FRENCH INTELLIGENCE-RELATED LEGAL DOCUMENTS


PRIME MINISTER

DELEGATION INTERMINISTERIELLE
FOR THE SAFETY OF SYSTEMS Of INFORMATION

3, Octave Avenue Greard 75007 Paris

NOTICE OF PRESENTATION

THE FRENCH REGULATION ON THE CRYPTOLOGIE

VERY IMPORTANT
This notice is edited by the Delegation Interministerielle for the Securite of Systemes of Information (DISSI) for the information of the nobodies concernees; it would know to substitute has the reglementation it meme.


preliminary editing of 15 May 1993

REGULATION ON THE CRYPTOLOGIE

SUMMARY

1. Introduction
2. Texts of reference
3. Definition of means of cryptologie and benefits of cryptologie
4. Essential Caracteristiques of the reglementation on the cryptologie
5. Constitution and depots of folders
6. Declaration of supply, export or usage
7. Authorization of supply, export or usage
8. Particular layouts 9. Transient Regime
ANNEX

1. Introduction

Texts, for most recemment publish to the log Official, institute, concerning the making, the trade and the means and benefit usage of cryptologie, a news reglementation in replacement of that that has been appliquee until has now.

The present opuscule plans:
  • to give the reference of official texts desormais in vigor;
  • to attract the attention on some aspects of the news procedure that appear particulierement important in practice.

    It goes from self that it not to would know substitute to official texts.

    2. Texts of reference

    This are:

    a) the law 90-1170 of 29 decembre 1990 (official log of 30 decembre 1990), notably its item 28, modifiee by the law 91-648 11 July 1991 (Official log of 13 July 1991);

    b) the decret 92-1358 of 28 decembre 1992 taken in application of the laws precedentes (Official Log of 30 decembre 1992, pages 17914 has 17916);

    c) the arrete of 28 decembre concerning the declarations and demands relative authorization to means and benefits of cryptologie (Official Log of 30 decembre 1992, pages 17916 and 17917, Official Log of 9 January 1993, pages 507 and 508);

    d) the arrete of 28 decembre 1992 definissant layouts particulars to which are somises benefits of cryptologie (Official Log of 30 decembre 1992, page 17917);

    e) for the export, the recommendation to importers and with exporters relative to products and submissive technologies to the controle of the final destination (Official Log, editing of documents administrative, n 9 of 24 January 1992) amends by the text publishes has the page 18043 of the Official Log of 30 decembre 1992

    and by the arrete of 15 fevrier 1993 affixing the modalites establishment of the demand of export license of means cryptologie and usage of this license (Log Official of 24 fevrier 1993, page 2947).

    3. definition of means of cryptologie and benefits of cryptologie

    Before to evoke some aspects the news reglementation, it is not able be useless to recall some what consist means cryptologie and benefits of cryptologie to which it applies.

    The definition of benefits of cryptologie figure has the item 28 of the law 90-1170 of 29 decembre 1990 precitee:

    " One hears by benefits of cryptologie all benefits aiming has transformed has the secret convention help information or clear tones in information or unintelligible tones for the third, or has realiser the operation opposite, grace has means, materiels or software concus has this effect " -.

    Means of cryptologie are definis by the reference that their is made have the end of this definition: this are the materiels or the software that can be used to provide these benefits.

    In this definition, two concepts appear clearly: that transformation and that secret convention.

    4. Essential Caracteristiques of the reglementation on the cryptologie

    Among the caracteristiques of the reglementation on the cryptologie, those that one can alert as being essential are:

    notions of benefit of cryptologie and secret members;

    the two implementation regimes discrete, the regime of declaration and regime of authorization;

    the existence of regimes simplify;

    the simplification of the demarches liee has the existence of a figure reduit of speakers representant the Administration.

    4.1 Notions of benefit of cryptologie and secret members

    The notion of benefit of cryptologie is definie to the first alinea of the paragraph I of the item 28 of the law 90-1170 modifiee. The notion of secret members apparait in the arrete 28 decembre 1992 (paragraph 2,d). Benefits of cryptologie submit has authorization make the object of layouts stated in the last alinea of the item 4 of the decret n 92-1358 of 28 decembre 1992 and in the arrete of 28 decembre 1992 (paragraph 2,d). Secret members use in the frame of benefits of cryptologie make equally the object of particular layouts stated in the arrete precite.

