Does the OPSEC interface for Checkpoint NG have retail or mass market
classification for encryption export from the Bureau of Industry and
Science www.bxa.doc.gov?

---

Request for Question Clarification by maniac-ga on 11 Feb 2003 16:15 PST

Hello Mattheww,

I would like to say "yes", but I cannot find an online reference that
says so for sure. May I suggest an alternative approach?

Purchase a copy of the Checkpoint product from an "in country"
supplier and send that to your customer (along with your product). I
know my company has done so in the past to avoid any difficulties in
export rules and would also get you a product that may already be
tailored for that country as well (e.g., translation of
documentation).

If that would be acceptable, I would be willing to help search for
suppliers if you provide a list of countries. For example, quick
search with the phrase
  opsec interface checkpoint ng site:fr
provides 9-15 pages of information (in French) from French sites.

  --Maniac

---

Clarification of Question by mattheww-ga on 12 Feb 2003 11:45 PST

Hi Maniac,
This is not the reason that I am asking. I want to build a product
that uses the OPSEC interface. In order to easily self classify as
retail for export compliance, all components in your product
(including third party components) must be retail as well.

My suspicion is that OPSEC probably does have retail or mass market
classification, but I need something harder than that to help classify
my product.

Matthew

Hello Mattheww,

The best I can determine at this time, the answer is no. In particular
- there are some serious limitations on the definition of "retail" (as
compared to "mass market") that appear to preclude such a definition.
Using
  http://encryption_policies.tripod.com/us/thomsen_00_export.htm
as a reference, note the section titled "Positive and Negative Tests"
about 1/4 of the way down. For example, the SDK is not "specifically
designed for individual consumer use" (though your product may meet
that criteria). The volume of sales and purpose of use can preclude
the "retail" classification.

I also followed up my search with an inquiry to Checkpoint directly
and received the following reply:
---
The following is a general guideline:

EVERY partner using the SDK must track whom they export software to
(check
against the "End user Screening References List", below) - In
addition,
since strong encryption is in the product, if they are US based they
must
report whom they ship to (except 4 items in the Exceptions List
below). If
they are non-US based, they don't need to report but must track.

End User Screening References List:
It outlines the list of Denied Parties; they can be found in:
a-	BXA Denied Parties
b-	DXA Entities list
c-	US Dept. of Commerce and Treasury  "Specially Designated Nationals
List
or SDN"
d-	Dept. of State list of Debarred Parties under Arms Export Control
Act

Exceptions List:
There are 4 items stating when reports aren't needed (all other cases
would
need a report)
a-	Any encryption to US subsidiaries for internal company use
b-	Retail Products exported to individual consumers
c-	Items exported via free or anonymous download
d-	Encryption items from or to a US bank, financial institutions or
their
subsidiaries, affiliates, customers or contractors for banking or
financial
operations
---

You may want to follow up in more detail with the vendor. Their reply
to my inquiry was quite quick - sent within a couple hours of the
start of business today.  Their email address for this type of inquiry
is at
  mailto:opsec@us.checkpoint.com

Let me know if you need further clarification on this and good luck
with your product.
  --Maniac

I was finally able to squeeze the information out of the vendor. The
answer is yes, they have retail classification.