419

I'm uploading a binary for the first time. iTunes Connect has asked me:

Export laws require that products containing encryption be properly authorized for export.
Failure to comply could result in severe penalties.
For further information, click here.
Does your product contain encryption?

I use https://, but only via NSURLConnection and UIWebView.

My reading of this is that my app doesn't "contain encryption," but I'm wondering if this is spelled out anywhere. "Severe penalties" doesn't sound pleasant at all, so "I think that's right" is a bit sketchy... an authoritative answer would be better.

Thanks.

Steven Fisher
  • 43,056
  • 20
  • 131
  • 184
  • If you app only makes calls to HTTPS, no documentation required in App Store Connect. But you must submit a Self Classification Report to the U.S. Bureau of Industry and Security (BIS) directly. See good summary from Apple: [Export compliance documentation for encryption](https://help.apple.com/app-store-connect/#/devc3f64248f) – vvkatwss vvkatwss Oct 25 '18 at 11:55
  • does anyone know for the table they want us to fill out if we using InMobi SDK(based out of india) if this is considered a non-us-component and non-us-manufactured ? – isJulian00 Dec 17 '18 at 03:31

15 Answers15

234

UPDATE: Using HTTPS is now exempt from the ERN as of late September, 2016

https://stackoverflow.com/a/40919650/4976373

Unfortunately, I believe that your app "contains encryption" in terms of US BIS even if you just use HTTPS (if your app is not an exception included in question 2).

Quote from FAQ on iTunes Connect:

"How do I know if I can follow the Exporter Registration and Reporting (ERN) process?

If your app uses, accesses, implements or incorporates industry standard encryption algorithms for purposes other than those listed as exemptions under question 2, you need to submit for an ERN authorization. Examples of standard encryption are: AES, SSL, https. This authorization requires that you submit an annual report to two U.S. Government agencies with information about your app every January. "

"2nd Question: Does your product qualify for any exemptions provided under category 5 part 2?

There are several exemptions available in US export regulations under Category 5 Part 2 (Information Security & Encryption regulations) for applications and software that use, access, implement or incorporate encryption.

All liabilities associated with misinterpretation of the export regulations or claiming exemption inaccurately are borne by owners and developers of the apps.

You can answer “YES” to the question if you meet any of the following criteria:

(i) if you determine that your app is not classified under Category 5, Part 2 of the EAR based on the guidance provided by BIS at encryption question. The Statement of Understanding for medical equipment in Supplement No. 3 to Part 774 of the EAR can be accessed at Electronic Code of Federal Regulations site. Please visit the Question #15 in the FAQ section of the encryption page for sample items BIS has listed that can claim Note 4 exemptions.

(ii) your app uses, accesses, implements or incorporates encryption for authentication only

(iii) your app uses, accesses, implements or incorporates encryption with key lengths not exceeding 56 bits symmetric, 512 bits asymmetric and/or 112 bit elliptic curve

(iv) your app is a mass market product with key lengths not exceeding 64 bits symmetric, or if no symmetric algorithms, not exceeding 768 bits asymmetric and/or 128 bits elliptic curve.

Please review Note 3 in Category 5 Part 2 to understand the criteria for mass market definition.

(v) your app is specially designed and limited for banking use or ‘money transactions.’ The term ‘money transactions’ includes the collection and settlement of fares or credit functions.

(vi) the source code of your app is “publicly available”, your app distributed at free of cost to general public, and you have met the notification requirements provided under 740.13.(e).

Please visit encryption web page in case you need further help in determining if your app qualifies for any exemptions.

