NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/sci/crypt/6114

Internet Message Format | 1992-12-23 | 6.5 KB

Xref: sparky sci.crypt:6114 alt.security.pgp:398
Newsgroups: sci.crypt,alt.security.pgp
Path: sparky!uunet!mcsun!Germany.EU.net!rzsun2.informatik.uni-hamburg.de!fbihh!bontchev
From: [e-mail] (Vesselin Bontchev)
Subject: Re: PKP/RSA comments on PGP legality
Message-ID: <bontchev.725112430@fbihh>
Sender: [e-mail] (Mr. News)
Reply-To: [e-mail]
Organization: Virus Test Center, University of Hamburg
References: <bontchev.724946717@fbihh> <[e-mail]> <bontchev.725036591@fbihh> <[e-mail]>
Date: 23 Dec 92 12:07:10 GMT
Lines: 123

[e-mail] (David Sternlight) writes:

> I don't argue the law and then if that doesn't work, argue ethics.

Well, this is what was obvious from your messages. You didn't clearly
state when and where you are applying legal and when and where you are
applying ethical arguments. If you have stated it in some
sophisticated way that I have failed to notice, then forgive me for
being so dumb... :-)

> Vesselin cannot have been reading my posts very carefully if
> he thinks so.

Can't I? How to you know? I -have- been reading your posts very
carefully and nevertheless think so...

> In the U.S., I argue the law, since the issue is patents and that RSA
> has one, and that the Munitions act covers imports as well as exports.

> In Europe, where I have never argued RSA's patents apply, and I have
> never argued the U.S. Munitions laws apply, I argue the ethics of
> taking an invention without compensation.

Ah, there is already an improvement. You have bothered to notice that
the world can be divided into at least two parts - USA and Europe, and
that the rules that apply in one of the parts do not necessarily apply
to the other... Now you should accept one more correction - Europe
is not everything that is not the USA. The world is large, you know...
:-)

> It's not a fallback position, but two separate sets of arguments for
> two separate situations--the one in Europe and the one in the U.S.

I saw that somebody has posted a detailled discussion on the
possibilities of PGP being illegal in the USA and being unethical
anywhere. I couldn't post a better reply. It clearly explains that the
legal and ethical issues of using PGP are at best debatable, so
everybody should answer to those questions for him/herself; decide
whether to use (or not) PGP him/herself; and not impose his/her
opinion to the rest of the world.

I would add only this. Considering the ethics of using PGP outside the
USA. The inventors of RSA have decided to patent their method in the
USA and not anywhere else. Therefore, they have decided to allow
everybody else to use it for free. We do not know what has caused this
solution. Many people think that they have done so, in order to
prevent the US government from "covering" their discovery. If it is
indeed so, then they deserve our admiration. But again, by deciding to
do so, they have obviously indended to provide their method to the
public. It it weren't so, they wouldn't publish it, right? Therefore,
it seems perfectly ethical to me to do that they have intended -
widely distribute and use their method. But again, your ethical system
might be different from mine, so I refuse to argue on this topic.

> Now let me try to cut through a lot of what seems to me to be
> posturing and rationalization about the legality of PGP in Europe. By
> starting a separate topic, I asked the public question about Munitions
> and crypto laws in European countries, and everybody who was so
> vociferous about their "rights" to use PGP there immediately fell
> silent.

Hey, what do you expect - to get an argumented answer to a serious
question like this in a few hours? I do not have detailled knowledge
of the German laws, so I feel incompetent to comment. I know somebody
in the BSI and will ask him, but right now are the Christmas
holidays...

> However, I received several e-mail responses from those who
> hadn't participated so far, pointing out, with details, that the
> crypto and munitions laws in most European countries (maybe not
> Finland or Bulgaria--dunno) are much more stringent than in the U.S.

I mentioned several times that we have enough problems with -our-
silly laws, so we definitively do not want to bother with the silly
laws in the US or anywhere else...

I can speak only about Bulgaria. We do not consider cryptographic
software as weapons. Owning a fire weapon is explicitely forbidden in
Bulgaria, except for hunting, but even then you can get only some
special kinds of rifles and only with a special permission.
Import/export of cryptographic software is not forbidden, unless it is
covered by a "state secret" or "military secret" act. These acts never
cover the import of something. On the other side, they cover not only
the export, but also the possession, access, or attempts to access the
items - i.e. if something is declared as military secret, it is
illegal even to possess or try to access it, not just to export it.

PGP and DES are definitively legal there.

> Thus I suggest for Vesselin's (and others') consideration that they
> may be violating the laws of the countries they are in by using PGP
> without (for example) getting permission from the appropriate
> Minister, as in France.

I've heard strange things about France - that even the import of
encrypted information is prohibited (unless to passes the country in
transit, which is allowed), but I do not it for sure, so I am unable
to comment on it.

> If true, that would make all the posturing
> about how the U.S. Munitions laws don't apply to Europe and hence PGP
> is o.k. completely bogus.

Even if there are restrictions (which I doubt, but will check),
nevertheless the US muniton laws -don't- apply to Europe or to
anything except the USA. Besides, they are not laws at all (and may be
even unconstitutional) - they are just regulations.

> In the case of Vesselin, specifically, I suggest he check out
> the German crypto and Munitions laws, since that's where he
> apparently has PGP on a computer. If he's planning to use it
> in Bulgaria, he may also wish to check out those laws.

I will check the German laws. For Bulgaria I am certain - PGP is
perfectly legal.

Regards,
Vesselin
--
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:[phone], Fax: [phone]      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: [e-mail]    D-2000 Hamburg 54, Germany