Re: Distributing cryptographic code

[Adam Back <aba@dcs.ex.ac.uk>]

Bill Stewart <stewarts@ix.netcom.com> writes:
> At 11:44 AM 5/18/97 +0100, Adam Back wrote:
> >> I don`t recall what the situation is in the US, is it the case that
> >> the provider of the information is guilty of export, or the person
> >> that actually downloads it, if it is available via anonymous FTP???
> 
> >The downloader by definition is restricted by his own national laws
> >not by US laws.  US attempted world policeman attitude does not mean
> >that US laws apply outside the US, particularly not to non-US citizens
> >outside the US.
> 
> They may apply to you anyway

I was arguing that US laws do not apply to me living outside the US.
The US courts/government may claim otherwise but this does not alter
that fact.

Where international agreements have been agreed the laws become part
of the legal framework of the agreeing countries.

Extradition is another method, but people normally only get extradited
from their own country if they commit a crime against a citizen of the
extraditing country.

And finally kidnap, the fact that this is an extra-legal process does
not bother the US.  (In fact they even declare it legal if they
consider it appropriate, as I understand it.)

> - they're not very enforceable if you're outside US territory,
> though if you try to visit the US once they've pegged you as a
> crypto-terrorist aider-and-abetter of drug smugglers, money
> launderers, child pornographers, and Commies, they could give you a
> hard time.  Just because you haven't been caught YET doesn't make
> you innocent :-)

For the sake of argument if I were detained at a US airport, or
kidnapped and taken to the US, and further was found to be "guilty" as
defined by US law, I would not be guilty, and I would hope that my
country would attempt to intervene.

The reality of all this is strained however because, a) they wouldn't
extradite someone, nor kidnap them for this, b) they wouldn't detain
me if I entered the US (I did last year with no ill effects), c) I am
having difficulty imagining what it is they could legitimately charge
me with, even by US standards of legitmacy with regard to crypto
export.  I attempted to _import_ a piece of software into the UK, no
crime there.

> Remember the Canadian author / Disney hero Farley Mowat?  
> He once got annoyed enough at the US military for flying nuclear-armed
> bombers over Canada that he shot at some as they crossed the border.
> Sure, his .22 caliber rifle wasn't going to hit a plane at 30,000 feet,
> and he was just making a political statement by it, but he was
> banned from the US for years.

I suspect it would be dodgy shooting at military aircraft in Canada
also.  In the UK, and most of EU (with the exclusion of France), we
can export electronically (on the web etc) to our hearts content.  The
situation with tangible exports, at least in the UK, is different.  I
understand you need a license to export tangibly.  I was unaware of
this at the time I started exporing T-shirts, but I'm aware of it now,
and have no particular intention of ceasing to export T-shirts.  If
they want to do something about it and make a media spectacle of
themselves, they're most welcome to try :-)

Actually I took a couple of my munitions T-shirts with me when I went
to the US last year, and bought them back out with me.  I was wearing
one of them (under another garment) through the airport as I left.
Again if the US would like to try something, the next time I'm there
they are welcome to try.

Unfortunately perhaps it appears, at least according to Peter Junger
that the T-shirts are probably OK now under the EAR regulations being
printed material, whilst I think he held that they would be
technically a violation under ITAR.  ITAR was the active regulation at
the time.

> >Self appointed world policemen are fooling themselves if they think
> >they have any control over bit flow.
> 
> As long as it keeps Americans from using strong crypto on an 
> everyday basis, for everything, and from taking the attitude that
> their privacy is their own business, it's working.
> Doesn't matter if a few foreign spies can talk to each other.

True enough.

Adam
-- 
Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`