If you believe that your app qualifies for an exemption, please answer “YES” to the question."

cogell
  • 2,852
  • 1
  • 18
  • 19
MikhailSP
  • 2,953
  • 1
  • 15
  • 29
  • 7
    That's a great answer. In fact, it's so great I've accepted it. The link isn't necessarily followable, though. To get to the document, log into iTunes Connect, click the FAQs link at the bottom of the page, then click World Wide Trade Compliance for the App Store. – Steven Fisher Apr 18 '13 at 16:34
  • Links to www.bis.doc.gov are dead. Link to iTunes Connect seems outdated. – Pang Dec 08 '13 at 10:14
  • Does apple push notification service comply to (iii) or (iv)? I don't know what those words in them mean. Do I need to register for an ERN if I use push notifications in my app? – Jeremy Jan 30 '14 at 22:34
  • 39
    There's an update called "Note 4" that exempts most commercial apps from Category 5 Part 2: http://www.bis.doc.gov/index.php/policy-guidance/encryption/identifying-encryption-items#Three This means that most apps that use encryption *to support* their main function are fine without registration – Andrew Alcock Feb 25 '14 at 05:36
  • 7
    @AndrewAlcock Only if their primary function is not "Information security", nor "A computer, including operating systems, parts and components therefor", nor "Sending, receiving or storing information (except in support of entertainment, mass commercial broadcasts, digital rights management or medical records management);" nor "Networking (includes operation, administration, management and provisioning". Unfortunately I think many business apps would still require registration. Games are likely okay now though! – JosephH Feb 26 '14 at 15:26
  • 31
    So if my app accesses an api through https does it qualify or not? Could you give examples of those four criteria? – H.Rabiee May 19 '15 at 23:45
  • What if I use https for only authentication and updating credits/virtual currency of authenticated user , and nothing else ? – Deepak Sharma Mar 06 '16 at 14:33
  • Using StackOverflow for legal advice....#suspect. You should be talking to a lawyer to be sure. – Jeremy Wiebe May 27 '16 at 16:36
  • 21
    You can't expect every independent app dev in a garage to retain a lawyer. It's expensive and potentially time-consuming with all the explanation overhead. – Erika Electra Sep 12 '16 at 19:40
  • 2
    Apple has now updated their FAQ with new information regarding the September 20, 2016 BIS changes that no longer require an ERN: [If the BIS says an ERN is no longer required, why is Apple still asking for it?](https://itunespartner.apple.com/en/apps/faq/Managing%20Your%20Apps_Trade%20Compliance#25874393) "If you do not qualify for the exemptions, Apple requires that you provide a brief written statement confirming that you understand your legal obligations to submit a year-end self classification report required by BIS." – breakingobstacles Nov 24 '16 at 05:23
  • hi, can you update your answer ? see the answer below https://stackoverflow.com/a/44396900/1778674 – Suhaib Aug 04 '17 at 17:41
  • 1
    does anyone know for the table they want us to fill out if we using InMobi SDK(based out of india) if this is considered a non-us-component and non-us-manufactured ? – isJulian00 Dec 17 '18 at 03:31
  • Hey, I've just sent the annual export compliance. Approximately how long does it take before they answer so that I can upload it to upload it to apple so that the app can get published? thanks – Mattias Aug 19 '19 at 14:44
90

It's not hard to get approval for your app the proper way. SSL (HTTPS/TLS) is still encryption and unless you are using it just for authentication, then you should get the proper approval. I just received approval, and my app is in the store now for something that uses SSL to encrypt data traffic (not just authentication).

Here is a blog entry I made so that others can do this the proper way.

