SCOMET

SCOMET. Export Authorization license & ICP. AMDA.

Wassenaar Arrangement. The Wassenaar Arrangement is a grouping of 42 countries, of which India is the latest entrant (on December 8, 2017) that seek to bring about security and stability by fostering transparent practices in the process of sale and transfer of arms and materials and technologies that can be used to make nuclear weapons with a view to prevent any undesirable build-up of such capabilities. By doing so the grouping hopes to stymie destabilizing developments. A further aim is also to prevent the prescribed items and technologies from falling into the hands of terrorists as well..

SCOMET - Special Chemicals, Organisms, Materials, Equipment and Technologies.

A picture containing text Description automatically generated.

Internal Compliance Programme (ICP). Given the challenges in ensuring optimal compliance in Intangible Technology Transfers (ITT), the government encourages voluntary compliance by the industry and for them to have a strong ICP in place. An ICP is individually designed by each company according to their specific requirements and nature of activities that may require export controls. Each company may designate an appropriate entity or authority responsible for the maintenance and implementation of that company’s ICP. In this regard, an important step in ensuring optimal compliance in transfer or export of technology and software, is for the industry to set in place an Internal Compliance Programme (ICP)..

Presently, SCOMET authorizations are granted by three agencies, i.e., Directorate General of Foreign Trade ( DGFT ), Department of Defense Production ( DDP ) and Department of Atomic Energy ( DAE ). Each SCOMET category contains an exhaustive list of items covered under that category, as well as conditions applicable to items under different categories. For issuance of a SCOMET authorization by DGFT, an online application needs to be filed which is considered on a case-by-case basis by an Inter-Ministerial Working Group ( IMWG ) as per guidelines and criteria laid down in the Handbook of Procedures of DGFT, issued under the FTP..

Procedure for SCOMET Authorization. Directorate General Of Foreign Trade (DGFT) Licensing authority Application shared with IMWG for approval Acceptance or rejection communicated to DGFT Inter Ministerial Working Group (IMWG) Approving authority If license granted License not granted Online Application for license Exporter • If export of item is controlled by SCOMET, application for export authorization to be submitted Online Application for revalidation of license Permission to Export Post-export obli gations Maintenance of records Reporting etc. Expiry of License (Validity period = 24 months) Members: Ministry of External Affairs, Department of Defence Production*, Department of Space (through ISRO), Defence Research and Development Organization, Departmentof Chemicals and Petrochemicals, National Authority of Chemical Weapon Convention and Cabinet Secretariat, Department of Bio- technology, Department of Atomic Energy, Department of Telecommunications, Ministry of Electronics and Information Technology, Cabinet Secretariatand Customs. Grants approval on a case-to-case basis, decision by consensus Criteria: Assessmentof end-use, end-user credentials, supply-chain etc. Assessed risk that exported items will not fall into hands of terrorists and non-State actors; Export control measures instituted by the recipient State;.

Overview of SCOMET Category 8 – Intangible Technology Transfers (ITT).

When SCOMET Authorization needed for ITT. Electronically transmit controlled technology , such as blueprints, diagrams, models and formulae, from India to another entity in a foreign country. Upload or store controlled technology onto a server, located outside India, or if located in India, such that the controlled technology is accessible to another entity in a foreign country. Conduct virtual meetings, via means such as Skype, Zoom, WhatsApp video calls etc. relating to controlled technology with people located in a foreign country. Modify controlled technology in India stored on a collaborative software, such as Google Drive, which is accessible to an entity in foreign country. Export (via device/document carrying laptop) controlled technology out of India. Upload or store export-controlled technology onto an IT server located in a foreign country, including e-mail servers and other such service providers. Giving visual access to foreign nationals of export-controlled data/processes. Allowing foreign nationals or users from foreign countries to virtually access your computers and systems in India that contain export-controlled data. Foreign national employed by company in India who can access the controlled technology..

Exempted for obtaining SCOMET authorization for ITT.

AMDÄ.

SCOMET - Special Chemicals, Organisms, Materials, Equipment and Technologies.

8A3 ELECTRONICS (SYSTEM, EQUIPMENT & COMPONENTS) : 8A301.

8E3 ELECTRONICS (TECHNOLOGY) : 8E301. 8E301 “Technology" according to the General Technology Note for the "development" or "production" of equipment or materials specified by 8A3, 8B3 or 8C3; Note 1: 8E301 does not apply to "technology" for equipment or components specified by 8A303. Note 2: 8E301 does not apply to "technology" for integrated circuits specified by 8A301.a.3 to 8A301.a.12, having all of the following: a. Using "technology" at or above 0.130 μm ; and b. Incorporating multi-layer structures with three or fewer metal layers. Note 3: 8E301 does not apply to 'Process Design Kits' ('PDKs') unless they include libraries implementing functions or technologies for items specified by 8A301. Technical Note A 'Process Design Kit' ('PDK') is a software tool provided by a semiconductor manufacturer to ensure thatthe required design practices and rules are taken into account in order to successfully produce a specificintegrated circuit design in a specific semiconductor process, in accordance with technological and manufacturing constraints (each semiconductor manufacturing process has its particular 'PDK')..

