Pass your certification exam. Faster. Guaranteed.

Import-Export Regulations Transcription

Welcome to our information security legal issues module on import and export regulations. Encryption products are very useful to keep our data secure but, unfortunately, they can also be used for illegal purposes such as terrorist activity. For this reason, some countries ban or limit the importation, exportation, and use of encryption products.

You should never assume that all international laws are the same. For the CISSP examination, you should be familiar with the wassenaar agreement, which allows the transportation of laptops with encryption software for personal use, but this does not apply in all countries. Before traveling, you should check the laws in the country where you will be traveling to or through, to make sure that you are not violating any of their rules.

In 2000, the Security and Freedom Through Encryption Act and the Economic Espionage Act relaxed some of the controls that were put in place on cryptography import and export laws. These new acts include provisions about encryption to allow you to use or sell encryption without concern of key registration and escrow.

Key registration and escrow are typically used to store a copy of the key in case the government decides that there is a reason to access to your encrypted data. These laws also make it so that the police or other government agencies are not allowed to use the fact that you have encrypted your data as probable cause to conduct a search for criminal activity.

These laws do however, provide enhanced penalties if encryption is used while committing a crime. It is very important to be familiar with trans-border data flow, both for your organization and for the CISSP examination. Trans-border data flow is the flow of electronic information through different countries or states and this process could cause legal conflicts.

You should follow the OECD guidelines, or the Organization for Economic Cooperation and Development. Because they provide a good set of guidelines on privacy and trans-border information flow. A common interest between many countries is to protect the privacy and individual liberties of its citizens. In the United States we have intrastate laws which can be implemented by the federal government to govern activity between states.

However individual states are also permitted to enact their own laws. If you have a global organization and you deal with multiple countries you should be aware of trans-border information flow rules and the OECD guidelines. If you have European customers or employees you will most likely be required to comply with the European Union Data Protection Directive which protects personally identifiable information throughout Europe. Safe Harbor permits United States organizations to certify themselves as being able to properly handle private data which belongs to European citizens. Safe Harbor is something that you may see on the CISSP examination. This concludes our information security legal issues module. Thank you for watching.