apple itunes export restrictions

NANNAV
  • 4,718
  • 4
  • 26
  • 48
Tige Phillips
  • 1,183
  • 1
  • 8
  • 7
  • 2
    Good information, but the question is *not* whether it's hard to get approval, but whether it is needed. According to [this official answer](http://www.bis.doc.gov/encryption/question6sub_2.htm) it may not be in this case (note 3 and note 4 [here](http://www.bis.doc.gov/encryption/ccl5pt2.pdf) may point to the same result). – Paul Kulchenko Jun 07 '13 at 17:06
  • Thanks for this. It seems that now the initial request for CIN/PIN has to be surface mailed, not FAXed or emailed. On the relevant page (https://snapr.bis.doc.gov/snapr/docs/fieldHelp.html and search for "Electronic Submission Letter"), they don't give a surface mail address. Anyone know what this is? – Chris Prince Sep 25 '14 at 19:57
  • 1
    FYI - None of this matters if you only plan on having your app available in the U.S. and Canada. This is from the iTunes Connect support docs: "(If) A developer chooses to release his app in the U.S. and Canada only. -- No U.S. CCATS or ERN is required. No France Import Declaration is required. " – PICyourBrain Jul 21 '15 at 14:59
  • does anyone know for the table they want us to fill out if we using InMobi SDK(based out of india) if this is considered a non-us-component and non-us-manufactured ? – isJulian00 Dec 17 '18 at 03:31
  • Hey, I've just sent the annual export compliance. Approximately how long does it take before they answer so that I can upload it to upload it to apple so that the app can get published? thanks – Mattias Aug 19 '19 at 14:41
48

I asked Apple the very same question and got the answer (from a Sr. Export Compliance Specialist), that "sending information over https is forcing the data to go through a secure channel from SSL, therefore it falls under the U.S. Government requirement for a CCATS review and approval." Note that it doesn't matter that Apple has already done this for their SSL implementation, but for the government, if you USE encryption that is the same (to them) as you would've coded it yourself. I also updated our blog (http://blog.theanimail.com) since Tim linked to it with updates and details on the process. Hope that helps.

der_flop
  • 559
  • 4
  • 5
  • 25
    "Sr. Export Compliance Specialist", seriously? Is there an army of Junior Export Compliance Specialists at Apple who only give so-so advice on compliance questions? I think you got duped. It's understandable that Apple would like to err on the side of caution. But the actual agreement regulating export restrictions would indicate that they're wrong: http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html – Udo Nov 20 '10 at 01:57
  • @Udo Are you referring to section "Is mod_ssl affected by the Wasenaar Arrangement"? If you are, while I don't know what's the correct answer to OP's question, I'd like to point out that the document you refer to does not apply, since *no* App Store app is made available "without restrictions upon its further dissemination". I'd very, very much love to be proven wrong... – Ivan Vučica Jan 13 '12 at 20:31
  • 18
    @Udo and the people who upvoted his comment. **Oh, how you are so wrong**. One, you may be using your common sense - that would be your first mistake. Common sense doesn't apply when it comes to export control. Second of all, httpd.apache.org is not a website affiliated with the US Commerce Department, so if you trust any information on that site, you're making another mistake. For what it's worth, the bulk of my career has been spent writing intelligence software, much of it for defense products that are exported to other countries. I know what I'm talking about (unfortunately). – Nate Jun 30 '12 at 23:43
  • 10
    @Nate, does that mean there's no army of junior export compliance specialists? :) – bbozo Jul 07 '15 at 10:13
  • does anyone know for the table they want us to fill out if we using InMobi SDK(based out of india) if this is considered a non-us-component and non-us-manufactured ? – isJulian00 Dec 17 '18 at 03:32
47

Short answer: Yes, but you don't have to do anything

I was searching the web for this for some hours. Actually it is pretty easy and you can verify this in itunes connect:

1. All you have to do

If your app uses only HTTPS or uses encryption only for authentication, tokens, etc., there is nothing you have to do, just include

<key>ITSAppUsesNonExemptEncryption</key><false/>

in your Info.plist and you are done.

2. Verification

You can verify this in itunes connect.

  • select your app
  • chose features
  • chose encryption
  • click "+"
  • follow the dialog
  • for https or authentication the answer is yes and yes

In any case you should of course read yourself carefully through the dialog.

