NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/sci/crypt/6579

Internet Message Format | 1993-01-09 | 9.1 KB

Xref: sparky sci.crypt:6579 alt.security.ripem:77
Newsgroups: sci.crypt,alt.security.ripem
Path: sparky!uunet!gatech!darwin.sura.net!convex!hamrick
From: [e-mail] (Ed Hamrick)
Subject: Nonlinear Amplification of Information
Message-ID: <[e-mail]>
Summary: Source of "Munitions Act" "Usenet Legend"
Sender: [e-mail] (news access account)
Nntp-Posting-Host: convex1.convex.com
Organization: CONVEX Computer Corporation, Richardson, Tx., USA
Date: Sat, 09 Jan 1993 15:09:10 GMT
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.
Lines: 153

A former boss of mine, Bill Jensen, once explained to me the concept
of "non-linear amplification of information" when using electronic
communications in general, and usenet in particular.  The sci.crypt
newsgroup contains a prime example of this phenomenon.

Mr. Sternlight has often expressed his opinions on the exportability
of the PGP program.  Without making any judgements about the validity of
his premise that PGP can't be exported, I'd like to point out a
recurring inaccuracy.  More interesting than this recurring inaccuracy
is the spread of this inaccurate information in this newsgroup.

It's a small point, but illustrates the point that if you state something
on usenet as a fact, and state it repeatedly, many people will believe
it and even repeat it.  I believe that this phenomenon exists for the
same reason that Urban Legends exist - people enjoy believing Urban
Legends as much as they enjoy believing "Usenet Legends".

I did a little research into the "Usenet Legend" called the
"Munitions Act".  I took every message posted to sci.crypt in 1992
and searched for the first occurance of a message containing both
"munition" and "act" in the same sentence.  The first occurance of
this "Usenet Legend" was on December 12, 1992 and was posted by
David Sternlight.  In the remainder of that month there were a
total of 26 messages containing "munition" and "act" in the same
sentence (not including messages quoting messages containing this).
Of these 26 messages, 18 were written by Mr. Sternlight, and
8 were written by others.  The extracts from these 26 messages are
attached at the end of this message, with the initials of the
author at the front of the line.

sci.crypt Frequently Asked Questions posted 16 Mar 1992 (Carl Ellison)
>     Among its recommendations (p.93):  "...determine whether 'speech
>     scramblers' and 'privacy devices' indeed belong in the Auxiliary
>     Munitions Equipment category of the Munitions List, or whether they
>     can be deleted as neither exclusively nor primarily military items.

Information posted by Carl Ellison from PKA's lawyer
>
> ITAR Section 123.2 "Imports" reads
>
> "No defense article may be imported into the United
> States unless (a) it was previously exported temporarily under a
> license issued by the Office of Munitions Control; or (b) it
> constitutes a temporary import/intransit shipment licensed under
> Section 123.3; or (c) its import is authorized by the Department of
> the Treasury (see 27 CFR parts 47, 178, and 179)."
>
> ITAR Section 125.2, "Exports of unclassified technical data," paragraph (c)
> reads:
>
> "(c) Disclosures. Unless otherwise expressly exempted in this
> subchapter, a license is required for the oral, visual, or documentary
> disclosure of technical data...  A license is required regardless of
> the manner in which the technical data is transmitted (e.g., in
> person, by telephone, correspondence, electronic means, telex, etc.)."
>
> ITAR Section 120.10, "Export," begins:
>
> "'Export' means, for purposes of this subchapter: ...(c) Sending or
> taking technical data outside of the United States in any manner
> except that by mere travel outside of the United States by a person
> whose technical knowledge includes technical data; or..."
>
> ITAR Part 121, the Munitions List, Category XIII, paragraph (b) reads, in part,
> "...privacy devices, cryptographic devices and software (encoding and
> decoding), and components specifically designed or modified
> therefore,..."

Excerpt from the Frequently Asked Questions document written by PKA.
>
> All cryptographic products need export licenses
> from the State Department, acting under authority of the International
> Traffic in Arms Regulation (ITAR), which defines cryptographic devices
> (including software) as munitions. The U.S. government has historically
> been reluctant to grant export licenses for encryption products stronger
> than some level (usually not defined publicly); it does grant licenses for
> encryption products that are less strong and for authentication products,
> no matter how strong.

