I will travel abroad carrying sensitive data on my Stanford laptop. What do I need to know?

Stanford Whole Disk Encryption (SWDE) uses PGP Whole Disk Encryption technology. The export restrictions that apply to the PGP technology also apply to computers using SWDE.

PGP Export Information

Are PGP products subject to export restrictions?
Yes. PGP products are subject to U.S. government export restrictions. For more information about export compliance, see below. How does PGP Corporation verify compliance with export restrictions?
PGP Corporation has introduced a series of automated steps in the ordering process to heighten awareness of the export requirements for itself and its end users. In addition to PGP Corporation's obligations, end users also have obligations with which they must comply. In PGP Corporation license agreements, customers must represent that they will not export to a prohibited country or to a restricted type of user as well.
Export Compliance
Exports and re-exports of PGP products are subject to U.S. export controls and sanctions administered by the Commerce Department's Bureau of Industry and Security (BIS) under its Export Administration Regulations (EAR).

The following matrix provides information on PGP products as related to the EAR and the Commerce Control List (CCL). This information can help customers determine whether they need to apply for an export license from the BIS. Also, an export license may be required for shipping documentation, recordkeeping, or post-shipment reporting.

 Product   ECCN   License Exception  CCATS
PGP Desktop Family:
PGP Desktop Corporate
PGP Desktop Professional
PGP Desktop Messaging
PGP Desktop Storage
PGP Desktop Home 
5D992.b.1  Mass Market  G051434
 PGP Whole Disk 5D992.b.1   Mass Market G045257
 PGP NetShare 5D992.b.1  Mass Market G051434
 PGP Universal 5D002.c.1  ENC/Unrestricted G051434
 PGP Universal Satellite 5D992.b.1  Mass Market G051434
 PGP Command Line 5D992.b.1  Mass Market G034611
 PGP SDK 3.x 5D002.c.1  ENC/Unrestricted G028990

The following information on definitions is based on the EAR. For more information on the EAR, please visit the BIS website or contact its offices directly at one of the numbers provided below:

  • BIS website: http://www.bis.doc.gov/
  • BIS Office of Exporter Services (Washington, D.C.): +1 202 482 4811
  • BIS Western Regional Office: +1 949 660 0144
Embargoed Destinations
PGP products may not be exported or re-exported, either directly or indirectly, to any country embargoed by the U.S. (Cuba, Iran, Iraq*, Libya**, North Korea, Sudan, and Syria) without prior authorization from the EAR and other applicable U.S. government agencies.

Iraq is not on the embargoed list, but encryption products can not be exported to Iraq for non-US military purposes.
** Effective August 31, 2006, Libya has been removed from the US list of embargoed countries. An export license continues to be required to order, buy, remove, use, sell, loan, transfer, or otherwise service items that may have been unlawfully exported or re-exported to Libya prior to the lifting of the embargo. The U.S. Department of Commerce will review applications for such activity on a case-by-case basis and apply favorable consideration for civil end-uses.

ECCN: Export Control Classification Number assigned to a product by the BIS. An ECCN is an alpha-numeric classification used in the CCL to identify items for export control purposes.

License Exception: The license exception assigned to a product by the BIS that allows for export to specified destinations without having to obtain a separate license from the Commerce Department.

Mass Market/NLR: Mass Market products are eligible for export with NLR (No License Required) to any end user (including government end users) in all countries except the embargoed countries: Cuba, Iran, Iraq*, Libya**, North Korea, Sudan, and Syria. Mass Market products are eligible for de minimis treatment.

ENC/Unrestricted: ENC/Unrestricted products are eligible for export to any end user (including government end users) in all countries except the embargoed countries: Cuba, Iran, Iraq*, Libya**, North Korea, Sudan, and Syria.

