HP Global Trade

shoulderslyricalAI and Robotics

Nov 21, 2013 (3 years and 11 months ago)

119 views


EL
-
MF880
-
01



11
-
Mar
-
2013





Page
1




HP Global Trade


Classification Compliance Supplier’s Declaration

3
rd

Party Products


Export Classification Data Collection Form

**** To be completed by the Manufacturer/Supplier of the 3
rd

Party Product ****


Owner

Fred Mailman

Responsible Group

Glo
bal Trade

Document Identifier

EL
-
MF880
-
01

Revision and Date

B
,
11
-
Mar
-
2013


Abstract

This questionnaire provides information about third
-
party products
that HP intends to export. This information assists HP’s Global Trade
Classification team to determin
e the proper export classification.

Applicability

This questionnaire is applicable to third
-
party manufacturers or
vendors who provide products to HP that HP intends to export.

Status

Approved


© Copyright 2013

Hewlett
-
Packard Development Company, L.P.


This is an uncontrolled copy when in printed form.



1.1

Introduction

The following is a list of questions/requests will help HP collect the needed classification
information for 3rd party products that HP intends to export. Please obtain the following
inform
ation from the 3rd party manufacturer or vendor in order to assist our HP Global Trade
Classification team in determining the proper export classification for each product:


Product Questions

Please respond to the following set of questions for each produc
t. These questions will help to
collect the needed classification information. If the product data is available in an electronic file
please provide a copy or allow access.


Date:

Name of Product:

HP Product Number:

Manufacturer/Vendor Product Number:

HP
Contact Name & Phone Number:


EL
-
MF880
-
01



11
-
Mar
-
2013





Page
2

Manufacturer Contact Name & Phone Number:

Name and Phone Number of person completing this form:


0. Export Commodity Classification Numbers /Control List numbers (ECCN)

Please confirm with your Export compliance department
if the product is subject to U.S. and/or
other national government export regulations (dual use, military etc.) and insert all control list
numbers applicable for the product:

U.S. ECCN:


[ ]

EU (European Union) ECCN:

[ ]

National

country______

ECCN:

[ ]


1.

Please provide technical specs or a product data sheet or a technical description that
provides a functional overview of the product.


2.

What is the overall design function and characteristics of the produc
t?


3.

Specify the related system software and/or hardware this product will interoperate or
interface with.


4.

If this product is a module or subcomponent of a higher product, identify this product and
provide the main product number if available.


5.

If software
, is this software available as freeware?

___Yes ___No


6.

Does this product use cryptography to provide for password protection, authentication,
access control or digital signature of the user?

___Yes ___No


7.

Does this product contain encryption/decryptio
n for any data privacy purposes, such as for
information security over virtual private network or public networks, or for data storage, etc.?

___Yes ___No


8.

Does this product contain a cryptographic application program interface (i.e. APIs specially
desi
gned to allow the plug
-
in or implementation of specific crypto capabilities)?


___Yes ___No


9.

If software, what type of media is the software loaded on?


___CD/DCD ___ Tape ___ Floppy Disk ___ Electronic Download


____other please explain:


EL
-
MF880
-
01



11
-
Mar
-
2013





Page
3


10.

Please provide the
Harmonized Tariff Schedule Number (HTS) used by the manufacturer of
the product.


11.

Please provide the Adjusted Peak Performance (APP) for computer based products.


12.

If this product is a 'graphics accelerator' or 'graphics coprocessor', c
lassified under ECCN
4A994.g, then

please provide the 3D vector rate for the product.


13.

Please provide the US export commodity classification number (ECCN) used by the
manufacturer for the product.


14.

Was this product self
-
classified or was an official expor
t classification decision obtained from
the US Dept of Commerce?


15.

If an official export classification decision was obtained from the US Dept of Commerce,
please provide a copy of the classification decision documents, or provide the case review
(CCATS) n
umber and the results of the review including any ‘Comments from Licensing
Officer’ stated on the CCATS document and associated with this product.


