ECCN Classification questions

[Rob Weir <ro...@apache.org>]

I'm hoping this is the right place to discuss the crypto export
classification procedures [1].

I'm stumped on the classification of the new OpenOffice.org podling.
The Apache page above seems to steer the classification toward ECCN
5D002, based on the "publicly available" exception of EAR 740.13(e).

But then when I check what commercial products have done, based on
this same code base, they are classified as 5D992.  For example, IBM
Lotus Symphony and LibreOffice Novell Edition.  From what I can tell,
they are using a different exception, for "mass market" software, per
EAR 740.13(d).  The mass market exception appears to have a different
reporting requirement than the one we use for ECCN 5D002 software.

Has this come up before at Apache?  We (OpenOffice.org) may be the
first project at Apache to be considered "mass market", so might want
to give this some consideration.

It is also unclear whether software can be classified in different
categories, at our election, or whether the same software can have
multiple categories.

I'm also poking around to see what ramifications the classification
choice has on downstream consumers.  For example, there was a request
a while ago from Dell, to include OpenOffice in a hardware bundle.  If
we have some discretion in what classification we use, I think we want
to pick one that allows the most permissive use of the product, even
if the paperwork requires more from us upfront.

Is there anyone here with deeper expertise in this area?  Anyone we
usually work with on this?

-Rob

[1] http://www.apache.org/dev/crypto.html

---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org