Encryption notification (Russia and the EAEU)

The encryption notification Russia's Federal Security Service (FSB) registers is the light route for bringing goods with cryptography into the Eurasian Economic Union. Its legal basis is EEC Board Decision No. 30 of 21 April 2015 on measures for non-tariff regulation, which keeps the unified list of goods that need an authorisation document at the border. A registered notification is published in the EEC's common registry of notifications on the characteristics of encryption (cryptographic) means, and goods on that registry clear customs in any member state without a licence. Cryptography the notification does not cover takes an FSB expert conclusion and a Minpromtorg import licence, valid in Russia only and issued per consignment.

Which products need an encryption notification?

Almost every connected consumer product does. The unified list of goods subject to non-tariff regulation measures in trade with third countries, published on the Union's website under Decision No. 30, includes encryption (cryptographic) means and the goods that contain them, and the test is cryptographic function; what the product is sold as does not matter. A wireless speaker running WPA2, a thermostat pairing over Bluetooth, a camera with an HTTPS client to a cloud service: each one contains cryptographic functionality for this purpose.

The notification route is open where the cryptography is the mass-market kind: standard published algorithms at ordinary key lengths, doing something ancillary to what the product is for. Wi-Fi, Bluetooth and TLS in a consumer device are exactly that case. A product whose purpose is the cryptography itself, a VPN gateway or a hardware security module, sits outside the notification categories and takes the licence route described further down.

The mistake we see first is a scoping one. The compliance file says "no security product", the firmware says otherwise, and the question is settled by the cryptographic specification: which algorithms, which key lengths, which protocols, in which module. We ask the firmware engineers for that list before anything else, because the answer decides whether the project is one notification or a per-consignment licence with an expert conclusion behind it.

How is an FSB notification registered, and where does it work?

An FSB notification (encryption notification, in the EEC's wording) is a registration, filed once for a product and its manufacturer, and it is checked against a public register. In Russia the authorised body is the FSB. A registered notification is entered in the common registry of notifications on characteristics of encryption (cryptographic) means and goods containing them, which the EEC publishes, and the EEC's own trade guidance lists that registry among the grounds for importing goods without presenting a licence or conclusion.

The document names the manufacturer, the product and its cryptographic characteristics, and it is filed by the manufacturer or by a person the manufacturer authorises. It is valid in all EAEU member states, so one registration supports imports into Russia, Kazakhstan, Belarus, Armenia and Kyrgyzstan by any importer. Customs checks the product against the register at the border; a licence or conclusion is not presented for goods on it.

Because the register is public and the entry belongs to the manufacturer, keep the filing under the manufacturer's name. A distributor that files on its own reading of the firmware ends up holding the only entry customs will match against, and the manufacturer's next importer starts from nothing. Where the manufacturer has nobody to sign, we draft the notification and file it as the authorised person, in the manufacturer's name.

What if the product falls outside the notification categories?

Then the route is the import licence for encryption goods: an FSB expert conclusion on the product first, and on the strength of it a one-off licence for a named consignment, or a general licence, from the Ministry of Industry and Trade (Minpromtorg). Both are Russian documents. The licence is valid in Russia only and is issued per consignment, so a shipment to Kazakhstan or Belarus needs its own national permission.

The licence uses the unified form the EEC set for all member states in Board Decision No. 199 of 6 November 2014, and the EEC guidance is explicit that for these goods the authorisation document is presented to customs on arrival. The expert conclusion is where the time goes. The FSB examines the cryptographic implementation, and the file has to describe it at a level a compliance department rarely holds without the firmware team in the room.

The decision this forces is whether to ship the product in that configuration at all. Where the feature that pushes a product out of the notification categories matters to few buyers, a firmware variant for the Union that drops it turns a per-consignment licence into a single notification. Have that conversation with engineering before the first purchase order; the licence route is the longest of the Russian clearances.

Is the notification separate from EAC, FAC and the RFC conclusion?

Yes, and none of the others stands in for it. The EAC declaration or certificate covers electrical safety and electromagnetic compatibility under the technical regulations. The FAC document covers attachment to the public communications network, and the RFC conclusion lets radio equipment through Russian customs. Those two are Russian permissions. The notification of encryption (cryptographic) means is the only one of the set that is valid across the Union.

They run in parallel, which is the reason to start them together. The same module datasheet feeds the radio parameters for the RFC conclusion and the algorithm list for the notification, and a file assembled once serves three applications.

Product changes are where a clean record breaks. The notification describes one product with one cryptographic implementation. A cost-down revision that swaps the Wi-Fi module, or a firmware release that adds a protocol, is a different product for this purpose, and the register entry stops matching what is in the container. Check the entry against the bill of materials before each new revision ships. It takes an hour, and it is the check customs will make.

Notification route against licence route

The two routes are decided by the cryptographic specification of the product, so the same product line can carry one model on a notification and a variant on a licence.