United States Department of Commerce Bureau of Export Administration Washington, D.C. 20230 Jun 19 1998 [stamped] Appl. Ref. No.: Z066051/G006298 Dear Mr. Tien: The Bureau of Export Administration (BXA) has reviewed the classification issued to you on June 6, 1997 for the Integrated DNSSEC program (Application Reference No. Z066051 / G006298). As you know, based on the information provided at that time, BXA's classification concluded that the program was classified as EAR99, given our understanding that the program could only be used to authenticate users or messages. However, a second review has led BXA to determine that the program was not classified appropriately. Classification No. Z066051 / G006298 is hereby withdrawn. The Integrated DNSSEC program is properly classified as ECCN 5D002 and controlled for EI reasons because it includes the source code for RSAREF, which can be used not only to encrypt files for authentication but, with minimal effort, to also encrypt data for confidentiality purposes. A license is required under the Export Administration Regulations for the export of Integrated DNSSEC to all destinations, except Canada. We also note that the program is available on your client's website without any precautions to prevent its unauthorized transfer outside the United States. Section 734.2(b)(9) of the Export Administration Regulations defines the export of encryption source code and object code software to include "making such software available for transfer outside the United States . . . including transfer from World Wide Web sites" without taking appropriate precautions. Accordingly, since the program is classified under ECCN 5D002, your client must take precautions adequate to prevent the unauthorized transfer of encryption source code and object code software controlled for EI reasons under ECCN 5D002 from that website. Failure to do so constitutes a violation of the Export Administration Regulations. I refer you to Section 734.2(b)(9) of the Export Administration Regulations. If you have any questions regarding this matter, please contact Ms. Patricia M. Sefcik, Director of the Encryption Policy Controls Division, at (202) 482-0707. Sincerely, /s/ James A. Lewis Director Office of Strategic Trade and Foreign Policy Controls