do I need French export compliance approval to submit an iOS app that uses encryption? [closed]

Question

My company just (5th July 2011) received the following email from Apple:

Starting in the first week of July, apps that meet the following criteria are required to comply with French Encryption Laws/Regulations if you intend to distribute your app in France.

This requirement applies to apps that use, access, implement, or incorporate:

(a) any encryption algorithm that is yet to be standardized by international standard bodies such as IEEE, IETF, ISO, ITU, ETSI, 3GPP, TIA, etc. or not otherwise published; or

(b) standard (e.g., AES, DES, 3DES, RSA) encryption algorithm(s) instead of or in addition to accessing or using the encryption in iOS and/or Mac OS X

Apple will require you to upload a copy of your approved French declaration when you submit your app to the App Store.

Relevant French encryption regulations can be found at:

http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=LEGITEXT000005789847&dateTexte=#LEGIARTI000006421577

http://www.ssi.gouv.fr/archive/fr/reglementation/regl_crypto.html

http://www.ssi.gouv.fr/site_article195.html

http://www.ssi.gouv.fr/site_article197.html

Regards,

Apple Export Compliance

I've had a hunt around the web, developer forums, etc, and cannot find one single English description of exactly what this means.

In my case (like many other people) I'm only using the standard encryption components provided in iOS - ie. https/SSL, AES, etc, I can't figure out if I need to do anything or not (beyond the USA encryption ERN that I've already completed). I'm worried it is going to delay submitting my next build though.

Does anyone have any further information/links (or speak French)?

Answer 1

I sent an email to the Apple Export Compliance department, and got a reply back:

If your app only uses or accesses encryption provided in iOS, you do not need any further approvals from French authorities.

So it seems for my case (using iOS's build in SSL/HTTPS/AES) I need to do nothing further.

Anyone finding the answer in the future might also want to check out this thread on the Apple dev forums in case any more information gets posted:

https://devforums.apple.com/thread/109830

Answer 2

I've sent an email to Apple Export Compliance department.

My app is only using the built in https/SSL so it would seem likely that it does not need any authorization as the email states "instead of or in addition to accessing or using the encryption in iOS" but better wait for Apple's response.

If it turns out an authorization is needed I will simply pull my app from the French AppStore until proper authorization is obtained and on the next app update in AppStore I'm going to sign a declaration that states that my app will not be sold in France.

You could do the same, if you need authorization simply remove the app from France AppStore until you get it.