Notification for importation of cryptographic devices

From IFCG Encyclopedia

Import (and export) of cryptographic equipment to the territory of the Eurasian Economic Union (EAEU) is restricted.

It is worth noting that most laptops, cell phones, routers, network switches, wireless mice, server systems, video game consoles, cryptocurrency mining hardware and other consumer devices support cryptography. In fact there are certain signs that suggest that the device contains some kind of cryptography:

  • It uses wireless communication technologies: Wi-Fi, Bluetooth, WiMax, GSM (and any other kind of mobile communication technologies: CDMA, UMTS, HSDPA, LTE, etc.), NFC;
  • It supports access restriction to certain functions with password, access key, security token;
  • It has one of the popular operating systems installed that is known to support cryptography (such as Windows, Linux, iOS, Android);
  • It is designed for data protection, establishing of secure communication channels, confidential data exchange (such as bank cards and cash machines, devices that use VPN, SSL, HTTPS, protected data storage devices).

Depending on product’s characteristics, purpose and conditions of importation (exportation) one needs to obtain different documents: Notification, Conclusion or License. In most cases, foreign manufacturers willing to import their equipment to the EAEU for sale should issue the Notification[1].

Notification

Notification is a document issued by the manufacturer of the product and containing information about its technical and cryptographic characteristics. Notification is issued by the manufacturer of the product and registered by the approving authority of the EAEU member state. In Russia notifications are registered by the Federal Security Service (FSS or FSB). Below registration in FSB of Russia is described in detail.

Notification may be issued only for products that may be classified as one or several categories from the List. Such products are referred to as encryption (cryptographic) means subject to notification.

One Notification contains the information about one or several models of a single product with identical cryptographic characteristics.

Example:

3 cell phone models of Prime trademark are to be imported into EAEU — X1, X2, X3. The models X1 and X2 feature Wi-Fi, Bluetooth, GSM (3G+LTE), and OS Android. The X3 model does not support Bluetooth.

Consequently, 2 Notifications should be issued for these 3 models — one for models X1 and X2 (as their cryptographic characteristics are identical) and one for the X3 model.

According to the EAEU law, the manufacturer or the person authorized by the manufacturer may be the applicant[2] of the Notification. If the Notification is issued by the person authorized by the manufacturer, they would need a legalized power of attorney from the manufacturer authorizing them to represent manufacturer’s interests in the FSS. See this article for more information about power of attorney.

Documents required for the registration of the Notification

The following documents are submitted to the FSS for the registration of the Notification:

  • Two copies of the notification (drawn up in accordance with the form);
  • Cover letter from the applicant listing the attached documents;
  • Electronic copy of the Notification on a CD;
  • Legalized power of attorney from the manufacturer of the product (if the applicant is not the manufacturer).

Registration and validity period of the Notification

FSS registers the Notification within 7 working days and returns paper copy, signed and stamped with registration number assigned, to the applicant. After that, within 10 days, the information about the registered Notification is included in the Common register of Notifications[1] on the official website of the Eurasian Economic Commission.

Some customs consider stamped paper copy of the Notification sufficient for customs clearance, others may take into account solely the Common register and will wait until the information is published on the EEC website. It’s always better to register the Notification in advance to avoid the demurrage.

The validity period of the notification is provided at the discretion of the manufacturer. The manufacturer guarantees that the product’s cryptographic characteristics stay unchanged until the end of this period.

Common register of Notifications

Registered Notifications are included in the Common register. Information from the register can be used to import or export the product by any person or legal entity, not only the applicant (the number of the Notification from the register is sufficient for the customs).

Notes

  1. Only legal entities registered on the EAEU territory may obtain License and Conclusion.
  2. Applicant is a person who signs and submits the notification to the FSS

See also