Exporting cryptographic materials, theory vs. practice

[Matt Blaze <mab@research.att.com>]

DRAFT - PLEASE DO NOT QUOTE OR REDISTRIBUTE

Mostly to find out what the process was like, I recently applied for,
and received, a temporary export license for a so-called ``exportable''
telephone voice encryption device to take with me on a business trip to
England and Belgium.  I returned from the trip last week, device in hand.
Here's how it went.

The device in question is an AT&T ``Telephone Security Device (TSD)'',
model 3600-F.  This is the ``bump in a cord'' voice encryptor.  The
``F'' model is supposed to be approved for ``fast track'' export; it
doesn't use Clipper or DES, but rather some ``exportable'' algorithm.
This model is aimed primarily, I presume, at international business
travelers who want to communicate in a reasonably secure manner with
their home offices in the states.  In other words, a typical user
carries it with him or her when traveling abroad.  The particular
options that I got for the device included a James Bond-ish looking
acoustic coupler and handset for dealing with the hardwired phones
that are common in European hotel rooms.

About two months before my trip I called our (AT&T's) export lawyer
division.  It turns out that while there was some discussion in the
government about exempting from the export licensing process temporary
exports of cryptographic equipment used on business trips, this
exemption never actually took effect.  So even though the device I had
was already approved for sale abroad, I still needed to get a
temporary export license.  But they assured me that ``this is an easy,
routine process''.  Well, sure enough, about two weeks before I was to
leave I got back my official US State Department ``license for the
temporary export of unclassified defense articles''.  So far, so good.

According to the information printed on the license and additional
information from the lawyer, I have to leave from an international
airport with a customs agent present (no problem there).  At the
airport, I have to fill out a form called a ``shipper's export
declaration'' (SED) on which I have to declare that ``these
commodities are authorized by the US government for export only to
Belgium and the United Kingdom [the countries I'm visiting].  They may
not be resold, transshipped, or otherwise disposed of in any country,
either in their original form or incorporated into other end-items
without the prior written approval of the US Department of State''.
Then I'm to present the SED and export license to a customs official
at the airport before I leave.  The Customs officer is supposed to
take my SED and endorse my license to show what I'm actually taking
out of the country.

On the way back in, I'm supposed to ``declare'' my item (even though
it was manufactured in the US) and show them my license, and they're
supposed to endorse the license again to show that I have, in fact,
returned the ``defense article''.

The first hitch I ran into was that no one could actually tell me
where I could get an SED form.  But when I called customs they assured
me that this was no big deal.  ``Just come by customs at the airport,
and we stamp the form.  I guess you can just fill out the SED there''
they said, assuring me this is not a big deal.

I made sure to get to the airport early anyway.

Although there was moderately heavy traffic near the airport, I made
it to JFK two and a half hours before my 10pm flight.  I was flying
United, which has their own terminal at JFK, so Customs has an office
right there in the same building from which I was to depart (JFK is
awful to get around, so I was glad for this).  I checked in for my
flight (and got upgraded to first class, which bolstered my
expectation that everything was going to be really easy from here on).
Then, luggage, license and TSD in hand, I made my way downstairs to
Customs, expecting to fill out the SED form and ``just have my license
stamped'' as they had assured me earlier on the telephone.  I
explained my situation to the security guard whose job is to keep
people from going in to the Customs area, and he led me to ``the back
office'' without much argument or delay.  The head uniformed customs
guy in the back office (which I think is same office where they take
the people suspected of being ``drug mules'' with cocaine-filled
condoms in their stomaches) looked approachable enough.  He had a sort
of kindly, grandfatherly manner, and he was playing ``Doom'' on a
laptop computer.  I got the impression that most of the people he
encounters are suspected drug smugglers, and he seemed pleased enough
to be dealing with something a little different from the norm.  When I
explained what I was doing he looked at me as if I had just announced
that I was a citizen of Mars who hadn't even bothered to obtain a Visa
before leaving.

He explained, carefully, that a) I really do need the SED form; b) Not
only that, I should have already filled it out, in duplicate; c) He
doesn't have blank SED forms; d) he, like everyone else in the entire
US government that I had spoken to, has no idea where one gets them
from, but people must get them from somewhere; and e) it doesn't
really matter, because I'm in the wrong place anyway.

I asked him where the right place is.  ``The cargo building, of
course,'' he explained patiently.  I remembered the cargo building
because we passed it in the taxi just as the traffic jam began, about
half an hour before I got to the United terminal.  The airport shuttle
bus doesn't stop there.  I'd have to call a taxi.  ``But I think
they're closed now, and even if they were open you'd never make it
before your flight'' he helpfully added, saving me the trip.  He also
complemented for going to the trouble to get the license.

I must have looked hurt and confused.  Eventually he called in some
fellow in a suit who must have been his boss.

