ITARs effects

I cross posted the ITAR proposed rev pointers to Firewalls.  In
addition to an entertaining rant, Marcus posted this:

----- Forwarded message from Marcus J. Ranum -----

>From mjr@mail.clark.net  Thu Dec 12 17:38:57 1996
Message-Id: <199612122240.RAA10556@mail.clark.net>
Comments: Authenticated sender is <mjr@mail.clark.net.>
From: "Marcus J. Ranum" <mjr@mail.clark.net>
Organization: V-ONE Corp Baltimore office
To: adam@homeport.org
Date: Thu, 12 Dec 1996 17:42:00 +0000
Subject: that doc....
Priority: normal
X-mailer: Pegasus Mail for Win32 (v2.42a)


You posted a pointer to that document. It was quite interesting.
I see that the feds are making INDIVIDUALS responsible for
ENFORCING export laws!!!  Read carefully:

(9) Export of encryption software. The export of encryption source
code and object code software controlled for EI reasons under ECCN
5D002 on the Commerce Control List (see Supplement No. 1 to part 774
of the EAR) includes downloading or causing the downloading, of such
software to locations (including electronic bulletin boards and
Internet file transfer protocol and World Wide Web sites) outside the
U.S., and making such software available for transfer outside the
United States, over radio, electromagnetic, photo optical, or
photoelectric communications facilities accessible to persons outside
the United States, including transfers from electronic bulletin boards
and Internet file transfer protocol and World Wide Web sites, or any
cryptographic software subject to controls under this regulation
unless the person making software available takes precautions as
adequate to prevent unauthorized transfer of such code outside the
United States. This provision applies both to the uploading and
downloading of such software. For purposes of this paragraph, the
following shall constitute adequate precautions to prevent
unauthorized transfer: 

This implies that putting something up for FTP == export. Holy
shit.

mjr.
-----
Marcus J. Ranum, Chief Scientist, V-ONE Corporation
Work:       http://www.v-one.com
Personal:   http://www.clark.net/pub/mjr
"I'll have time to be laid back when I'm laid out on a slab"

----- End of forwarded message from Marcus J. Ranum -----

-----BEGIN PGP SIGNED MESSAGE-----

Adam Shostack <adam@homeport.org> writes:
> I cross posted the ITAR proposed rev pointers to Firewalls.  In
> addition to an entertaining rant, Marcus posted this:
> 
> ----- Forwarded message from Marcus J. Ranum -----
> 
> From mjr@mail.clark.net  Thu Dec 12 17:38:57 1996
> Message-Id: <199612122240.RAA10556@mail.clark.net>
> Comments: Authenticated sender is <mjr@mail.clark.net.>
> From: "Marcus J. Ranum" <mjr@mail.clark.net>
> Organization: V-ONE Corp Baltimore office
> To: adam@homeport.org
> Date: Thu, 12 Dec 1996 17:42:00 +0000
> Subject: that doc....
> Priority: normal
> X-mailer: Pegasus Mail for Win32 (v2.42a)
> 
> 
> You posted a pointer to that document. It was quite interesting.
> I see that the feds are making INDIVIDUALS responsible for
> ENFORCING export laws!!!  Read carefully:

<snip excerpt>

> This implies that putting something up for FTP == export. Holy
> shit.

This has always been the case. At this point, it is sufficient to make
the downlaoder promise that they are a US citizen-unit (eg the mit pgp
dist.). Of course, seeing as how no congressional laws involved, the
ores. could decide that that's not good enough on a whim.

Jer

"standing on top of the world/ never knew how you never could/ never knew
 why you never could live/ innocent life that everyone did" -Wormhole

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQB1AwUBMrHFJ8kz/YzIV3P5AQE/EgMAuoWyNti9XqXfEGCOCIFHXR7fIPiCJJx1
tbYCGeZlBvIkwopHvGLWpR5AdTSC1/loleWbOCP0hBL13+lVLTtMPaA4OcCBnY34
z75eLpbPUibUxCX+uaLhFAkQF1i0W8Zz
=G2HV
-----END PGP SIGNATURE-----

: This implies that putting something up for FTP == export. Holy
: shit.

That has always been the position of the Department of Defense Trade
Controls with respect to the ITAR, the only difference is that now
it is going to be in writing.

--
Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH
Internet:  junger@pdj2-ra.f-remote.cwru.edu    junger@samsara.law.cwru.edu
                     URL:  http://samsara.law.cwru.edu

Peter D. Junger wrote:
| 
| : This implies that putting something up for FTP == export. Holy
| : shit.
| 
| That has always been the position of the Department of Defense Trade
| Controls with respect to the ITAR, the only difference is that now
| it is going to be in writing.

