NetNews Usenet Archive 1992 #30/NN_1992_30.iso/spool/sci/crypt/5746

Internet Message Format | 1992-12-16 | 5.6 KB

Xref: sparky sci.crypt:5746 alt.security.pgp:210
Newsgroups: sci.crypt,alt.security.pgp
Path: sparky!uunet!caen!hellgate.utah.edu!hellgate!moore
From: [e-mail] (Tim Moore)
Subject: Re: PKP/RSA comments on PGP legality
Message-ID: <[e-mail]>
In-reply-to: [e-mail]'s message of 11 Dec 92 18:16:23 GMT
Organization: University of Utah CS Dept
References: <[e-mail]>
Date: 16 Dec 92 13:12:18
Lines: 110

In article <[e-mail]> [e-mail] (Carl Ellison) writes:

   I went to the horse's mouth and asked some folks at PKP & RSA to comment
   on PGP legality.  Here's their reply.  I have permission to post it.

PKP's description of the export laws reads like a Bobby Inman wet
dream.  I'd like clarification of some of the points below.

   EXPORT LAW
...
   "123.2 Imports. No defense article may be imported into the United
   States unless (a) it was previously exported temporarily under a
   license issued by the Office of Munitions Control; or (b) it
   constitutes a temporary import/intransit shipment licensed under
   Section 123.3; or (c) its import is authorized by the Department of
   the Treasury (see 27 CFR parts 47, 178, and 179)."

Is "defense article" a synonym for "anything on the Munitions List",
or does it mean something else in the context of this paragraph?

   Was pgp illegally exported? Was pgp illegally imported?  Of course.
   It didn't export or import itself.  pgp 1 was illegally exported from
   the U.S., and pgp 2, based on pgp 1, is illegally imported into the
   U.S.  Is a license required? According to the ITAR, it is.  ITAR
   Section 125.2, "Exports of unclassified technical data," paragraph (c)
   reads:

What, exactly, is the "technical data" refered to here?  The
implication is that it is information about any item otherwise on the
munitions list, but that seems ridiculous.  An F16 would be on the
munitions list, but its dimensions are surely not classified.
Japanese model makers got that information somehow, and I doubt that
they violated the ITAR in doing so.

Or does the ITAR restrict the export of any technical data whatsoever?
am I violating the ITAR when I correspond with a colleague in Sweden
about details of gcc?

The concept of restricting "unclassified technical data" seems
unconstitutional, but I realize that that might not have any bearing on
import/export regulations.

   "(c) Disclosures. Unless otherwise expressly exempted in this
   subchapter, a license is required for the oral, visual, or documentary
   disclosure of technical data...  A license is required regardless of
   the manner in which the technical data is transmitted (e.g., in
   person, by telephone, correspondence, electronic means, telex, etc.)."

   What is "export?" Section 120.10, "Export," begins:

   "'Export' means, for purposes of this subchapter: ...(c) Sending or
   taking technical data outside of the United States in any manner
   except that by mere travel outside of the United States by a person
   whose technical knowledge includes technical data; or..."

   Is pgp subject to the ITAR? See Part 121, the Munitions List, in
   particular Category XIII, of which paragraph (b) reads, in part,
   "...privacy devices, cryptographic devices and software (encoding and
   decoding), and components specifically designed or modified
   therefore,..."

   A further definition in 121.8, paragraph (f) reads: "Software
   includes but is not limited to the system functional design,
   logic flow, algorithms, application programs, ..."

This paragraph seems to be trying to restrict the import and export of
source code and more.  What is an algorithm?  Is it a description of a
process, or the process itself?  Did my university's library violate
the ITAR by recieving copies of EUROCRYPT proceedings which include,
among other things, descriptions of the IDEA algorithm?  Is it
illegal to export the DES specification?

   pgp encourages you to post it on computer bulletin boards.  Anybody
   who considers following this advice is taking quite a risk.  When you
   make a defense item available on a BBS, you have exported it.

I doubt that very much.  Whoever downloads the defense item exports
it, not the owner of the BBS.  Is every BBS that makes available
implementations of DES exporting it, and therefore violating the ITAR?

...

   These points on patent and export law are straightforward and can
   easily be confirmed with legal advice.
:-)

 Phil Zimmerman's lawyer seems to disagree.  From the pgp docs:
"I wrote my PGP software from scratch, with my own implementation of
the RSA algorithm.  I didn't steal any software from PKP.  Before
publishing PGP, I got a formal written legal opinion from a patent
attorney with extensive experience in software patents.  I'm
convinced that publishing PGP the way I did does not violate patent
law."
...

   The documentation to pgp would have readers believe that pgp was the
   result of a noble desire to save everyone from an evil government
   threatening to deny rights to privacy; that users and distributors of
   pgp have little or nothing to fear from the patent holders, who, it is
   implied, are probably dishonest anyway; and that one shouldn't be
   concerned about export controls because pgp beat the system for
   everyone by having been developed overseas and imported legally.  The
   facts simply don't support these claims.

Maybe not, but this missive from PKP does.

--
Tim Moore                    [e-mail] {bellcore,hplabs}!utah-cs!moore
"Wind in my hair - Shifting and drifting - Mechanical music - Adrenaline surge"
    - Rush