Member Article

In recent years, with the continuous improvement of science and technology standards in China, the country’s cryptography technical capabilities have also begun to enter the global forefront. In turn, China has promulgated various policies and measures to fulfill its non-proliferation obligations, which have promoted the gradual implementation of control measures for the export of cryptographic technologies.

On December 31, 2020, the Ministry of Commerce and the General Administration of Customs jointly issued Announcement [2020] No.75 (“Announcement 75”), which adjusted the Catalogue for Administration of Import and Export Licenses for Dual-use Items and Technologies (the “Dual-use Catalogue”) to expressly add a commercial cryptography import license list and a commercial cryptography export control list. The Dual-use Catalogue came into force as of January 1, 2021.

Inclusion into the Dual-use Catalogue of the commercial cryptography export control list signals an intent to subject commercial cryptography to the regulatory scope of the Export Control Law. Until now, a relatively comprehensive regulatory framework had been formulated for the import and export of commercial cryptography, supported by the Cryptography Law, the Export Control Law, and the revised Regulations on Administration of Technology Import and Export (the “Import-Export Regulations”), which successively entered into force in 2020, and a public comment revision draft of the Regulations on Administration of Commercial Cryptography (Revision Draft for Comment) (the “Draft CCA Regulations”).

With the establishment and improvement of the regulatory system for commercial cryptography exports, Chinese enterprises, especially Internet, financial and high-tech enterprises, should pay special attention to compliance issues arising from commercial cryptography exports and conduct self-reviews, consider and adjust their strategies for the export and use of commercial cryptography, and establish a sound internal compliance system according to relevant laws and regulations. In addition, we also suggest foreign-invested enterprises to pay attention to compliance issues under Chinese law when sharing cryptographic technologies and products with their offshore parent companies in order to avoid relevant legal risks.

Relevant laws and regulations on commercial cryptography export supervision

The laws and regulations on commercial cryptography export supervision mainly comprise the Cryptography Law, the Export Control Law, and the Import-Export Regulations. Specifically, the

 

Cryptography Law provides general provisions on the export of commercial cryptography, while the Export Control Law and the Import-Export Regulations stipulate provisions on the export of commercial cryptography from the perspectives of export control and control of export-prohibited or -restricted technologies, respectively.

• Cryptography Law provisions on commercial cryptography export matters

The Cryptography Law was deliberated and adopted by Standing Committee of the National People's Congress on October 26, 2019, and took effect on January 1, 2020. The Cryptography Law, as the first comprehensive law regarding cryptography governance in China, fills a legislative void in this area. By dedicating a special chapter to commercial cryptography, the Cryptography Law for the first time established a regulatory system for the export of commercial cryptography that involves national security and public interests and which has encryption protection functions, and specifies that the bodies responsible for the formulation and release of commercial cryptography control lists are the competent department in charge of commerce under the State Council, the national cryptography administrative department, and the General Administration of Customs^[1].

Before the promulgation of the Cryptography Law, commercial cryptography imports and exports were principally governed by the Regulations on Administration of Commercial Cryptography (the “CCA Regulations”), which came into effect in October 1999, and by the Catalogue for the Administration of Import of Cryptographic Products and Equipment with Cryptographic Technologies, promulgated in December 2009 by the State Cryptography Administration (“SCA”) and the General Administration of Customs in SCA Announcement No. 18 (“SCA Ann. 18”) in December 2009 and in SCA Announcement No. 27 (“SCA Ann. 27”) in December 2013. Specifically, SCA Ann. 18 and SCA Ann. 27 only provided regulatory rules for the import of commercial cryptography.

It is noteworthy that the Commercial Cryptography Import License List and the Commercial Cryptography Export Control List were promulgated in the Announcement on the Promulgation of the Commercial Cryptography Import License List, and the Commercial Cryptography Export Control List and Related Administrative Measures [2020] No.63 jointly promulgated by the Ministry of Commerce, SCA and the General Administration of Customs on November 26, 2020 (“Announcement 63”), which officially came into force on January 1, 2021. It is crucial for enterprises to clarify the relationship between Announcement 63 and Announcement 75 in order to establish their compliance systems and procedures.

