Re: Aust crypto regulations

[M.Gream@uts.EDU.AU (Matthew Gream)]

Well, fuck that for thinking I was living under a less restrictive
regime -- and I can say goodbye to an international market for my
software.

---- begin include ----
From: M.Gream@uts.edu.au (Matthew Gream)
Newsgroups: aus.computers.ibm-pc,alt.security.pgp
Subject: Re: PGP for Oz users
Date: 6 Sep 1994 06:44:14 GMT

Matthew Gream (M.Gream@uts.edu.au) wrote:

> That sounds bogus to me, at least from the information you've given me
> there. I've had the pleasure of being routed from our `Australian Trade
[..]
> I'm fairly confident in saying that there are no export restrictions on
> software (specific clause stating that mass market, public domain and
> "unsupported after installation" software is not covered by the
> Industrial List). There do exist restrictions on hardware. All of these
> restrictions are a direct result of our adherence with COCOM
> regulations.

I'm afraid I have to post a clarification to a clarification. I've just
been in contact with the relevant people at the Defence Signals
Directorate. It seems that regardless of advice obtained from other
departments and documentation that points to the contrary, there are
restrictive controls on software.

In my conversation, the following was articulated (she was refering to
the same document as previously mentioned [1]):

1. The "General Software Note" on Page 1-6 of [1] does not override
   the regulations in "Category 5: Telecommunications and `Information
   Security'", specifically s.5.A.2 and s.5.D.2. This means that they
   assert control over all forms of software _including_ public domain.
   I tried to pin-point what the "General Software Note" is for then,
   but didn't receive an acceptable answer.

2. DES can only be exported for specific banking and associated 
   applications, even then only to 8 governments and certain banking 
   groups. They accept RSA for export where it's used in Key 
   Distribution applications. In essence, there is a list of specific
   uses for certain algorithms.

3. Message digests are in general OK, so long as they can't be modified
   to perfom cryptographic functions (ie. encryption/decryption).

4. Export is regulated on a per end user basis. In order words, they
   assert control over _each_ item of software sold.

5. The fact that COCOM is in a "forum" period does not affect the
   current regulations.

6. I specifically asked about "public domain" distribution of software
   via the Internet. She said that this was "highly inadvisable" and
   "if our government found out about it, they could take action" and
   asserted that it would be worse for an individual than if the
   violation was carried out by a company. She said that she wouldn't
   like someone to become a "test case", and made mention of problems
   in the USA.

She was extremely helpfull though, but the real problem I had, and I
spent most of my time on this, was that these requirements aren't
solidified anywhere, and hence subjective. I'm not really surprised
though, that's the whole point of it all.

I wasn't concerned about "weak crypto", only DES, IDEA, RSA, MD* and
locally produced algorithms.

In short: Anything cryptographic, they want to know about, and they
want to know about it on a per end-user basis. They advise against
distribution on the "Internet" and any distribution without prior
approval otherwise there could be "problems".

Matthew.

[1] "Australian Controls on the Export of Technology with Civil and
	Military Applications", Aust Dept of Defence, Sept 1992.

--
Matthew Gream <M.Gream@uts.edu.au> -- Consent Technologies, (02) 821-2043
Disclaimer: From? \notin speaking_for(Organization?)            [cfqx103]
---- end include ----

-- 
Matthew Gream <M.Gream@uts.edu.au> -- Consent Technologies, (02) 821-2043
Disclaimer: From? \notin speaking_for(Organization?)            [cfqx103]