16.

Does the product fall under the U.S. Government International Traffic in Arms Regulations
(ITAR), or any oth
er local government regulations which uniquely control the product for
military or encryption reasons?

If
YES
, please provide the regulatory citation:


17.

Is this product specially designed or intended primarily for military, defense or government
use? If ‘
yes’ please explain.


18.

If this product has been classified for export in any country other than the US please identify
the country, provide the classification, explain the justification/basis for the classification and
provide references to any government i
ssued documents supporting the classification.



19.

If the product is not designed or manufactured in the US then please identify the country
where designed and/or manufactured, and explain what local country export requirements,
export control or export cl
assification applies to this product.


20.

Is this product
specially designed and limited for banking use, financial transaction use or for
money transaction use?


If response was positive for questions 6, 7 or 8 then please answer the remaining
questions in

order to provide further details regarding the use of cryptography in the
product:



EL
-
MF880
-
01



11
-
Mar
-
2013





Page
4

21.

Please indicate if this product uses cryptography functionality (i.e., incorporates or uses
encryption or decryption code, techniques or a cryptography application progr
amming
interface) for any purpose, including but not limited to access control, user/data
authentication, message/data privacy, data storage security, network communications
security or general purpose use?

If yes please identify all uses of crypto:


22.

Pleas
e describe in detail the type of data that is encrypted

for example general purpose user
data/files, general user communications, limited financial data, data limited to systems
and/or network management (
Operations, Administration, Maintenance and Provisi
oning):


23.

Please provide the following technical details regarding the implementation of cryptography
in the product:





the type of algorithm(s)



where the crypto was sourced from,



key lengths,



method of key management including key size,



identify crypto f
unctions/parameters exposed to applications,



purpose or use of the crypto,



identify if the product contains any cryptographic application programming interfaces
(i.e., APIs specially designed to allow the plug
-
in or implementation of specific crypto
capabi
lity(ies))


24.

If the product contains cryptography please indicate if a one
-
time
cryptography product
review and French import approval was requested from the French ANSSI (formerly referred
to as DCSSI) agency and provide the results of the review.

If this

product is exempted from the one
-
time cryptography product review in France please
explain the basis for the exempt status.


25.

Does this product provide: secure Wide Area Network (WAN),

Metropolitan Area Network (MAN), Virtual Private Network (VPN)?

If YES
, please answer the following 4 questions:


a)


Is the aggregate encrypted WAN, MAN, VPN or backhaul throughput (includes
communications through wireless network elements such as gateways, mobile switches,
controllers, etc.) greater than 90 Mbps?


b)


Does the wire (line), cable or fiber optic WAN, MAN or VPN single channel input data
rate exceed 154 Mbps?

c)


Does the media (voice/video/data) encryption or centralized

key management support
more than 250 concurrent encrypted data channels, or suppor
t encrypted signaling to more
than

1,000 endpoints, for digital packet telephony/media (voice/video/data) over internet protocol
communications?


EL
-
MF880
-
01



11
-
Mar
-
2013





Page
5

d)


Does the air interface coverage (e.g., through base stations, access points to mesh
networks, bridges, e
tc.) exceed 1,000 meters, where any of the following applies?



i.


Maximum data rates exceed 10 Mbps (at operating ranges


beyond 1,000 meters); or



ii.


Maximum number of concurrent full duplex voice



channels exceed 30; or





iii.

Substantial support is required for installation


or use

26. Is this product generally available to the public by being sold or freely distributed, without
restriction, from stock at retail selling
points such as through over
-
the
-
counter, mail order,

electronic or telephone transactions? If yes, please explain.

