Bidzos on PGP and ITAR verbatim

Bidzos comments on PGP related to ITAR, from sci.crypt a while ago (not
sure of date). Essential argument: it was illegally exported, and ITAR
prohibits re entry of things illegally exported, therefore it is
illegally imported. Relevant section, Software export: Section 123.2 of
the ITAR reads:
 
>"123.2 Imports.
>
>No defense article may be imported into the United States unless (a)
>it was previously exported temporarily under a license issued by the
>Office of Munitions Control; or (b) it constitutes a temporary
>import/intransit shipment licensed under Section 123.3; or (c) its
>import is authorized by the Department of the Treasury (see 27 CFR
>parts 47, 178, and 179)."

There is a section on `illegal export of unclassified technical data to
foreign nationals' (paraphrase) and Bidzos claims it applies to PGP
export. But he appears to me to be using a bit of sleight of hand to
conflate this category with *cryptographic software* mentioned
elsewhere (sections also as quoted also by H. Finney).

I'll let others pick it apart for the loopholes.

===cut=here===

Date: Mon, 20 Sep 93 19:31:08 PDT
Message-Id: <9309210231.AA16113@RSA.COM>
To: ld231782@longs.lance.colostate.edu
In-Reply-To: "L. Detweiler"'s message of Mon, 20 Sep 93 19:57:35 -0600
<9309210157.AA04992@longs.lance.colostate.edu>
Subject: PGP & ITAR


Here's the ITAR part. (This was posted in 1992, so I don't know, since
pgp has changed since then I understand, how it would apply.) Also,
the ITAR has changed recently, and I haven't studied the changes to
see how they would affect these comments.


Risks of using pgp

One should be careful about assuming that the documentation in
electronically distributed software is accurate, especially where
law is concerned.  There are a few things the documentation for
a program called "pgp" does not tell you about patent and export
law that you should be aware of.  Further, there are a number of 
claims and offered interpretations of patent and export law that 
are simply false.

pgp seems to be an attempt to mislead netters into joining an
illegal activity that violates patent and export law, letting them
believe that they run no serious risk in doing so.  

EXPORT LAW

pgp leads users to believe that it has circumvented export controls
"...since it is not illegal to import..."  You are led to believe that
since you didn't import it, it's legal to use it. The "no import
restrictions" claim has been made so many times, many people probably
believe it.

One would be well advised not to accept this legal opinion.  While
stated as if it were a well-known fact, the claim that "there are no
import restrictions" is simply false.  Section 123.2 of the ITAR
(International Traffic in Arms Regulations) reads:
 
"123.2 Imports.

No defense article may be imported into the United States unless (a)
it was previously exported temporarily under a license issued by the
Office of Munitions Control; or (b) it constitutes a temporary
import/intransit shipment licensed under Section 123.3; or (c) its
import is authorized by the Department of the Treasury (see 27 CFR
parts 47, 178, and 179)."

Was pgp illegally exported? Was pgp illegally imported?  Of course.
It didn't export or import itself.  pgp 1 was illegally exported from
the U.S., and pgp 2, based on pgp 1, is illegally imported into the
U.S.  Is a license required? According to the ITAR, it is.
 
125.2 Exports of unclassified technical data. Paragraph (c) reads:

"(c) Disclosures. Unless otherwise expressly exempted in this
subchapter, a license is required for the oral, visual, or documentary
disclosure of technical data to foreign nationals in connection with
visits by U.S. persons to foreign countries, visits by foreign persons
to the United States, or otherwise.  A license is required regardless
of the manner in which the technical data is transmitted (e.g., in
person, by telephone, correspondence, electronic means, telex, etc.)."
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                

What is "export?" Section 120.10, "Export," begins:

"'Export' means, for purposes of this subchapter: ...(c) Sending or
taking technical data outside of the United States in any manner
except that by mere travel outside of the United States by a person
whose technical knowledge includes technical data; or..."

Crypto software is controlled by the ITAR. See Part 121, the Munitions
List, includes Category XIII, of which paragraph (b) reads, in part,
"...privacy devices, cryptographic devices and software (encoding and
decoding), and components specifically designed or modified
therefore,..."

A further definition in 121.8, paragraph (f) reads: "Software 
includes but is not limited to the system functional design, 
logic flow, algorithms, application programs, ..."

pgp encourages you to post it on computer bulletin boards.  Anybody
who considers following this advice is taking quite a risk.  When you
make a defense item available on a BBS, you have exported it.

pgp's obvious attempts to downplay any risk of violating export law
won't help you a bit if you're ever charged under the ITAR.