Before promulgation of the Cryptography Law, commercial cryptography imports and exports were subject to SCA approval^[2]. According to the Cryptography Law, after Announcement 63 took effect, applications for the import and export of commercial cryptography are to be submitted to the Ministry of Commerce, which is responsible for reviewing and approving applications and for which SCA should render cooperation. However, the specific division of work among the Ministry of Commerce, SCA and other competent authorities with respect to such reviews is ambiguous and remains to be further clarified^[3]. In addition, the Draft CCA Regulations published in August 2020 also contain a dedicated chapter governing commercial cryptography exports, specifying that they would be subject to restrictions in the Commercial Cryptography Export Control List and specify relevant rules for commercial cryptography exports in respect of export applications, application reviews, and customs declarations^[4].

• Export Control Law provisions on commercial cryptography exports categorized as dual-use items

As mentioned above, commercial cryptography exports are mainly governed by the Export Control Law and the Import-Export Regulations, of which the Export Control Law provides the regulatory rules for commercial cryptography exports that are categorized as dual-use items.

The Export Control Law, which was deliberated and adopted by the Standing Committee of the National People’s Congress on October 26, 2020 and came into force on December 1, 2020, has the fundamental purpose of safeguarding national security and interests by prohibiting or restricting the export of military-and-civilian dual use items and military items. The Export Control Law reiterates all previous administrative regulations related to the export control of controlled items, including various military and civilian dual-use items and military-use items such as nuclear, missile, biological items, chemical items, etc., and includes all previous export control lists into the Catalogue, except for the Military Items Export Administration List.

With regard to commercial cryptography, Announcement 63 for the first time promulgated the Commercial Cryptography Import License List and the Commercial Cryptography Export Control List, which expand the supervision scope of commercial cryptography to include exports, repealed SCA Ann. 18 and SCA Ann. 27, further refines the scope of commercial cryptography as referenced in the SCA Ann. 18 and SCA Ann. 27, and places commercial cryptography exports under the supervision of Export Control Law. It should be noted that the adjusted contents of the Dual-use Catalogue introduced by Announcement 75 are in fact consistent with the contents of the list in Announcement 63. Announcement 75 can essentially be understood as an update to the Dual-use Catalogue that took effect on January 1, 2020, and as an improvement of the commercial cryptography export control system under the Export Control Law.

• Import-Export Regulations provisions on the export of commercial cryptography categorized as export-prohibited or -restricted technologies

In addition to the control of commercial cryptography as dual-use items under the Export Control Law, the Import-Export Regulations (whose purpose is to maintain the order of import and export trade) was also revised to include the import and export of commercial cryptography into its regulatory scope following the issuance of the Cryptography Law. Subsequently, Announcement [2020] No. 38 (“Announcement 38”), jointly promulgated by the Ministry of Commerce and the Ministry of Science and Technology on August 28, 2020, adjusted the Catalogue for Technologies China Prohibits and Restricts from Export (“Tech Export Catalogue”) by adding “cryptographic security technologies” into the catalogue, and describing relevant technical contents of commercial cryptography which are subject to its purview.

Specific application of two legal systems related to commercial cryptography exports and operating procedures

Both the Export Control Law and the Import-Export Regulations regulate commercial cryptography imports and exports. Below, we further clarify and the relationship between the two systems.

• Scope of commercial cryptography subject to supervision

Under the current regulatory framework, cryptography referenced in the Cryptography Law means “technologies, products, and services utilized for encryption protection and security authentication on information and the like by using specific transformation methods^[5].” Various types of cryptography include core cryptography, common cryptography and commercial cryptography, of which commercial cryptography is used to protect information that does not constitute state secrets^[6].

Based upon the above provisions and the relevant provisions in the Dual-use Catalogue and Tech Export Catalogue, commercial cryptography subject to export control includes not only commercial cryptographic products such as cryptography machines, VPN equipment, security chips, authentication equipment, etc., but also includes technologies and software used for the research and development, design, manufacturing and use of cryptographic products. In fact, cryptographic product-related services should also be included into their regulatory scope. Although cryptographic product-related services have not been clearly defined as an export control item under either the Dual-use Catalogue or the Tech Export Catalogue, it is clearly provided that cryptographic product-related services are regulated under the Cryptography Law, the Export Control Law, and the Import-Export Regulations^[7]. Thus, we do not exclude the possibility that the Dual-use Catalogue and the Tech Export Catalogue will in the future also expressly regulate cryptography services.

