ITSAppUsesNonExemptEncryption export compliance while internal testing?

Question

I got this message while selecting build for internal testing.it says about setting ITSAppUsesNonExemptEncryption in info.plist what does it mean? is it necessary?

Piperpiperaceous

It is literally asking if you're using any cryptography/ if your app is designed to store secure information cryptographically. – Casserole

As of Sept. 20th, 2016, this is no longer required. See my answer here: https://mcmap.net/q/35584/-does-my-application-quot-contain-encryption-quot - You can say you are exempt. – Joey

I’m voting to close this question because it is about legal issues and App Store review policies. – Valvular

Answer 1

According to WWDC2015 Distribution Whats New

Setting "ITSAppUsesNonExemptEncryption" to "NO" in info.plist works fine. if no cryptographic content in your app.

I had got this pop up During selecting build for internal testing i didn't included "ITSAppUsesNonExemptEncryption" key in my info.plist but still worked for me.

Even i successfully uploaded new application didn't included "ITSEncryptionExportComplianceCode" and "ITSAppUsesNonExemptEncryption" keys.

Also Apple Doc.

Important: If your app requires that you provide additional documents for the encryption review, your app won’t have the Ready for Sale status on the store until Export Compliance has reviewed and approved your documents. The app can’t be distributed for prerelease testing until Export Compliance has reviewed and approved it.

If your app is not using encryption and you don’t want to have to answer these questions at the time of submission, you can provide export compliance information with your build. You can also provide new or updated documentation via iTunes Connect to receive the appropriate key string value to include with your build before uploading it to iTunes Connect.

To add export compliance documentation in iTunes Connect:

Go to the Encryption section under Features. Click the plus sign next to the appropriate platform section. Answer the questions appropriately. Attach the file when prompted. Click Save. Your documents will then be sent for review immediately and the status of your document will show in Compliance Review. A key value will also be generated automatically that you can include in your Info.plist file. For more information on including the key value with your build, see the Resources and Help section Trade Compliance.

You can upload a build without an export compliance key. If you include a key, it can indicate that you do not need export compliance documentation; this requires no approval. If you include a key that references a specific export compliance document, that document must be approved; it cannot be in In Review or Rejected.

You can review your answers at any time by clicking the document file name and selecting More Information. If you need to update your documentation or change any of the answers to the questions, you will need to repeat the steps above to add a new document that corresponds with your changes.

Piperpiperaceous

For more. #2135581 – Piperpiperaceous

Answer 2

Basically <key>ITSAppUsesNonExemptEncryption</key><false/> stands for a Boolean value equal to NO.

Update by @JosepH: This value means that the app uses no encryption, or only exempt encryption. If your app uses encryption and is not exempt, you must set this value to YES/true.

It seems debatable sometimes when an app is considered to use encryption.

Musicianship

thanks - this was exactly what i was looking for (how to add this key into the graphical plist file) – Hurlee

Setting 'ITSAppUsesNonExemptEncryption' to false/NO does NOT mean that the encryption in your app hasn't changed. It means that the app uses no encryption, or only exempt encryption. If your app uses encryption and is not exempt, you must set this value to YES/true.Very few apps can set this to NO; for example if any part of your app uses https you almost certainly need to say YES. See #2135581 – Ettaettari

@Ettaettari alright, thanks so much for the insight, indeed your information seems to be correct – Musicianship

Is this still required even if you are not distributing the app outside of the US? – Ohl

@AndroidNoob yes, if you download something from the AppStore, Apple is basically exporting this technology. So the regulations also apply even if you don't target the American market. – Rhinarium

You don't usually need to set this to YES if you're using https. See Note 4 from Category 5 part 2. For the most part, if the main purpose of the app isn't encryption, you can set the value to NO. There are some caveats here, like whether or not you're willing to give up information upon request from "the appropriate authority", so read carefully. – Adorn

Don't quote me on this, but iTunes Connect told me to add <key>ITSAppUsesNonExemptEncryption</key><false/> to my plist because I checked YES on the question "Does your app only use HTTPS transfers?" – Rh

HTTPS encryption is implemented on the OS level; application doesn't go into the trouble of actually ciphering data. In my understanding, Ben Kane's suggestion is correct. – Musicianship

Answer 3

Add this key in plist file...Everything will be alright..

<key>ITSAppUsesNonExemptEncryption</key>  
<false/>

Just paste before </dict></plist>

Potsherd

"Everything will be alright"... until an audit is done – Neuropsychiatry

Answer 4

Apple has simplified our building process, so you don't need to click on the same checkbox every time. You can streamline your iTC flow by compiling this flag into the app.

This is still the case as of 2019.

Worthington

Answer 5

To select from dropdown please start typing following line:

App Uses Non-Exempt Encryption

Saccule

Answer 6

There are basically 2 things to bear in mind. You are only allowed to set it to NO if you either don't use encryption at all, or you are part of the exempt regulations. This applies to the following kind of applications:

Source: Chamber of Commerce: https://www.bis.doc.gov/index.php/policy-guidance/encryption/encryption-faqs#15

Consumer applications

• piracy and theft prevention for software or music;
• music, movies, tunes/music, digital photos – players, recorders and organizers
• games/gaming – devices, runtime software, HDMI and other component interfaces, development tools
• LCD TV, Blu-ray / DVD, video on demand (VoD), cinema, digital video recorders (DVRs) / personal video recorders (PVRs) – devices, on-line media guides, commercial content integrity and protection, HDMI and other component interfaces (not videoconferencing);
• printers, copiers, scanners, digital cameras, Internet cameras – including parts and sub-assemblies
• household utilities and appliances

Business / systems applications: systems operations, integration and control. Some examples

• business process automation (BPA) – process planning and scheduling, supply chain management, inventory and delivery

• transportation – safety and maintenance, systems monitoring and on-board controllers (including aviation, railway, and commercial automotive systems), ‘smart highway’ technologies, public transit operations and fare collection, etc.