Penalties under the ITARs are quite serious.  The ITARs were clearly
designed to put teeth into laws that make exporting munitions illegal.
It's unfortunate that cryptography is on the munitions list. But it
is.  pgp is software tainted by serious ITAR violations.








------- End of Forwarded Message

"L. Detweiler" <uunet!longs.lance.colostate.edu!ld231782> writes:

> There is a section on `illegal export of unclassified technical data to
> foreign nationals' (paraphrase) and Bidzos claims it applies to PGP
> export. But he appears to me to be using a bit of sleight of hand to
> conflate this category with *cryptographic software* mentioned
> elsewhere (sections also as quoted also by H. Finney).

If Bidzos is using the term "technical data" as it's defined in $120.21
of the ITAR, I think it's debatable. Can we come up with data to support
that IDEA and RSA are "commonly taught .. in academia"? The public (and
published) nature of both IDEA and RSA seems to place them far away from
the general thrust of the "technical data" definition, which seems oriented
towards preventing disclosure of data/information that's not available to
the general public. Def'n follows:

    $120.21 Technical data.

        Technical data means, for purposes of this subchapter:
            (a)     Classified information relating to defense articles
                    and defense services;
            (b)     Information covered by an invention secrecy order;
            (c)     Information, in any form, which is directly related
                    to the design, engineering, development, production,
                    processing, manufacture, use, operation, overhaul,
                    repair, maintenance, modification, or reconstruction
                    of defense articles. This includes, for example,
                    information in the form of blueprints, drawings,
                    photographs, plans, instructions, computer software,
                    and documentation. This also includes information
                    which advances the state of the art of articles on
>                   the U.S. Munitions List. This definition does not
>                   include information concerning general scientific,
>                   mathematical, or engineering principles commonly
>                   taught in academia. It also does not include basic
                    marketing information or general system descriptions
                    of defense articles.

        [emphasis added, of course]

I'm working my way through the ITAR and am going to leave the majority
of Bidzos' message alone until I feel like I have a stronger grasp on the
legal issues here.

He did, however, say two things which look pretty shaky to me:

> When you make a defense item available on a BBS, you have exported it.

The definitions of export that I've seen have concerned transferring
information or physical things, or providing services to, persons,
corporations, or nations which are not U.S. citizens. They have not
addressed placing these things where "foreign persons" might conceivably
get them. Under Bidzos' interpretation, making RSAREF available via FTP
sounds like export to me. My interpretation is based on ITAR; other
relevant statutes may define it more broadly, but those definitions
aren't relevant when talking about violations of the ITAR.

> pgp is software tainted by serious ITAR violations.

I interpret this to mean, assuming that Bidzos is right on all points, that:
(1) all copies (and their descendants?) of PGP 1.0 which have been taken
outside of the U.S. are "tainted" and cannot be re-imported legally; and
(2) all copies (and their descendants?) of PGP 2.x which were written outside
of the U.S. are "tainted" once they enter the U.S.; U.S. citizens will need
to re-write (sigh) PGP 2.x inside the U.S., using the published algorithms
for IDEA and RSA.

I can't see any basis for saying that "PGP", a standard for interoperable
crypto software, is tainted - only particlar implementations of that
standard are, depending on who wrote them and what country the author is
from, where the copy is located, and where it's been before.

Surely Bidzos won't claim that RSA licensees in the U.S. are somehow
"tainted" by the illegal export of other copies of RSA, hmm?


--
Greg Broiles
greg@goldenbear.com                     Baked, not fried.

>> If Bidzos is using the term "technical data" as it's defined in $120.21
>> of the ITAR, I think it's debatable. Can we come up with data to support
>> that IDEA and RSA are "commonly taught .. in academia"? 

>                   the U.S. Munitions List. This definition does not
>                   include information concerning general scientific,
>                   mathematical, or engineering principles commonly
>                   taught in academia. It also does not include basic

Well, I learned about the RSA algorithms in 18.063 (Introduction to
Algebraic Systems), which is a required mathematics course at MIT for
an undergraduate CS degree.  It is normally taken by sophomores and
juniors.  MIT isn't exactly a "common" school, but it's certainly
academia.  Unfortunately, there is no textbook for this course.

Public Key Cryptosystems are also discussed in the textbook
(Introduction to Algorithms, Corman/Leiserson/Rivest, MIT Press) for
6.046 (Introduction to Algorithms), but are not discussed extensively
in the class.

