Can a product that uses BouncyCastle be exported from the UK

Question

We are doing work for a company, based in the UK, who are planning on developing an application that uses the BouncyCastle.Crypto.dll. They intend to make their product (including the crypto dll) available for download over the Internet. Are there UK restrictions on the export of crypto software that would prevent them from doing this? From Wikipedia, I understand it's okay to export it from the US, but not sure about the UK.

EDIT: To be clear, their product itself wouldn't provide any crypto. All the crypto functionality would be within the BouncyCastle DLL only, which is already widely available for download on the internet. Not sure if there are any BouncyCastle library mirror download sites in the UK?

EDIT 2 Thanks for the feedback so far. The most useful responses pointed us to the relevant UK government websites. We're going to give the The Export Control Organisation (ECO) a call as they have a dedicated helpline for the UK strategic export control lists.

EDIT 3 We were told by a nice lady at the BIS that the company need to apply online for an export licence using the SPIRE system.

From the website:

SPIRE is the Export Control Organisation's fully electronic system for processing strategic export and trade licence applications. It is the main system exporters need to use to apply or register for an export licence for military or Dual-Use products.

Also:

SPIRE allows you to:

• apply for licences online
• complete an application form over a number of sessions, as required
• access previous applications and information, using this in new application forms
• automatically validate your application as part of the process
• track how your application is progressing at every stage

A copy of the electronic licence will also be held by HM Revenue & Customs.

Thanks again for the helpful feedback that put us on the right track.

Answer 1

Using wikipedia as a substitute for a solicitor is bad news. Get a solicitor.

If you state where you are exporting to, that seems as relevant as where the software is coming from.

Then again, using stackoverflow as a replacement for a solicitor is bad news. Ignore what I just said.

Answer 2

I'm pretty sure your first port of call should be HM Customs & Excise's helpline - they should at least be able to put you on the right track. (0845 numbers work from abroad as well but may be more expensive than normal land lines.)

Answer 3

It depends on exactly what your application is doing with crypto, to what extent that functionality is exposed to the user (or is hidden behind the covers), and what algorithm and strength. It is impossible to answer this question properly without going into full detail.

It always used to be the DTI who oversaw export control, but they are now called Department for Business, Innovation and Skills. Where crypto is covered, it is in the category of "dual use" technology.

As others have said, don't rely on legal advice from random people on the internet when it comes to questions of potentially significant liability like this. We could all be wrong, and your customer (and perhaps you) would be left carrying the can.

Answer 4

Your first port of call should be the Crypto Law Survey's UK entry. After that, they should consult their company lawyers.