Any Permission for Foreigners to Use Commercial Cryptographic Equipment?

According to “Measures for the Use of Encryption Products by Overseas Organizations and Individuals within China” (2007), if a foreign would like to use commercial cryptographic equipment (“CCE”) imported from overseas within the territory of mainland China, he shall obtain the Permit for Use of Cryptographic Products Manufactured Overseas; if he would like to buy any CCE produced within the territory of mainland China, he shall obtain the Permit for Use of Cryptographic Products by a Foreign Organization or Individual. In practice, a few foreigners have been warned by the public security authorities for using CCE without permits, and the relevant equipment have been confiscated. So many foreigners pay special attention to the relevant issues.

On Sep. 30, 2017, the State Council has released the “Decision on Canceling a Number of Administrative Licensing Items” (Guo Fa [2017] No.46)”, in which 4 administrative licensing items related to CCE have been canceled. The item concerning foreign organizations or individuals who use cryptographic products or devices containing cryptography is one of the four. Literally, it seems that there is no restriction on the usage of CCE by foreigners.

Later then, on Oct. 11, 2017, the State Cryptography Administration Office of Security Commercial Code Administration (“OSCCA”) released the “Notice on the Smooth Transition in Relevant Administrative Policies after Cancellation of Four Administrative Licensing Items Including the Approval of Manufacturers of Commercial Cryptographic Products” (Guo Mi Ju [2017] No.336), Article 3 provides that foreign individuals who use cryptographic products or devices containing cryptography is no longer subject to the approval of OSCCA, but if the cryptographic products or devices containing cryptography used by a foreign individual needs to be imported, the Import Permit for Cryptographic Products or Devices Containing Cryptography shall still be obtained as legally required. Incidentally, foreign-invested enterprises and overseas organizations must also obtain this permit when they import the cryptographic products or devices containing cryptography, but domestic-invested enterprises don’t have to obtain such permit.

In view of this, if a foreigner comes to China with a CCE, he shall obtain the Import Permit for Cryptographic Products or Devices Containing Cryptography in advance. But if he buys CCE in mainland China or uses CCE which is produced within the territory of mainland China, then such permit is not required.

Therefore, if a foreigner would like to use CCE produced in the territory of mainland China, it is recommended to pay attention to the following issues: (a) although Guo Mi Ju [2017] No.336 has prescribed that a manufacturer or distributor of the CCE are per se no longer subject to the permit of OSCCA, but shall still obtain a Certificate of Commercial Cryptographic Product Types for the CCE manufactured or distributed, as legally required. In view of this, a foreigner shall check whether the CCE that he plans to use has such certificate. (b) According to the “Regulation on Administration of Testing and Sales License of Security Products Exclusively Used for Computer Information System” issued by the Ministry of Public Security, the cryptographic software is a special product for the security of computer information systems, and the sales of this product requires a sales license, which means if a foreigner buys a cryptographic software within the territory of mainland China, he shall check whether such software has the Sales License for the Special Security Products.