TaxTMI 
TaxTMI 
2023 (5) TMI 449
X X X X Extracts X X X X
X X X X Extracts X X X X
....ication No. 24/2005-Customs, dated 01.03.2005, as amended. 2. The applicant is a registered LLP (Limited Liability Partnership) company involved in the business of trading. The applicant is intending to import 'Cryptogenic Device/Token' (ProxKey and ProxKey PRO) (herein after referred as 'subject goods'). In their submissions the applicant has stated the following: 2.1 Both ProxKey & ProxKey PRO represent the same product with same functions, technical specification with different brand name on hardware and its associated middleware/drivers & physical appearance in terms of color. 2.2 Products Overview, Features & Appearance-: a. Cryptographic Device/Token is very portable, easy-to-use and cost-effective solution for strong authentication, secure access and online transactions. It features a plug-and-play capability that brings convenience to end users and is designed to meet the demand for secure, fast and reliable external tokens with built-in secure mechanisms and designed to function with computer systems and automated data processing machined with varied configurations and operating systems. b. They are among the securest and lightest....
X X X X Extracts X X X X
X X X X Extracts X X X X
....e forms and back again; (b) Use what is known as "Public Key Cryptography", which employs an algorithm using two different but mathematical related "keys" - one for creating a Digital Signature or transforming data into a seemingly unintelligible form, and another key for verifying a Digital Signature or returning the electronic record to original form, the process termed as hash function shall be used in both creating and verifying a Digital Signature. e. Further the Information Technology Act 2000, mandates that the key pair of the user must be mandatorily generated on the FIPS -140-2 Level 2 validated cryptographic Module / Hardware. The Federal Information Processing Standard [FIPS] 140-2 is a U.S. government computer security standard used to approve cryptographic modules. The National Institute of Standards and Technology (NIST) issued the FIPS 140 Publication Series to coordinate the requirements and standards for cryptography modules that include both hardware and software components. Protection of a cryptographic module within a security system is necessary to maintain the confidentiality and integrity of the information protected by the module. This standard s....
X X X X Extracts X X X X
X X X X Extracts X X X X
....e the user's private and public key pairs. The user's key pairs reside in the memory of the Crypto Processor / Module and the private keys can never be exported. h. The products are used for digital signature authentication/identification purposes using a system of a secure key pair consisting of a private key for creating a digital signature and a public key to verify the digital signature using the cryptographic modules / Crypto Processor / Crypto CPU and validated algorithms. i. The products cannot be operated on a standalone basis and it should be operated along with a computer system for its authentication and identification. The products when connected with the computer or ADP read the data embedded in the device and send the information to the network / server to get the authentication for the transaction. Thus it means that mere token/device alone is not sufficient and it has to get connected to the computer system to access the network / server to send the details for its authentication / identification. Cryptographic Device cannot work without an ADPS. j. Rule 2 of the Information Technology (Security Procedure) Rules, 2004 defines "hardware token" to mea....
