Black Duck debuts U.S. encryption compliance

IDG News Service - Black Duck Software Inc. is extending the scope of its compliance management offerings with a new product to handle U.S. export encryption requirements.

Available Monday, the company's exportIP software will enable users to search their source code to identify any encryption algorithms and ascertain whether the encryption complies with rules enforced by the U.S. Department of Commerce's Bureau of Industry and Security (BIS).

The rules forbid the export of powerful encryption algorithms to Cuba, Iran, North Korea, Sudan and Syria. The BIS can impose serious penalties on companies violating those rules including fines and a denial of export privileges.

Black Duck is launching exportIP at the Update 2006 Conference on Export Controls and Policy which is being hosted by the BIS and taking place in Washington through Tuesday.

"We're helping companies to understand the contents of their code so they can identify any intentional or unintentional use of encryption or encryption algorithms buried in the code," said Doug Levin, the company's chief executive officer and president.

Black Duck has been working on exportIP for about a year, he added. For the immediate future, the vendor will focus on U.S. regulations, but it could potentially localize exportIP for use in other countries with similar encryption rules.

The company will target not only developers but any organization whose products for export include embedded software such as phone handsets and computers, Levin said.

Black Duck already sells protexIP, compliance software and services to help companies analyze their development projects to determine whether they contain any pieces of open-source or other third-party code and then ensure that those code fragments meet the required licensing obligations.

At present, exportIP and protexIP are separate products, Levin said. They are designed to run on separate Windows or Linux servers since they have their own distinct analytics engines and knowledge bases.