Open-source status alone does not decide whether U.S. export controls apply. In its 15 July 2021 update, The Linux Foundation described a change affecting publicly available encryption software: email notifications for software classified under ECCN 5D002 were required only when the software implemented “non-standard cryptography.” The Foundation also explained that public availability without restrictions on further dissemination is the relevant “published” condition in its account of the Export Administration Regulations (EAR). That is a dated industry explanation, not a complete statement of current U.S. law or legal advice.
What The Linux Foundation’s 15 July 2021 update changed
The Linux Foundation said its principal change was to reflect an amendment to the EAR’s treatment of publicly available encryption software. Before the change described in the update, email notifications were required for public encryption software classified under ECCN 5D002 whether its cryptography was standardized or not.
Under the Foundation’s 2021 account, the notification requirement narrowed to software implementing non-standard cryptography:
“Following the change, email notifications are only required for software that implements ‘non-standard cryptography.’”
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
This statement describes the Foundation’s interpretation of the rule at that time. It should not be read as a current, self-executing determination for every project, product, destination, or transaction.
The update matters because a globally distributed project can make source code, binaries, specifications, or design files available across borders. That availability can constitute an export for EAR purposes, but the legal analysis turns on the item, its publication status, its encryption features, and the way it is distributed—not simply on whether the project calls itself open source.
Why “open source” is not the operative test
The Foundation’s expanded guidance begins with the EAR’s scope. It notes that exports can include making software electronically available to people outside the United States and certain releases of technology within the United States. It then explains the published-material treatment in terms of access and dissemination:
“For the purposes of compliance with the EAR, if the open source technology is publicly available without restrictions upon its further dissemination, then it is ‘published’ and therefore ‘not subject to’ the EAR.”
Recommended: Update Every Outdated Driver on Your PC in One Scan - Free →Recommended: PC Feels Slow? A Free Scan Shows What's Dragging Windows Down →Recommended: Crashes or Glitches? A Free Driver Scan Usually Finds the Culprit →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
This is The Linux Foundation’s description of the EAR, not text from a regulator or a court. A project should verify the current primary rules before relying on the conclusion.
| Material or practice | How the Foundation describes it | Question a project still has to answer |
|---|---|---|
| Public source code | May be “published” when available without restrictions on further dissemination. | Are access, licensing, authentication, or other controls actually restricting further dissemination? |
| Public specifications | Listed as an example of publicly available technology that may receive the published treatment. | Does the specific release contain restricted technical information or fall within a current exception? |
| Public hardware design files | Included among typical publicly available materials. | Was every relevant file released publicly, or are some design materials private? |
| Public binaries | May be published when the dissemination condition is met. | Does encryption or another classification create additional analysis or notice obligations? |
| Private or restricted exchanges | May not satisfy the public-availability condition the Foundation describes. | Were technical decisions, releases, or discussions confined to a private group? |
Consequently, a permissive license is not by itself the whole analysis. The relevant practical question is whether the material was made publicly available without restrictions on further dissemination, and whether another rule—especially one concerning encryption—requires separate action.
How encryption changes the analysis
The 2021 update focuses on encryption classified under ECCN 5D002. The Foundation’s expanded guidance states that, as of 2021, a project using standard cryptography had no additional requirements or analysis under the provision it discussed:
“As of 2021, if an open source project uses standard cryptography, there are no additional requirements or analysis required.”
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Its treatment of non-standard cryptography is different.
| Cryptography situation | Foundation’s 2021 description | Practical implication |
|---|---|---|
| Standard cryptography | No additional requirements or analysis under the described provision, as of 2021. | Document why the implementation is considered standard and confirm that no other current rule changes the result. |
| Non-standard cryptography in software classified under ECCN 5D002 | Email notification may still be required under the changed treatment. | Determine whether the project must notify, deliver the notice through the applicable channel, and retain proof. |
| Encryption distributed in object-code form | The Foundation recommends keeping the corresponding source code publicly available. | Check that the source release is genuinely public and not limited to a private or controlled group. |
The Foundation recommends making delivered notices publicly available where appropriate, identifying a responsible legal entity and contact when applicable, and retaining evidence that the notice was delivered. It also mentions source-code scanning tools but cautions that automated scanning is not a perfect detector of cryptography. Human review and technical documentation remain necessary.
