POLICIES

Export Compliance


Exports, re-exports and transfers of F5 products and technology are subject to control under the Export Administration Regulations ("EAR"), as administered by the U.S. Department of Commerce's Bureau of Industry and Security ("BIS"). Diversion of F5 products and technology contrary to U.S. law is prohibited. Depending on where you reside, additional import or export requirements may apply.

The export or re-export of items that are subject to the EAR to an embargoed or sanctioned destination (Cuba, Iran, North Korea, Sudan, and Syria) without a valid license or license exception is prohibited. Further, the U.S. Department of Treasury's Office of Foreign Assets Control may impose additional controls on exports, re-exports, or transfers to these destinations.

Exports to entities listed on a U.S. government denied party/prohibited end-user list may be prohibited or proceed only if they have been licensed. Further information on these lists may be found here. In addition, exports that support the design, development, or production of biological, chemical, or nuclear weapons, or missile proliferation, are prohibited without prior U.S. government authorization.

Please note that the information set forth on this web page is provided for general reference purposes only. It is not intended to constitute legal guidance, and the information contained herein is subject to change at any time by the BIS or other U.S. government authorities. Please consult the EAR, or contact the BIS, for further details on U.S. export control and licensing requirements.


Product Export Classification and Licensing Definitions

Following are definitions of key terms that relate to the export classification and licensing of F5 products and technology. If you have a question about how an F5 product has been classified for export, please refer to the Export Product Classification Guide or contact our Export Compliance team at exportcompliance@f5.com.

ECCN: The Export Control Classification Number, or ECCN, is the U.S. term for an export classification code. An ECCN identifies the relevant category and paragraph of a classification, as they are maintained under the EAR's Commerce Control List.

Typically, F5's products are classified under one of the following ECCNs:

5A002(a)(1): Information security hardware that is designed or modified to use "cryptography," employing analog principles when implemented with digital techniques, with the following features:

  • A symmetric algorithm employing a key length in excess of 56-bits; or
  • An "asymmetric algorithm" where the security of the algorithm is based on any of the following:
    • Factorization of integers in excess of 512 bits (e.g., RSA);
    • Computation of discrete logarithms in a multiplicative group of a finite field of size greater than 512 bits (e.g., Diffie-Hellman over Z/pZ); or
    • Discrete logarithms in a group other than mentioned in 5A002.a.1.b.2 in excess of 112 bits (e.g., Diffie-Hellman over an elliptic curve)

5D002(c)(1): "Software" that has the characteristics, or performs or simulates the functions of the equipment controlled under ECCN 5A002

5A992(a): Telecommunications and other information security equipment that contains encryption, but which does not meet the characteristics of ECCN 5A002

5D992(b): "Software" that has the characteristics, or performs or simulates the functions of the equipment controlled by ECCN 5A992.a, but which does not meet the characteristics of ECCN 5A002

EAR99: Refers to items that are subject to the EAR but are not listed on the CCL

CCATS: Refers to the Commodity Classification Automated Tracking System, or CCATS, number that the BIS assigns to a commodity classification request.

Encryption Licensing Arrangement: Refers to a specific type of export license that allows the export or re-export of specified encryption hardware or software to specified destinations in unlimited quantities. In certain cases, shipments authorized under an Encryption Licensing Arrangement may be limited to specified end users for specified end uses.

License Exception: A license exception is an authorization that allows the export or re-export of items subject to the EAR without first obtaining an export license under certain specified conditions. Most F5 products may be exported under License Exception ENC, as set forth under Section 740.17 of the EAR.

ENC-Restricted: Refers to products that may be exported or re-exported under License Exception ENC to non-government end users in all countries, except to embargoed or sanctioned countries. These products also may be exported without a license to government entities in the countries listed in Supplement No. 3 to Part 740 of the EAR. Exports or re-exports to government entities in other countries require a license.

ENC-Unrestricted: Refers to products that may be exported or re-exported under License Exception ENC to government or non-government end users in all countries, except embargoed or sanctioned countries.

Mass-Market Encryption: Refers to products that meet the following characteristics:

  1. Generally available to the public by being sold, without restriction, from stock at retail selling points by means of any of the following:
    1. Over-the-counter transactions;
    2. Mail order transactions;
    3. Electronic transactions (e.g., Internet); or
    4. Telephone call transactions.
  2. The cryptographic functionality cannot be easily changed by the user;
  3. Designed for installation by the user without further substantial support by the supplier; and
  4. When necessary, details of the items are accessible and will be provided, upon request, to the appropriate authority in the exporter's country in order to ascertain compliance with the conditions described in paragraphs (a) through (c).

Deemed Export: Under the EAR, an export is "deemed" to take place when technology or source code is released to a foreign national in the United States. Such a release is viewed as an export to that foreign national's country or last country of permanent residence.

ENC Reporting: Refers to the semi-annual reporting requirement, as set forth under the Section 740.17(e) of the EAR, for exports to all destinations other than Canada, and for re-exports from Canada for certain encryption items.

For questions, please contact F5's Export Compliance Team at exportcompliance@f5.com