What are the review and reporting requirements for encryption source code that would not be considered “publicly available”?
Encryption source code that would not be considered publicly available under Section 734.3(b)(3) of the EAR (including general purpose toolkits that also contain such encryption source code) is eligible for export and reexport under License Exception ENC to government and non-government end users in the “EU+8”, and also to non-government end-users outside the “EU+8” (see Note)once you have submitted a review request, including a copy of the source code, to BIS and the ENC Encryption Request Coordinator. Refer to Section 740.17(b)(2)(ii) and paragraph (e) of Supplement No. 6 to part 742 of the EAR for more information on these provisions, and to paragraph (e)(3) of Section 740.17 (License Exception ENC) for certain post-export reporting requirements.