The following article was researched and written by Dmitry Gladkov resume of Debevoise & Plimpton and Dmitriy A. Tartakovskiy. For more information or with any questions, please contact Mr. Gladkov in Moscow by telephone at 7 (095 or 503) 956-3858 or by e-mail at dkgladkov@debevoise.com.
Introduction
The Russian Federation has established a special legal regime governing importation of encryption devices and software into its territory. Specifically, importation of encryption equipment, software and related technical specifications is subject to a set of licensing requirements and procedures set forth in several government regulations. This article seeks to examine these licensing requirements and procedures, provide an estimate of the amount of time required to complete the licensing process, and assess the likelihood of ultimate success in obtaining an importation license.
Part I of this article examines the legal foundation of the existing licensing requirements and procedures for importation of encryption devices and software into the Russian Federation. Part II defines the various licenses required to effect the importation, specifies the government agencies that have the authority to issue such licenses and describes the licensing procedures established by these government agencies. Finally, Part III of this article assess the likelihood of success in satisfying the existing licensing requirements and obtaining an importation license.
I. Restrictions on Importation and Operation of Encryption Devices and Software
The design, manufacture, distribution and operation of encryption devices in the Russian Federation (Presently, the authority to issue importation licenses is vested in the Ministry of Trade and Development of the Russian Federation. See infra, Part II. ) is subject to a number of restrictions. Specifically, by RF President Edict No. 179 of February 22, 1992 (as amended through July 15, 1998), encryption equipment and technical specifications for its manufacture and use are classified as products the free circulation of which is prohibited for national security reasons. Further, RF President Edict No. 334 of April 3, 1995 ("Edict No. 334") provides that legal entities and individuals may not engage in activities related to the design, manufacture, distribution and operation of encryption devices without a license issued by the Federal Agency for Government Communications and Information ("FAPSI"). Finally, distribution of encryption devices, technical support for encryption equipment and other services related to the encryption of information are subject to licensing under Article 17 of RF Law No. 158-FZ of September 25, 1998 (as amended through May 12, 2000) On the Licensing of Certain Types of Activities.
Importation of encryption devices and software into the Russian Federation is subject to licensing as well. Edict No. 334 requires the State Customs Committee to take measures to prevent importation into the Russian Federation of encryption devices of foreign manufacture without a license issued by the Ministry of Foreign Economic Affairs of the Russian Federation1 with the approval of FAPSI. Article 19 of RF Law No. 157-FZ of October 13, 1995 On Foreign Trade Activity (the "Foreign Trade Law") provides that certain restrictions may be imposed on the import and export of particular goods (work/services) if such measures are required by the national interests of the Russian Federation. Pursuant to this provision of the Foreign Trade Law, RF Government Decree No. 854 of November 6, 1992 (as amended through February 22, 2000) has approved a list of specific goods (work/services) export or import of which requires a license. One of the items on this list is "encryption devices" (including encryption equipment, parts thereof and encryption software) and technical specifications for encryption equipment (including design documentation and operation manuals). (It should be noted that personal computer programs of foreign origin that contain encryption codes and that are widely used in Russia (e.g., Microsoft Explorer) apparently are not considered to be encryption software within the meaning of the legal acts mentioned above, and therefore, their importation and use are not subject to licensing. )
II. Licensing Procedures
A. Required Licenses and Relevant Government Agencies
The existing regulations establish a three-step procedure for obtaining a license for the importation of encryption devices and software of foreign manufacture into the Russian Federation. Pursuant to para. 4 of Edict No. 334, the importer must first obtain from FAPSI a general license to engage in activities related to the operation of encryption devices and programs (which includes the right to use such devices or programs) ("Activity License"). Under para. 5 of Edict No. 334, the importer must then secure the FAPSI approval of the intended importation and a letter from FAPSI to the customs authorities stating that the importation has been authorized by FAPSI. The importer may then apply for an importation license to the Ministry of Trade and Development of the Russian Federation (the "Ministry of Trade"), as required by para. 5 of Edict No. 334.
Pursuant to Article 11 of RF Law No. 4524-1 of February 19, 1993 (as amended on December 24, 1993) On Federal Agencies for Government Communications and Information and RF Government Resolution No. 1299 of October 23, 1996 (as amended through December 29, 1998), the authority to regulate activities related to encryption devices and software, to enforce restrictions on the design, manufacture, distribution and operation of such devices and software and to issue licenses for their import and export is vested in the Ministry of Trade and FAPSI.
