Export Compliance in iOS App Submission

Question

I making a new app and want to submit to app store.

But at the time of final submission there is check for Export Compliance.

What should I Check Yes Or No.

I use https url in my app.

Please Help Me .

Thanks In Advance.

This has been asking before: https://stackoverflow.com/questions/45008590/itunesconnect-requires-me-to-submit-year-end-self-qualification-report However, since that question doesn't have an asnwer, I wont mark this one as duplicate. — Nicolas Miari, Aug 24 '17 at 07:44
Instead, I'll refer you to the link posted as a comment to the question above: http://tigelane.blogspot.jp/2011/01/apple-itunes-export-restrictions-on.html Hope it helps. — Nicolas Miari, Aug 24 '17 at 07:45
Also, this: http://blog.supertop.co/post/162562874252/reporting-app-encryption-use-to-the-us-government — Nicolas Miari, Aug 24 '17 at 07:47

score 36 · Answer 1 · answered Aug 14 '19 at 08:27

36

When you know that you ARE export compliant you can put this in your Info.plist:

<key>ITSAppUsesNonExemptEncryption</key>
<false/>

This will prevent App Store Connect from asking you questions about export compliance.

answered Aug 14 '19 at 08:27

buzi

377
3
3

1

Thanks. But do I still need to submit annual reports to BIS if my answer is no? – oliverbytes Apr 27 '22 at 07:03

score 29 · Answer 2 · edited Aug 05 '19 at 13:10

29

If you are using https in your application, you will need to answer yes to this question, even if all you are using is built in mechanisms to communicate over https. The good news is that you no longer need to get the Encryption Registration Number (ERN) - the current requirements (as of August 2017) are that you just need to submit the annual self classification report to the BIS(Bureau of Industry and Security). To submit a self classification report, follow the instructions on item 13 in this FAQ: A sample Self Classification report can be found here.

For a great write up that talks about both sides of the story (apps that only use common / freely available encryption, like SSL, as well as apps that have their own, proprietary encryption, see this Medium post.

Please don't listen to other people who state that they just answer no to this question to make things easier when submitting an app.

edited Aug 05 '19 at 13:10

iosMentalist

3,066
1
30
40

answered Aug 25 '17 at 19:57

wottle

13,095
4
27
68

So which type of reports do we need? 13 item mentions a couple of report they can be sent to "BIS" (one email) and to "ENC Encryption Request Coordinator" (another email? Do we need to sent both reports? – user924 May 23 '19 at 20:31
@user924 No, it's stating that the one report needs to be sent to both email addresses. – wottle May 30 '19 at 20:23
1

Hey, I've just sent the annual export compliance. Approximately how long does it take before they answer so that I can upload it to upload it to apple so that the app can get published? thanks – Mattias Aug 15 '19 at 14:38
2

I tell Apple and other platforms I use encryption if they ask, but it's a complete waste of time to tell the government. I can't be bothered, it's a stupid rule, and is completely pointless, so I don't. – Skylar Ittner Jan 24 '21 at 04:12

score 12 · Answer 3 · answered Feb 17 '18 at 04:36

12

As of February 2018 this is the process to file an Annual Self Classification Report to BIS (Bureau of Industry and Security):

https://www.bis.doc.gov/index.php/policy-guidance/product-guidance/high-performance-computers/223-new-encryption/1238-how-to-file-an-annual-self-classification-report

answered Feb 17 '18 at 04:36

Valerio Gentile

1,071
11
24

what about `"ENC Encryption Request Coordinator" `? Do I need to send anything to them? – user924 May 23 '19 at 20:59
from your link it says that we need to sent to both BIS and ENC – user924 May 23 '19 at 21:02
Hey, I've just sent the annual export compliance. Approximately how long does it take before they answer so that I can upload it to upload it to apple so that the app can get published? thanks – Mattias Aug 15 '19 at 14:38
1

You just need to submit the report. They will not answer. You can go ahead with the upload to apple. – Valerio Gentile Aug 17 '19 at 00:37

phil · Answer 4 · 2020-04-29T20:20:08.963

To get a ECCN (Export Control Classification Number) for a HTTPS mass market iOS app follow, these steps.