    4.2 Regime of declaration and regime of authorization

    In its paragraph I, the item 28 of the law 90-1170 of 29 decembre 1990 establishes a distinction between means and submissive benefits has declaration and means and benefits submissive has authorization.

    " -... the supply, the export or the usage of means or benefits of cryptologie are submitted:

    a) had declaration prealable when this means or this benefit can not have other object that authenfifier a communication or to ascertain the integrite of the message transmitted;

    b) has authorization prealable the prime minister in the other cases. "
    This distinction is developpee and explicit in the item 2 has 7 the arrete of application of 28 decembre 1992 paragraph 2, c) of the present document. In case of doubt, the SCSSI will be able to be consulted (to see its address the paragraph 4.4).

    4.3 Regime simplify

    For the declaration as for the authorization, the item 28 the law 90-1170 of 29 decembre 1990 mentions, to the last alinea of its paragraph I, that " this decret (1) can prevoir a regime simplifies declaration or authorization for some types of materiel or for some categories of users. " The decret 92-1358 of 28 decembre 1992 prevoit effectively of the regimes simplify for some declarations of usage and for some demands of authorization usage (cf. paragraph 6.2 and 7.2 of the present document).

    That will allow, in the majorite of cases, decharger the user it meme of all formalite, the demarches having been prealablement effectuees by the supplier.

    (1) It concerns the decret of application of the law

    4.4 Housekeepings concern the Administration

    Organisms to which it invite desormais to address are:

    for the supply or the usage:
             The Central housekeeping of the Securite of the systemes of Information  
             (SCSSI),  
             18, street of the Doctor Zamenhof  
             92131 Issy-les-moulineau Cedex  
             Telephone: (1) 40 95 37 15 Telecopie: (1) 40 95 37 01 

    for the export:

            The SCSSI, for the declaration and the demand of authorization, and  
             The Financial and Commercial Authorization housekeeping  
             (SAFICO),  
             42, STREET OF CLICHY 75436 PARIS CEDEX 09  
             Telephone: (1) 42 81 91 44 Telecopie: (1) 40 23 06 51,  
    for the demand of export license. In the case of a demand of authorization, the decision of the Administration is notifiee to the caller by the SCSSI.

    5. Constitution and depot of folders

    That it concerns declaration (item 1 has 3 the decret 92-1358 28 decembre 1992) or demand of authorization (items 4 has 9), the folder is depose to the SCSSI, that in delivre recepisse.

    This depot can be acted:

    is by clean hand-held remittance to the SCSSI (hours of aperture: Monday to Thursday of 9h has 12h and 14h had 17h, Friday of 9h has 12h and 14h has 16h);

    is by way postal, recommandee of preference.

    Texts quote to the first alinea, complete by the item 1st of the arrete of application (paragraph 2, c), precisant the constitution of folders. The recepisse delivre by the SCSSI certifies the remittance of the folder, but not of its conformite with the reglementation: the scssi can demand information complementaires during all the procedure.

    A folder of declaration or demand of authorization comprises an administrative part and a technical part that are one and the other has provided in four copies.

    The technical part has to flag objectives of seecurite and decrire in detail functions and the mecanismes of securite.

    The administrative part allows, among others functions, to ascertain the identite of the declarant or the caller. to establish it, the former has to fill prints a true to models it annex has the arrete application (paragraph 2, c) and duplicated in annex in the present document. prints this is used for a declaration as well as for a demand of authorization; one can to obtain it for the SCSSI.

    The declarant or the caller is fitted to provide to the scssi, has the demand of the former, members allowing verifier that the means or the benefit of cryptologie is well true to the technical folder provided. the nature of these members is precisee had the item 14 of the decret 92-1358 of 28 decembre 1992, complete by the arrete of application (paragraph 2, c).

    6. declaration of founiture, export or usage

    (heading Ier of the decret 92-1358)

    6.1 declaration of supply or usage. regime general

    the item 2 of the decret stipulates, in its 1st alinea:

    " the declaration of supply ...est effectuee an once for a means or a benefit of cryptologie gives, meme if this means or this benefit has several suppliers or makes the object several deliveries. it is subscribed a month to the less before the first delivery, that it is has free heading or onereux. "

    that means for example that, when the maker of a means has procede had a declaration of supply, its retailers have not has made it.

    the delai of a month applies also has the declaration usage, the deuxieme alinea of the meme item having that:

    " the declaration of usage is effectuee by the user of the means or the benefit a month to the less before all usage... "

