Technology Export and Import Issues
Many countries place legal restrictions on the import and/or export of cryptographic software and technologies. Some nations also restrict the use of cryptography by its citizens (and others within their borders).
NOTE
Exporting Without a License Countries to which export of strong cryptography without a license is authorized under the 2000 changes to the law include the 15 members of the EU (Belgium, France, Germany, Italy, Luxembourg, Netherlands, Denmark, Ireland, the United Kingdom, Greece, Spain, Portugal, Austria, Finland, Sweden), Australia, Czech Republic, Hungary, Japan, New Zealand, Norway, Poland, and Switzerland.
Prior to the year 2000, the United States had heavy restrictions on the export of strong cryptography (classified as “munitions” and defined as that using encryption keys of more than 40 bits) imposed by the International Traffic in Arms Regulations (ITAR). New export regulations have greatly relaxed these restrictions. Now, most encryption products can be legally exported to the 15 members of the European Union and 8 other countries designated as trading partners, under a license exception. A license must still be obtained if the end user is a foreign government.
The Bureau of Industry and Security (which was called the Bureau of Export Administration, or BXA, until the name was changed in April 2002) administers the export controls on encryption products (control over nonmilitary and “dual-use” encryption was transferred from the State Department to the Commerce Department [of which the BIS is a part] in 1996).