A very helpful article can be found here:

https://www.cocoanetics.com/2017/02/itunes-connect-encryption-info/

Simon C.
  • 1,245
  • 11
  • 10
  • 8
    I'm reading the following from Apple: "Your app’s use of encryption is limited to making calls over HTTPS. Please note that you will be responsible for submitting a self-classification report at the end of the year." I think you still have to self-classify as exempt every January here: https://www.bis.doc.gov/index.php/policy-guidance/encryption/4-reports-and-reviews/a-annual-self-classification – Joshua Plicque Dec 29 '17 at 19:06
  • does anyone know for the table they want us to fill out if we using InMobi SDK(based out of india) if this is considered a non-us-component and non-us-manufactured ? – isJulian00 Dec 17 '18 at 03:33
38

If you use the Security framework or CommonCrypto libraries provided by Apple you do include crypto in your App and you have to answer yes - so simply because libraries were provided by Apple does not take you off the hook.

With regards to the original question, recent posts in the Apple Development Forums lead me to believe that you need to answer yes even if all you use is SSL.

Brad Larson
  • 168,330
  • 45
  • 388
  • 563
Tim
  • 2,676
  • 1
  • 15
  • 10
  • This is correct to my knowledge. The encryption export laws are draconian in how strict they are (considering the fact that software can be transmitted over a network effortlessly), but this requirement has nothing to do with whether a particular encryption approach or implementation is "authorized", but that the system (your app) utilizing it is vetted first. #IANAL, however. – Justin Searls Feb 05 '10 at 03:32
  • does anyone know for the table they want us to fill out if we using InMobi SDK(based out of india) if this is considered a non-us-component and non-us-manufactured ? – isJulian00 Dec 17 '18 at 03:32
37

All of this can be very confusing for an app developer that's simply using TLS to connect to their own web servers. Because ATS (App Transport Security) is becoming more important and we are encouraged to convert everything to https - I think more developers are going to encounter this issue.

My app simply exchanges data between our server and the user using the https protocol. Seeing the words "USES ENCRYPTION" in the disclaimers is a bit scary so I gave the US government office a call at their office and spoke to a representative of the Bureau of Industry and Security (BIS) http://www.bis.doc.gov/index.php/about-bis/contact-bis.

The representative asked me about my app and since it passed the "primary function test" in that it had nothing to do with security/communications and simply uses https as a channel for connecting my customer data to our servers - it fell in the EAR99 category which means it's exempt from getting government permission (see https://www.bis.doc.gov/index.php/licensing/commerce-control-list-classification/export-control-classification-number-eccn)

I hope this helps other app developers.

Community
  • 1
  • 1
Ed Trujillo
  • 1,271
  • 11
  • 9
  • This is from memory and I haven't seen the screen in a while, but: If you walk through the uploader now, you can answer Yes to the encryption question, the next question relates to exemptions. It explains in some detail, and I had no problem counting my app as having encryption and getting it through anyway. – Steven Fisher Jun 30 '16 at 18:12
  • 5
    To sum up, an average consumer application that uses https for client-server communication usually falls under Note 4 exemption. So an average indie developer should simply choose "Yes" and then again "Yes" and proceed directly to submission. iTunes Connect FAQ even has a link to this question #5 in FAQ explaining the Note 4 and even having some examples: https://www.bis.doc.gov/index.php/policy-guidance/encryption/encryption-faqs#15 – Vitalii Nov 09 '16 at 19:00
  • 1
    @Vitalii this link is now a 404 – 1800 INFORMATION Nov 21 '18 at 19:25
  • @1800INFORMATION things change. My comment is dated 2016. There were some changes in the requirements since then. Better to rely on Apple's docs: https://help.apple.com/app-store-connect/#/devc3f64248f – Vitalii Nov 22 '18 at 17:50
  • does anyone know for the table they want us to fill out if we using InMobi SDK(based out of india) if this is considered a non-us-component and non-us-manufactured ? – isJulian00 Dec 17 '18 at 03:32
  • Oh, I thought ATS stood for Amazon Trusted Services here, and I was using one in my iOS app (an IoT endpoint). – Abhijith C R Dec 31 '19 at 17:58
33

As of September 20th, 2016, registering is no longer required for apps that use https (or perhaps other forms of encryption): https://web.archive.org/web/20170312060607/https://www.bis.doc.gov/index.php/informationsecurity2016-updates

In fact, on SNAP-R you can no longer choose 'encryption registration': enter image description here

Specifically, they note:

Encryption Registrations no longer required – some of the information from the registration now goes into the Supp. No. 8 to Part 742 report.