As I know foreign nationals who have graduated, they must have taken
these courses.

		Marc

Marc Horowitz says:
> >> If Bidzos is using the term "technical data" as it's defined in $120.21
> >> of the ITAR, I think it's debatable. Can we come up with data to support
> >> that IDEA and RSA are "commonly taught .. in academia"? 
> 
> Well, I learned about the RSA algorithms in 18.063 (Introduction to
> Algebraic Systems), which is a required mathematics course at MIT for
> an undergraduate CS degree.

I learned about lots of this stuff in an advanced course in
cryptography taught by Zvi Galil and some of his students and
colleagues (like Stu Haber and Joan Feigenbaum) at Columbia.

I suspect that there is an academic discipline here (lots of PhDs
specializing in cryptography) and papers and academic journals and
conferences make it fairly clear that this data is common in academia.

Perry

If Bidzos is using the term "technical data" as it's defined in $120.21
   of the ITAR, I think it's debatable. Can we come up with data to support
   that IDEA and RSA are "commonly taught .. in academia"? 

The RSA public key algorithm is taught at MIT in the math course
18.063, which is required for an undergraduate computer science
degree.

That's one data point...

					- Bill

> 
>    If Bidzos is using the term "technical data" as it's defined in $120.21
>    of the ITAR, I think it's debatable. Can we come up with data to support
>    that IDEA and RSA are "commonly taught .. in academia"? 
> 
> The RSA public key algorithm is taught at MIT in the math course
> 18.063, which is required for an undergraduate computer science
> degree.
> 
> That's one data point...
> 
> 					- Bill

It was taught in one of my digital design classes as an example
of why (and how) we need modular arithmetic circuitry, and how
it is made.  If it is taught in such a non-related class what does
that say to the commonness of it?

> It was taught in one of my digital design classes as an example
> of why (and how) we need modular arithmetic circuitry, and how
> it is made.  If it is taught in such a non-related class what does
> that say to the commonness of it?

Similarly, it was taught in an advanced discrete math course at the
Univ. of Massachusetts as an application of the Chinese-remainder
bignum system we'd been working with.

   Eli   ebrandt@jarthur.claremont.edu

FTP site for complete ITAR is:

ripem.msu.edu:/pub/crypt/docs/itar-july-93.txt.

sci.crypt archives are there also. Thanks to M. Riordan for this
valuable service. I also understand that D. Bernstein may have helped
in getting the ITAR on specifically. Both are sci.crypt FAQ
contributors & maintainers.

* * *

greg@ideath.goldenbear.com (Greg Broiles) quotes an *extremely*
interesting section of the ITAR, perhaps the *critical section* for
this issue at hand. But he seemed to skip right over a critical piece.

The thread, as it stands: we have seen the ITAR sections that bar
disclosure (export) of `technical data' to `foreign nationals' and
sections that state that anything illegally exported cannot be legally
imported, and now we find technical data defined as:


   $120.21 Technical data.

        Technical data means, for purposes of this subchapter:
            (a)     Classified information relating to defense articles
                    and defense services;
            (b)     Information covered by an invention secrecy order;
            (c)     Information, in any form, which is directly related
                    to the design, engineering, development, production,
                    processing, manufacture, use, operation, overhaul,
                    repair, maintenance, modification, or reconstruction
                    of defense articles. This includes, for example,
                    information in the form of blueprints, drawings,
1                   photographs, plans, instructions, computer software,
1                   and documentation. This also includes information
                    which advances the state of the art of articles on
2                   the U.S. Munitions List. This definition does not
2                   include information concerning general scientific,
2                   mathematical, or engineering principles commonly
2                   taught in academia. It also does not include basic
                    marketing information or general system descriptions
                    of defense articles.

*wow* -- we find that (1) `computer software and documentation'
`related to [verb1,verb2,verb3 ad infinitum] of defense articles' is
*banned*. but in the same paragraph, (2) `general scientific or
commonly taught mathematical or engineering principles' are *not*
banned. Surely, (1) is the clause that Bidzos would claim applies --
restricting the export of technical data in the form of software.

The $64K Question: Is PGP `computer software related to defense' or
`technical documentation encompassing general scientific & engineering principles'?

so, likely, that paragraph will be the focus of attention, and perhaps
the fulcrum of the case, for both the prosecution and defense, of a
hypothetical trial.

another point to make: the naive prejudices of those who crafted this
list are apparent as being from the
agency-which-will-remain-anonymous-but-has-the-initials-NSA. They seem
to think that `defense articles' and `general scientific, mathematical,
and engineering principles' are mutually exclusive. Hee, hee. They
might as well just have a law that bans `everything we don't approve
of' with no loss of ambiguity.

