topic Re: Export Control Classification Number [ECCN] for Activiti in Alfresco Archive

Export Control Classification Number [ECCN] for Activiti

kstickler — Thu, 30 May 2013 12:35:52 GMT

Hello,I need to get the Export Control Classification Number [ECCN] for Activiti. My company requires that information to allow software into our operating environment. Does anyone from the team have documentation on such? As an example, the Apache Software Foundation publishes a list of ECCN’s

Re: Export Control Classification Number [ECCN] for Activiti

jbarrez — Fri, 31 May 2013 12:13:32 GMT

This is honestly the first time in my life I hear about 'ECCN' … so I'm sorry I don't have any information on that.

How would one proceed to get such an ECCN?

Re: Export Control Classification Number [ECCN] for Activiti

kstickler — Fri, 31 May 2013 13:08:15 GMT

Hi Joram,

That's OK, Export Control #'s aren't the most common facet of software 🙂 They are categorizations for software. The categories are described by the US Department of Commerce (for nonMilitary applications) over view here: http://www.bis.doc.gov/licensing/do_i_needaneccn.html. Most common computing products fall under that jurisdiction.

The US Department of State's ITAR also has the stipulations for military application (guns, tanks, munitions, and any related software) at http://pmddtc.state.gov/regulations_laws/itar_official.html

All of these guidelines determine where/how/when a product can be exported outside the USA. The government doesn't "issue" those numbers to you (or a company, vendor, product, etc). Instead the vendor will use those guidelines to tag their software based on those categories. These #'s sometimes become necessary in situations dealing with multi-national companies, or with military contracts for export & trade compliance. If the #'s aren't available from the vendor, the responsibility falls on the consumer/customer to make that determination on their own.

Thanks again for the reply. Regards,
kstickler

Re: Export Control Classification Number [ECCN] for Activiti

jbarrez — Fri, 31 May 2013 19:06:48 GMT

Ok so if I understand you correctly we could just assign that ECCN ourselves? If so, how could we proceed. If it is not too much work, I guess it is something we could do 🙂

Re: Export Control Classification Number [ECCN] for Activiti

kstickler — Wed, 05 Jun 2013 13:55:04 GMT

Thx Joran,

From the vendor/author perspective, I couldn't say for sure what effort it would take. I believe organizations like the Apache Software Foundation go thru a process to obtain their own CCATS # (http://en.wikipedia.org/wiki/Commodity_Classification_Automated_Tracking_System). If I recall, part of that process is described at the US Bureau of Industry & Security under the DoC at http://www.bis.doc.gov/licensing/cclrequestguidance.html. Other commercial-available software we use from IBM, RedHat, Adobe, etc, go thru that process for their products as well…

-Kurt

Re: Export Control Classification Number [ECCN] for Activiti

jbarrez — Mon, 10 Jun 2013 14:33:45 GMT

Looks like a lot of paperwork (and we're not even based in the US!) …

For the moment it seems that it would be a difficult thing to get through … but who knows, if Alfresco would have a big customer asking for it …

Re: Export Control Classification Number [ECCN] for Activiti

roberthafner — Thu, 12 Jun 2014 19:24:16 GMT

Joram,

Our legal department is also requesting an export classification number for Activiti. Could you check with Alfresco to see if they have already obtained (or are in the process of obtaining) one for Activiti?

thanks,
Rob

Re: Export Control Classification Number [ECCN] for Activiti

roberthafner — Fri, 13 Jun 2014 12:48:39 GMT

Hi Joram,

Can you also check if Activiti has any encryption functionality either contained in the product or calls encryption in another product/library (such as an operating sytem or JRE)?

Specifically, our legal team is asking the following questions:

1. Does the software include functionality, or call on functionality in another product (such as an operating system or JRE), to secure (i) any passwords, (ii) data for transmission or (iii) data for storage? For this question and all others, specify if the functionality is included in the product or if the functionality is accomplished by calling to functionality in another product.
2. Does the software convert or transform data by using any method, including hashing, compression, or fixed encoding functionality contained either in the software or in another product?
3. Does the software make use of any key management/public key infrastructure?
4. Does the software call for HTTPS, TCP or other secure connection?
5. Does the software include any other encryption/decryption functionality (either contained in the software or by making calls to another product?

thanks,
Rob

Re: Export Control Classification Number [ECCN] for Activiti

jbarrez — Fri, 27 Jun 2014 11:49:21 GMT

Robert sorry for the delay in response - but i also saw this email passing with the same questions internally … so maybe you already received the answers?

Activiti does not contain any encryption libs.

So,

1. No
2. no
3. no
4. no
5. no