In addition, according to the Cryptography Law, commercial cryptography used for mass consumption products is not subject to the import license and export control management^[8]. As per the SCA’s interpretation, commercial cryptography adopted for mass consumption products refer to the products or technologies that the public can acquire through regular retail channels, which is sold for personal use and whose cryptography functions cannot be easily altered^[9]. Therefore, according to the abovementioned interpretations, commercial cryptography products directly sold to users and relevant technical services should not be regarded as commercial technologies subject to export restrictions.

• Application of the two systems

As mentioned above, there are two systems that will apply if one needs to engage in commercial cryptography exports, i.e. the Export Control Law and the Import-Export Regulations. We will summarize the main differences between these two systems in the following table:

	Export Control Law	Import-Export Regulations
Purpose of Law	Protect national security and interests, fulfill nonproliferation and other international obligations, and strengthen and regulate export controls. See Article 1 of the Export Control Law	Regulate the administration of technology import and export, maintain the order of technology import and export, and promote national economic and social development. See Article 1 of the Import-Export Regulations
Regulatory Objects	Dual-use items, military products, nuclear materials and other goods, technologies, services and items that are related to the protection of national security and interests or the fulfillment of nonproliferation or other international obligations. See Article 2 of the Export Control Law	Act of transferring technology from within the territory of the People’s Republic of China to outside the territory of the People's Republic of China by way of trade, investment, or economic and technological cooperation. Export of export-controlled technologies shall be conducted pursuant to the relevant administrative regulations, including nuclear technology, relevant technologies of dual-use nuclear products, chemicals manufacturing-related supervising or monitoring technologies, etc. See Articles 2 and 42 of the Import-Export Regulations
Regulatory Activities	The transfer of controlled items from the territory of the People's Republic of China to overseas, and on the provision of controlled items by any citizen or incorporated or non-incorporated organization of the People's Republic of China to any foreign organization or individual. Also border crossing, transshipment, transit, and re-export of controlled items or the export of such controlled items from customs special supervision areas including bonded zones and export processing zones and bonded supervision areas such as export supervision warehouses and bonded logistics centers. See Articles 2 and 45 of the Export Control Law	Transferring technology from outside the territory of the People’s Republic of China into the territory of the People’s Republic of China or vice versa by way of trade, investment, or economic and technical cooperation. The acts mentioned in the preceding paragraph include assignment of the patent right, assignment of the patent application right, licensing for patent exploitation, assignment of technical secrets and technical services, and transfer of technology by other means. See Article 2 of the Import-Export Regulations
Regulatory Form	Export control	Freely exportable, export restricted, export prohibited
Regulatory Authorities	Bureau of Industry Safety and Import & Export Control under the Ministry of Commerce	Department of Trade in Services and Commercial Services under the Ministry of Commerce
Relevant Lists	Dual-use Catalogue The State adopts a unified export control system, and implements export controls through formulating export control lists, catalogues or directories, and implements export license management, etc. See Article 4 of the Export Control Law	Tech Export Catalogue The competent foreign trade department under the State Council, in coordination with other relevant departments under the State Council, formulate, adjust, and publish catalogues of technologies that are prohibited or restricted for export. See Article 28 of the Import-Export Regulations
Legal Liability	Any exporter that is engaged in the export of relevant controlled items without obtaining the corresponding export business license shall be given a warning, be ordered to cease the illegal activity, any illegal gains shall be confiscated, and they shall be fined between five and ten times the illegal proceeds if the illegal proceeds exceed RMB 500,000, or be fined between RMB 500,000 and RMB 5 million if there are no illegal proceeds or the illegal proceeds are below RMB 500,000. Any exporter engaged in any of the following activities shall be ordered to cease the illegal activity, any illegal gains shall be confiscated, and they shall be fined between five and ten times the illegal proceeds if the illegal proceeds exceed RMB 500,000, or be fined between RMB 500,000 and RMB 5 million if there are no illegal proceeds or the illegal proceeds are below RMB 500,000; and in serious cases, an order to suspend business for rectification up to the revocation of export business qualification for the relevant controlled item may be imposed where: The export of any controlled item is conducted without a license; or The export of any controlled item is beyond the scope of the export license; or The export of any controlled item is prohibited to be exported. See Articles 33 and 34 of the Export Control Law	Where any person imports or exports technologies that are prohibited for import or export, or imports or exports technologies that are restricted for export without a license, the person concerned shall be prosecuted for committing criminal offences of smuggling, conducting illegal business operations, divulging state secrets or other related offences and shall be prosecuted for criminal liabilities in accordance with the criminal law. Where no criminal offence is constituted, punishments shall be imposed in accordance with the relevant provisions of the Customs Law based upon specific situation of the violation, or a warning shall be issued by the department responsible for foreign trade and economics administration under State Council, and illegal proceeds gained by the person from the illegal activity shall be confiscated, and a fine between two (2) to five (5) times of the illegal proceeds shall be imposed. In addition, the department responsible for foreign trade and economics administration under the State Council may order suspension or revocation of the license for operating foreign trade issued to the violating party. Where the party imports or exports technologies which are restricted for import or export beyond the licensed scope, the party concerned shall be convicted for committing illegal business operations or other related offences and shall be prosecuted for criminal liability in accordance with the provisions of the Criminal Law. Where no criminal offence is constituted, punishments shall be imposed in accordance with the relevant provisions of the Customs Law based upon specific circumstances of the violation, or a warning shall be issued by the department responsible for foreign trade and economics under the State Council, and illegal proceeds gained by the party from the illegal activity shall be confiscated, and a fine between one (1) to three (3) times of the illegal proceeds shall be imposed. In addition, the department responsible for foreign trade and economics administration under the State Council may order suspension or revocation of the license for operating foreign trade issued to the violating party. See Articles 43 and 44 of the Import-Export Regulations
List Contents	n Systems, equipment and components: security chips, cryptography machines (cipher cards), cryptography VPN device, key management products, special cryptography equipment, quantum cryptography equipment, and cryptography analysis equipment; n Testing, checking and production equipment: cryptography development and production equipment, and cryptography testing and verification equipment; n Software specially designed or modified for the purpose of developing, manufacturing or using such cryptography; n Technologies specially designed or improved to be used to develop, manufacture or use such cryptography. See Announcement 75	n Design and implementation technology of cryptographic chips (high-speed cryptographic algorithms, parallel cryptographic technologies, security design technology for cryptographic chips, on-chip cryptographic chip (SOC) design and implementation technology, high-speed chip implementation technology based on high-speed algorithm standards); n Quantum cryptography (quantum cryptography implementation methods, quantum cryptography transmission technology, quantum cryptography network, quantum cryptography engineering implementation technology). See Announcement 38

