NetNews Usenet Archive 1992 #30/NN_1992_30.iso/spool/sci/crypt/5763

Internet Message Format | 1992-12-12 | 4.0 KB

Xref: sparky sci.crypt:5763 alt.security.pgp:218
Newsgroups: sci.crypt,alt.security.pgp
Path: sparky!uunet!zaphod.mps.ohio-state.edu!uwm.edu!linac!att!cbnewse!cbnewsd!att-out!walter!qualcom.qualcomm.com!servo.qualcomm.com!karn
From: [e-mail] (Phil Karn)
Subject: Re: PKP/RSA comments on PGP legality
Message-ID: <[e-mail]>
Sender: [e-mail]
Nntp-Posting-Host: servo.qualcomm.com
Organization: Qualcomm, Inc
References: <[e-mail]> <[e-mail]> <[e-mail]>
Date: Thu, 17 Dec 1992 03:14:21 GMT
Lines: 61

In article <[e-mail]> [e-mail] (Tim Moore) writes:
>I was asking questions about ITAR, but I guess the Munitions Act is
>the basis for that.  What is the law?  If I go to the law library on
>campus and ask to see the text of ITAR, is that enough, or should I go
>in citing chapter and verse?  By the way, is this stuff really a law
>or is it regulations draw up by bureaucrats in the executive branch?

It's the latter. The International Traffic in Arms regulations are
part of the Code of Federal Regulations (CFR). It is maintained by the
State Department under authority delegated by various acts of
Congress.  That's how every government regulatory agency operates.

>You say that if the dimensions are published here by the Air Force,
>then Tamya et al. aren't violating any export laws by making use of
>them.  In fact the dimensions and rough performance characteristics of
>the F-16 are available in hundreds of books and magazines published in
>the U.S.  Maybe you could reveal how exporting this information
>doesn't violate ITAR since the passages quoted by PKP would seem to
>forbid it.

A part of the ITARs not quoted by PKP exempts from control any
"technical data" that is in the public domain, with "public domain"
having a broader meaning than the same term as used in copyright law.
Here it refers to anything that is freely and widely available to the
public in libraries, magazines, books, etc, as opposed to proprietary
information available only under non-disclosure agreement.  So
"technical data" published in, say, Aviation Week can be exported
anywhere in the world, regardless of what it relates to. It also means
that you can export articles and books describing DES or RSA.

Now the question arises, is software "technical data" that would be
subject to the public domain exemption? Some have claimed it is, which
would make any public domain crypto code freely exportable (even as a
proprietary implementation of the same algorithms would require an
export license). But other legal interpretations of the ITARs claim
that software is a "defense article", not "technical data", and the
public domain exemptions apply only to the latter. By this theory you
can't export even a widely available public domain encryption package.

Clearly this situation is absurd, given the fuzzy distinction between
"technical data" and "software" as it relates to a crypto algorithm.
(A description of an algorithm is "technical data", while a direct
implementation of that same algorithm in C is "software". Evidently
the State Dept believes that only Americans know how to turn the
former into the latter.)

Privately, people associated with the "intelligence community" freely
admit the absurdity of the NSA's current position regarding public
domain crypto software. They know that it's widely ignored, and it
wouldn't stand up in a real court test anyway.  (One former assistant
US attorney told me that no self-respecting prosecutor would try to
make a case based on exporting something in the public domain. To back
it up he offered to defend me pro bono if I should ever get in trouble
over my public domain DES code.)

Still, the NSA is trying to slow down the inevitable spread of
cryptography as much as they can with the FUD (Fear, Uncertainty and
Doubt) factor.  Hopefully the new administration will soon put an end
to this nonsense.

Phil