New crypto regs outlaw financing non-US development

As you know, the President has transferred most crypto from State to
Commerce. We were all waiting in anticipation for the text of new
regulations to take effect on 12/30/96. Not because we thought that the new
regs will be more favorable to industry and the individual (we know
better), but so we could assess the damage. I will try to give a brief look
at some interesting provisions in the new regs. I assume the reader is
familiar with the carrot and stick (export of single DES and key escrow)
provision of the new regs. IANAL.

This post refers to the text of the regulations available at
http://jya.com/bxa123096.txt and
http://jya.com/itar123096.txt

The above URL's mirror [Federal Register: December 30, 1996 (Volume 61,
Number 251)], also available via
http://www.access.gpo.gov/su_docs/aces/aces140.html

First the good news: the export controls mentioned in the draft of the regs
on any kind of data security software, regardless if it uses crypto or not
did not carry into the final version.

Now to the rest of the news. 

>equests for one-time review of recoverable
>products which allow government officials to obtain, under proper legal
>authority and without the cooperation or knowledge of the user, the
>plaintext of the encrypted data and communications will also receive
>favorable consideration.

The GAK provisions require that the keys are made available without
knowledge of the user. This disqualifies some of the suggested key recovery
schemes alerting the user to the fact that keys are being requested.

>A
>printed book or other printed material setting forth encryption source
>code is not itself subject to the EAR (see Sec. 734.3(b)(2)). However,
>notwithstanding Sec. 734.3(b)(2), encryption source code in electronic
>form or media (e.g., computer diskette or CD ROM) remains subject to
>the EAR (see Sec. 734.3(b)(3)). The administration continues to review
>whether and to what extent scannable encryption source or object code
>in printed form should be subject to the EAR and reserves the option to
>impose export controls on such software for national security and
>foreign policy reasons.

Printed source can still be exported. Source printed in special OCR fonts
will eventually be banned.

Finally, to the big one:
>Sec. 736.2  General prohibitions and determination of applicability.
>
>* * * * *
>    (7) General Prohibition Seven--Support of Certain Activities by
>U.S. persons--(i) Support of Proliferation Activities (U.S. Person
>Proliferation Activity). If you are a U.S. Person as that term is
>defined in Sec. 744.6(c) of the EAR, you may not engage in any
>activities prohibited by Sec. 744.6 (a) or (b) of the EAR which
>prohibits the performance, without a license from BXA, of certain
>financing, contracting, service, support, transportation, freight
>forwarding, or employment that you know will assist in certain
>proliferation activities described further in part 744 of the EAR.
>There are no License Exceptions to this General Prohibition Seven in
>part 740 of the EAR unless specifically authorized in that part.

IMHO, this closes the door on the foreign contracting loophole used by C2
and others. It is now illegal for US persons to finance or contract out
overseas crypto development, since doing so will obviously assist in
proliferation. While not unexpected (I offered a bet on Cypherpunks that
this would happen. Nobody took the bet.), this provision sets a dangerous
precedence. The technical assistance prohibitions of the past have been
transformed into general prohibitions against "financing, contracting,
service, support, transportation, freight forwarding, or employment".

Again, IANAL.



-- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred
   Make your mark in the history of mathematics. Use the spare cycles of
   your PC/PPC/UNIX box to help find a new prime.
   http://www.mersenne.org/prime.htm

At 5:15 PM -0800 12/29/96, Timothy C. May wrote:
>This very list advocates violation of the ITARs in various ways (I speak of
>"the list" as a person in the sense of the consensus of the list...there
>may not be unanimity, but the consensus of the vocal members of the list is
>obvious).

Gee, I always thought that people on this list only advocated changing the
ITAR thru legal means.  The fact that strong crypto is widely available
outside the USA is merely supporting evidence for this view.  :-)

It's nice to see some signal back instead of just the noise sent during the
Christmas attack on the list.  Thanks to all of you who provided the signal.


-------------------------------------------------------------------------
Bill Frantz       | Client in California, POP3 | Periwinkle -- Consulting
(408)356-8506     | in Pittsburgh, Packets in  | 16345 Englewood Ave.
frantz@netcom.com | Pakistan. - me             | Los Gatos, CA 95032, USA

At 10:57 PM -0800 12/28/96, Lucky Green wrote:

>IMHO, this closes the door on the foreign contracting loophole used by C2
>and others. It is now illegal for US persons to finance or contract out
>overseas crypto development, since doing so will obviously assist in
>proliferation. While not unexpected (I offered a bet on Cypherpunks that
>this would happen. Nobody took the bet.), this provision sets a dangerous
>precedence. The technical assistance prohibitions of the past have been
>transformed into general prohibitions against "financing, contracting,
>service, support, transportation, freight forwarding, or employment".
>
>Again, IANAL.

Nor am I, but I have a "prediction" to make in the spirit of Lucky's types
of predictions of doom.

I predict that we will see within two years a law making it illegal to
"structure communications" with the intent to avoid traceability,
accountability, etc.

This would be along the lines of the laws making it illegal to "structure"
financial transactions with the (apparent) intent to avoid or evade certain
laws about reporting of income, reporting of transactions, etc.

