NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/alt/drugs/20116

Text File | 1992-12-22 | 14.2 KB | 315 lines

Newsgroups: alt.drugs
Path: sparky!uunet!cs.utexas.edu!zaphod.mps.ohio-state.edu!sol.ctr.columbia.edu!titan.ucc.umass.edu!locklin
From: [e-mail] (Space for Rent )
Subject: PGP warning (ooo; I am scared)
Sender: [e-mail]
Organization: Campus Crusade for Cthulhu
Date: Tue, 22 Dec 1992 04:12:19 GMT
Message-ID: <[e-mail]>
X-Posted-From: titan.ucc.umass.edu
NNTP-Posting-Host: sol.ctr.columbia.edu
Lines: 302


I recieved this from a freind who gave me a copy of pgp; just goes to show
ya that big bro doesn't want us to have nice toys like this...

@@@@@@@@@@@@@@@@@@@@@@@@@@@@CUT@@@@@@@FOLD@@@@@@@@@@MANIPULATE@@@@@@@@@@@@@@@

This is what was posted as info on pgp.


Risks of using pgp

One should be careful about assuming that the documentation in
electronically distributed software is accurate, especially where
law is concerned.

There is much that the documentation for pgp does not tell you about
patent and export law that you should be aware of.  Some of the
statements and interpretations of patent and export law are simply
false. This note will attempt to offer some clarification and accurate
information.

pgp seems to be an attempt to mislead netters into joining an
illegal activity that violates patent and export law, letting them
believe that they run no serious risk in doing so.

PATENTS

Patent law prohibits anyone from making, using, or selling a device
that practices methods described in a U.S. patent.  pgp admits
practicing methods described in US patent #4,405,829, issued to the
Massachusetts Institute of Technology, and licensed by Public Key
Partners.

Those who send signed or encrypted messages, post the pgp program,
or encourage others to do so are inducing infringement. Under
patent law, there is no distinction between inducement to infringe and
direct infringement. You are just as liable.

Since you are aware of the RSA patent, your infringement is willful
and deliberate. Under patent law, a patent holder is entitled to seek
triple damages and legal fees from deliberate infringers.  While the
pgp documentation suggests that you probably won't get sued, it
doesn't tell you what can happen when patent holders assert their
rights against infringement.

Free and legal RSA software is available. RSA Data Security has
released a program, including source code, called RSAREF. This program
is available free to any U.S. person for non-commercial use.
Applications may be built on RSAREF and freely distributed, subject to
export law.  An application that provides email privacy, based on
RSAREF, which uses the RSA and DES algorithms, called RIPEM is an
example. For information, send email to [e-mail] or
[e-mail].

NOTE: The pgp documentation states that PKP acquired the patent rights
to RSA "... which was developed with your tax dollars..." This is very
misleading.  U.S. tax dollars only partially funded researchers at MIT
who developed RSA. The U.S. government itself received royalty-free
use in return.  This is standard practice whenever the government
provides financial assistance.  The patents on public-key are no
different and were handled no differently than any others developed at
universities with partial government funding. In fact, almost every
patent granted to a major university includes government support,
returns royalty-free rights to the government, and is then licensed
commercially by the universities to private parties.

EXPORT LAW

pgp leads users to believe that it has circumvented export controls
when it says "...there are no import restrictions on bringing
cryptographic technology into the USA."  You are led to believe that
since you didn't import it, it's legal for you to use it in the US.
The "no import restrictions" claim has been made so many times, many
people probably believe it.

One would be well advised not to accept this legal opinion.  While
stated as if it were a well-known fact, the claim that "there are no
import restrictions" is simply false.  Section 123.2 of the ITAR
(International Traffic in Arms Regulations) reads:

"123.2 Imports. No defense article may be imported into the United
States unless (a) it was previously exported temporarily under a
license issued by the Office of Munitions Control; or (b) it
constitutes a temporary import/intransit shipment licensed under
Section 123.3; or (c) its import is authorized by the Department of
the Treasury (see 27 CFR parts 47, 178, and 179)."

Was pgp illegally exported? Was pgp illegally imported?  Of course.
It didn't export or import itself.  pgp 1 was illegally exported from
the U.S., and pgp 2, based on pgp 1, is illegally imported into the
U.S.  Is a license required? According to the ITAR, it is.  ITAR
Section 125.2, "Exports of unclassified technical data," paragraph (c)
reads:

"(c) Disclosures. Unless otherwise expressly exempted in this
subchapter, a license is required for the oral, visual, or documentary
disclosure of technical data...  A license is required regardless
of the manner in which the technical data is transmitted (e.g., in
person, by telephone, correspondence, electronic means, telex, etc.)."