X X X X Extracts X X X X
X X X X Extracts X X X X
....s shall be determined according to the terms of the headings and any relative Section or Chapter Notes. The goods under consideration are classified with reference to the headings and any relative Section or Chapter Notes. 3.2 For ease of reference, the relevant portions of CTH 8471 are reproduced as under: 8471 Automatic data processing machines and units, thereof; magnetic or optical readers, machines for transcribing data on to data media in coded form and machines for processing such data, not elsewhere specified or included 8471 30 - Portable automatic data processing machines, weighing not more than 10 kg, consisting of at least a central processing unit, a keyboard and a display: 8471 30 10 --- Personal computer 8471 30 90 --- Other - Other automatic data processing machines : 8471 41 -- Comprising in the same housing at least a central processing unit and an input and output unit, whether or not combined : 8471 41 10 --- Micro computer 8471 41 20 --- Large or main frame computer 8471 41 90 --- Other 8471 49 00 -- Presented in the form of systems 8471 50 00 - Processing ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....esented separately, even if they meet all of the conditions set forth in paragraph (C):- (i) printers, copying machines, facsimile machines, whether or not combined; (ii) apparatus for the transmission or reception of voice, images or other data, including apparatus for communication in a wired or wireless network (such as a local or wide area network); (iii) loudspeakers and microphones; (iv) television cameras, digital cameras and video camera recorders; (v) Monitors and projectors, not incorporating television reception apparatus. E. Machines incorporating or working in conjunction with an automatic data processing machine and performing a specific function other than data processing are to be classified in the headings appropriate to their respective functions or, failing that, in residual headings 3.4 Explanatory notes of WCO for CTH 8471 a. Subject to the provisions of Notes 5 (D) and (E) to this Chapter, this heading also covers separately presented constituent units of automatic data processing systems. These may be in the form of units having a separate housing or in the form of units not having a separate housing and d....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... need to draw power from its host ADPS. It is connectable to the central processing unit either directly or through one or more other units Rule 2 of the Information Technology (Security Procedure) Rules, 2004 defines "hardware token" to mean a token which can be connected to any computer system using Universal Serial Bus (USB) port." Thus the IT law itself recognizes the Cryptographic Device as a device, which is connected to the computer system by using USB port. It is able to accept or deliver data in a form (codes or signals) which can be used by the system The content to be signed flows thought the USB port to product and after the electronic record received by the product is converted into an unintelligible form by the private key, another key i.e. the public key returns the electronic record to the original form along with the signature (in this case digital) and transmits the data back to the ADPM to enable it to be printed or electronically transmitted to another device through mail or any other form of transfer. The documents would have the inscription "Digitally Signed by-------------" Not excluded by the provisions of Notes 5 (D) and (E) to this Chapter ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....0 20 --- Motherboards 8473 30 30 --- Other mounted printed circuit boards 8473 30 40 --- Head stack --- Other : 8473 30 91 ---- Network access controllers 8473 30 92 ---- Graphic and intelligence based script technology (GIST) cards for multilingual computers 8473 30 99 ---- Other The products also merit classification under 8473 30 99 Parts and Accessories (Other than covers, carrying cases and the like) suitable for use solely or principally with machines of heading 8470 to 8472, 847330-Parts and Accessories of machines of heading 8471 are capable of directly connecting to and designed for use with an Automatic Data Processing System (Hereafter known as ADPS) of Heading 8471. Relevant headings reproduced as under. The accessories covered by this heading are interchangeable parts or devices designed to adapt a machine for a particular operation, or to perform a particular service relative to the main function of the machine, or to increase its range of operations. Further accessory is in the nature of having a secondary, supplementary or subordinate function by accompanying as a subordi....
X X X X Extracts X X X X
X X X X Extracts X X X X
....om one recording or reading apparatus to another. b. The media of this heading may be presented recorded, unrecorded, or with some pre-recorded information, but capable of having more information recorded on them. c. Solid-state, non-volatile data storage devices for recording data from an external source (See Note 6 (a) to this chapter). These devices (also known as "flash memory cards" or "flash electronic storage cards") arc used for recording data from an external source, or providing data to, devices such as navigation and global positioning systems, data collection terminals, portable scanners, medical monitoring appliances, audio recording apparatus, personal communicators, mobile phones, digital cameras and automatic data processing machines. Generally, the data are stored onto, and read from, the device once it has been connected to that particular appliance, but can also be uploaded onto or downloaded from an automatic data processing machine. d. The media use only power supplied from the appliances to which they are connected, and require no battery. e. These non-volatile data storage devices are comprised of, in the same housing, one ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....its presence or absence does not impact the functioning of the product for its intended use. Even in the absence of the flash memory in which the middleware is loaded, the same could also be downloaded freely from the internet or external sources for the intended use of the product. The fact that the user of the product in no manner can add, erase or modify any content in this memory itself justifies that it cannot be categorized under heading 8523 or any other its sub headings. The product cannot be compared with a device of nature mentioned under chapter heading 8523. 3.13 In view of the above submission, the product under consideration merits classification under 8471 80 00 as other units of automatic data processing machines or under 8473 30 99- Others - Parts and accessories of the machines heading 8471 (ADPS). However, the product has specific character which are in consonance with principles laid to Chapter note 5C of 84, WCO Explanatory notes to 8471 80 and specific product entry of WCO classification opinion under 8471 80, the product with classifiable under the product with classifiable under CTH 8471 80 00 as other units of automatic data processing machines and eligi....