	My understanding is that they choose not to continue
per^H^Hrosecuting Phil for putting the code up for FTP.  Thus, this is
a change.  Or did Phil not put the code up for FTP?

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

Adam Shostack writes:

: Peter D. Junger wrote:
: | 
: | : This implies that putting something up for FTP == export. Holy
: | : shit.
: | 
: | That has always been the position of the Department of Defense Trade
: | Controls with respect to the ITAR, the only difference is that now
: | it is going to be in writing.
: 
: 	My understanding is that they choose not to continue
: per^H^Hrosecuting Phil for putting the code up for FTP.  Thus, this is
: a change.  Or did Phil not put the code up for FTP?

Phil probably did not put up the code, but that is not the point.
They held his feet over the fire for three years and then, as the
statute of limitations ran out, dropped the case---perhaps because
they could not prove that Phil made the code available, perhaps
because they did not want to subject their position to judicial
review, probably for a combination of those reasons.  But that in no
way amounted to a change in what they claim.  In my case the
government's lawyer has made it quite clear that they would consider
putting cryptographic software on a web site as a violation, and I
don't think that for this purpose there is any distinction either in
the government's mind or in reality between an FTP site and a web
site.

--
Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH
Internet:  junger@pdj2-ra.f-remote.cwru.edu    junger@samsara.law.cwru.edu
                     URL:  http://samsara.law.cwru.edu

At 7:09 pm -0500 12/14/96, Adam Shostack wrote:
>	My understanding is that they choose not to continue
>per^H^Hrosecuting Phil for putting the code up for FTP.  Thus, this is
>a change.  Or did Phil not put the code up for FTP?

Actually, it's my understanding that PRZ didn't do it personally. Someone
else got the code from Phil and put it on the net. Phil had nothing to do
with it. Except for writing PGP, of course. :-).

Cheers,
Bob Hettinga

-----------------
Robert Hettinga (rah@shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"The cost of anything is the foregone alternative" -- Walter Johnson
The e$ Home Page: http://www.vmeng.com/rah/

Robert Hettinga <rah@shipwright.com> writes:
> At 7:09 pm -0500 12/14/96, Adam Shostack wrote:
> >	My understanding is that they choose not to continue
> >per^H^Hrosecuting Phil for putting the code up for FTP.  Thus, this is
> >a change.  Or did Phil not put the code up for FTP?
>
> Actually, it's my understanding that PRZ didn't do it personally. Someone
> else got the code from Phil and put it on the net. Phil had nothing to do
> with it. Except for writing PGP, of course. :-).

And what exactly was Kelly Goen's role?

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

At 7:09 PM -0500 12/14/96, Adam Shostack wrote:
>Peter D. Junger wrote:
>|
>| : This implies that putting something up for FTP == export. Holy
>| : shit.
>|
>| That has always been the position of the Department of Defense Trade
>| Controls with respect to the ITAR, the only difference is that now
>| it is going to be in writing.
>
>	My understanding is that they choose not to continue
>per^H^Hrosecuting Phil for putting the code up for FTP.  Thus, this is
>a change.  Or did Phil not put the code up for FTP?

I certainly can't speak for Phil, but according to everything I have heard,
and according to several articles that have been written about the events
surrounding the release of PGP 1.0, Phil most definitely DID NOT place the
PGP 1.0 software on any kind of ftp site.

(I believe that at that time, circa 1991, Phil did not even have any kind
of ISP or university Internet access which would have even made this
possible for him. In fact, I believe it was not until around 1993 that he
had a stable e-mail account.)

As to who, if anybody, placed PGP 1.0 on an ftp site, I suggest folks read
some of the articles about how the software was uploaded to bulletin
boards. The evidence is strong that it was NOT Phil who did this, though of
course the software at some point got from Phil to whomover it was who did
place the software on bulletin boards (and ultimately onto ftp sites).

(Note that it was primarily PGP 1.0 which was the subject of the
government's investigations. PGP 2.0 and later releases were handled in a
different way.)

I hope I have not mangled any of the history. These events have been
reported in many articles on PGP and the Zimmermann Affair, including a
long article by Jim Warren on whom--he claims--actually DID place PGP on
publically-accessible sites. See those articles for more details.

It seems likely to me that the new laws, pointed out to us by Lucky, would
make a much wider range of things illegal, and that the mere appearance of
some software on a foreign site could be construed as ipso facto proof that
due care was not taken ("you let it leak out").

But this was not the law in 1991, nor is it the law yet.

--Tim May

Just say "No" to "Big Brother Inside"
We got computers, we're tapping phone lines, I know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1398269     | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."