27. Can the cryptography
functionality in the product be easily changed by the user?


28. Is the product designed for installation by the use
r without further substantial support by the
supplier?

29. Import to Russia: Pl
ease indicate if a technical product import review has been done by the
FSB or by a Russian technical laboratory and if a Russian import license has been obtained
from the Mini
stry of Industry and Technology (MIT) or if an import notification request has been
filed with the FSB, and provide the results of any reviews, import license or notification
requests?

30. Import to China: If the
product contains cryptography please indi
cate if any China import
license request has been filed with the Chinese government and provide the results of any
China government reviews or import license request?


31. Is this is an open source code product which contains cryptography

and no formal ex
port
classification decision was obtained from the US

govt (see questions 14 and 15 above)?

If YES, then please:

-

identify the URL where the source code can be obtained without cost,


and

-

confirm if written notification of the internet posting ha
s been sent

to the US Department of
Commerce
, Bureau of Industry and

Security in accordance with US exports

regulations.




ADDITIONAL EVALUATION QUESTIONS TO DETERMINE IF PRODUCT IS SUBJECT TO
US GOVT CRYPTOGRAPHY REVIEW



EL
-
MF880
-
01



11
-
Mar
-
2013





Page
6

1.

Does the product provide penet
ration capabilities that are capable of attacking, denying,
disrupting or otherwise impairing the use of cyber infrastructure or networks?


2.

Does the product provide or perform vulnerability analysis, network forensics, or
computer forensics functions c
haracterized by any of the following?:




(A) Automated network analysis,

visualization, or packet inspection for profiling

network flow, network user or client behavior, or

network structure/topology and adapting
in

real
-
time to the operating envi
ronment; or




(B) Investigation of data leakage, network

breaches, and other malicious intrusion
activities

through triage of captured digital forensic data for

law enforcement purposes or in a
similarly

rigorous evidentiary manner.


3.

Does the prod
uct provide or perform

"non
-
standard cryptography" as defined below?




Definition of Non
-
standard cryptography:

Non
-
standard cryptography
. Means any

Implementation

of "cryptography" involving the

Incorporation

or use of proprietary or unpublished

Cryptogr
aphic

functionality, including encryption

Algorithms

or protocols that have not been

Adopted

or approved by a duly recognized

International

standards body (e.g., IEEE, IETF,

ISO, ITU, ETSI, 3GPP, TIA, and GSMA) and

have not otherwise been published.


4.

Reser
ved.


5.

Does the product include encryption source code? If yes please identify the source code
and confirm if the source code is open source or proprietary?


6.

Does the product have any of the following:





-

Been designed, modified, adapted o
r customized for "government end
-
user(s)";




-


Cryptographic functionality that has

been modified or customized to customer

specification; or



EL
-
MF880
-
01



11
-
Mar
-
2013





Page
7

-

Cryptographic functionality or

"encryption component" that is user
-
accessible and can
be easily

changed by the user;


-

Encryption commodities and software

that provide functions necessary for quantum
cryptography;


-

Encryption commodities and software

that have been modified or customized for
computers classified under ECCN 4A003 (high performance comp
uters);



-

Public safety / first responder radio (
e.g. Implementing

Terrestrial Trunked Radio

(TETRA) and/or Association of Public
-
Safety

Communications Officials International
(APCO)

Project 25 (P25) standards);


-

Cryptanalytic functionality

-

"Open cryptogra
phic interface"


7.

Can the product be characterized as chips, chipsets
, electronic

assemblies or a field
programmable logic device?


8.

Can the product be described as cryptographic libraries, modules,

development kits or
toolkits, including for operating syst
ems and cryptographic service providers (CSPs)?


9.


Can the product be described as an application
-
specific hardware or software
development kit implementing cryptography?


End of Questionnaire


Please send the completed form with requested information to
fred.mailman@hp.com


Revision History:


Revision,

Date,

Change
Number

Brief Description of change

A,

10
-
Jan
-
2007

Initial release of reformatted questionnaire dated 31
-
May
-
2006.

B , 11
-
Mar
-
2013
,
DCN
-
03163

Revised
document