To be controlled in 5A002.a, an item must have “information security” as a primary function; be digital communications or networking systems; or be computers or other items having information storage or processing as a primary function. Below we further describe what types of products are covered under 5A002.a.1-a.4.

5A002 a.4 also controls items if the cryptography supports a non-primary function of the item AND the cryptographic functionality is performed by incorporated equipment or software that would as a standalone item be specified by Cat. 5 Part 2.

Examples: (a) An automobile where the only ‘cryptography for data confidentiality’ ‘in excess of 56 bits of symmetric key length, or equivalent’ is performed by a Category 5 – Part 2 Note 3 eligible mobile telephone that is built into the car. In this case, secure phone communications support a non-primary function of the automobile but the mobile telephone (equipment), as a standalone item, is not controlled by ECCN 5A002 because it is excluded by the Cryptography Note (Note 3) (See ECCN 5A992.c). (b) An exercise bike with an embedded Category 5 – Part 2 Note 3 eligible web browser, where the only controlled cryptography is performed by the web browser. In this case, secure web browsing supports a non-primary function of the exercise bike but the web browser (“software”), as a standalone item, is not controlled by ECCN 5D002 because it is excluded by the Cryptography Note (Note 3) (See ECCN 5D992.c).

Examples of reviewing an item in 5A002 a.1- a.4

Example 1: The vending machine

• In this example a vending machine can send encrypted communications in order to report that it has run out of soda. The main purpose of this item is to sell drinks, and the cryptographic functionality is there purely to enable it to fulfill this main purpose more efficiently. Such an item would be considered outside of 5A002 a.1 – a.4.
• In this case the primary function is the obvious or main purpose of the item. It can also be thought of as the function which is not there to support other functions.
• In this analysis you would look at the main purpose that the vending machine would be used for. The vending machine is not mainly for “information security”, digital communications or networking, and/or computing; and the cryptographic functionality of the item is just to support the main purpose of vending sodas, so the item would not be in Cat. 5, Part 2, 5A002 a.1 - a.4.

Example 2: The learning laptop

• A child’s laptop that access the internet securely and only to a specified site for literacy based learning would be considered outside of 5A002 a.1- a.4. Its primary function is specific to literacy training and would not be considered a computing item like a general purpose laptop would. A general purpose computer that implements cryptography such as a laptop or desktop computer would be in Cat. 5, Part 2 because its main function is to provide general purpose computing.
• A general purpose laptop or desktop computer may be used in multiple applications and provides a general set of features, whereas the learning laptop is an application specific item specifically designed with a set of functions targeted to a certain end use (literacy training). The cryptography is limited to secure communication for supporting literacy based learning.

Example 3: Wireless Chip

• Another example is a communications chip that implements cryptography for secure Wi-Fi connections within a cell phone. This item would be in Cat. 5, Part 2 because it is a general purpose communications chip. However, a chip designed for a utility meter with features that allow it to wirelessly interface securely only with specific utility meter readers could be outside of Cat. 5, Part 2, 5A002 a.1- a.4 because it provides specific communication between a meter and reader.

Example 4: The App

• Yet another example could be an app on a phone used for chatting or instant messaging using text, images and video. An app such as this would be in Cat. 5, Part 2 because it provides communications. However, an app designed for your local car shop to securely communicate between you and your mechanic about the status of your vehicle repair or maintenance would be considered outside of Cat. 5, Part 2, 5A002 a.1 – a.4. The app is using communications only in the context of vehicle repair.

Some Examples of items that are not Cat. 5, Part 2, 5A002 a.1-a.4