Re: Exporting from Canada (was Re: Let's try breaking an SSL RC4 key)

Sorry for taking so long to respond to this.

I have been checking out the Canadian rules for exporting crypto.
Basically (according to "A Guide to Canada's Export Controls",
published by the Department of Foreign Affairs and International
Trade) public domain software can be exported from Canada -- one
might need to file a form with Canadian Customs for each export,
but the export it self is legal. (Public domain is defined as
technology that has been made available without restrictions upon
it's further dissemination. Copyright restrictions do not remove
technology from the public domain. So, I'm not quite sure if PGP
falls within that definition.)

However, goods of U.S. origin are export restricted, unless said
goods are further processed outside the U.S. so as to result in a
substantial change in value, so some of the PGP development would
need to be done in Canada.
--
	-marc

On Jul 24, 10:15am, M. Plumb wrote:
> I have been checking out the Canadian rules for exporting crypto.
> Basically (according to "A Guide to Canada's Export Controls",
> published by the Department of Foreign Affairs and International
> Trade) public domain software can be exported from Canada -- one
> might need to file a form with Canadian Customs for each export,
> but the export it self is legal. (Public domain is defined as
> technology that has been made available without restrictions upon
> it's further dissemination. Copyright restrictions do not remove
> technology from the public domain. So, I'm not quite sure if PGP
> falls within that definition.)
Synchronicity! [argh] I had been considering making a posting along
the same lines. Note that the form required [EXT 1042(09/93)] has a
$15 processing fee. (Which might be peanuts if we're selling a
frigate, but which is a royal pain for a piece of crypto.)

Page 1, "A guide to Canada's Export Controls", April 1994

General "Software" Note
This list does not embargo "software" which is either:
1.	Generally available to the public by being:
	a.	Sold from stock at retail selling points, without
		restriction, by means of:
		1.	Over-the-counter transactions;
		2.	Mail order transactions; or
		3.	Telephone call transactions; and
	b.	Designed for installation by the user without further
		substantial support by the supplier; or
2.	"In the public domain".



<sigh>

Excerpts relating to Canadian Export controls on cryptography should
be up somewhere off http://www.io.org/~samwise/interesting.html#privacy
towards the end of the week.

frodo =)

-- 
Richard Martin 
Alias|Wavefront - Toronto Office [Co-op Software Developer, Games Team]
rmartin@alias.com/g4frodo@cdf.toronto.edu
Trinity College UofT ChemPhysCompSci 9T7+PEY=9T8 Shad Valley Waterloo 1992

marc:
> However, goods of U.S. origin are export restricted, unless said
> goods are further processed outside the U.S. so as to result in a
> substantial change in value, so some of the PGP development would
> need to be done in Canada.

How about compiling it? THAT is "further processing"......

-- 
A host is a host from coast to coast.................wb8foz@nrk.com
& no one will talk to a host that's close........[v].(301) 56-LINUX
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead....................................20915-1433

David Lesher (wb8foz@nrk.com) wrote:


: marc:
: > However, goods of U.S. origin are export restricted, unless said
: > goods are further processed outside the U.S. so as to result in a
: > substantial change in value, so some of the PGP development would
: > need to be done in Canada.

: How about compiling it? THAT is "further processing"......

Perhaps...but I for one wouldn't trust anyone else to compile my copy
of PGP...would you?
And, note, it says sustantial change in value...I don't know if this is taken
to mean monetary, or usability...the later might work.  
It's an interesting idea.
Jeremy


: -- 
: A host is a host from coast to coast.................wb8foz@nrk.com
: & no one will talk to a host that's close........[v].(301) 56-LINUX
: Unless the host (that isn't close).........................pob 1433
: is busy, hung or dead....................................20915-1433

--
 ____________________________________________________________________________
| Jeremy Rauch              .--~~,__   |                                     |
|              :-....,-------`~~'._.'  |         jed@cs.jhu.edu              |
|               `-,,,  ,_      ;'~U'   |    alhambra@jhu.edu                 |
| Johns Hopkins  _,-' ,'`-__; '--.     |         jed@jhunix.hcf.jhu.edu      |
|   University  (_/'~~      ''''(;     |     http://server.cs.jhu.edu/~jed   |
|______________________________________|_____________________________________|
Finger for PGP key
				Member, *the Guild

          The light that burns twice as bright burns half as long

> : How about compiling it? THAT is "further processing"......

> Perhaps...but I for one wouldn't trust anyone else to compile my copy
> of PGP...would you?
Not at all. But who says I must USE the compiled version?
I get Linux with both source & object on one CD. Pick & choose as I
please....

> And, note, it says sustantial change in value...I don't know if this is taken
> to mean monetary, or usability...the later might work.  
Or offer many compiled versions, with source tree.
	Comes complete SYSIII, LISA, PET and
	TRS-80 versions!!!!!

-- 
A host is a host from coast to coast.................wb8foz@nrk.com
& no one will talk to a host that's close........[v].(301) 56-LINUX
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead....................................20915-1433