Re: ITAR

[axlotl <axlotl@rigel.infonex.com>]

On Wed, Nov 19, 1997 at 01:00:02AM -0000, lcs Mixmaster Remailer wrote:
> If someone writes a piece of software, a networking layer, or anything else
> with support for later cryptographic enhancement but doesn't actually
> include the cryptographic implementation and it is later added by somebody
> outside of the United States does this fall under ITAR? 

Crypto exports have been governed (for the most part) by the EAR, not
ITAR, for about 11 months now. The EARs can be found at 15 CFR 730 et seq.

> In other words the original U.S. authors wrote the software with support for
> crypto, function hooks, etc. They didn't include any crypto at all. Somebody
> outside the United States uses these hooks and writes strong cryptography.
> These modifications are kept as patches and never exported from the U.S.. Is
> this allowed?

No. Software designed or modified to use cryptography is export controlled;
see ECCN 5D002 in 15 CFR part 744.

> What if the U.S. authors are actively collaborating with the
> non-US authors?

See 15 CFR 744.9, "Restrictions on Technical Assistance by US Persons With 
Respect to Encryption Items":

(a) General prohibition

No U.S. person may, without a license from BXA, provide technical assistance
(including training) to foreign persons with the intent to aid a foreign
person in the development or manufacture outside the United States of
encryption commodities and software that, if of United States origin, would
be controlled for"EI" reasons under ECCN 5A002 or 5D002. Note that this
prohibition does not apply if the U.S. person providing the assistance has a
license or is otherwise entitled to export the encryption commodities and
software in question to the foreign person(s) receiving the assistance. Note
in addition that the mere teaching or discussion of information about
cryptography, including, for example, in an academic setting, by itself would
not establish the intent described in this section, even where foreign persons
are present.

 ---

 also, see the definition of "technology" in 15 CFR 772 -

 "Technology". (General Technology Note)-- Specific information necessary for
 the "development", "production", or "use" of a product. The information takes
 the form of "technical data" or "technical assistance". Controlled "technology"
 is defined in the General Technology Note and in the Commerce Control List
 (Supplement No. 1 to part 774 of the EAR).

      N.B.: Technical assistance--May take forms such as instruction, skills
      training, working knowledge, consulting services.

      Note: "Technical assistance" may involve transfer of "technical data".

 "Technical data".--May take forms such as blueprints, plans, diagrams, models,
 formulae, tables, engineering designs and specifications, manuals and
 instructions written or recorded on other media or devices such as disk,
 tape, read-only memories.


-- 
axlotl@cyberpass.net

PGP signature