Re: Crippled Notes export encryption

At 9:29 AM 1/24/96, Jeff Weinstein wrote:

>  I suspect that to get around the US government in this way we
>would have to develop the entire product outside of the US.  That
>would be a very drastic move that is not likely to happen any
>time soon.  We are going to invest some money and effort into
>trying to get the current restrictions lifted first.

For what it's worth, this is what I've heard several knowledgeable lawyers
say is the case, that merely sending the crypto experts abroad is no
solution, that the entire product (or some large fraction of it) must be
foreign-originated.

The usual issue: That if a foreign-originated product even appears to be a
standard (so far, none have been), and includes strong crypto, then the NSA
and other agencies will simply change the rules. Thus, if extremely strong
crypto from "Netscape-Zurich" starts to have a significant market presense
in the U.S., then some law will be passed to restrict it.

--Tim May

Boycott espionage-enabled software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^756839 - 1  | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

In article <310612A1.69E7@netscape.com>,
Jeff Weinstein  <jsw@netscape.com> wrote:
>  Another problem is that the government may consider any "help" provided
>to the foreign entity to be evidence of a conspiracy.  When Eric Young
>released SSLEAY we got a call from someone in the State Department
>(probably some lackey paid for by the NSA) to find out if we provided
>him with any "help" in doing his implementation.  Since he did it all
>on his own from the published spec and was able to test interoperability
>over the internet we were off the hook, but they seemed to be prepared
>to come down on us if we had "conspired" with him.
>
You don't have to go as far as calling it a conspiracy.  Remember
statement (5) that I posted yesterday:

(5) Performing a defense service on behalf of, or for the benefit of, a
foreign person, whether in the United States or abroad.

If Netscape had "helped" Eric write SSLEAY, that would count as a defense
service for the benefit of a foreign person.

Section 120.9:

@ 120.9 -- Defense service.

   Defense service means:

   (1) The furnishing of assistance (including training) to foreign persons,
whether in the United States or abroad in the design, development, engineering,
manufacture, production, assembly, testing, repair, maintenance, modification,
operation, demilitarization, destruction, processing or use of defense articles;
or

   (2) The furnishing to foreign persons of any technical data controlled under
this subchapter (see @ 120.10), whether in the United States or abroad.

   - Ian

-- Timothy C. May wrote:
> 
> At 9:29 AM 1/24/96, Jeff Weinstein wrote:
> 
> >  I suspect that to get around the US government in this way we
> >would have to develop the entire product outside of the US.  That
> >would be a very drastic move that is not likely to happen any
> >time soon.  We are going to invest some money and effort into
> >trying to get the current restrictions lifted first.
> 
> For what it's worth, this is what I've heard several knowledgeable lawyers
> say is the case, that merely sending the crypto experts abroad is no
> solution, that the entire product (or some large fraction of it) must be
> foreign-originated.
> 
> The usual issue: That if a foreign-originated product even appears to be a
> standard (so far, none have been), and includes strong crypto, then the NSA
> and other agencies will simply change the rules. Thus, if extremely strong
> crypto from "Netscape-Zurich" starts to have a significant market presense
> in the U.S., then some law will be passed to restrict it.

  Another problem is that the government may consider any "help" provided
to the foreign entity to be evidence of a conspiracy.  When Eric Young
released SSLEAY we got a call from someone in the State Department
(probably some lackey paid for by the NSA) to find out if we provided
him with any "help" in doing his implementation.  Since he did it all
on his own from the published spec and was able to test interoperability
over the internet we were off the hook, but they seemed to be prepared
to come down on us if we had "conspired" with him.

	--Jeff

Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.