Re: Distributing cryptographic code

[iang@cs.berkeley.edu (Ian Goldberg)]

-----BEGIN PGP SIGNED MESSAGE-----

In article <3.0.1.32.19970517183655.00867d60@mail.io.com>,
Greg Broiles  <gbroiles@netbox.com> wrote:
>But a clerk in Egghead who sells a copy of 128-bit Netscape to a "foreign
>person" is also guilty of an export violation.

Not the way I read the regs (IANAL)...  734.2(b) provides a completely
different definition of "export" for encryption software ((b)(9) instead
of (b)(2)(ii)).

   - Ian

734.2(b):
	(b) Export and reexport--(1) Definition of export. ``Export'' means
    an actual shipment or transmission of items subject to the EAR out of
    the United States, or release of technology or software subject to the
    EAR to a foreign national in the United States, as described in
    paragraph (b)(2)(ii) of this section. See part 772 of the EAR for the
    definition that applies to exports of satellites subject to the EAR.
    See paragraph (b)(9) of this section for the definition that applies to
    exports of encryption source code and object code software subject to
    the EAR.
	(2) Export of technology or software. (See paragraph (b)(9) for
    provisions that apply to encryption source code and object code
    software.) ``Export'' of technology or software, excluding encryption
    software subject to ``EI'' controls, includes:
    <snip, irrelevant to EI>

734.2(b)(9):
	(9) Export of encryption source code and object code software. (i)
    For purposes of the EAR, the export of encryption source code and
    object code software means:
	(A) An actual shipment, transfer, or transmission out of the United
    States (see also paragraph (b)(9)(ii) of this section); or
	(B) A transfer of such software in the United States to an embassy
    or affiliate of a foreign country.
	(ii) The export of encryption source code and object code software
    controlled for EI reasons under ECCN 5D002 on the Commerce Control List
    (see Supplement No. 1 to part 774 of the EAR) includes downloading, or
    causing the downloading of, such software to locations (including
    electronic bulletin boards, Internet file transfer protocol, and World
    Wide Web sites) outside the U.S., or making such software available for
    transfer outside the United States, over wire, cable, radio,
    electromagnetic, photooptical, photoelectric or other comparable
    communications facilities accessible to persons outside the United
    States, including transfers from electronic bulletin boards, Internet
    file transfer protocol and World Wide Web sites, unless the person
    making the software available takes precautions adequate to prevent
    unauthorized transfer of such code outside the United States. Such
    precautions shall include:
    <snip; this part was in the previous note>

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM38TokZRiTErSPb1AQHZJgP/aFc77erbX8CTK5dKDOskMas5eqHPTj36
VkALz17gkkZLbOs8jafc/hCVRgAC5wiF29CLE33XX2Ngvb8O98mwQFFGnJaUj0+9
70Q7fuKKvjvo19V+yPWVw/Q9ZJR4uA+qpIyyIZf28HIn+949Mpyq75eOs686se3t
AX5q7acfjJc=
=7kz4
-----END PGP SIGNATURE-----