Cryptography Regulations & Trade Controls

Encryption technology offers both substantial benefits (by protecting the confidentiality, integrity, and availability of business and personal information) and substantial risks (by making it easier for criminals and terrorists to conceal communications regarding illegal behavior). While most countries recognize the benefits of encryption, the associated risks have led many governments to impose controls on the import, sale, use, and/or export of encryption software, hardware, and technical information. Companies that operate in a multinational environment can pay a significant price if they are not familiar with these controls. An accurate understanding of national encryption regulations is critical for manufacturers, distributors, and multinational users of encryption products, and helps such companies avoid costs and delays and ensure compliance with local laws.

Our Practice

Steptoe’s encryption practice provides counsel to clients seeking to navigate worldwide cryptography regulations. We have an international team of lawyers based in the United States, Europe, and Asia, whose combined experience spans decades.

In addition to being leaders in encryption regulatory issues, Steptoe has a broad network of information sources around the world, including government agencies, multilateral organizations such as the OECD, local embassies, commercial networks and organizations, and local counsel. This gives us the unique ability to send quick inquiries to numerous countries and to obtain formal or informal guidance on encryption regulations. Our contacts are particularly useful in countries that do not publish the details of their encryption policies. With the help of our extended network, we provide counseling on country-by-country requirements, as well as assistance in obtaining import, export, sale, and/or use licenses around the world.

CryptoGuide: Online Service

Steptoe offers a unique online resource to subscribers, the CryptoGuide, which contains detailed reports on the encryption regulations of more than 130 countries. Each report discusses applicable laws and regulations regarding the import, use, and export of encryption, including rules on "internal" corporate use, "intangible" imports and exports (i.e., Internet downloads or uploads), and temporary imports of encryption by business travelers on laptops or other mobile devices. Each report also covers applicable penalties and provides local points of contact for additional information.

For more information on the CryptoGuide, please click here or reach out to Alexandra Baj.