Re: Aust crypto regulations

Well, fuck that for thinking I was living under a less restrictive
regime -- and I can say goodbye to an international market for my
software.

---- begin include ----
From: M.Gream@uts.edu.au (Matthew Gream)
Newsgroups: aus.computers.ibm-pc,alt.security.pgp
Subject: Re: PGP for Oz users
Date: 6 Sep 1994 06:44:14 GMT

Matthew Gream (M.Gream@uts.edu.au) wrote:

> That sounds bogus to me, at least from the information you've given me
> there. I've had the pleasure of being routed from our `Australian Trade
[..]
> I'm fairly confident in saying that there are no export restrictions on
> software (specific clause stating that mass market, public domain and
> "unsupported after installation" software is not covered by the
> Industrial List). There do exist restrictions on hardware. All of these
> restrictions are a direct result of our adherence with COCOM
> regulations.

I'm afraid I have to post a clarification to a clarification. I've just
been in contact with the relevant people at the Defence Signals
Directorate. It seems that regardless of advice obtained from other
departments and documentation that points to the contrary, there are
restrictive controls on software.

In my conversation, the following was articulated (she was refering to
the same document as previously mentioned [1]):

1. The "General Software Note" on Page 1-6 of [1] does not override
   the regulations in "Category 5: Telecommunications and `Information
   Security'", specifically s.5.A.2 and s.5.D.2. This means that they
   assert control over all forms of software _including_ public domain.
   I tried to pin-point what the "General Software Note" is for then,
   but didn't receive an acceptable answer.

2. DES can only be exported for specific banking and associated 
   applications, even then only to 8 governments and certain banking 
   groups. They accept RSA for export where it's used in Key 
   Distribution applications. In essence, there is a list of specific
   uses for certain algorithms.

3. Message digests are in general OK, so long as they can't be modified
   to perfom cryptographic functions (ie. encryption/decryption).

4. Export is regulated on a per end user basis. In order words, they
   assert control over _each_ item of software sold.

5. The fact that COCOM is in a "forum" period does not affect the
   current regulations.

6. I specifically asked about "public domain" distribution of software
   via the Internet. She said that this was "highly inadvisable" and
   "if our government found out about it, they could take action" and
   asserted that it would be worse for an individual than if the
   violation was carried out by a company. She said that she wouldn't
   like someone to become a "test case", and made mention of problems
   in the USA.

She was extremely helpfull though, but the real problem I had, and I
spent most of my time on this, was that these requirements aren't
solidified anywhere, and hence subjective. I'm not really surprised
though, that's the whole point of it all.

I wasn't concerned about "weak crypto", only DES, IDEA, RSA, MD* and
locally produced algorithms.

In short: Anything cryptographic, they want to know about, and they
want to know about it on a per end-user basis. They advise against
distribution on the "Internet" and any distribution without prior
approval otherwise there could be "problems".

Matthew.

[1] "Australian Controls on the Export of Technology with Civil and
	Military Applications", Aust Dept of Defence, Sept 1992.

--
Matthew Gream <M.Gream@uts.edu.au> -- Consent Technologies, (02) 821-2043
Disclaimer: From? \notin speaking_for(Organization?)            [cfqx103]
---- end include ----

-- 
Matthew Gream <M.Gream@uts.edu.au> -- Consent Technologies, (02) 821-2043
Disclaimer: From? \notin speaking_for(Organization?)            [cfqx103]

>   Matthew Gream (M.Gream@uts.edu.au) wrote [in re aussie spooks and
>   crypto (I think)]:

>   In short: Anything cryptographic, they want to know about, and they
>   want to know about it on a per end-user basis. They advise against
>   distribution on the "Internet" and any distribution without prior
>   approval otherwise there could be "problems".

I am sure they will be as successfull as their american counterparts in
suppressing such distribution.

josh

On Sep 6,  6:41am, joshua geller wrote:
> >   Matthew Gream (M.Gream@uts.edu.au) wrote [in re aussie spooks and
> >   crypto (I think)]:

> >   In short: Anything cryptographic, they want to know about, and they
> >   want to know about it on a per end-user basis. They advise against
> >   distribution on the "Internet" and any distribution without prior
> >   approval otherwise there could be "problems".

> I am sure they will be as successfull as their american counterparts in
> suppressing such distribution.

It's kinda interesting, because another contact I have in DSD said that
he wasn't aware of any restrictions on the distribution of crypto
software.  This may have been simply a personal lack of knowledge, but it
also may indicate the obscurity of the restriction itself.  It also interests
me in that their charter gives DSD absolutely no responsibility for the
control of domestic crypto.

Anyway, if there are any other Australians on the list apart from Matthew
and myself, I think a few letters to our respective members of Federal
parliament are in order now.  This law not acceptable, and I am pretty sure
that most politicians won't support the spooks in this matter (the fact that
Matthew has had such a hard time finding out makes me suspect that this is
regulation might have been slipped in "under wraps", and I see the fingerprints
of the AG's Law Enforcement Advisory Committee all over it).  If we can
coordinate this, all the better.

Unfortunately, my MP is the Right Honorable Paul Keating, MP (Prime Minister),
and his position reduces the time he spends on constituency matters somewhat.
It's not going to stop me trying, though.

							Ian.

"Ian Farquhar" wrote:
> 
> It's kinda interesting, because another contact I have in DSD said that
> he wasn't aware of any restrictions on the distribution of crypto
> software.  This may have been simply a personal lack of knowledge, but it
> also may indicate the obscurity of the restriction itself.  It also interests
> me in that their charter gives DSD absolutely no responsibility for the
> control of domestic crypto.

This intrigued me, as I too see no basis for their controls. The prohibited
exports come under the Customs Act, and it may well be that the upfront
"general software note" which excludes public domain and other software
isn't yet instilled in legislation. I'll have to look at the Customs Act
itself to see how the prohibited exports ties in. Finding out what group
constructed this documentation and hence the relevance of that note is
another avenue.

I wouldn't hesitate to speculate that they are asserting controls over 
crypto that they don't really have. The issue still requires further
investigation though.

cheers,
Matthew.
-- 
Matthew Gream 
<M.Gream@uts.edu.au>
(02) 821-2043
(sw/hw engineer)