As indicated in the table above, the Export Control Law differs from and the Import-Export Regulations in many aspects regarding the supervision of commercial cryptography exports, but they also share many common features. Below, we compare the two to summarize their similarities and differences and briefly analyze their application.

1. Certain subject matter is regulated by both laws, in such cases, the relevant subject matter is regulated by the Export Control Law

Article 2 of the Export Control Law specifies that it applies to dual-use items, military products, nuclear, as well as goods, technologies, services and other items related to the maintenance of national security and interests and the performance of international obligations including anti-proliferation obligations. “Technology” falls under provisions of the Import-Export Regulations, although the term “technology” is not clearly provided for thereunder, the Import-Export Regulations clearly exclude “goods” from their application. Therefore, we understand commercial cryptography-related goods do not fall within the regulatory scope of Import-Export Regulations. In addition, commercial cryptography primarily includes related technologies and services under both systems, as Article 2(2) of the Import-Export Regulations specifically cites activities that include patent right transfers, patent application right transfers, patent implementation licenses, technical secret transfers, technical services, etc.

Both systems have catalogues for commercial cryptography export controls, i.e., the Tech Export Catalogue and the Dual-use Catalogue, which were introduced by Announcement 38 and Announcement 75, respectively. Therefore, in most cases, enterprises may examine whether a certain commercial cryptography falls into the regulatory scope of these two laws by referring to the Tech Export Catalogue and the Dual-use Catalogue.