8E3 ELECTRONICS (TECHNOLOGY) : 8E302. 8E302 "Technology " according to the General Technology Note other than that specified by 8E301 for the "development" or "production" of a "microprocessor microcircuit", "microcomputer microcircuit" or microcontroller microcircuit core, having an arithmetic logic unit with an access width of 32 bits or more and any of the following features or characteristics: 8E302 a. A 'vector processor unit' designed to perform more than two calculations on floating-point vectors (one-dimensional arrays of 32-bit or larger numbers) simultaneously; Technical Note A 'vector processor unit' is a processor element with built-in instructions that perform multiple calculations on floating-point vectors (one-dimensional arrays of 32-bit or larger numbers) simultaneously, having at least one vector arithmetic logic unit and vector registers of at least 32 elements each. b. Designed to perform more than four 64-bit or larger floating-point operation results per cycle ; or c. Designed to perform more than eight 16-bit fixed-point multiply-accumulate results per cycle (e.g., digital manipulation of analogue information that has been previously converted into digital form, also known as digital "signal processing"). Note 1 8E302 does not apply to "technology" for multimedia extensions . Note 2 8E302 does not apply to "technology" for micro-processor cores, having all of the following: a Using "technology" at or above 0.130 μm ; and b. Incorporating multi-layer structures with five or fewer metal layers . Note 3 8E302 includes "technology" for the "development" or "production" of digital signal processors and digital array processors. Technical Notes 1. For the purpose of 8E302.a. and 8E302.b., 'floating-point' is defined by IEEE-754. 2. For the purpose of 8E302.c.,'fixed-point' refers to a fixed-width real number with both an integer component and a fractional component, and which does not include integer-only formats..

CRYPTOGRAPHIC "INFORMATION SECURITY“ - 8A502. 8A502 "Information security" systems, equipment and components, as follows: N.B. For Global Navigation Satellite Systems (GNSS) receiving equipment containing or employing decryption see 8A705, and for related decryption "software" and "technology" see 8D705 and 8E701. a. Designed or modified to use 'cryptography for data confidentiality' having 'in excess of 56 bits of symmetric key length, or equivalent', where that cryptographic capability is usable, has been activated, or can be activated by means of "cryptographic activation" not employing a secure mechanism, as follows: 1. Items having “Information Security" as a primary function; 2. Digital communication or networking systems, equipment or components, not specified in paragraph 8A502.a.1; 3. Computers, other items having information storage or processing as a primary function, and components therefor, not specified in paragraphs 8A502.a.1 or 8A502.a.2;.

CRYPTOGRAPHIC "INFORMATION SECURITY“ - 8A502. Technical Notes: 1. For the purposes of 8A502 .a, 'cryptography for data confidentiality’ means “cryptography” that employs digital techniques and performs any cryptographic function other than any of the following : a. "Authentication"; b. Digital signature; c. Data integrity; d. Non-repudiation; e. Digital rights management , including the execution of copy-protected "software"; f. Encryption or decryption in support of entertainment, mass commercial broadcasts or medical records management; or g. Key management in support of any function described in paragraph a. to f. above. 2. For the purposes of 8A502 .a, 'in excess of 56 bits of symmetric key length, or equivalent' means any of the following: a. A "symmetric algorithm" employing a key length in excess of 56 bits, not including parity bits; or b. An "asymmetric algorithm" where the security of the algorithm is based on any of the following: 1. Factorization of integers in excess of 512 bits (e.g., RSA); 2. Computation of discrete logarithms in a multiplicative group of a finite field of size greater than 512 bits (e.g., Diffie-Hellman over Z/ pZ ); or 3. Discrete logarithms in a group other than mentioned in paragraph b.2. in excess of 112 bits (e.g., Diffie-Hellman over an elliptic curve). Note 1: When necessary, as determined by the appropriate authority in the exporter's country, details of items must be accessible and provided to the authority upon request, in order to establish any of the following: a. Whether the item meets the criteria of 8A502 .a.1 to a.4.; or b. Whether the cryptographic capability for data confidentiality specified by 8A502 .a is usable without "cryptographic activation"..

NON-CRYPTOGRAPHIC " INFORMATION SECURITY”- 8A503.

DEFEATING, WEAKENING OR BYPASSING " INFORMATION SECURITY” – 8A504.

8B5PART 2 - "INFORMATION SECURITY"(TEST, INSPECTION AND PRODUCTION EQUIPMENT) – 8B502.

8D5 PART 2 - " INFORMATION SECURITY"(SOFTWARE) – 8D502.

8E5 PART 2 - " INFORMATION SECURITY"(TECHNOLOGY) – 8E502.

What help/info needed for filing?. One technical expert needed who can able to provide details of our works and to map with SCOMET Categories. Classification of item including Software and Technology Documentary Proof of relationship between Indian company and its parent company For Software/Technology, relevant details like encryption algorithm, key length, encryption functionality, eligibility under Cryptography note etc. to be provided. Certified ICP & End User declaration/certificate are required. If item contains Cryptography functions: A “Symmetric algorithm” employing key length in excess of 56 bits, not including parity bits? Yes /No. If yes: Full name, Key length/bits required. Used for .. Encryption algorithm Encryption functionality.

COMMENTS:. The present scheme for issuance of GAICT marks the first ever scheme for issuance of advance and bulk license in India, although description and technical details of SCOMET items are required to be submitted while making application for GAICT. The benefits of the scheme however appear to be restricted to service entities in India re-exporting imported items back to their overseas group company and would cover such re-exports of encrypted IT products, etc. of Category 8. The scheme mainly seems to cover re-exports by service providers and hence, re-exports of trading companies may not be covered under the scheme. While the scheme also covers re-export of software and technology, it may be covered only to the extent it is established that functionality and classification of the same have remained same post original import into India. While the requirement of ICP has been provided, nature or broad guidelines of compliance program expected by the authorities in this regard..

Thank you… -Suresh Vaddy. AMDÄ.