This means you may need to send an annual report to BIS, but you don't need to register and you can note when submitting your app that it is exempt.

hisnameisjimmy
  • 1,378
  • 2
  • 15
  • 20
  • Thanks but the link is broken. Could you find the original article somewhere in the internet? – bluish Feb 01 '19 at 14:02
27

Yes, according to iTunes Connect Export Compliance Information screens, if you use built-in iOS or MacOS encryption (keychain, https), you are using encryption for purposes of US Government Export regulations. Whether you qualify for an export compliance exemption depends on what your app does and how it uses this encryption. Attached images show the iTunes Connect Export Compliance Screens to help you determine your export reporting obligations. In particular, it states:

If you are making use of ATS or making a call to HTTPS please note that you are required to submit a year-end self classification report to the US government. Learn more

iTunes Connect Export Compliance Information Q1

iTunes Connect Export Compliance Information Q2

Tim Tisdall
  • 8,670
  • 3
  • 41
  • 70
dferrero
  • 447
  • 6
  • 6
  • 29
    I think a law degree may be necessary to make sense of anything under that "Learn More" link... There's absolutely nothing there indicating HOW you make this "year-end self classification report". – Tim Tisdall Jul 17 '17 at 19:19
  • 10
    so a simple button that opens an https url in the browser so that users can find my twitter account will make me have to submit a year-end self classification report to the US government ? wow – Suhaib Aug 04 '17 at 17:44
  • 4
    It was hard to find, so here is the link to the self classification report guidelines(until they move it again): https://www.bis.doc.gov/index.php/policy-guidance/encryption/4-reports-and-reviews/a-annual-self-classification – dragi Nov 21 '17 at 08:33
  • 2
    @Suhaib - opening a link in the browser probably doesn't count - your app is not using https, your app is opening another app. That app may or may not use HTTPS (in this case it does, that app being safari or chrome or the likes) – csga5000 May 24 '18 at 18:38
  • I'm calling `UIApplication.shared.open(url:...` with an URL that begins with `https`. I'm taking this as "My app does **not** use encryption, _Safari Mobile_ does". – Nicolas Miari Oct 09 '18 at 05:53
  • My new app uses encryption (it's only for Perú market), Do I have to answer 'yes' at: Does your app use encryption? or I can bypass answering 'No'? – aguilarpgc Oct 26 '18 at 17:24
  • does anyone know for the table they want us to fill out if we using InMobi SDK(based out of india) if this is considered a non-us-component and non-us-manufactured ? – isJulian00 Dec 17 '18 at 03:33
  • 1
    Did you guys figure out how to make this annual self classification report? (as non lawyers haha) – Rony Azrak Dec 27 '18 at 13:26
21

@hisnameisjimmy is correct: You will notice (at least as of today, Dec 1st 2016) when you go to submit your app for review and reach the Export Compliance walkthrough, you'll notice the menu now states that HTTPS is an exempt version of encryption (if you use it for every call):

enter image description here

enter image description here

Jake
  • 900
  • 1
  • 10
  • 17
  • 1
    It's been that way for a while, but that answer fails to answer the question: Yes, your application contains encryption. Also, yes, a future question lets you out of that. Which is also exactly what the accepted answer says, only the accepted answer says so better. Edit: Also, your edit to that answer is redundant. – Steven Fisher Dec 02 '16 at 00:39
  • Does limited to using the encryption within the operating system include data that is automatically backed up to the cloud? – Ian Warburton Jun 22 '18 at 21:24
  • does anyone know for the table they want us to fill out if we using InMobi SDK(based out of india) if this is considered a non-us-component and non-us-manufactured ? – isJulian00 Dec 17 '18 at 03:33
8

I found this FAQ from the US Bureau of Industry and Security very helpful.

encryption

Question 15 (What is Note 4?) is the important point:

...