While commercial cryptography is regulated by both the Tech Export Catalogue and the Dual-use Catalogue, there are no legal rules or judicial interpretations clarifying which of the catalogues would apply in respect of regulating commercial cryptography. It is clearly stipulated in Announcement 38 that “military-civil dual-use technologies shall be subject to Export Control Law,” and according to Article 28, para. 2 of the Cryptography Law that “commercial cryptography adopted by mass consumer products are not subject to the import licensing and export control management.” Therefore, we understand that with respect to cryptography-related products that fall into the regulatory scope of the Dual-use Catalogue, the Export Control Law applies in priority regardless of whether those products are also subject to the Tech Export Catalogue; the Import-Export Regulations apply to those cryptographic products that are not included in the Dual-use Catalogue. Furthermore, the Export Control Law enjoys priority in application over the Import-Export Regulations, from perspectives of legislative purpose and hierarchy of authorities, considering the purpose of the former is to safeguard national security and interests while the latter is to maintain the order of technology import and export.

2. Export Control Law stipulates a broader scope of regulatory activities than the Import-Export Regulations

Activities subject to the Import-Export Regulations include the import and export of technologies implemented via trade, investment and economic and technological cooperation, while the Export Control Law governs the transfer and provision of controlled items to overseas countries in whatever form, not only including through “trade, investment and economic and technological cooperation,” but also including forms of the border crossing, transshipment, and other non- economic cooperation means. It can be seen that Export Control Law stipulates a broader scope of regulatory activities than the Import-Export Regulations, and includes into its scope all forms of cross-border transfers of controlled items.

3. Dual-use Catalogue stipulates detailed list of items, while the Tech Export Catalogue merely stipulates general principles

The Dual-use Catalogue includes four categories of items, i.e., systems, equipment and components, testing, inspection and production equipment, software, and technology. Specifically, the systems, equipment and components include security chips, cipher machines (cipher cards), cryptographic VPN devices, key management products, special cryptographic equipment, quantum cryptographic equipment and cryptography analysis equipment. The testing, inspection and production equipment category includes cryptography development and production equipment, and cryptography testing verification equipment. The Dual-use Catalogue even specifies parameter characteristics for items contained therein. Taking cryptography VPN devices, the Dual-use Catalogue defines such devices as “devices whose main functions are IPsec/SSL VPN and which have the following two characteristics: (i) A symmetric cryptographic algorithm with a key length of more than 64 bits, an asymmetric cryptographic algorithm with a key length of more than 768 bits based on integer factorization, or an asymmetric cryptographic algorithm with a key length of more than 128 bits based on elliptic curves; and (ii) cryptography communication rate exceeds 10Gbps.”

In contrast, the Tech Export Catalogue, as revised by Announcement 38, adds two new categories of technologies, i.e., design and realization technology for cryptographic chips (high-speed cryptographic algorithms, parallel cryptographic technologies, security design technology for cryptographic chips, design and realization technology for on-chip cryptographic chips (SOC), and high-speed chip realization technology based on high-speed algorithm standards) and quantum cryptography technology (quantum cryptography realization method, quantum cryptography transmission technology, quantum cryptography networks, quantum cryptography engineering realization technologies).

From the above, we can see the Dual-use Catalogue provides a more detailed list of items and therefore is of more reference value in practice.

In addition, it should be noted that as aforesaid both the Import-Export Regulations and the Export Control Law incorporate services into their scopes, but neither has explicitly stipulated whether those services include commercial cryptography services. So, relevant issues regarding the import and export of commercial cryptography still awaits further clarification, and we will keep a close watch on developments in this area.

4. Different application procedures and different departments responsible for reviewing applications

The Export Control Law and the Import-Export Regulations prescribe different application and examination procedures with respect to the applications for the export of commercial cryptography.

