US, EU Working to Harmonize Encryption Controls, BIS Official Says

The U.S. and the EU are making progress on more closely aligning their encryption-related export controls, a senior Bureau of Industry and Security official said last week, along with differences in export licensing and classification.

Eileen Albanese, director of the Office of National Security and Technology Transfer Controls, said the U.S. and the EU have used recent meetings of the joint Trade and Technology Council to try to better harmonize export regulations surrounding encryption items. European industry officials have called EU encryption controls outdated and asked the bloc to adopt regulations similar to the U.S. (see 2212090026, 2206010007 and 2206150038).

One of the main differences between U.S. and EU encryption rules is how the two approach classification, Albanese said during a virtual Massachusetts Export Center conference last week. She said the TTC is working “to ensure that both the EU and the U.S. are looking at encryption items the same way and defining the terms the same way, so that a classification from the EU will be the same as the classification from the U.S.”

One American company told BIS that because the two jurisdictions classify encryption items differently, the company was able to secure a license exception from the U.S. but not the EU for the same transaction, Albanese said. “Encryption is a fun area with a lot of interpretations,” she said. “So what we're trying to do is just kind of get the people who actually do the work together and say, ‘Yes, this is what we're going to do.’”

The TTC is also tackling the issue of “double licensing,” Albanese said, which is when both the EU and the U.S. require a license for the same export. “We have tried to parse where that happens and how we can stop that,” she said. “The hope is that we reduce the administrative burden and reduce the licensing necessary to facilitate trade between the U.S. and the EU.”

The next TTC meeting is scheduled for Jan. 30.