Merge pull request NuGet#1491 from NuGet/karann-msft-exportControl

Create export-control.md

Author: karann-msft

docs/nuget-org/TOC.md

@@ -10,7 +10,8 @@
 ## [Data Requests](policies/Data-requests.md)
 ## [Dispute resolution](policies/dispute-resolution.md)
 ## [Deleting packages](policies/deleting-packages.md)
+## [Export Controls](policies/export-control.md)
 # Reference
 ## [NuGet API](../api/overview.md)
 ## [licenses.nuget.org](licenses.nuget.org.md)
-## [FAQ](nuget-org-faq.md)
+## [FAQ](nuget-org-faq.md)

docs/nuget-org/policies/export-control.md

@@ -0,0 +1,26 @@
+---
+title: Export Control Policy
+description: Policies governing export control laws
+author: karann-msft
+ms.author: karann
+ms.date: 06/27/2019
+ms.topic: conceptual
+---
+
+# Export Control Policy
+
+The content you upload to or access from NuGet.org may be subject to U.S. export control laws, including U.S. Export Administration Regulations (the EAR).  While we have provided some information below for your convenience, you are ultimately responsible for ensuring that your use of NuGet.org and any related services complies with all applicable laws and regulations, including U.S. export control laws, and complies with our [Terms of Use](https://www.nuget.org/policies/Terms).
+
+## Publicly available encryption source code
+
+Subject to the notification requirements described in the EAR, encryption source code classified under ECCN 5D002 is no longer subject to the EAR.  Such source code is publicly available even if it is subject to an express agreement for the payment of a licensing fee or royalty for commercial production or sale of any product developed using the source code.
+
+## Notification requirement
+
+As specified in the EAR (Part 742.15(b) & 734.3(b)(3)), the person or entity providing or uploading encryption source code must notify the U.S. Bureau of Industry and Security (BIS) and the ENC Encryption Request Coordinator via email of the Internet location (e.g., URL or Internet address) of the publicly available encryption source code classified under ECCN 5D002 or provide each of them a copy of the publicly available encryption source code. If you update or modify the encryption source code, you must also provide additional copies to each of them each time the cryptographic functionality of the encryption source code is updated or modified. In addition, if you posted the encryption source code on the Internet (e.g., via NuGet.org), you must notify BIS and the ENC Encryption Request Coordinator each time the Internet location is changed, but you are not required to notify them of updates or modifications made to the encryption source code at the previously notified location. In all instances, submit the notification or copy to [email protected] and to [email protected].
+
+## Commerical Software
+
+Release of publicly available source code from export control jurisdiction through the notification process described above *does not apply* to commercial software incorporating or derived from such items.  You are solely responsible for compliance with Export Laws as applied to any commercial software incorporating or derived from source or object code hosted via NuGet.org.
+
+For further information on export and geographic export restrictions, please visit https://www.microsoft.com/en-us/exporting.