The conclusion I draw from this information is that there is not now, nor has
there ever been, a "Munitions Act". Part 121 of the International Traffic in
Arms Regulation (ITAR) is the "Munitions List".  Category XIII is the
Auxiliary Munitions Equipment category of the Munitions List.  This category
includes cryptographic software.

I have several questions about what PKA's lawyer chose to quote from the
ITAR, and since I can't find a copy anywhere on the net (using archie),
I'll have to wait till I have access to a copy in early February.

The questions I have are:

    1) Does the export license (that you use to get the goods through
       customs) get issued by the Department of Commerce or the Department
       of State (for items on the Munitions List)?  I know where I can
       find one of these issued export licenses, so unless someone
       who has actually seen one can tell me the answer, I'll look
       at it myself in February.

    2) Does the ITAR contain specific exemptions for publicly available
       software like the GTDA license contains?  Can somebody post
       a verbatim extract from the ITAR?

Regards,
Ed Hamrick

Postings to sci.crypt in 1992 containing original text of "munitions" and "act"
on the same line:

DS:going to have to import IDEA legally, under the munitions act. Otherwise
DS:Munitions Act provisions. Though I hope he's right, I'm not so
DS:sure. I think the Munitions Act covers cryptographic methods.
DS:the conflict between the Munitions Act and the First Amendment).
DS:against PGP under the Munitions Act.
DS:and the Munitions Act. I must tell Miller, who appears to be winging
DS:extensive quotations from the Munitions act which make it absolutely
DS:Munitions Act quotes in his message to me which convinces me he's
RS:of the (in my mind neanderthal) export provisions of the Munitions Act.
DS:can also come from the Munitions Act since PGP is based on an import
DS:Munitions Act and PKP's patents, and that this violation is occasioned
JD:it and forget about the munitions act angle.  Patent law gives overwhelming
JD:suit and to get the rest, he throws in a specious Munitions Act
AR:The Munitions Act?  Possibly, as it does seem (according to RSA) that the
AR:Munitions Act forbids import of munitions.  Possession of PGP clearly does
AR:Munitions Act.
AR:without violating the Munitions Act, unless the program being published
AR:makes it not subject to the Munitions Act, which (as far as I know, and not
AR:Did you read the Munitions act yourself?  How do you know that Bidzos
AR:I agree with you on this one; IF Bidzos quoted the Munitions Act correctly,
DS:place does he say one isn't violating the Munitions Act. He even concedes it's
DS:PGP in the US. is wronging the patent holders and violating the Munitions Act.
DS:"violated Munitions Act." And you'd never know. Something to think about. Life
AR:It appears not to be violating the Munitions Act, only the regulations.
DS:place does he say one isn't violating the Munitions Act. He even concedes it's
DS:PGP in the US. is wronging the patent holders and violating the Munitions Act.
DS:"violated Munitions Act." And you'd never know. Something to think about. Life
DS:He can't get RSAREF since it falls under the Munitions Act.
DS:argue it can't be imported into the U.S. without a Munitions Act
JP:Using the munitions act to restrict import/export of information not "owned"
DS:There would be no legal or Munitions Act problems, as far as I can see
DS:about the Munitions Act--namely whether IDEA could be imported into
DS:it violates the Munitions Act/ITAR, which requires a license for
DS:not a patent one but a Munitions Act one, since the U.S. copies were
DS:brought in from outside the U.S. without a Munitions Act import
DS:Munitions Act as far as importing it is concerned, not PKP.
DS:the patent or munitions act violation were possession and use of PGP
DS:has one, and that the Munitions act covers imports as well as exports.
DS:4. For the Munitions Act/ITAR regulations to be changed AND PKP's
PL:   the patent or munitions act violation were possession and use of PGP
DS:or the Munitions Act and its implementing regulations.
DS:trying to get the Munitions Act changed. That's not my issue
DS:the Munitions Act and implementing regulations are reasonable
DS:or signature, both the U.S. Govrnment under the Munitions Act, and RSA
DS:to send my speech out of the country.  I feel that the munitions act is