cancel
Showing results for 
Search instead for 
Did you mean: 

Export Control Classification Number [ECCN] for Activiti

kstickler
Champ in-the-making
Champ in-the-making
Hello,

I need to get the Export Control Classification Number [ECCN] for Activiti.  My company requires that information to allow software into our operating environment.   Does anyone from the team have documentation on such?  

As an example, the Apache Software Foundation publishes a list of ECCN’s for their products here:
  http://www.apache.org/licenses/exports/

Thanks for any details,
kstickler
8 REPLIES 8

jbarrez
Star Contributor
Star Contributor
This is honestly the first time in my life I hear about 'ECCN' … so I'm sorry I don't have any information on that.

How would one proceed to get such an ECCN?

kstickler
Champ in-the-making
Champ in-the-making
Hi Joram,

That's OK,  Export Control #'s aren't the most common facet of software 🙂   They are categorizations for software.  The categories are described by the US Department of Commerce (for nonMilitary applications) over view here:  http://www.bis.doc.gov/licensing/do_i_needaneccn.html.   Most common computing products fall under that jurisdiction. 

The US Department of State's ITAR also has the stipulations for military application (guns, tanks, munitions, and any related software) at http://pmddtc.state.gov/regulations_laws/itar_official.html

All of these guidelines determine where/how/when a product can be exported outside the USA.  The government doesn't "issue" those numbers to you (or a company, vendor, product, etc).  Instead the vendor will use those guidelines to tag their software based on those categories.    These #'s sometimes become necessary in situations dealing with multi-national companies, or with military contracts for export & trade compliance.   If the #'s aren't available from the vendor, the responsibility falls on the consumer/customer to make that determination on their own.


Thanks again for the reply. Regards,
kstickler

jbarrez
Star Contributor
Star Contributor
Ok so if I understand you correctly we could just assign that ECCN ourselves? If so, how could we proceed. If it is not too much work, I guess it is something we could do 🙂

kstickler
Champ in-the-making
Champ in-the-making
Thx Joran,

From the vendor/author perspective, I couldn't say for sure what effort it would take.    I believe organizations like the Apache Software Foundation go thru a process to obtain their own CCATS # (http://en.wikipedia.org/wiki/Commodity_Classification_Automated_Tracking_System).  If I recall, part of that process is described at the US Bureau of Industry & Security under the DoC at http://www.bis.doc.gov/licensing/cclrequestguidance.html.  Other commercial-available software we use from IBM, RedHat, Adobe, etc,  go thru that process for their products as well…

-Kurt

jbarrez
Star Contributor
Star Contributor
Looks like a lot of paperwork (and we're not even based in the US!) …

For the moment it seems that it would be a difficult thing to get through … but who knows, if Alfresco would have a big customer asking for it …

roberthafner
Champ in-the-making
Champ in-the-making
Joram,

Our legal department is also requesting an export classification number for Activiti. Could you check with Alfresco to see if they have already obtained (or are in the process of obtaining) one for Activiti?

thanks,
Rob

roberthafner
Champ in-the-making
Champ in-the-making
Hi Joram,

Can you also check if Activiti has any encryption functionality either contained in the product or calls encryption in another product/library  (such as an operating sytem or JRE)?

Specifically, our legal team is asking the following questions:

1. Does the software include functionality, or call on functionality in another product (such as an operating system or JRE), to secure (i) any passwords, (ii) data for transmission or (iii) data for storage? For this question and all others, specify if the functionality is included in the product or if the functionality is accomplished by calling to functionality in another product.
2. Does the software convert or transform data by using any method, including hashing, compression, or fixed encoding functionality contained either in the software or in another product?
3. Does the software make use of any key management/public key infrastructure?
4. Does the software call for HTTPS, TCP or other secure connection?
5. Does the software include any other encryption/decryption functionality (either contained in the software or by making calls to another product?

thanks,
Rob

jbarrez
Star Contributor
Star Contributor
Robert sorry for the delay in response -  but i also saw this email passing with the same questions internally … so maybe you already received the answers?

Activiti does not contain any encryption libs.

So,

1. No
2. no
3. no
4. no
5. no