X X X X Extracts X X X X
X X X X Extracts X X X X
....e same product with same functions; technical specification with different brand name on hardware and its associated middleware/drivers & physical appearance in terms of color. 5.1.4 Cryptographic Device/Token is very portable, easy-to-use and cost-effective solution for strong authentication, secure access and online transactions, ft features a plug-and-play capability that brings convenience to end users and is designed to meet the demand for secure, fast and reliable external tokens with built-in secure mechanisms and designed to function with computer systems and automated data processing machined with varied configurations and operating systems. They are among the securest and lightest cryptographic USB tokens in the world, complying with the most stringent international standards, like ISO 7816 4, 8, 9, FIPS140-2 certified and possesses the most reliable encrypting capabilities like DES, 3DES and RSA. The chip embedded in the device is a highly secure data container as the private key stored on the chip and can never be exported. With this device, users can access web-based applications, corporate networks and carry out online transactions easily, conveniently for consumer....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... of the user must be mandatorily generated on the FIPS -140-2 Level 2 validated cryptographic Module / Hardware. The Federal Information Processing Standard [FIPS] 140-2 is a U.S. government computer security standard used to approve cryptographic modules. The National Institute of Standards and Technology (NIST) issued the FIPS 140 Publication Series to coordinate the requirements and standards for cryptography modules that include both hardware and software components. Protection of a cryptographic module within a security system is necessary to maintain the confidentiality and integrity of the information protected by the module. This standard specifies the security requirements that will be satisfied by a cryptographic module. e. The products barely have only 1 critical component which determines the functioning of the product i.e. AS518 in the form of Crypto processor IC mounted on the PCB version no K023314A having an USB Interface. AS518 series is a high-performance 32-bit micro-processor based on ARM Cortex-M. The IC has its own RAM, Memory, CPU and various interfaces like USB, SPI, and UART. The IC has built-in hardware algorithm coprocessor provides excellent performan....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ill be satisfied by a cryptographic module. Sec 3 of IT Act 2000 provides for "Authentication of Online record by affixing a Digital Signature". The Gazette Notification 735(E) dated 24th October 2004 which contains the Rules to be read in conjunction with section 16 of the IT Act 2000 defines the Secure Electronic Record to be one that has been authenticated by means of a Secure Digital Signature. To create a Secure Digital Signature a hardware token with cryptographic module has to be used to create the key pair. The content to be signed /encrypted should go from the host system to the cryptographic device and the signed /encrypted content to be returned to the host system. The product is one such hardware token device with cryptographic processor to be used for the purpose and mentioned aforesaid. Further it is also submitted that user's private and public key pairs can be generated and retained only on the memory of the Crypto Processor / Module. The Crypto Processor / Module has very limited memory of 256 KB out of which only 64KB can be used to store the user's private and public key pairs. The user's key pairs reside in the memory of the Crypto Processor / Mod....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... examine each of these headings in sequential manner separately. 5.4 For the ease of reference, the relevant portions of CTH 8471 are reproduced as under: 8471 Automatic data processing machines and units, thereof; magnetic or optical readers, machines for transcribing data on to data media in coded form and machines for processing such data, not elsewhere specified or included 8471 30 - Portable automatic data processing machines, weighing not more than 10 kg, consisting of at least a central processing unit, a keyboard and a display: 8471 30 10 --- Personal computer 8471 30 90 --- Other - Other automatic data processing machines : 8471 41 -- Comprising in the same housing at least a central processing unit and an input and output unit, whether or not combined : 8471 41 10 --- Micro computer 8471 41 20 --- Large or main frame computer 8471 41 90 --- Other 8471 49 00 --- Presented in the form of systems 8471 50 00 - Processing units other than those of sub-headings 8471 4 for 8471 49, whether or not containing in the same housing one or two of the following types of unit: stora....
