United Arab Emirates - Hardware Security Modules (HSMs) & Cryptographic Devices

The security and privacy of your data – especially business data – is more important than ever before, and also more complex to defend than ever before. Hardware Security Modules (HSMs), specialist VPN routers, and other cryptographic devices are becoming essential. But importing these items and other such devices into the United Arab Emirates (UAE) carries its own legal and regulatory hurdles.

So what do you need to know?

What Cryptographic Devices Need to Be Imported?

A wide range of hardware and software is grouped together by vendors as cryptographic devices. Simply put, any tool that can help you encrypt your data, including calls, is a cryptographic device.

Some examples include:

• Encrypted Communications Devices: There are encrypted radios, smartphones, and other communication devices on the market.
• Hardware Security Modules (HSMs): Otherwise known as authenticators, digital keys, and dongles, HSMs can be plugged into computers or other devices to encrypt outgoing data and decrypt incoming data.
• Virtual Private Network (VPN) Routers: Rather than simply using VPN apps, some security conscious businesses import VPN router hardware to ensure secure and encrypted internet connections.
• Encryption Software: This catchall category includes any software used to encrypt or decrypt computer data.

As you can imagine, many major organisations in both private and public sectors find devices like these critical, especially working in government, defence, finance, and healthcare. But it’s just as obvious that technology with far-reaching implications like these will be tightly regulated by many governments, both for import and use.

The UAE is no exception.

UAE Regulatory Framework for Importing Encrypted Devices

There are three main organisations overseeing the UAE’s stringent regulations in this area.

1. Telecommunications Regulatory Authority (TRA)

The primary authority overseeing the import and use of cryptographic devices in the UAE is the Telecommunications Regulatory Authority (TRA). The TRA ensures that all telecommunication and IT equipment entering the country complies with national security standards.

Under UAE law, any device or software capable of encryption must be approved by the TRA before it can be imported or used in the country. This includes devices used for personal, commercial, or government purposes. The TRA has set out specific guidelines that must be followed to obtain approval.

2. National Electronic Security Authority (NESA)

Another key player in the regulation of cryptographic devices is the National Electronic Security Authority (NESA), which is responsible for protecting the UAE’s critical information infrastructure. NESA’s regulations often overlap with those of the TRA, particularly in cases involving high-level security equipment or software.

NESA has established a set of standards known as the UAE Information Assurance Standards (IAS), which provide a framework for the secure use of cryptographic devices and other IT equipment. Compliance with these standards is mandatory for all government entities and is recommended for private sector organizations involved in critical infrastructure.

3. Customs Regulations

In addition to TRA and NESA regulations, the UAE’s Customs authorities play a crucial role in controlling the importation of cryptographic devices. Importers must declare any such devices to customs upon entry into the country. Failure to do so can result in the confiscation of the devices, fines, or even criminal charges.

Customs authorities work closely with the TRA and NESA to ensure that all imported devices meet the necessary security and compliance standards. Importers are often required to provide detailed documentation, including the purpose of the device, technical specifications, and proof of approval from the TRA. This makes an Importer of Record (IOR) an extremely useful asset in importing encrypted devices.

Understanding the Import Process for HSMs & Other Cryptographic Devices

We’ve broken the import process down into several clear steps.

Please click here for the full article.