Rank #3
- Used Book in Good Condition
A practical project workflow based on the guidance
-
Map every form of release
List source repositories, package registries, downloadable binaries, specifications, hardware design files, documentation, and technical discussions. Record which items are public, which require authentication, and which remain private.
-
Check the dissemination condition
For each public item, ask whether people can obtain and further disseminate it without restrictions. Review repository permissions, access gates, distribution terms, and private channels rather than relying only on an “open source” label.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Characterize the cryptography
Identify cryptographic algorithms, protocols, libraries, and implementation changes. Determine whether the software uses standard or non-standard cryptography and whether ECCN 5D002 is implicated. The Foundation’s account does not supply a classification for a particular project.
-
Handle any applicable notice
If the project’s circumstances fall within the non-standard-cryptography notification treatment described in the 2021 update, send the required email notification through the applicable process. Publish or otherwise make the delivered notice available as the Foundation recommends, and preserve delivery evidence.
-
Keep source available with object-code releases
When distributing encryption software in object-code form, maintain a public source-code release consistent with the project’s publication terms. Check that the source is complete enough to correspond to the distributed software.
-
Document decisions and technical evidence
Keep records of classification reasoning, cryptographic design choices, notices, release dates, and repository settings. Public technical conversations and outcomes can help demonstrate how the project made its decisions; private exchanges may not establish public availability.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Review security-disclosure timing
For vulnerability discussions, the Foundation suggests considering public disclosure after a fix is available rather than keeping information permanently confined to a confidential list. Coordinate disclosure with security and compliance responsibilities.
-
Reassess each downstream distribution
Do not assume that the project’s own public release answers the compliance position of a company or person that modifies the code, combines it with other technology, or ships a derived product.
Where the project’s public release stops answering the question
Modified code distributed by someone else
The Foundation says its explanation concerns the open-source project itself. A downstream redistributor that changes the code must evaluate its own release, access conditions, and encryption features. The upstream project’s public source does not automatically establish that the modified version is published.
Derived products with non-public source
A product built from an open-source project may contain additional code, technical information, or encryption that is not publicly available. If the source for the resulting product is withheld or distribution is restricted, the downstream party needs a separate EAR analysis.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsBest Value
Special categories mentioned by the Foundation
The expanded guidance also flags a 2020 addition concerning certain neural-network-driven geospatial-analysis training and says publicly available software in that category may receive the published treatment. The source does not provide a complete current test for that category, so projects should not extend the statement beyond the applicable primary rules.
EAR export controls and OFAC sanctions are separate questions
The 2021 update addresses the EAR. It does not resolve U.S. sanctions administered by the Office of Foreign Assets Control (OFAC).
In a 29 January 2025 discussion, The Linux Foundation warned that sanctions may apply to transactions and interactions even when software or technology is publicly available. It also said that the application of sanctions to open-source and standards activity is not fully defined. Public availability under the Foundation’s EAR explanation therefore does not automatically permit every interaction with every person, organization, territory, or listed party.
A project may need two distinct reviews: one for EAR classification, publication, and export-related requirements, and another for OFAC sanctions, blocked-party restrictions, and transaction activity. Current regulations, sanctions lists, agency guidance, and qualified counsel should be checked for decisions with legal or commercial consequences.
Free tools Windows power users keep installed
One-click scans. No signup required.
What this 2021 guidance can—and cannot—tell a project today
What it helps clarify
- The date and scope of the change described by The Linux Foundation: 15 July 2021.
- Why standard and non-standard cryptography were treated differently in the Foundation’s account.
- Why unrestricted public dissemination is more important than the label “open source” alone.
- Why notices, public source availability, technical records, and downstream review are practical safeguards.
What it does not establish
- A current, project-specific ECCN classification.
- A guarantee that every publicly hosted repository is “published” for every legal purpose.
- A compliance conclusion for a modified codebase or derived commercial product.
- An exemption from OFAC sanctions or other U.S. restrictions.
- Legal advice for a particular release, destination, user, or transaction.
Use the 2021 article as historical context for the notification change and the Foundation’s published-material explanation. For a current release, verify the applicable EAR and BIS guidance, review OFAC requirements separately, and obtain qualified legal advice when the project’s distribution, encryption, or counterparties create material risk.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