G.B. again
>The definitions of export that I've seen have concerned transferring
>information or physical things, or providing services to, persons,
>corporations, or nations which are not U.S. citizens. They have not
>addressed placing these things where "foreign persons" might conceivably
>get them.

another *very* critical aspect of the case, noted also by H. Finney and
others. I have a theory about this (surprise! :) Bidzos indicated how
the ITAR is very recent. It appears to be being updated all the time.
This is a bit scary how easy it is for `the powers that be' (the most
verminous expression, hence my use) to slip in to modifications to the
ITAR. I wonder how much these various paragraphs have changed between
versions of the ITAR -- I suspect that if we looked at it in a linear
historical progression, we would find an increasing desperation in the
writing, representing the futile attempt to encompass all the data
leaking all over cyberspace, like trying to hold onto a handful of
greased vibrating marbles, or chain down electrons. This is another
`conspicuous omission' that suggests the likelihood that it is `in the
works' to get in clauses that *specifically address* the concept of
`broadcast' of information similar to an FTP site, perhaps even
underway at this moment in the labyrinthine catacombs of our government.

* * *

My sincere thanks to everyone who has contributed to the ITAR analysis
associated with the case dispassionately. We shouldn't delude ourselves
in thinking all this is happening in anything other than a mailing list
vacuum, and the EFF/PRZ laywers (`the Professionals') surely have
entirely different perspectives on the matter, but for me at least I
find it extraordinarily educational and intellectually stimulating --
in a sort of depraved way.

On the other hand, reading between the lines of our comments, the ITAR
itself is probably close to the most totalitarian document our country
has yet produced. It is sort of like `constitutional antimatter'. Look
at how pliant this enterprise-constricting law is to burdensome and
insideous modifications, in total defiance of open and public
legislative procedure! The people that are *experts* on it can't keep
up with all the shadowy knob-twiddling. In restricting *technical data*
to `foreign nationals' (the latter phrase a rather atrocious coinage in
itself) we seem to find the same institutionalized paranoia against the
spread of simple *information* that was associated with copier machines
in the cold-war-era Soviet Union. The irony is that to a totalitarian
state, that paranoia is not comical -- it is entirely justified and
critical to its self preservation.

"L. Detweiler" <uunet!longs.lance.colostate.edu!ld231782> writes:

> *wow* -- we find that (1) `computer software and documentation'
> `related to [verb1,verb2,verb3 ad infinitum] of defense articles' is
> *banned*. but in the same paragraph, (2) `general scientific or
> commonly taught mathematical or engineering principles' are *not*
> banned. Surely, (1) is the clause that Bidzos would claim applies --
> restricting the export of technical data in the form of software.


ITAR seems to contemplate (at least) two different classes of things relevant
here: "defense articles" and "technical data". While RSA and IDEA 
implementations may well escape being technical data by way of the academic 
exemption, they are pretty clearly defense articles.

$121.1 General. The United States Muntions List.

(a) The following articles, services, and related technical data are 
designated as defense articles and defense services pursuant to sections 38 
and 47(7) of the Arms Export Control Act (22 USC 2778 and 2794(7)). Changes 
in designations will be published in the Federal Register.

[ . . .]

(c)

[. . .]
Category XIII - Auxiliary Military Equipment

(b) Information Security Systems and equipment, cryptographic devices, 
software, and components, specifically designed or modified therefore, 
including:

(1) Cryptographic (including key management) systems, equipment, assemblies, 
modules, integrated circuits, components or software with the capability of 
maintaining secrecy or confidentiality of information or information 
systems, except cryptographic equipment of software as follows:
   (long list of narrow applications of crypto deleted, none seem relevant.)
(2) [Crypto systems making use of spread spectrum tech.]
(3) Cryptanalytic systems, equipment, assemblies, modules, integrated 
circuits, components, or software.
(4) [Systems for multiuser security of B2 or better, or certification 
software]
(5) Ancillary equipment specifically designed or modified for paragraphs (b) 
(1), (2), (3), (4), or (5) of this category;

[. . .]


[end of quoted ITAR text]

Sorry if the subdivisions/deleted text there is confusing - will snarf the 
full ITAR text tomorrow, perhaps it'll be more nicely formatted.


--
Greg Broiles
greg@goldenbear.com                     Baked, not fried.