    6.2 declaration d ' usage. regime simplifies

    the item first of the decret, in its alinea 3, institutes a regime simplifies declaration of usage: " the declaration of supply can be accompagnee a declaration of usage generale, that precise the domain of usage prevu of the means or the benefit as well as the possible categories of users to which the means or the benefit is destined. " these information are precisees by the declarant by filling the part c of prints it.

    persons desirant to use the means or the benefit having makes the object of a such declaration of usage generale are dispensees of deposer a declaration of usage. the deuxieme alinea the item 2 stipulates indeed that: " -... this declaration (the declaration of usage) is subscribed only for means or the benefits that have not made the object of a declaration of usage generale to the heading of a declaration of supply anterieure. "

    6.3 declaration of export (item 3 of the decret 92-1358 of 28 decembre 1992)

    the declaration of export gives place to the depot prealable to the SCSSI of a folder of declaration of supply in view of the export following the modalites deja evoked, a month to the less before the first export. a copy of the recepisse of this declaration has to be presentee had the admnistration of customs during each export.

    7. authorization of supply, export or usage

    (ii heading of the decret 92-1358 of 28 decembre 1992)

    7.1 demand of supply authorization

    The formalites of depot of demands of authorization of supply are regies by the item 4 of the decret. the duree in order that the authorization is demandee can not exceder five years. That concerns means as well as benefits.

    7.2 demand of usage authorization

    The item 5 of the decret distinguishes two demand types: the demand of usage authorization own, formulee by the user;

    the demand of usage authorization generale, formulee by the holder of the authorization of supply (regime simplifies).

    the authorization generale represente a regime simplifies authorization mentions to the last alinea of the paragraph i of the item 28 of the law amends 29 decembre 1990. the existence an authorization of usage generale dispenses futures users of the depot of a demand of usage authorization, under reserve that they satisfy to the possible conditions of the authorization of usage generale (to see alinea 7.3).

    the formalites of depot of demands of authorization usage are regies by the item 6. the duree in order that the authorization is demandee can not exceder ten years.

    7.3 Delivrance of the supply or usage authorization

    The item 7 mention fact of some conditions whose can be matched the supply or usage authorization. They have for object of reserver the employment of some means or some benefits has the categories determinees of users or applications.

    One can quote for example:

    means of cryptologie use solely for the radiotelephone;

    products has exclusively banking usage (allocators automatic of bank notes).

    7.4 Demand of export authorization (item 9 of the decret)

    The folder of demand understands, in more of parts administrative and technique deposees aupres of the SCSSI (an once for a means or a benefit donnee), a demand of license export deposee (for each export) aupres of the administration of Customs (SAFICO), that the delivre pungent agreement the prime minister.

    8. Particular layouts

    They concern:
  • boards has microprocessor;
  • some means of software protection;
  • the temporary export.

    8.1 Boards has microprocessor (item 6 the arrete quotes to the paragraph 2, c)

    " boards has microprocessor that do not allow by they memes, it is told without resorting has a device cryptologique external, to ascertain the confidentialite of communications beneficient the declarations effectuees or authorizations obtained to the heading of the means and benefits in which they are utilisees " -.

    8.2 Middle of protection of software (item 7 of the arrete quotes to the paragraph 2, c)

    " are not consideres as average cryptologie the means, materiels or software, specialement concus to ascertain the protection of software against the copy or the usage illicit, meme if they make call has the methodes or devices fitted secrets, has condition that they do not allow to encrypt is directly, is indirectly, the software concerns " -.

    8.3 Temporary export (item 13 of the decret)

    For the temporary means export of cryptologie submitted to the regime declaratif, this item institutes two derogations to the layouts prevues by the item 3 of the decret (cf. paragraph 6.3 the present document):

    the declaration of usage holds place declaration

    temporary export in the case of a means of cryptologie detenu by a particular for its exclusive usage;

    the declaration of supply of a means of cryptologie is

    equally consideree as a declaration of temporary export a sample of this means.

    The meme item 13 precise also that the authorization usage of a means of cryptologie detenu by a particular for its exclusive usage can mention that it costs equally temporary export authorization and that it dispenses the formalites prescribed by the item 9 of the decret (cf. paragra[he 7.4 the present document).

    9. Regime transistoire

    The law prevoit that authorizations anterieurement delivrees reside valid with their duree.Cela concerns all the authorizations, including AEMG. .