Vendor Guide

BlackBerry Manuals & Help  >  Developer Documentation  >  BlackBerry App World storefront  >  Vendor Guide Vendor Portal - BlackBerry App World storefront - 4.2.1

Information for US export regulations

You can restrict the distribution of your products to users from specific countries, or to users that use specific wireless service providers. You specify distribution options when you submit a product to Research In Motion for approval.

Depending on the country where you develop your products and the type of encryption that your products use, you might need to provide the ECCN for a product, or you might need to upload a copy of the product's CCATS document. Research In Motion requires this information to verify that the product complies with international export regulations.

An ECCN is an alphanumeric reference (for example, 5D992) that the United States Export Administration Regulations use to identify items for export control purposes. An ECCN is used to categorize products based on the type of commodity, technology, or software and its respective technical parameters, such as the type of encryption the product uses.

You must submit an ECCN if your product uses cryptography or information security features, and if your organization meets any of the following criteria:

  • You are a vendor located in the United States
  • The product was developed in the United States
  • The product uses software or code that was created by organizations or individuals that are located in the United States
Research In Motion does not add additional requirements to the export control regulations that are issued by the United States government. The following are examples of cryptography or information security features that would require you to submit an ECCN:
  • Calling web-based libraries to invoke encryption
  • HTTPS, SSL, TLS
  • MAC, hashing
  • Digital signatures
  • Passwords

Obtaining an ECCN

When you add a release for a product on BlackBerry App World, you must confirm that your product uses cryptography or information security features. If you answer yes to any of these questions, you are asked to specify whether you are a vendor located in the United States, or if your product was developed using technology that was created in the United States. If you meet either criteria, you must provide an ECCN for your product.

You can obtain an ECCN using one of the following methods:
  • Classify the cryptographic features yourself by reading documentation and resources from the Bureau of Industry and Security
  • Classify the cryptographic features by contacting the Bureau of Industry and Security
  • Classify the cryptographic features by contacting an export control lawyer
  • Request the appropriate ECCN from the Bureau of Industry and Security by applying for a Commodity Classification Automated Tracking System (CCATS) number

You must verify that your product complies with the Note 3 (Cryptography Note) and Note 4 sections of the Export Administration Regulations, Category 5, Part 2: Telecommunications and "Information Security".

For more information about contacting the Bureau of Industry and Security, to access the Bureau's documentation, or to apply for a CCATS number, visit www.bis.doc.gov and www.bis.doc.gov/encryption/default.htm.

Research In Motion cannot help determine which ECCN is correct for a product. For more information about United States Export Administration Regulations, visit www.bis.doc.gov to read FAQs on Export Licensing and ECCN Questions and Answers.

Obtaining an ERN

If your product uses crytographic features that are not limited to authentication, password protection, digital signatures, copy protection, or banking transactions, your organization might also require an ERN from the Bureau of Industry and Security.

For more information about contacting the Bureau of Industry and Security and obtaining an ERN, visit www.bis.doc.gov to read Encryption Frequently Asked Questions.

Review What items are removed from encryption controls? Note 4, to determine if your organization requires an ERN.

Information that you must provide

When you add a release for a product, you are asked to confirm whether your product uses cryptography or information security features. If your product uses cryptography or information security features, you must prepare the following information:

Sections that you must complete

Detailed information that you must provide

Type of encryption or information security
Specify whether the product uses encryption or information security features for any of the following purposes:
  • Authentication, password protection, digital signature
  • Copy protection
  • Banking transactions
  • Data confidentiality
  • Other cryptographic features (provide description)

Select the data confidentiality option only if you use encryption or information security features for a purpose that is not covered by the authentication, password protection, digital signature, copy protection, and banking transactions options.
RIM Cryptographic API

Confirm whether the product calls cryptographic libraries from the BlackBerry Device Software or BlackBerry PlayBook OS to perform cryptographic functionality, or to enable protocols that use cryptography (for example, HTTPS, SSL).

Additional cryptographic functionality

Confirm whether the product offers cryptographic functionality in addition to the encryption functionality that is available in the BlackBerry Device Software or BlackBerry PlayBook OS.

United States vendor or technology

Confirm whether you are a vendor located in the United States, or if your product was developed using technology that was created in the United States. If you meet either condition, you must provide an ECCN.

CCATS

Confirm whether the product received a CCATS number from the Bureau of Industry and Security. If the product received a CCATS number, you must upload the CCATS document.

ERN

If your organization received an ERN, you must specify the ERN.

Related resources for ERN

For more information about export controls and obtaining an ECCN and ERN, see the following resources:

Resource Description
Bureau of Industry and Security Visit the Bureau of Industry and Security home page for information, news, and links about export licensing.
United States Export Administration Regulations Visit the Bureau of Industry and Security policies and regulations page to download the unofficial electronic Export Administration Regulation files that you can use to confirm that your organization meets regulations.
United States Regulatory Guidance Visit the Bureau of Industry and Security encryption page for information and FAQs for developers whose products are classified as Category 5.
United States Department of Commerce, Bureau of Industry and Security Contacts Visit the Information Technology Controls Division page to find contact information for the Information Technology Controls Division of the Bureau of Industry and Security.
Back to top

Next topic: Using the BlackBerry App World vendor portal
Previous topic: Information for digital rights

Was this information helpful? Send us your comments.