Export Control Law	Import-Export Regulations
License for export of commercial cryptography categorized as dual-use items	License for export of commercial cryptography restricted for export
Handling according to “Procedures for Applying for Export License of Commercial Cryptography,” attached as Appendix 2 to Announcement 63. n Submit applications, fill in application forms, and submit documents to the Ministry of Commerce through competent departments of commerce at the provincial level; n The Ministry of Commerce shall examine the application together with the SCA and other relevant departments; n The Ministry of Commerce shall issue the import/export license for dual-use items and technologies upon approval of application after the examination; n The application and issuance procedures for import and export licenses, the handling of exceptional cases and the preservation period for documents and materials shall be subject to the Measures for Administration of Import and Export Licenses for Dual-use Items and Technologies; n The party engaging in import/export business shall submit to the customs the import/export license for dual-use items and technologies, proceed with the customs procedures, and accept supervision and management of the customs in accordance with the provisions of the Customs Law. The customs shall examine the application and proceed with clearance procedures upon receipt of the import/export license for dual-use items and technologies issued by the Ministry of Commerce.	Handling in accordance with the provisions of the Import-Export Regulations. n Submit applications to the foreign trade and economic cooperation department of the State Council (the Ministry of Commerce); n The Ministry of Commerce shall examine the application together with the Ministry of Science and Technology; if the application needs to be examined on a confidential basis, the examination shall be conducted in accordance with relevant state provisions; n If the application is approved, the Ministry of Commerce shall issue a letter of intent for issuing technology export license; n Applicants may only conduct substantive negotiations with foreign parties and sign technology export contracts after obtaining a letter of intent for issuing the technology export license. n After a technology export contract is concluded, the applicant needs to submit the following materials to the Ministry of Commerce to apply for a technology export license: a letter of intent for issuing technology export 2.license; a copy of the technology export contract; a list of technical materials to be exported; and any document certifying the legal status of the contracting parties. n The Ministry of Commerce will examine the technology export contract for authenticity and make a decision on whether or not to grant a license; n Upon the application is approved, a technology export license shall be issued subsequently.

Areas of focus for enterprises in relation to commercial cryptography export compliance

• Importance of commercial cryptography export compliance

With the implementation of Announcement 75, the Dual-use Catalogue under the Export Control Law clearly specifies the scope of commercial cryptography categorized as dual-use items and specifies that commercial cryptography and other items are together regarded as controlled items subject to the Export Control Law. Under Announcement 75 (regarding export controls) and Announcement 38 (regarding technology imports and exports), regulatory controls apply to both the export of commercial cryptographic technologies and the export of commercial cryptography that do not involve the export of technologies.

In light of this background, Chinese enterprises, especially those involved in the Internet, finance and other high- tech fields, will face new compliance risks when they undertake the export of commercial cryptography, provide commercial cryptography technical services to foreign companies, and conduct relevant business activities. Those Enterprises will face great legal risks if they cannot accurately understand and grasp the spirit of the commercial cryptography export regulations.

• Identify commercial cryptography involved in business operations covered by Dual-use Catalogue and the Tech Export Catalogue

To ensure commercial cryptography compliance, a primary focus for enterprises is to check whether they operate any controlled businesses. Therefore, we recommend enterprises to actively organize internal screening, check their technologies, products, software, or services as well as the commercial cryptographic technologies used in daily business operations to determine whether the Catalogue covers those technologies, products, software, or services, are restricted or prohibited for export, and whether the relevant commercial cryptography are involved in their overseas business or export business.

• Closely monitor the legislative developments and take preventive measures to reduce risk

Considering relevant regulations have been recently promulgated and there are few cases for enterprises to refer to in practice, and the relevant departments have been ambiguous in their attitudes toward enforcement, we recommend enterprises to closely monitor the law enforcement developments, and particularly to closely watch the applications for export of commercial cryptographic products (such as security chips, cryptographic machines, etc.) submitted by relevant manufacturing and export enterprises and the authorities’ attitude toward such applications, then analyze the status of enterprises and the potential risks the enterprises may face, and formulate solutions to tackle risks identified, including submitting export applications for relevant commercial cryptography or to avoid export.

• Establish and improve internal compliance systems

In order to avoid commercial cryptography export compliance risks, we recommend enterprises establish an internal compliance system. We recommend the establishment of monitoring and management systems and to focus special attention on the following issues: (i) compliance in the transfer of controlled products overseas; (ii) compliance in the transfer or license of controlled technologies involved in cooperations with overseas entities; (iii) strengthen the management of technical materials, encrypt and properly preserve relevant technologies when transferring the same overseas; (iv) clarify the ownership of the corresponding technologies if controlled technical services must be provided overseas; and (v) timely handle the relevant application and approval formalities.

