ICT Products that Use Cryptography in ASEAN: Balancing Digital Trade and Regulatory Objectives in DEFA

Cryptography is embedded in a wide range of internationally traded information and communication technology (ICT) products, including smartphones, laptops, and software applications, even when encryption is not their primary function. As a result, national cryptography laws and controls may increasingly affect a broad range of commercial ICT products.

This policy brief examines the intersection of cryptography-related regulations in ASEAN and provisions in free trade agreements (FTAs) and digital economy agreements (DEAs). It shows that licensing requirements, import and export controls, and conformity assessment procedures, when applied too broadly to ICT products that use cryptography, can raise compliance costs and unintentionally restrict trade. The brief reviews how recent FTAs and DEAs address ICT products that use cryptography, highlighting common prohibitions on mandatory disclosure of encryption information, forced localisation, and prescribed algorithms, alongside clear carve-outs for regulatory and judicial access. Based on these developments, the brief offers policy considerations for ASEAN Member States (AMS) in assessing whether and how to include provisions on ICT products that use cryptography in the ASEAN Digital Economy Framework.