Confusion about USA export restriction regarding electronics

Question

I am an electronic hobbyist based in Canada. Recently I bought different Microcontroller development boards from Mouser.ca This is mostly to satisfy my curiosity and to try out the different features offered by different companies and/or different model of microcontroller CPU cores.

Out of 12 dev boards I bought, only one was export regulated under the U.S Export Administration Regulation (EAR).

I did a bit of digging around and found that the listing for the product had an Export Control Classification Number (ECCN) attached to it.

The number in question is 5A002. I searched further and this correspond to:

“END ITEMS,” “EQUIPMENT,” “ACCESSORIES,” “ATTACHMENTS,” “PARTS,” “COMPONENTS,” AND “SYSTEMS” with CRYPTOGRAPHIC “INFORMATION SECURITY”

Source

Indeed this device does have some cryptographic capabilities. From what I can tell from the datasheet here are the security/Cryptography features:

Security and Encryption

• Arm® TrustZone®

1. Up to three regions for the code flash
2. Up to two regions for the data flash
3. Up to three regions for the SRAM
4. Individual secure or non-secure security attribution for each peripheral

Now this is an optional feature common to all microcontrollers with an ARM-Cortex M-33 core. So I checked Microcontrollers from other companies with an ARM-Cortex M-33 core and implementing Arm TrustZone and to my surprise these were not export regulated. In fact, most of them are listed with a ECCN number of 5A992.C, now if I go back to the above document this means:

Equipment not controlled by 5A002

• .c – Commodities classified Mass Market – 740.17(b)

Now for fun if I take 3 Microcontrollers from 3 different companies and compare them:

R7FA4E10D2CFM#AA0 (From Renesas based in Japan)

Cryptographic features

Security and Encryption Arm® TrustZone®

1. Up to three regions for the code flash
2. Up to two regions for the data flash
3. Up to three regions for the SRAM
4. Individual secure or non-secure security attribution for each peripheral

ECCN: 5A002 (Export Restricted)

Note: Most of Renesas Microcontroller Offering is export restricted under 5A002 for some reason.

ATSAMD51J20A-AUT (From Microchip based in the USA)

Cryptographic Features

1. One Advanced Encryption System (AES) with 256-bit key length and up to 2 MB/s data rate
2. Five confidential modes of operation (ECB, CBC, CFB, OFB, CTR)
3. Supports counter with CBC-MAC mode
4. Galois Counter Mode (GCM)
5. True Random Number Generator (TRNG)
6. Public Key Cryptography Controller (PUKCC) and associated Classical Public Key Cryptography Library (PUKCL)
7. RSA, DSA
8. Elliptic Curves Cryptography (ECC) ECC GF(2n), ECC GF(p)
9. Integrity Check Module (ICM) based on Secure Hash Algorithm (SHA1, SHA224, SHA256), DMA assisted

ECCN: 5A992.C (No export Control)

Note: Seems to give much more cryptographic features than the above chip yet is not export controlled.

LPC55S04JBD64E (From NXP based in the Netherlands)

Cryptographic Features

1. ARM TrustZone® enabled.
2. AES-256 encryption/decryption engine with keys fed directly from PUF or a software supplied key > 3. Secure Hash Algorithm (SHA2) module supports secure boot with dedicated DMA controller.
3. Physical Unclonable Function (PUF) using dedicated SRAM for silicon fingerprint. PUF can generate, store, and reconstruct key sizes from 64 to 4096 bits. Includes hardware for key extraction.
4. True Random Number Generator (TRNG).
5. 128 bit unique device serial number for identification (UUID).
6. Secure GPIO.
7. Code Watchdog for detecting code flow integrity.
8. CASPER Crypto co-processor is provided to enable hardware acceleration for various functions required for certain asymmetric cryptographic algorithms, such as, Elliptic Curve Cryptography (ECC).

ECCN: 5A992.C (No export Control)

Note: Notice how this one also implements trust zone and is not exported controlled. It goes as far as including a Crypto co-processor and is still not export controlled.

The question

Is this a lack of expertise/training/knowledge from the people classifying these products into export categories or is there a valid reason for the difference? What makes the difference between a product classified into the 5A992.C category and the 5A002 category. This is really confusing to me. Shouldn't all these products be classified into the 5A992.C category?

Edit

Just wanted to point out that I also posted this question in the Law Stack Exchange because I wanted to get the opinion of both people with a background in US laws and people with a background in Electrical Engineering/Electronics Procurement

https://law.stackexchange.com/questions/83016/confusion-about-usa-export-regulations-regarding-electronics

Answer 1

This is an interesting question. I have done ECCN classification for ICs, though not cryptographic ICs, for probably 15 years and still at times find this challenging.

Some of the lack of clarity/consistency is training, some is mistakes, some is facts not clear from data sheets, some is judgement calls on parts which fall into gray areas, etc.

The challenge we have is exactly what you imply by having to post both in legal and engineering forums. The legal folks can read and think legally but don’t understand the technology so well. The engineers get the tech, but the legal side is tricky. I sometimes feel like the lawyers and I are both uncertain and trying to make a determination.

So, we could run the exact same part through the process at different companies, or even the same company multiple times, and it’s possible, though hopefully unusual, that we would get differing answers. Some products are obvious, some are not obvious.

Other factors can be things such as whether a part was “designed for” a purpose rather than if it meets certain technical specifications. So, the wording in the original business proposal for the product might be a dispositive factor. Or, a reference design advertising certain performance. Two parts could be identical but have different business proposals or declared target applications, or intents in certain customer segments, which would affect the determination.

For products we know are dual use, we need to be careful to determine what our target markets will be and stick to them, to avoid export restrictions. Or, we need to make sure to apply more restrictive export classes so we can in fact target military applications directly.

Answer 2

Misclassification is a common problem, and it can go both ways.

I'm not an expert nor even a professional in this area, but it would seem that the R7FA4E10D2CFM#AA0 part's cryptographic features fall under Technical Note 1 under 5A002.a, and thus should not be classified under 5A002.a, but may end up with another classification.

Ultimately, the export classification of a component done by the manufacturer/vendor may not absolve the exporter for the responsibility for compliance - I'd be surprised if it did, as that would be quite generous for a legal area that typically is rather draconian - although I don't know this for a fact.

By buying stuff from most IC vendors, you agree to idemnify them from, well, pretty much everything that will stick on the paper and later in court... So you might not even have a recourse against a vendor in case you end up paying fines etc. Case law would inform more of this, I'm sure, and a lawyer specializing in export control violations should be retained if you have actual concerns.

I am an electronic hobbyist based in Canada.

US export laws don't directly apply to you, at least not as long as you're not receiving items from the US. Canada may have export restrictions that may be harmonized to an extent with the US ones. And, for sure, the Canadian export restrictions will apply whenever you try to export/sell any of those boards internationally when you don't need them anymore!

Answer 3

Comment to answer:

Not to address the legal and regulatory issues (how it should be), but try to tackle the thrust of the question (how it happens)

The determination for export control largely comes from a declaration made by the manufacturer or distributor of the part so there is some room for subjective interpretation, but also variations based on the status and location of the entity and how used to filing these declarations they are.

It may depend on how engaged the compliance group is at a particular company. Sometimes it's only the engineers looking at it and they may overanalyze even when not required.

Additionally whether or not a specific feature is subject to export controls is partly a function of its target market. This is a question that is directly asked.

I believe this is why sometimes equivalent capabilities for different intended markets will be subject to different regulations.

Don't worry if it feels arbitrary and poorly thought out. It's an opaque and confusing system, even for professionals.