v2.6 for the rest of us

Jeff Barber wrote:
>While creating a 2.6-like version from 2.3a seems a worthy goal, this
>supporting argument is flawed.  The original PGP was written in the USA
>and, never having received the proper export approvals, must have been
>"illegally exported."   Isn't Phil Zimmerman being "investigated" by a
>grand jury for this even now?  So, it would seem to me that a bulletin
>board carrying any version of PGP holds illegally exported software (wrt
>US law).  How does 2.3a differ from 2.6 in this respect?
 
Ok, you got me there!  My supporting argument is indeed flawed.
 
However, I would say that most people _regard_ v2.3a as a legal version 
outside the USA and so are willing to carry it on their systems; and at this 
time I believe nothing concrete to the contrary has been proved.  
 
Versions 2.5 and 2.6 however are obviously illegal exports, and I think that 
it is the fact that people think of one as legal and the other as illegal 
that makes the difference, and therefore we who are outside the USA need our 
own version to be brought up to date.
 
I have, at this time, been informed of two separate people working on a new 
version that is compatible with 2.6, based on 2.3a code.
 
Maybe everyone working on (or who know of people working on) such 
developments could post information regarding what exactly they are 
changing/upgrading/doing to 2.3a to make an 'international' v2.6.
 
What do others think of everyone 'putting their cards on the table' to enable 
other knowledgeable cypherpunks to help and suggest things?
 
Am I jumping the gun?  Should we just let MIT's v2.6 reach an FTP site 
somewhere outside of the USA and let it slowly (and cautiously) get 
distributed to a small community of cypherpunks leaving the rest incompatible?
 
All of those inside the USA, *PLEASE* get involved with this.  It _is_ 
important!
 
Thankyou for listening.
 

*****************************************************************************
*  Paul Strong                      Fidonet: 2:254/438 (weekly mail check)  * 
*                                                                           * 
*  pauls@dcs.rhbnc.ac.uk            Finger for PGP v2.3a public key         * 
*****************************************************************************

> However, I would say that most people _regard_ v2.3a as a legal version 
> outside the USA and so are willing to carry it on their systems;
...
> Versions 2.5 and 2.6 however are obviously illegal exports,

If people feel this way, they are confused.  Once the code escapes the
U.S. it is legal to use, modulo local anti-privacy legislation.  Someone
exporting the code from the U.S. takes a legal risk; someone who uses
already-exported code does not.

> Am I jumping the gun?  Should we just let MIT's v2.6 reach an FTP site 
> somewhere outside of the USA and let it slowly (and cautiously) get 
> distributed to a small community of cypherpunks [...]

Snarf it from ghost.dsi.unimi.it, as cautiously as you like.
(Oh, actually, the ftp site has moved to goblin.something -- it will
tell you when you try to log in.)

   Eli   ebrandt@hmc.edu

Versions 2.5 and 2.6 however are obviously illegal exports, and I
   think that it is the fact that people think of one as legal and the
   other as illegal that makes the difference, and therefore we who
   are outside the USA need our own version to be brought up to date.

Legality is always relative to some jurisdiction.  Let us stipulate
for discussion that export of PGP 2.6 from the USA was in violation of
the ITAR.

Is PGP 2.6 in Europe an "illegal export"?  To wit, it is in the USA,
but not in Europe, barring specific reciprocity agreements.  Under USA
law, it violates the ITAR (by stipulation--now may be the time to
reach for the dictionary).  So, if the USA could manage to extradite a
2.6-user from Europe, that person could be tried under USA law,
convicted, and jailed.

Think not?  One word: Noriega.

Noriega was tried under USA law for activities which never took place
in the USA.  You think that sucks?  Well, expect the tendrils of law
to extend past the nominal geographic borders more often.  If
individuals can become locationally ambiguous, there's no reason to
expect governments to remain locationally confined.

Now, is USA law a threat?  Now is the time to estimate the cost of
extradition, trial, incarceration, etc. relative to other law
enforcement priorities.  It's pretty unlikely, in the case of PGP-2.6.
No need to lose sleep.

So, is it illegal in Europe?  Well, not usually.  What law of any
European state has a 2.6-user broken?  The ITAR is a USA law, not,
say, a German one.  There may be other statutes, as in France, which
could restrict its use, but they're not the ITAR.  So if I were living
in England, using PGP 2.6, I'd have nothing to fear from local
authorities as such.  (Maybe from them acting as extradition officers,
but you can figure out that difference easily.)

And I haven't even addressed detection yet.

Eric

Eric said:
> So, if the USA could manage to extradite a
> 2.6-user from Europe, that person could be tried under USA law,
> convicted, and jailed.

Convicted of what?  The ITAR provides civil and criminal penalties
for exporting defense articles or technical information, for
providing defense services, etc.  AFAIK (anybody OCRed it?), it
contains no clause that would cover the use of software or
rocket launchers that have already been exported.

   Eli   ebrandt@hmc.edu

The issue is whether mere use of USA-illegally exported crypto is
itself illegal.

   AFAIK (anybody OCRed it?), it
   contains no clause that would cover the use of software or
   rocket launchers that have already been exported.

The text of the ITAR is available at one or both of eff.org or
cpsr.org.

I purposefully elided over this point in my first post in order to
more clearly talk about jurisdiction.  (This may not have been best.)
I don't know if such use is illegal; for the purpose of discussion
above, I assumed it was.  It may be otherwise, however.  Suppose it's
not explicitly illegal.  Does that mean you can't get prosecuted for
it, or convicted?  Whatever the answer is, it's not "clearly no".

Inside every prosecutor's office is a legal hacker try to push the
boundaries of criminal law, trying to make more things _illegal_.
(Not exactly what you want to hear, I'm sure.)  What creative
arguments might an agressive prosecutor use?  Conspiracy is a good
one.  The argument could be that there's so much publicity about PGP
that any user must know that 2.6 was USA-illegally exported, and,
therefore, was blindly conspiring with the original exporter.  This is
an apparently ludicrous argument, but could it fly?  Ever heard of the
twinkie defense?  

Eric