• industrial, manufacturing or mechanical systems - including robotics, plant safety, utilities, factory and other heavy equipment, facilities systems controllers such as fire alarms and HVAC

• medical / clinical – including diagnostic applications, patient scheduling, and medical data records confidentiality

• applied geosciences – mining / drilling, atmospheric sampling / weather monitoring, mapping / surveying, dams / hydrology

Research /scientific /analytical. Some examples:

• business process management (BPM) – business process abstraction and modeling

• scientific visualization / simulation / co-simulation (excluding such tools for computing, networking, cryptanalysis, etc.)

• data synthesis tools for social, economic, and political sciences (e.g., economic, population, global climate change, public opinion polling, etc. forecasting and modeling)

Secure intellectual property delivery and installation. Some examples

• software download auto-installers and updaters

• license key product protection and similar purchase validation

• software and hardware design IP protection

• computer aided design (CAD) software and other drafting tools

Note: These regulations are also true for testing your app using TestFlight

Rhinarium

Answer 7

Apple has changed the rules on this. I read through all the Apple docs and as many of the US export regs as I could find.

My view on this was until recently even using HTTPS for most apps meant Apple would require the export certificate. Some apps such as banking would be OK but for many apps they did not fall into the excempt category which is very, very broad.

However Apple has now introduced a getout under the exempt category for apps that JUST use https. I do not know when they did this but I think it was either Dec 2016 or Jan 2017. We are now submitting our apps without the certificate from the US Govt.

Shoifet

Link to the "get out" documentation? I cannot determine if HTTPS is okay or not. – Thremmatology

@Thremmatology Not needed for HTTPS. You can try apply and you wont even get through the application form anymore from the GOV sites. (don't remember the name) – Antiknock

@Sneak OK cheers man. Hopefully that remains true going into the future. – Thremmatology

@Sneak cheers man. This more recent example seems to indicate you need to submit a yearly report: https://mcmap.net/q/35584/-does-my-application-quot-contain-encryption-quot – Thremmatology

@Thremmatology Yeah, I havn't dived into it yet, but I think its something minor , unless you use anything else than https etc. I think its all about use-case. – Antiknock

@Sneak definitely something to look into more. Thanks for the links. Just HTTPS at the moment. – Thremmatology

If the app itself doesn't have any encryption but the embedded Ads (say Google Ads) makes HTTPS request, what should be done? – Fullbodied

Answer 8

The same error solved like this

    using UnityEngine;
    using System.Collections;
    using UnityEditor.Callbacks;
    using UnityEditor;
    using System;
    using UnityEditor.iOS.Xcode;
    using System.IO;

public class AutoIncrement : MonoBehaviour {

    [PostProcessBuild]
    public static void ChangeXcodePlist(BuildTarget buildTarget, string pathToBuiltProject)
    {

        if (buildTarget == BuildTarget.iOS)
        {

            // Get plist
            string plistPath = pathToBuiltProject + "/Info.plist";
            var plist = new PlistDocument();
            plist.ReadFromString(File.ReadAllText(plistPath));

            // Get root
            var rootDict = plist.root;

            // Change value of NSCameraUsageDescription in Xcode plist
            var buildKey = "NSCameraUsageDescription";
            rootDict.SetString(buildKey, "Taking screenshots");

            var buildKey2 = "ITSAppUsesNonExemptEncryption";
            rootDict.SetString(buildKey2, "false");


            // Write to file
            File.WriteAllText(plistPath, plist.WriteToString());
        }
    }
    // Use this for initialization
    void Start () {

    }

    // Update is called once per frame
    void Update () {

    }

    [PostProcessBuild]
    public static void OnPostprocessBuild(BuildTarget target, string pathToBuiltProject)
    {
        //A new build has happened so lets increase our version number
        BumpBundleVersion();
    }


    // Bump version number in PlayerSettings.bundleVersion
    private static void BumpBundleVersion()
    {
        float versionFloat;

        if (float.TryParse(PlayerSettings.bundleVersion, out versionFloat))
        {
            versionFloat += 0.01f;
            PlayerSettings.bundleVersion = versionFloat.ToString();
        }
    }
    [MenuItem("Leman/Build iOS Development", false, 10)]
    public static void CustomBuild()
    {
        BumpBundleVersion();
        var levels= new String[] { "Assets\\ShootTheBall\\Scenes\\MainScene.unity" };
        BuildPipeline.BuildPlayer(levels, 
            "iOS", BuildTarget.iOS, BuildOptions.Development);
    }

}

Caernarvonshire

added a related code line so dev could use to add the necessary keys – Make

Got it, removed my comment. Thanks – Guidebook

Answer 9

In Xcode 12 use App Uses Non-Exempt Encryption instead of ITSAppUsesNonExemptEncryption

Millrace

If you manually input this into the textfield it will just translate to: App Uses Non-Exempt Encryption – Seasickness