Conclusion

The basic regulatory framework for commercial cryptography exports has been formulated with the introduction and implementation of the Export Control Law and the Cryptography Law, the revised Import-Export Regulations, Announcement 38, and Announcement 75, as well as Draft CCA Regulations. We foresee more laws and regulations will be released in the future and there will arise cases of significant guidance and reference value in practice. To avoid legal risks related to the export of commercial cryptography, which is an indispensable aspect of going global for Chinese enterprises, we recommend enterprises to improve their compliance systems relating to commercial cryptography as soon as possible and focus close attention on relevant law enforcement developments, in order to promote overseas business and clear away compliance obstacles.

 

Important Announcement

This Legal Commentary has been prepared for clients and professional associates of Han Kun Law Offices. Whilst every effort has been made to ensure accuracy, no responsibility can be accepted for errors and omissions, however caused. The information contained in this publication should not be relied on as legal advice and should not be regarded as a substitute for detailed advice in individual cases. If you have any questions regarding this publication, please contact:

Lili WU Tel: +86 10 8516 4266 Email: [email protected] Chen MA Tel: +86 10 8525 5552 Email: [email protected]

 

[1] Article 28 of the Cryptography Law stipulates: “The competent department in charge of commerce under the State Council and the national cryptography administrative department shall, in accordance with law, apply import licensing to commercial cryptography which has encryption functionality and concerns national security or public interests, and shall apply export control to commercial cryptography which concerns national security or public interests or which entails international obligations on China. The import licensing list and export control list of commercial cryptography shall be formulated and published by the competent department in charge of commerce under the State Council in conjunction with the national cryptography administrative department and the General Administration of Customs …… Import licensing and export control shall not be applied to commercial cryptography used in mass consumption products.”

[2] According to Article 13 of the CCA Regulations, the import of cryptographic products and equipment containing cryptographic technologies or the export of commercial cryptographic products shall be subject to the approval of the state cryptography administration. No entities or individuals shall sell foreign cryptographic products.

[3] According to Announcement 63, entities need to apply for a license to export dual-use items and technologies referred in the Commercial Cryptography Export Control List. The Ministry of Commerce, the cryptography administration and the customs shall supervise and inspect the import and export of the items and technologies set out in the Announcement 63 in accordance with law. If anyone imports or exports commercial cryptography by violating regulations on commercial cryptography import license or export control rules, the Ministry of Commerce or customs will impose administrative penalties in accordance with law. Those whose actions constitute criminal offenses shall be pursued for criminal liabilities in accordance with law.

[4] The above issues have been clearly provided in Articles 31 to 34 of the Cryptography Regulations (Draft for Comments).

[5] Cryptography Law, art. 2: “for the purpose of the Law, ‘cryptography’ refers to technologies, products, and services utilized for encryption protection and security authentication on information and the like by using specific transformation methods.”

[6] Cryptography Law, art. 6: “the State shall implement classified administration of cryptography. Cryptography shall be classified into core cryptography, common cryptography and commercial cryptography.” According to art. 8: “commercial cryptography shall be used to protect information that does not involve State secrets.”

[7] Export Control Law, art. 2: “This Law shall apply to the State’s export control of dual-use items, military products, nuclear materials and other goods, technologies, services and items that are related to the protection of national security and interests or the fulfillment of nonproliferation or other international obligations (hereinafter collectively referred to as the “controlled items”).” Import-Export Regulations, art. 2 stipulates that “the acts mentioned in the preceding paragraph include assignment of the patent right, assignment of the patent application right, licensing for patent exploitation, assignment of technical secrets and technical services, and transfer of technology by other means.”

[8] Article 28, para. 2 of the Cryptography Law stipulates that commercial cryptography used for mass consumer products shall not be subject to import license and export control administration.

[9] See the “Questions and Answers on Cryptography Policies (87)”, which was promulgated by the SCA on April 2, 2020, www.sca.gov.cn/sca/xxgk/20-04/02/content _ 1060694.shtml.