What is "export?" Section 120.10, "Export," begins:

"'Export' means, for purposes of this subchapter: ...(c) Sending or
taking technical data outside of the United States in any manner
except that by mere travel outside of the United States by a person
whose technical knowledge includes technical data; or..."

Is pgp subject to the ITAR? See Part 121, the Munitions List, in
particular Category XIII, of which paragraph (b) reads, in part,
"...privacy devices, cryptographic devices and software (encoding and
decoding), and components specifically designed or modified
therefore,..."

A further definition in 121.8, paragraph (f) reads: "Software
includes but is not limited to the system functional design,
logic flow, algorithms, application programs, ..."

pgp encourages you to post it on computer bulletin boards.  Anybody
who considers following this advice is taking quite a risk.  When you
make a defense item available on a BBS, you have exported it.

pgp's obvious attempts to downplay any risk of violating export law
won't help you a bit if you're ever charged under the ITAR.

Penalties under the ITARs are quite serious.  The ITARs were clearly
designed to put teeth into laws that make exporting munitions illegal.
It's unfortunate that cryptography is on the munitions list. But it
is.  pgp is software tainted by serious ITAR violations.

From [e-mail] Thu Dec 17 17:59:29 1992
Resent-From: [e-mail]
Received: by eagle.is.lmsc.lockheed.com (5.57/Ultrix3.0-C)
    id AA29823; Thu, 17 Dec 92 14:53:37 -0800
Date: Thu, 17 Dec 92 14:53:37 -0800
From: [e-mail]
Resent-Message-Id: <[e-mail]>
Message-Id: <[e-mail]>
Received: from LMSC5 by LMSC5.IS.LMSC.LOCKHEED.COM (IBM VM SMTP V2R1)
   with BSMTP id 2232; Thu, 17 Dec 92 13:33:22 PST
Subject:      pgp
Comments:     Converted from PROFS to RFC822 format by PUMP V2.2
Resent-Date:  Thu, 17 Dec 92  13:33:20 PST
Resent-To: John Newlin <[e-mail]>,
        Judy Birmingham <[e-mail]>,
        SCOTT C LOCKLIN <[e-mail]>,
        JAY ALBERTS <[e-mail]>,
        Ed Railey <NTMTV![e-mail]>,
        "Cooper, G.T." <LJ05540@lmsc5>, "Sutton, A.F." <6884580@lmsc5>
Apparently-To: <NTMTV![e-mail]>
Apparently-To: <[e-mail]>
Apparently-To: <[e-mail]>
Apparently-To: <[e-mail]>
Status: OR

      Internet:[e-mail]

I may have sent you a program entitled PGP2.1. Before using it, you may
want to read this note from the prez of the company that developed the
algorithem.

***************************************************************
*  Phone:[phone]     In Plant:46617   Mail Stop:27A1/509 *
*                           ><IXOYE>                          *
***************************************************************
*** Forwarding note from JIM     --CMSNAMES 12/17/92 11:38 ***
Received: from eagle.is.lmsc.lockheed.com by LMSC5.IS.LMSC.LOCKHEED.COM
   (IBM VM SMTP V2R1) with TCP; Thu, 17 Dec 92 11:38:01 PST
Received: by eagle.is.lmsc.lockheed.com (5.57/Ultrix3.0-C)
    id AA26101; Thu, 17 Dec 92 11:34:11 -0800
Received: by RSA.COM
    id AA07980; Thu, 17 Dec 92 11:35:59 PST
Date: Thu, 17 Dec 92 11:35:59 PST
From: [e-mail] (Jim Bidzos)
Message-Id: <[e-mail]>
To: [e-mail]
Subject: pgp


This is what was posted as info on pgp.



Risks of using pgp

One should be careful about assuming that the documentation in
electronically distributed software is accurate, especially where
law is concerned.

There is much that the documentation for pgp does not tell you about
patent and export law that you should be aware of.  Some of the
statements and interpretations of patent and export law are simply
false. This note will attempt to offer some clarification and accurate
information.

pgp seems to be an attempt to mislead netters into joining an
illegal activity that violates patent and export law, letting them
believe that they run no serious risk in doing so.

