Our contact at Apple replied today that she double checked with the Government: they confirm that "sending information over https is forcing the data to go through a secure channel from SSL, therefore it falls under the U.S. Government requirement for a CCATS review and approval."

As simple as that. She also added that she asked if our type of data (private communication / messages) would fall under a new exception category, but "unfortunately it does not."

So it looks like we've got to go through a process that will take at least a month, probably significantly longer.

The only relief that Apple can offer is that if you agree (in written) to go through with the CCATS process and you've already submitted your application to the Government, Apple lets you start selling your app in the U.S. and Canada, adding more countries in a second step and finally opening all for sale when approval is obtained.

Again, I have to say that Apple (and the Sr. Export Compliance Specialist dealing with us there) always offers support in every way she can. Very helpful, very good service! I suspect it won't be the same with the Department of Commerce and its Bureau of Information Security...

We'll keep you posted on our journey. At least it involves "fun" stuff that you don't usually do in your every day life like writing letters of explanation to the NSA...