B. Procedure for Obtaining an Activity License
The existing procedure for issuing Activity Licenses was established by FAPSI pursuant to RF Government Decree No. 333 of April 15, 1995 (as amended through July 29, 1998) ("Decree No. 333"). To obtain an Activity License, the importer must submit to FAPSI a written application addressed to the General Director of FAPSI. The application must state the purposes for which the Activity License is sought, specify the term for which the Activity License is required and contain certain information about the importer's business. Copies of the importer's incorporation documents must be attached to the application, as well as proof of payment of the licensing fee, which presently amounts to approximately $48.
In addition, the existing licensing procedure involves mandatory expert examination of the importer's business in order to determine whether the importer is capable of carrying out the stated activities, and technical expert examination of the equipment and software to be imported. The expert examination is performed by a certification center authorized by FAPSI. The certification centers perform the expert examination pursuant to a contract between the certification center and the importer and may charge substantial fees for their services.
Decree No. 333 requires FAPSI to process Activity License applications within 30 days from the date of receipt of the application and other required documents. This period may be extended, however, if it is necessary to perform additional expert examination of the importer, in which case the application must be processed within 15 days from the date of receipt by FAPSI of the results of such additional expert examination but not later than 60 days from the date of receipt of the application and other documents.
Decree No. 333 provides that an Activity License may not be issued for a period of less that three and more than five years, unless the applicant requests that the Activity License be issued for a period of less than three years. Also, Decree No. 333 requires that a separate Activity License be issued for each type of the importer's activity that is subject to licensing.
C. Procedure for Obtaining the FAPSI Approval and Letter to the Customs Authorities
Once the importer has obtained the Activity License, the next step of the importation licensing procedure involves securing the FAPSI approval of the importation and a letter from FAPSI to the customs authorities stating that the importation has been authorized by FAPSI. Such approval and letter are required for each category of the equipment and/or software to be imported. Although no formal procedure for issuing such approvals or letters has been established by FAPSI to date, the existing FAPSI practice is summarized below.
To obtain the FAPSI approval and letter, the importer must submit to FAPSI two applications, one for the approval and one for the letter, addressed to the General Director of FAPSI. The applications must specify the purposes for which the approval and letter are sought, state the name and specifications of the equipment and/or software to be imported, provide an explanation as to why existing analogous, certified software of Russian origin cannot be used for the stated purposes and provide some information.
FAPSI makes its decision to approve or deny the application based on the results of an expert examination of the technical documentation and/or samples of equipment or software provided by the importer. FAPSI normally processes such applications within one to two months from the date of receipt of the application and other required documents.
D. Procedure for Obtaining an Importation License
The existing procedure for obtaining a license for the importation of encryption equipment and software is set forth in the Methodological Instructions on the Procedure for Accepting Applications, Issuing Export and Import Licenses and Maintaining the Federal Database of Licenses, approved by Ministry of Foreign Economic Relations Order No. 367 of July 11, 1997 (as amended through October 12, 1999) (the "Instructions").
Under the Instructions, the importer must submit to the Ministry of Trade the following documents: the importer's application for an importation license; the contract for the acquisition of the equipment and/or software to be imported or another document pursuant to which the importer will be bringing the equipment and/or software into the Russian Federation; the importer's incorporation documents; the approval and letter to the customs authorities issued to the importer by FAPSI; the importer's Activity License and some other documents.
The Instructions require the Ministry of Trade to make a decision whether to grant an importation license to the applicant or deny the application within 25 days. The Ministry of Trade may extend the processing period for 10 more days if additional inquiries are required. The license is issued for one importation transaction, and each further importation requires a separate license.
III. Likelihood of Success in Completing the Licensing Process
The general policy underlying the existing licensing requirements for the importation of encryption technology in the Russian Federation is to limit the use of foreign encryption devices and software and encourage the use of similar products of Russian origin. Therefore, it seems likely that FAPSI decisions whether to approve or deny a particular application will be based primarily on the purposes for which the equipment and/or software of foreign origin is being imported. For example, if a Russian branch of a foreign bank applies for a license to import into Russia the same encryption equipment and/or software as its parent bank uses abroad, the approval is likely to be granted. In contrast, if the product is being imported for the purpose of sale in the Russian Federation, securing the FAPSI approval could be problematic.
Overall, it would normally take an importer of encryption equipment and/or software from 31/2 to 41/2 months to complete the licensing process, provided that the importer timely submits to the licensing agencies all the information and documents necessary to obtain the licenses and approvals discussed above. Although obtaining an importation license normally will not require profound legal skills, compliance with the somewhat cryptic licensing requirements outlined above can be an onerous task for foreign importers of encryption equipment or software. The lawyers of the Moscow office of Debevoise & Plimpton LLC will be happy to provide the necessary legal assistance on these matters.
| 