Download the quick reference guide to classify your app. https://www.bis.doc.gov/index.php/documents/new-encryption/1652-cat-5-part-2-quick-reference-guide/file

For a basic HTTPS iOS app used to securely access a webpage or transfer a file use
5D992 which is Information Security” “software” not controlled by 5D002.

If your app contains more encryption functionality, then reference the policy guide. https://www.bis.doc.gov/index.php/policy-guidance/encryption

Might not be what you want to hear, but you will need to review the policy and correctly categorize the app and get the correct ECCN.

Now go to the SNAP-R form. https://snapr.bis.doc.gov/snapr/ To get to the form from the BIS homepage. https://www.bis.doc.gov/index.php Then select Licensing -> Simplified Network Application Process Redesign (SNAP-R)

Register Online for a SNAP-R account. https://snapr.bis.doc.gov/registration/Register.do The Bureau of Industy and Security will return a CIN application ID quickly via email.

Return to the main SNAP-R page with the CIN issued number and login.

Select "Create Work Item "

The Type will be "Commodity Classification Request"

Reference number is 7 digits. I used my phone number.

Create

Fill in Contact Information. Leave License Information Blank

Fill in Company Designation any info missing. When you created the CIN this info was requested.

Other Party can be left blank. Now for each app you want to register, fill in a Export Item and press Add Export Item. Multiple apps can be submitted on the same request.

ECCN will be 5D992

APP can be left blank. It is the Adjusted Peak Performance"("APP") which for a commodity iOS app is not required.

Product/Model is the name of the app in the App Store.

CCATS can be left blank.

Manufacturer is your company name.

Technical Description - briefly describe the apps function and how HTTPS is leverage. Keep it simple. They are interested if the app is a security risk and how encryption is used.

example: AppName is distributed as an Apple iOS App. It uses HTTPS to download/upload daily updates to and from xxxx. The download is used to generate a table. An In-App .99 cent purchase expands the table results to include xxxx.

Additional information explains in more detail how HTTPS has been implemented.

The HTTPS file transfer is a URLSession data transfer task found in the Apple Foundation library. The iPhone automatically performs the download of the published data in csv file format, using the HTTPS protocol for a secure transfer.

Make sure you saved all your drafts. Check for errors. Then submit.

The turnaround is pretty fast. Mine took around an hour. But I am sure it varies.

The other option is once a year you can submit an Annual Self Classification Report. But if you have a SNAP-R CCATS number you are not required to submit a Annual Self Classification Report.

https://www.bis.doc.gov/index.php/policy-guidance/encryption/4-reports-and-reviews/a-annual-self-classification This is very simple. Download the sample csv file. Delete out the sample data leaving the headings. The heading are required. Fill in the columns. The column Authorization Type is MMKT. Item type Other: HTTPS File Transfer. Save the file and submit.

The BIS SNAP-R hotline [202-482-4811 DC, 949-660-0144 CA] and the Encryption Hotline for the annual submission [202-482-0707] are both very helpful. Last point, the BIS has helpful set of YouTube video. https://www.bis.doc.gov/index.php/online-training-room

Hope this helps.

Thanks! Please confirm if I understand correctly: there are two options: 1) Process with creation of SNAP-R account and Work Item registration, can be done once; and 2) Submitting an Annual Self Classification Report every year — Lion, Oct 14 '20 at 18:24
Yes, that is my understanding. With the Annual, the department does not confirm receipt, it simply files the annual report submitted away. — phil, Oct 17 '20 at 14:58

score 3 · Answer 5 · answered Feb 03 '22 at 09:05

From Complying with Encryption Export Regulations: Declare Your App’s Use of Encryption:

Typically, the use of encryption that’s built into the operating system—for example, when your app makes HTTPS connections using URLSession—is exempt from export documentation upload requirements, whereas the use of proprietary encryption is not. To determine whether your use of encryption is considered exempt, see Determine your export compliance requirements.

So Apple says that for usual HTTPS scenarios, you do not need to upload export documentation for your app.

Export Compliance in iOS App Submission

5 Answers5

Linked

Related