Pointsec Restrictions

RESTRICTIONS ON ENCRYPTION TECHNOLOGIES

We want to make you aware of certain federal regulations that limit technology exports, which set limits on your use of Pointsec.  Encryption products like Pointsec are among the technologies that are subject to U.S. Export Administration Regulations and other U.S. laws when in or exported from the United States. Pointsec may also be subject to import controls in some countries. 

While most Pointsec users will never encounter these restricted circumstances, it is important that all users are aware of the limitations, particularly if they contemplate international travel.

How is Pointsec use restricted under U.S. export regulations?

Pointsec is designated as a "Mass Market" technology product, approved for export to most destinations without a license (formally, No License Required or "NLR") but with appropriate notification to and opportunity for review by the U.S. Department of Commerce.   

Pointsec may not be exported or re-exported without a license to certain countries designated as Embargoed and Terrorist states, nor transferred to citizens of those countries, including faculty and university students from those countries.  That list includes China, Cuba, Iran, North Korea, Sudan and Syria.

Pointsec is generally installed only on devices purchased with UM funds and used for UM business purposes.  Such devices generally may not be transferred out of the custody of UM affiliates without explicit authorization from the UM department responsible for the asset.  In the case of Pointsec, if such a transfer were made to a non-US citizen or organization, the device would be considered "exported" and thus at risk of violating export/re-export regulations.

What do I do if I am travelling?

The simplest solution is not to take a device with Pointsec software installed on it when you travel.  This advice is essentially mandatory if you are travelling to a destination designated as an Embargoed and Terrorist state.

If you take a computing device that does not have this critical data protection capability, be very careful about what you store on it before or during your travels.  With or without Pointsec, the computing device should remain under your control and supervision as much as circumstances allow.

What about getting an export license?

In certain limited circumstances, it may be possible to receive a license for items accompanying their user for the user's personal use as "tools of the trade." Such temporary exports of tools of the trade require that the device remain under the "effective control" of the person.  (In the case of Cuba or Sudan, only non-governmental, humanitarian organizations are allowed under US law to temporarily export into those countries.)

Laptops containing whole disk encryption can be considered part of the "tools of the trade" of a UM employee. "Effective control" requires that the employee retain physical possession of the item, or secure the item in an environment such as a safe, at all times.

Please contact the University’s Export Compliance Officer for assistance in applying for a license.  Do not contact the Department of Commerce directly.

Are there other restrictions on export of Pointsec?

In addition to the country restrictions, Pointsec may not be transferred to persons or entities prohibited from receiving U.S. exports, including those (a) on the Bureau of Industry and Security Denied Parties List or Entity List, (b) on the Office of Foreign Assets Control list of Specially Designated Nationals and Blocked Persons, or (c) to persons or entities involved with missile technology, nuclear, chemical or biological weapons, or military end-uses where prohibited by an applicable arms embargo.  For more information, see:

-- The University of Miami uses a specific Restricted Party Screening tool to assist with this area of compliance. Please contact the University’s Export Compliance Officer for assistance. (www.miami.edu/exportcompliance)

Who determines these export classifications?

The Export Administration Regulations (EAR) classifications are reviewed by the U.S. Bureau of Industry and Security (BIS), part of the U.S. Department of Commerce (http://www.bis.doc.gov/). Pointsec has an Export Control Classification Number (ECCN) of 5D992 under EAR.  The BIS is the place to provide notice and to apply for an export license of such a product.

Are export controls the only thing to consider?

There are also import restrictions.  Some countries ban, or severely regulate, the import, export or use of encryption technology (e.g., China, Russia).  Taking a laptop with encryption software to certain countries could risk imprisonment or cause your laptop to be confiscated.  For a list of requirements and restrictions, see:  www.miami.edu/exportcompliance .   

It is probably safer on balance to take another device, without Pointsec software installed on it, or take no computer at all, rather than risk violating compliance requirements in these countries.

You may also contact the University’s Export Compliance Officer for assistance.

What else do I need to worry about when traveling?

It is important to consider not only Pointsec software, but also source code, technical data, manuals, biological, chemicals, other "high tech" items, etc., that you are taking with you on your travels to another country.  For advice on export controls, contact the UM Office of Research Compliance at ResearchCompliance@miami.edu, or visit their website at www.miami.edu/exportcompliance.   

What if I have more questions about this issue?

Contact the Medical Information Technology Help Desk at 305-243-5999, option 1 or help@med.miami.edu.

More information