Russian FSB notification (Federal Security Bureau notification)

Russia: Roadmap for Importing Encrypted Products:-

Summary :-

In response to a variety of questions concerning the importation of encrypted products, the U.S. Commercial Service in Moscow has developed this roadmap to help U.S. exporters navigate this process. In the past, it was obligatory to obtain a license from Russia’s Federal Security Service (FSB) that would permit the importation of encrypted products. Since the establishment of Customs Union in 2010, however, things have dramatically changed, making the process in some way easier.

Background :-

While importers no longer need to obtain a license from the FSB, they do need to submit a notification to the FSB’s Center for Licensing, Certification and State Information Protection. This change came into force with the creation of the Customs Union between the Russian Federation, Belarus and Kazakhstan. These rules cover the most popular groups of products: cellphones, laptops, software and much more.

When customs officers issue permits for the import and export of encryption means, they rely on the list of notifications which is registered by the FSB.

Products Covered :-

The Eurasian Economic Commission (EEC), as the regulating body of the Customs Union, defines the list of products that are subject to non-tariff barriers. The EEC decree №134, dated August 16, 2012, creates the grounds for obtaining the notification. Chapter 2.19 of the decree reflects the full list of products that are subject to notification.

Below is the list of products which belong to encryption (cryptographic) means or include encryption (cryptographic) means, technical and cryptographic characteristics of which are subject to notification:

• 1 =Products, which include encryption (cryptographic) means, which have any of the following components:

  A) Symmetric cryptographic algorithm, which uses the cryptographic key, the length of which does not exceed 56 bits; or asymmetric cryptographic algorithm, based on any of the following methods: October 31, 2013 Russia: Roadmap for Importing Encrypted Products Russia Page 2 of 5

  B) Factorization into prime numbers, the size of which does not exceed 512 bits;

  C) Calculation of discrete logarithms, in the multiplicative group of the finite field, the size of which does not exceed 512 bits; or

  D) Discrete logarithm in the group, the size of which is different from that named in the above item “b”, and does not exceed 112 bits.

  Note: Parity bits are not included in the key length.

• 2 =Products, which include encryption (cryptographic) means, and have limited functions:

  A) Thentication, which includes all aspects of access control, where there is no file or text encryption, except for encryption, which is directly related to protection of passwords, personal identification numbers or similar data for protection from unauthorized access;

  B) Digital signature. Note: Functions of authentication and digital signature include the function of keys distribution which is related to them.

• 3 =Components of software operation systems, cryptographic possibilities of which cannot be changed by users, which are developed for installation by users without further substantial support by supplier and which have technical documents available (description of cryptographic transformation algorithms, interaction protocols, description of interfaces, etc.)
• 4 =Personal smart-cards (intelligent cards):

  A) Cryptographic capabilities of them are limited to usage on equipment or in systems, which are specified in items 5 – 8 of this list;

  B) For wide public usage, cryptographic capabilities of which are not available to users and due to a special design they have limited capabilities of protection of personal information, which is stored on the card. Note: If an intelligent card can perform several functions, then the reference status of each function shall be specified individually.

• 5 =Receiving equipment for radio broadcasting, commercial TV or similar commercial equipment for broadcasting on a limited territory without encryption of a digital channel, except for cases when encryption is used solely for control of video or audio channels and sending of reports or return of the information, which is related to the program, to broadcast providers.
• 6 =Equipment, cryptographic capabilities of which are not available to users, which is custom developed and limited for use by any of the following:

  A) The software is made in the copy protected form; Page 3 of 5

  B) By access to any of the following: - copy protected content, stored only on a readable information carrier; - information, which is stored in encrypted form on carriers, when such information carriers are offered for sale to people in identical sets;

  C) Copy check of video and audio information, which is copyright protected.

• 7 =Encryption (cryptographic) equipment, which is specifically developed and limited for use to banking and financial transactions. Note: Financial transactions include fees and payments for transportation services and credit financing.
• 8 =Portative or mobile radio electronic devices of civil purpose (for example, for use in commercial civil systems of cellular radio communication), which are not capable of end-to-end encryption (i.e. subscriber-to-subscriber).
• 9 =Wireless radio electronic equipment, which encrypts information only in the radio channel with the maximum wireless range without amplification and bridging less than 400 m in accordance with technical specifications of manufacturer.
• 10 =Encryption (cryptographic) means used for protection of technological channels in information and telecommunication systems and communication networks.
• 11 =Products, the cryptographic function of which is blocked by manufacturer.

Documents to be submitted include the following:-

• Technical data of the imported radio electronic devices and (or) high frequency devices, country of origin, specific technical data (frequencies, transmitter power, radio signal type and modulation);
• Information on the encryption features of the product; it might also be required to obtain FSB notification, certificate of conformity, if required.
• Resolution of the State Frequency Committee on allocation of the radio frequencies for the imported equipment or the compliance statement of the technical parameters of the imported equipment.

Submitting FSB Notification :-

• Step 1 :Fill in the Notification Form, following instructions provided on the FSB website: http://clsz.fsb.ru/docs/fn.htm
• Step 2 : If your company does not have a representative office in Russia, you will need to act through your distributor or certification agency or any other trusted representative, providing him with the Power of Attorney (POA). The POA should be notarized and have an apostil.
• Step 3 :After filling the notification, it should be passed to the FSB’s Center for Licensing, Certification and State Secrets Protection. The office is located in Moscow.

4PL Consultancy has a team of experts in Tariff classifications of wide variety of Product lines – Medical spares, Aerospace, Radiation Oncology machines & spares etc.