X X X X Extracts X X X X
X X X X Extracts X X X X
....red or wireless network (such as a local or wide area network); III. loudspeakers and microphones; IV. television cameras, digital cameras and video camera recorders; V. Monitors and projectors, not incorporating television reception apparatus. E. Machines incorporating or working in conjunction with an automatic data processing machine and performing a specific function other than data processing are to be classified in the headings appropriate to their respective functions or, failing that, in residual headings 5.6 Applicant has produced following table in support of their claim to compliance of Chapter note 5C by the product Principles Comments It is of a kind solely or principally used in an automatic data processing system The ADP system send the data to the product for signing / Encryption / Authentication. The content on the ADP system which is to be signed /Encrypted should go from the ADP system to the product and the signed /Encrypted/ Authentication content is returned to the host system. Thus it means that mere token/device alone is not sufficient and it has to get connected to the computer system to receive the data from ADP....
X X X X Extracts X X X X
X X X X Extracts X X X X
....arts of a complete system. b. An apparatus can only be classified in this heading as a unit of an automatic data processing system if it:- (a) Performs a data processing function; (b) Meets the following criteria set out in Note 5 (C) to this Chapter:- (i) It is of a kind solely or principally used in an automatic data processing system; (ii) It is connectable to the central processing unit either directly or through one or more other units; and (iii) It is able to accept or deliver data in a form (codes or signals) which can be used by the system. (iv) Is not excluded by the provisions of Notes 5 (D) and (E) to this Chapter. c. In accordance with the last paragraph of Note 5 (C) to this Chapter, keyboards, X-Y coordinate input devices and disc storage units which satisfy the conditions of items (b) (ii) and (iii) above, are in all cases to be classified as constituent units of data processing systems. d. If the unit performs a specific function other than data processing, it is to be classified in the heading appropriate to that function or, failing that, in a residual heading (see Note 5 (E) to this ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....0 30 --- Other mounted printed circuit boards 8473 30 40 --- Head stack --- Other : 8473 30 91 ---- Network access controllers 8473 30 92 ---- Graphic and intelligence based script technology (GIST) cards for multilingual computers 8473 30 99 ---- Other 99 Parts and Accessories (Other than covers, carrying cases and the like) suitable for use solely or principally with machines of heading 8470 to 8472, 8473 30-Parts and Accessories of machines of heading 8471 are capable of directly connecting to and designed for use with an Automatic Data Processing System (Hereafter known as ADPS) of Heading 8471. The accessories covered by this heading are interchangeable parts or devices designed to adapt a machine for a particular operation, or to perform a particular service relative to the main function of the machine, or to increase its range of operations. Further accessory is in the nature of having a secondary, supplementary or subordinate function by accompanying as a subordinate; aiding in a secondary way; being additional; contributing or being contributory. 5.10 It is observed that the applicant ha....
X X X X Extracts X X X X
X X X X Extracts X X X X
....r, the product has specific character which are in consonance with principles laid to Chapter note 5C of 84, WCO Explanatory notes to 8471 80 and specific product entry of WCO classification opinion under 8471 80. There is nothing contrary to this opinion in the chapter 84 to the first schedule to the Customs Tariff Act, 1975. HSN/WCO classification opinion has a significant guidance value in deciding the matters of classification under the Customs law. Honorable Supreme Court has in their judgment in the case of Collector of Central Excise, Shillong v. Wood Craft Products Ltd. (1995) 3 SCC 454. observed as under:- "Accordingly, for resolving any dispute relating to tariff classification, a safe guide is the internationally accepted nomenclature emerging from the HSN. This being the expressly acknowledged basis of the structure of the Central Excise Tariff in the Act and the tariff classification made therein, in case of any doubt the HSN is a safe guide for ascertaining the true meaning of any expression used in the Act." In the case of Collector of Customs, Bombay Vs Business Forms Ltd, 2002-TIOL-277-SC-CUS-LB, the Hon'ble Supreme court held that Explanatory Notes....