CCATS required for non-export iPhone app?

Question

I am ready to finally deploy my first iPhone application. The application uses SSL to connect to the REST web service. While reading documents about deploying the application in the application store, I came across some nonsense about having to go through the government verification process for 30-60 days in order to send an application that simply connects to the HTTPS server.

My question is, since this is an export requirement, do applications that are distributed only in the US face the same restriction?

thanks

Answer 1

According to The Animail , yes, you need to go through export controls, even if you only use an HTTPS connection in your application.

Pay attention to this part, although it can ease your pain:

The only relief Apple can offer is that if you agree (in writing) to go through the CCATS process and have already submitted an application to the government, Apple allows you to start selling your application in the US and Canada, adding more countries in the second stage and finally opening everything for sale when approval is received.

Apple may be satisfied with the same written promise to only distribute in the US and allow you to sell without an export review, but I will definitely check with Apple and not assume anything.

Zetetic contains an extensive message explaining the whole process of obtaining export certification.

Answer 2

The short answer is no, if you are not exporting from the United States, you do not need to get an encryption overview for your application. But not because it is not considered encryption. An application is an encryption element if the application uses encryption and you need to dig a little deeper. It doesn’t matter that you call the routines built into the phone to encrypt instead of providing the code.

The reason is that if you sell your application only in the USA, this is not an export. If you sell it to Canada, it is exported to Canada, but since the US allows the export of national security-controlled encryption elements (NS1) to Canada without a license, you do not need to obtain permission for Canada.

See 15 CFR part 738, Appendix 1, for more information and find Canada. Better yet, visit the Bureau of Industry and Security at http://www.bis.doc.gov/encryption

And if you have questions, you can call the BIS help desk at 202-482-0707.

Answer 3

Obviously, I'm not a lawyer - an important warning. The US relaxed export restrictions more than 10 years ago. In addition, technically, your software uses HTTPS, and the phone performs encryption (as in the library in CocoaTouch), not your software.

Technically, your software does not have encryption - unless you actually put it on top. You, I suppose, pass the plain text to the library provided by Apple, and that does the rest.