ENC: ENC (also denoted as ENC/Restricted) products are eligible for export to any end user (including government end users) in EU member countries (Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Slovakia, Slovenia, Spain, Sweden, and United Kingdom) and close trading partners (Australia, Japan, New Zealand, Norway, and Switzerland). In addition, ENC products are eligible for export to any non-government customer in all destinations except the embargoed countries: Cuba, Iran, Iraq*, Libya**, North Korea, Sudan, and Syria. Exports to government end users outside the EU and close trading partner countries will require an export license issued by the U.S. Department of Commerce. Government end users are defined as:

(a) any foreign central, regional or local government department, agency, or other entity performing governmental functions; including governmental research institutions,  governmental corporations or their separate business units …which are engaged in the manufacture or distribution of items or services controlled on the Wassenaar Munitions List, and international governmental organizations;
(b) this term does not include the following public entities: utilities (including telecommunications companies and Internet service providers); banks and financial institutions; transportation; broadcast or entertainment; educational organizations; civil health and medical organizations; retail or wholesale firms; and manufacturing or industrial entities not engaged in the manufacture or distribution of items or services controlled on the Wassenaar Munitions List.

CCATS: Commodity Classification Automated Tracking System. This is the code number assigned by the BIS to products that it has classified against the CCL. PGP Corporation provides CCATS because some encryption exports require post-shipment reporting to the BIS and the CCATS is a mandatory element of these reports. 

Denied Persons
PGP products may not be exported or re-exported, either directly or indirectly, to a person or entity barred by the U.S. government from participating in export activities. Denied persons include those individuals and entities listed on the Commerce Department's Denied Persons List, the Commerce Department's Entity List, the Commerce Department's Unverified List, the State Department's Debarred Parties List, and the Treasury Department's Lists of Specially Designated Nationals. Please review the attached link to the prohibited US government lists: http://www.bis.doc.gov/ComplianceAndEnforcement/ListsToCheck.htm

Enhanced Proliferation Control Initiative
PGP products may not be used directly or indirectly in the design, development, fabrication, or use of nuclear, chemical, or biological weapons or missile technology without U.S. government authorization.

Foreign Nationals
A person who was born outside the jurisdiction of the United States, who is subject to a foreign government, and who has not been naturalized under U.S. law. This includes foreign national contractors and vendors. For the purposes of the US Export Administration Regulations ('EAR') a 'foreign national' subject to the US 'Deemed Export'† rule is an individual who is not a citizen of the United States, not a legal permanent resident (meaning not a 'permanent resident alien' or 'Green Card' holder.)

A U.S. export license may be needed BEFORE disclosing certain kinds of software or technology to a foreign national IF:

  1. The software or technology is export-controlled and
  2. The individual is a citizen of one or more of the following countries: Cuba, Iran, Sudan, North Korea, Syria
†Deemed Export: Any release of technology or source code subject to the EAR to a foreign national within the United States. Such a release is deemed to be an export to the home country or countries of the foreign national. This deemed export rule does not apply to persons lawfully admitted for permanent residence in the United States or to persons who are protected individuals under the Immigration and Naturalization Act - 8 U.S.C. 1324b(a)(3).

Definition of 'release' of technology or software. Technology or software is 'released' for export through:

i.  Visual inspection by foreign nationals of U.S.-origin equipment and facilities;
ii. Oral exchanges of information in the United States or abroad; or
iii. The application to situations abroad of personal knowledge or technical experience acquired in the United States.

This report is not intended to replace the EAR or other U.S. export laws (e.g., Treasury Department embargo and sanctions regulations), but is intended as an accommodation to you to be used in conjunction with applicable laws to assist you in the export and import of PGP products. You are responsible for exporting PGP products in accordance with the requirements of the EAR and other U.S. export laws. End user, end use, and country of ultimate destination may affect export licensing requirements. All ECCN and CCATS numbers and License Exception information are subject to change without notice. Modification in any way to a PGP product nullifies the classification. It is therefore your obligation as an exporter to verify such information and comply with the then currently applicable regulations. The data provided herein is for informational purposes only. PGP Corporation makes no representation or warranty as to the accuracy or reliability of such classifications or numbers. Any use of such classifications or numbers by you is without recourse to PGP Corporation and is at your own risk. PGP Corporation is in no way responsible for any damages, whether direct, indirect, consequential, incidental or otherwise, suffered by you as a result of using or relying upon such classifications or numbers for any purpose whatsoever. The materials on this Web page are not intended to be or contain legal advice. Nothing provided on it should be used as a substitute for the legal advice of competent counsel. You are urged to consult the EAR, the Bureau of Industry and Security's Export Counseling Division, and other appropriate sources before distributing, importing, or using PGP products.