State revised the ITAR at that time as well, but did not implement parallel definition until this notice.\u00a0 The revision will go into effect nearly five years after the original proposal.<\/p>\n

As revised, the Department of Commerce\u2019s Export Administration Regulations (EAR) now allows the use of cloud services with EAR-controlled technology by excluding the following from the definition of exports, reexports, or transfers (EAR \u00a7734.18(a)(5)<\/a>):<\/p>\n

Sending, taking, or storing \u201ctechnology\u201d or \u201csoftware\u201d that is:<\/p>\n

(i) Unclassified;<\/p>\n

(ii) Secured using ‘end-to-end encryption;’<\/p>\n

(iii) Secured using cryptographic modules (hardware or \u201csoftware\u201d) compliant with Federal Information Processing Standards Publication 140-2 (FIPS 140-2) or its successors, supplemented by \u201csoftware\u201d implementation, cryptographic key management and other procedures and controls that are in accordance with guidance provided in current U.S. National Institute for Standards and Technology publications, or other equally or more effective cryptographic means; and<\/p>\n

(iv) Not intentionally stored in a country listed in Country Group D:5 (see Supplement No. 1 to part 740 of the EAR) or in the Russian Federation.<\/p>\n

Note that the EAR\u2019s Country Group D:5<\/a> incorporates ITAR \u00a7126.1 prohibited destinations<\/a>.<\/p>\n

The new ITAR rule is nearly identical, creating ITAR \u00a7120.54 \u201cActivities that are not exports, reexports, retransfers, or temporary imports.\u201d\u00a0 \u00a7120.54(a)(5) excludes:<\/p>\n

Sending, taking, or storing technical data that is:<\/p>\n

(i) Unclassified;<\/p>\n

(ii) Secured using end-to-end encryption;<\/p>\n

(iii) Secured using cryptographic modules (hardware or software) compliant with the Federal Information Processing Standards Publication 140\u20132 (FIPS 140\u20132) or its successors, supplemented by software implementation, cryptographic key management, and other procedures and controls that are in accordance with guidance provided in current U.S. National Institute for Standards and Technology (NIST) publications, or by other cryptographic means that provide security strength that is at least comparable to the minimum 128 bits of security strength achieved by the Advanced Encryption Standard (AES\u2013128)<\/u>;<\/p>\n

(iv) Not intentionally sent to a person in or stored in a country proscribed in \u00a7 126.1 of this subchapter or the Russian Federation; and<\/p>\n

(v) Not sent from a country proscribed in \u00a7 126.1 of this subchapter or the Russian Federation.<\/u><\/p>\n

(Substantial variations from EAR text are underlined.)<\/p>\n

One noteworthy variation is that while the EAR allows for \u201cother equally or more effective cryptographic means\u201d the ITAR rule specifies AES-128 as a minimum standard.\u00a0 The ITAR rule also adds paragraph (v) regarding transmissions from \u00a7126.1 countries or Russia.<\/p>\n

Both the EAR and ITAR rules note that \u201cdata in-transit via the internet is not deemed to be stored,\u201d define end-to-end encryption, and state that the ability to access encrypted data is not considered a release or export.<\/p>\n

The rule also makes minor changes to other ITAR definitions in order to reference the new section.<\/p>\n

An Interim Final Rule?<\/strong><\/p>\n

The Interim Final Rule combines a request for comments like the original 2015 Proposed Rule with a rule that is scheduled to be effective March 25, 2020.\u00a0 The new definitions are subject to revision based on comments received.\u00a0 This is a valuable opportunity to submit substantive comments on how the ITAR revision will affect your business, particularly if you can suggest possible changes that could make the rules more workable.<\/p>\n

Comments may be submitted through January 27, 2020. \u00a0Refer to the Federal Register Notice<\/a> for the full revision, responses to previous comments, and how to comment.<\/p>\n","protected":false},"excerpt":{"rendered":"

