Cryptography FAQ

  1. What is Encryption?
  2. Why Does the United States Control Encryption Exports?
  3. Are Imports of Encryption Controlled?
  4. Is the Use of Encryption within the United States Controlled?
  5. Can I Send an Encrypted Message to Someone Outside the United States?
  6. Where Can I Obtain a License to Export?
  7. What Constitutes an “Export”?

  1. What is Encryption?
    Encryption is a method of making information secret, so that only a person who knows the method can understand or decrypt the information.
  2. Why Does the United States Control Encryption Exports?
    The U.S. Government uses encryption to secure military, diplomatic and intelligence information, and wishes to deny others the ability to secure their information using American products, except under license. In addition, law enforcement (the Department of Justice’s Federal Bureau of Investigation) is concerned that the widespread use of encryption will make it more difficult to conduct electronic surveillance in the future.
  3. Are Imports of Encryption Controlled?
    No. The United States does not control the importation of encryption at this time. However, FBI documents obtained by the Electronic Privacy Information Center under the Freedom of Information Act state that “Technical solutions, such as they are, will only work if they are incorporated into all encryption products. To ensure that this occurs, legislation mandating the use of Government approved encryption products or adherence to Government encryption criteria is required.”
  4. Is the Use of Encryption within the United States Controlled?
    No. However, the U.S. government is trying to influence the market toward deployment of products which provide government access, through imposition of export controls and development of a Federal Information Processing Standard for government procurement. Link to The Technical Advisory Committee to Develop a Federal Information Processing Standard for the Federal Key Management Infrastructure.
  5. Can I Send an Encrypted Message to Someone Outside the United States?
    U.S. law does not restrict the transmission of information, merely because it has been encrypted. However, the information itself may require a license, under U.S. export control laws and regulations. For example, you may encrypt and export the Bible to anyone (even Castro), but you may not encrypt and export classified information related to nuclear weapons to anyone (even a Canadian) without a license.
  6. Where Can I Obtain a License to Export?
    The Department of Commerce’s Bureau of Industry and Security accepts applications for licenses to export encryption products and technologies. The Departments of Defense, Justice and State also have the right to review license applications.
  7. What Constitutes an “Export”?
    Physical or electronic transfer of encryption hardware, software or information outside the United States constitutes an export. So does release within the United States to an embassy of a foreign government.