PATENTS

Patent law prohibits anyone from making, using, or selling a device
that practices methods described in a U.S. patent.  pgp admits
practicing methods described in US patent #4,405,829, issued to the
Massachusetts Institute of Technology, and licensed by Public Key
Partners.

Those who send signed or encrypted messages, post the pgp program,
or encourage others to do so are inducing infringement. Under
patent law, there is no distinction between inducement to infringe and
direct infringement. You are just as liable.

Since you are aware of the RSA patent, your infringement is willful
and deliberate. Under patent law, a patent holder is entitled to seek
triple damages and legal fees from deliberate infringers.  While the
pgp documentation suggests that you probably won't get sued, it
doesn't tell you what can happen when patent holders assert their
rights against infringement.

Free and legal RSA software is available. RSA Data Security has
released a program, including source code, called RSAREF. This program
is available free to any U.S. person for non-commercial use.
Applications may be built on RSAREF and freely distributed, subject to
export law.  An application that provides email privacy, based on
RSAREF, which uses the RSA and DES algorithms, called RIPEM is an
example. For information, send email to [e-mail] or
[e-mail].

NOTE: The pgp documentation states that PKP acquired the patent rights
to RSA "... which was developed with your tax dollars..." This is very
misleading.  U.S. tax dollars only partially funded researchers at MIT
who developed RSA. The U.S. government itself received royalty-free
use in return.  This is standard practice whenever the government
provides financial assistance.  The patents on public-key are no
different and were handled no differently than any others developed at
universities with partial government funding. In fact, almost every
patent granted to a major university includes government support,
returns royalty-free rights to the government, and is then licensed
commercially by the universities to private parties.

EXPORT LAW

pgp leads users to believe that it has circumvented export controls
when it says "...there are no import restrictions on bringing
cryptographic technology into the USA."  You are led to believe that
since you didn't import it, it's legal for you to use it in the US.
The "no import restrictions" claim has been made so many times, many
people probably believe it.

One would be well advised not to accept this legal opinion.  While
stated as if it were a well-known fact, the claim that "there are no
import restrictions" is simply false.  Section 123.2 of the ITAR
(International Traffic in Arms Regulations) reads:

"123.2 Imports. No defense article may be imported into the United
States unless (a) it was previously exported temporarily under a
license issued by the Office of Munitions Control; or (b) it
constitutes a temporary import/intransit shipment licensed under
Section 123.3; or (c) its import is authorized by the Department of
the Treasury (see 27 CFR parts 47, 178, and 179)."

Was pgp illegally exported? Was pgp illegally imported?  Of course.
It didn't export or import itself.  pgp 1 was illegally exported from
the U.S., and pgp 2, based on pgp 1, is illegally imported into the
U.S.  Is a license required? According to the ITAR, it is.  ITAR
Section 125.2, "Exports of unclassified technical data," paragraph (c)
reads:

"(c) Disclosures. Unless otherwise expressly exempted in this
subchapter, a license is required for the oral, visual, or documentary
disclosure of technical data...  A license is required regardless
of the manner in which the technical data is transmitted (e.g., in
person, by telephone, correspondence, electronic means, telex, etc.)."

What is "export?" Section 120.10, "Export," begins:

"'Export' means, for purposes of this subchapter: ...(c) Sending or
taking technical data outside of the United States in any manner
except that by mere travel outside of the United States by a person
whose technical knowledge includes technical data; or..."

Is pgp subject to the ITAR? See Part 121, the Munitions List, in
particular Category XIII, of which paragraph (b) reads, in part,
"...privacy devices, cryptographic devices and software (encoding and
decoding), and components specifically designed or modified
therefore,..."

A further definition in 121.8, paragraph (f) reads: "Software
includes but is not limited to the system functional design,
logic flow, algorithms, application programs, ..."

pgp encourages you to post it on computer bulletin boards.  Anybody
who considers following this advice is taking quite a risk.  When you
make a defense item available on a BBS, you have exported it.

pgp's obvious attempts to downplay any risk of violating export law
won't help you a bit if you're ever charged under the ITAR.

Penalties under the ITARs are quite serious.  The ITARs were clearly
designed to put teeth into laws that make exporting munitions illegal.
It's unfortunate that cryptography is on the munitions list. But it
is.  pgp is software tainted by serious ITAR violations.