On December 26, 2019, the Department of State, Directorate of Defense Trade Controls (DDTC) published an Interim Final Rule (84 FR 70887) describing when data controlled by the International Traffic in Arms Regulations (ITAR) may be transmitted electronically without triggering a requirement for an export authorization.\u00a0 The new rule is intended to clearly permit the […]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","footnotes":""},"categories":[7,10],"tags":[],"class_list":["post-370","post","type-post","status-publish","format-standard","hentry","category-all","category-export-control-reform"],"yoast_head":"\nDDTC Issues Long-Awaited ITAR Cloud Rule - Export Compliance Solutions<\/title>\n<meta name=\"description\" content=\"State Department publishes long-awaited ITAR cloud rule.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DDTC Issues Long-Awaited ITAR Cloud Rule - Export Compliance Solutions\" \/>\n<meta property=\"og:description\" content=\"State Department publishes long-awaited ITAR cloud rule.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/\" \/>\n<meta property=\"og:site_name\" content=\"Export Compliance Solutions\" \/>\n<meta property=\"article:published_time\" content=\"2019-12-27T16:24:28+00:00\" \/>\n<meta name=\"author\" content=\"Export Compliance Solutions\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Export Compliance Solutions\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/\"},\"author\":{\"name\":\"Export Compliance Solutions\",\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/#\/schema\/person\/67ff29bf0564dfc7e76544292c11dcb9\"},\"headline\":\"DDTC Issues Long-Awaited ITAR Cloud Rule\",\"datePublished\":\"2019-12-27T16:24:28+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/\"},\"wordCount\":663,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/#organization\"},\"articleSection\":[\"All\",\"Export Control Reform\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/\",\"url\":\"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/\",\"name\":\"DDTC Issues Long-Awaited ITAR Cloud Rule - Export Compliance Solutions\",\"isPartOf\":{\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/#website\"},\"datePublished\":\"2019-12-27T16:24:28+00:00\",\"description\":\"State Department publishes long-awaited ITAR cloud rule.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/#website\",\"url\":\"https:\/\/exportcompliancesolutions.com\/blog\/\",\"name\":\"Export Compliance Solutions\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/exportcompliancesolutions.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/#organization\",\"name\":\"Export Compliance Solutions\",\"url\":\"https:\/\/exportcompliancesolutions.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/exportcompliancesolutions.com\/blog\/wp-content\/uploads\/2015\/09\/ecs_logo.png\",\"contentUrl\":\"https:\/\/exportcompliancesolutions.com\/blog\/wp-content\/uploads\/2015\/09\/ecs_logo.png\",\"width\":226,\"height\":113,\"caption\":\"Export Compliance Solutions\"},\"image\":{\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/#\/schema\/person\/67ff29bf0564dfc7e76544292c11dcb9\",\"name\":\"Export Compliance Solutions\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/exportcompliancesolutions.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/fb63828a9af2d663044d4b4f3b70b09291b2ff872bf165b3fad5dada75698fb1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/fb63828a9af2d663044d4b4f3b70b09291b2ff872bf165b3fad5dada75698fb1?s=96&d=mm&r=g\",\"caption\":\"Export Compliance Solutions\"},\"url\":\"https:\/\/exportcompliancesolutions.com\/blog\/author\/export-compliance-solutions\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DDTC Issues Long-Awaited ITAR Cloud Rule - Export Compliance Solutions","description":"State Department publishes long-awaited ITAR cloud rule.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/","og_locale":"en_US","og_type":"article","og_title":"DDTC Issues Long-Awaited ITAR Cloud Rule - Export Compliance Solutions","og_description":"State Department publishes long-awaited ITAR cloud rule.","og_url":"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/","og_site_name":"Export Compliance Solutions","article_published_time":"2019-12-27T16:24:28+00:00","author":"Export Compliance Solutions","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Export Compliance Solutions","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/#article","isPartOf":{"@id":"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/"},"author":{"name":"Export Compliance Solutions","@id":"https:\/\/exportcompliancesolutions.com\/blog\/#\/schema\/person\/67ff29bf0564dfc7e76544292c11dcb9"},"headline":"DDTC Issues Long-Awaited ITAR Cloud Rule","datePublished":"2019-12-27T16:24:28+00:00","mainEntityOfPage":{"@id":"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/"},"wordCount":663,"commentCount":0,"publisher":{"@id":"https:\/\/exportcompliancesolutions.com\/blog\/#organization"},"articleSection":["All","Export Control Reform"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/","url":"https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/","name":"DDTC Issues Long-Awaited ITAR Cloud Rule - Export Compliance Solutions","isPartOf":{"@id":"https:\/\/exportcompliancesolutions.com\/blog\/#website"},"datePublished":"2019-12-27T16:24:28+00:00","description":"State Department publishes long-awaited ITAR cloud rule.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/exportcompliancesolutions.com\/blog\/2019\/12\/27\/ddtc-issues-long-awaited-itar-cloud-rule\/"]}]},{"@type":"WebSite","@id":"https:\/\/exportcompliancesolutions.com\/blog\/#website","url":"https:\/\/exportcompliancesolutions.com\/blog\/","name":"Export Compliance Solutions","description":"","publisher":{"@id":"https:\/\/exportcompliancesolutions.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/exportcompliancesolutions.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/exportcompliancesolutions.com\/blog\/#organization","name":"Export Compliance Solutions","url":"https:\/\/exportcompliancesolutions.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/exportcompliancesolutions.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/exportcompliancesolutions.com\/blog\/wp-content\/uploads\/2015\/09\/ecs_logo.png","contentUrl":"https:\/\/exportcompliancesolutions.com\/blog\/wp-content\/uploads\/2015\/09\/ecs_logo.png","width":226,"height":113,"caption":"Export Compliance Solutions"},"image":{"@id":"https:\/\/exportcompliancesolutions.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/exportcompliancesolutions.com\/blog\/#\/schema\/person\/67ff29bf0564dfc7e76544292c11dcb9","name":"Export Compliance Solutions","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/exportcompliancesolutions.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/fb63828a9af2d663044d4b4f3b70b09291b2ff872bf165b3fad5dada75698fb1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fb63828a9af2d663044d4b4f3b70b09291b2ff872bf165b3fad5dada75698fb1?s=96&d=mm&r=g","caption":"Export Compliance Solutions"},"url":"https:\/\/exportcompliancesolutions.com\/blog\/author\/export-compliance-solutions\/"}]}},"_links":{"self":[{"href":"https:\/\/exportcompliancesolutions.com\/blog\/wp-json\/wp\/v2\/posts\/370","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/exportcompliancesolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/exportcompliancesolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/exportcompliancesolutions.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/exportcompliancesolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=370"}],"version-history":[{"count":1,"href":"https:\/\/exportcompliancesolutions.com\/blog\/wp-json\/wp\/v2\/posts\/370\/revisions"}],"predecessor-version":[{"id":371,"href":"https:\/\/exportcompliancesolutions.com\/blog\/wp-json\/wp\/v2\/posts\/370\/revisions\/371"}],"wp:attachment":[{"href":"https:\/\/exportcompliancesolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=370"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/exportcompliancesolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=370"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/exportcompliancesolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=370"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}