``Are you the guy who wants to export the fancy gun?'' the fellow in
the suit asked me.

``It's not a gun, it's a telephone,'' I responded, with a straight
face.

``Why do you have a license to export a telephone?''  Good question, I
thought.   I explained about the ITAR, and showed him the thing.  He
agreed that it looked pretty harmless.

The guy in the suit reiterated points a through e almost verbatim (do
they rehearse for these things?) and explained about how this is a
State Department license, not a Customs license, and this doesn't
happen very much because exports usually go via The Cargo Building.
He'd love to help me, but the computer in which these things get
entered is over in Cargo.  ``That's how the records get made.  But you
do have a valid license, which is nice.''  He also suggested that I
would have an easier time had I shipped the device instead of carrying
it with me.

I asked what I should do, given that my plane was scheduled to leave
in less than an hour.  Neither was sure, but the fellow in the suit
seemed willing leave it to the discretion of the uniformed guy.  ``How
does this thing work, anyway?'' he asked.  I tried to explain as best
as I could, trying to make it sound as harmless as it is.  ``You mean
like that Clipper chip?'' he asked.

At this point, given that he has a laptop and knows something about
the Clipper chip, I figured that maybe there was some hope of making
my flight.  Or maybe I was about to spend the night in jail.  In my
mind, I put it at about a 90:10 hope:jail ratio.

Then he asked, ``Do you know about this stuff?''

So we chatted about computers and cryptography for a while.  Finally,
the two of them decided that it wouldn't really hurt for them to just
sign the form as long as I promise to call my lawyer and get the SED
situation straightened out ASAP.  They assured me that I won't be
arrested or have any other trouble upon my return.

I made my flight, validated license in hand.

An aside: Throughout my trip, I discovered an interesting thing about
the TSD and the various options I was carrying with it.  Under X-ray
examination, it looks just like some kind of bomb.  (I suspect it was
the coiled handset cords).  Every time I went through a security
checkpoint, I had to dig the thing out of my luggage and show it to
the guard.  I almost missed the new ``Eurostar'' chunnel train (3hrs
15mins nonstop London->Brussels, airport-style checkin and security)
as the guards were trying to figure out whether thing thing was about
to explode.

On the way back to the US, it took me a little over an hour to get
through Customs.  I carried all my luggage with me, and, expecting a
bit of a hassle, made sure to be the FIRST person to reach Customs.
The inspector was ready to wordlessly accept my declaration form and
send me on my way when I opened my mouth and explained that I needed
to get my export license stamped.  The inspector explained that this
had to be done by something called the ``Ships Office''.  I was sent
to an unoccupied back room (a different back room than before), and
told to wait.  I thought about the recent Customs experiences of Phil
Zimmermann.  After about half an hour of waiting, an officer came in
and asked me what I needed.  I explained that I needed to get my
export license endorsed, and she shrugged and told me that she had to
``process the flight'' first.  As best as I could tell, her job was to
clear the airplane itself through customs, that being, technically
speaking, a very expensive import.  It would take a little wile.  She
was pleasant enough, though, and at least didn't look at me as if she
intended to send me to jail or have me strip searched.

Finally, she finished with the plane and asked me for my form.  She
studied it carefully, obviously having never seen one before, and
eventually asked me what, exactly, she was supposed to do.  I
explained that I had never actually gone through this process before
but I understood that she's supposed to record the fact that I was
re-importing the device and stamp my form somewhere.  She explained
that she didn't know of any place for her to record this.  After some
discussion, we agreed that the best thing to do was to make a Xerox
copy of my license and arrange for it to go wherever it had to go
later.  She stamped the back of the license and sent me out.  It was a
little over an hour after I first reached the Customs desk.

My conclusion from all this is that it just isn't possible for an
individual traveler to follow the rules.  Even having gone through the
process now, I still have no idea how to obtain, let alone file, the
proper forms, even for a device that's already been determined to be
exportable.  The export of ITAR-controlled items is ordinarily handled
by cargo shipment, not by hand carrying by travelers, and the system
is simply not geared to deal with exceptions.  Technically speaking,
everyone with a laptop disk encryption program who travels
internationally is in violation of the ITAR, but since no one actually
knows this, no mechanism exists to deal with it.  While (fortunately)
everyone I dealt with was sympathetic, no one in the government who I
spoke with was actually able to help me follow the rules.  I was able
to leave and come back only because everyone involved eventually
recognized that my telephone was pretty harmless, that my intentions
were good, and that the best thing to do was be flexible.  Had anyone
taken a hard line and tried to enforce the letter of the law, I simply
wouldn't have been able to take the thing with me, even with my
license.  Had I simply taken it with me and come back instead of
calling attention to myself by trying to follow the rules, no one would
have noticed.

DRAFT - PLEASE DO NOT QUOTE OR REDISTRIBUTE