Examples of items that are excluded from Category 5, Part 2 by Note 4 include, but are not limited to, the following:

Consumer applications. Some examples:

piracy and theft prevention for software or music; music, movies, tunes/music, digital photos – players, recorders and organizers games/gaming – devices, runtime software, HDMI and other component interfaces, development tools LCD TV, Blu-ray / DVD, video on demand (VoD), cinema, digital video recorders (DVRs) / personal video recorders (PVRs) – devices, on-line media guides, commercial content integrity and protection, HDMI and other component interfaces (not videoconferencing); printers, copiers, scanners, digital cameras, Internet cameras – including parts and sub-assemblies household utilities and appliances

Chris Ballance
  • 32,056
  • 25
  • 101
  • 147
user2089118
  • 81
  • 1
  • 1
7

I had a lab with App Review team (WWDC20).

My questions were:

  1. My app is making calls through HTTPS only. Should I select Yes or No?
  2. Should I send report to the US government if my app available in Germany only (doesn't available in the USA)?

Answers:

  1. If you just use HTTPS you can select No

  2. The answer on the second question was unclear. Helpful link Looks like yes if you're using custom encryption.

Iraklii
  • 1,255
  • 13
  • 28
6

Found some of these answers very useful, but wanted to add this URL for completeness since it walks you through the questions:

https://itunespartner.apple.com/en/apps/faq/Managing%20Your%20Apps_Export%20Compliance#21109148

mtpultz
  • 13,197
  • 18
  • 96
  • 180
  • Good link. I think most people running into this these days will qualify for an exemption under "Use of encryption is limited to encryption within the operating system (iOS or macOS)" or "Only makes call(s) over HTTPS." – Steven Fisher Mar 07 '18 at 20:35
3

Simple answers are Yes(App has encryption) and Yes(App uses Exempt encryption). In my application, I am just opening my company's website in WKWebView but as it uses "https", it will be considered as exempt encryption. Apple document for more info: https://developer.apple.com/documentation/security/complying_with_encryption_export_regulations?language=objc

Alternatively, you can just add key "ITSAppUsesNonExemptEncryption" and value "NO" in your app's info.plist file. and this way iTunes connect won't ask you that questions anymore. More info: https://developer.apple.com/documentation/bundleresources/information_property_list/itsappusesnonexemptencryption?language=objc

You can follow these 3 simple steps to verify if your application is exempt or not: https://help.apple.com/app-store-connect/#/dev63c95e436

You may need to submit this annual-self-classification to US gov. For more info: https://www.bis.doc.gov/index.php/policy-guidance/encryption/4-reports-and-reviews/a-annual-self-classification

patel dhruval
  • 460
  • 5
  • 7
2

The instructions to complete the 2020 SNAP-R forms can be found at this link. Also the Annual Self Classification Report instructions are updated for 2020.

https://stackoverflow.com/a/61431496/1217670

phil
  • 173
  • 2
  • 11
-2

If you're not explicitly using an encryption library, or rolling your own encryption code, then I think the answer is "no"

Jason
  • 73,476
  • 14
  • 119
  • 139
  • 10
    Just to elaborate: You are using encryption (TLS), but it **is** properly authorized for export from the united states (and it shipped with the iPhone), so you're fine. – BlueRaja - Danny Pflughoeft Jan 25 '10 at 20:20
  • Smart comment, BlueRaja. I was thinking only of not writing the code, but thinking of it from your angle, it's obvious that Apple's HTTPS is already authorized. That makes the question much simpler I think. – Steven Fisher Jan 25 '10 at 20:31
  • 12
    Just because a library is licensed for export does not mean that your product that uses the library is also licensed. I know this doesn't make sense logically, but this is government we're discussing. See the link in Tim's answer or ask Apple or the U.S. BIS directly if you want an authoritative answer. – Steve Madsen Mar 13 '10 at 19:18