As I was wading through the 500 accumulated Cypherpunks messages upon my
return, and after I discarded hundreds of spam and loop messages, and all
of the Vulisgrams--and about 50 others my filter kicked into the trash--I
was struck by the discussion by our former Federal prosecutor, Brian Davis,
about a "structuring" case he personally handled--the gambling lawyer
("IANAL--not") who arranged to receive his winnings as three separate $9000
checks. He paid all of his taxes, perhaps because he was alerted to the
invwestigation, but he nevertheless paid them. And yet, as Brian notes, he
forfeited the $27,000 in income. (Brian has noted that the guy voluntarily
agreed to this outcome, to avoid a court battle. The effect is that he lost
his income for the crime of structuring transactions, not for evading
taxes.)

How long before the U.S. Code declares "attempting to obscure or hide the
origin of a communication" to be a felony? That would rule out orninary
mail without return adresses, but I think there are ample signs we're
already moving toward this situation (packages that could be bombs
putatively require ID, talk of the Postal Service handling the citizen-unit
authentication/signature system, etc.).

While this would not stop all uses of remailers, sendmail-type hacks a la
Port 25 obfuscation, and so on, it would give the Feds a powerful tool in
the suppression of remailer networks.

"The operator of Anonymizer.com failed to file adequate "Reports of
Suspicious Communications" with the Internet Regulatory Commission. He has
agreed to settle the case by forfeiting his machines, his office furniture,
and $225,000 in alleged profits from past uses of his remailer service."

The various lawyers on this list may point out flaws in my prediction.
Please do! And there are still workarounds to such laws. But I think the
use of such regulations to "get" those the government wants "got" is a
time-honored strategy in our modern state. As Whit Diffie notes, the War on
Drugs certainly did not stop drug use, but it most assuredly caused
_corporations_ to be pressed into service as de facto drug policy
enforcers. (How, you ask? The threat of forfeiture of corporation-owned
properties if drugs were ever found on them. And the loss of government
business if urine samples were not taken regularly. "Just say no" posters
up in the company cafeterias.)

Similar restrictions on cryptography--including the "suspicious
communications" reporting item discussed here--will have a similar effect:
casual or "underground"  users will of course not be directly affected, but
corporate or institutional users will find their institutions are actings
as the cops. The large corporations will dare not use "rogue" crypto, for
fear of being hit with tax evasion or SEC or FTC charges (think about
it--that undecodable communication using remailer networks could have been
about price-fixing, or collusion). And companies offering anonymizing
services, like the old business model of Community Connexion (C2), will
likely be hit with the "structuring" rules.

This will force strong, unescrowed crypto to the margins, to the
underground. Exactly the desired intent, of course.

You heard it here.

--Tim May




Just say "No" to "Big Brother Inside"
We got computers, we're tapping phone lines, I know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1398269     | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

This fascist move by the U.S. government is a huge threat to our liberty.
It may be time to simply give up on communicating with these assholes and
give them the treatment they have earned.

At 10:57 PM -0800 12/28/96, Lucky Green wrote:

>Finally, to the big one:

And this a very big one indeed. Not only does it probably put organizations
like C2 out of business, at least in terms of supporting the development of
things like the South African and British Web products, but it also may
mean the *Cypherpunks list itself*, and some of its members, are ipso facto
in violation of this "giving comfort to the enemy" (to paraphrase) language!

>>Sec. 736.2  General prohibitions and determination of applicability.
>>
>>* * * * *
>>    (7) General Prohibition Seven--Support of Certain Activities by
>>U.S. persons--(i) Support of Proliferation Activities (U.S. Person
>>Proliferation Activity). If you are a U.S. Person as that term is
>>defined in Sec. 744.6(c) of the EAR, you may not engage in any
>>activities prohibited by Sec. 744.6 (a) or (b) of the EAR which
>>prohibits the performance, without a license from BXA, of certain
>>financing, contracting, service, support, transportation, freight
>>forwarding, or employment that you know will assist in certain
>>proliferation activities described further in part 744 of the EAR.
>>There are no License Exceptions to this General Prohibition Seven in
>>part 740 of the EAR unless specifically authorized in that part.

This may mean, subject to the usual legal system review (a scapegoat is
targetted, a court case is filed, several years of Zimmermann limbo follow,
etc.), that members of this list may be construed to be engaging in
"certain financing, contracting, service, support, transportation, freight
forwarding, or employment that you know will assist in certain
proliferation activities described further in part 744 of the EAR."

Certainly "support" and "service" of these products. Is giving a user
advice on "Stronghold" now to be a felony? How about PGP, which certainly
has not received export approval? And so on.

This very list advocates violation of the ITARs in various ways (I speak of
"the list" as a person in the sense of the consensus of the list...there
may not be unanimity, but the consensus of the vocal members of the list is
obvious).


It may be time for us to go underground. It may be time to take much, much,
much, much more extreme steps. This fascism is unacceptable.

--Tim May

Just say "No" to "Big Brother Inside"
We got computers, we're tapping phone lines, I know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1398269     | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

"Timothy C. May" <tcmay@got.net> writes:

> This fascist move by the U.S. government is a huge threat to our liberty.
> It may be time to simply give up on communicating with these assholes and
> give them the treatment they have earned.

I said it recently on another forum: U.S. today reminds me not of Nazi
Germany (which would have existed for hundreds of years if it hadn't
foolishly attacked more neighbors than it could fight at the same time),
but of the former Soviet Union under late Brezhnev, Chernenko, and
Andropov. Nothing needs to be done; just wait for it to collapse and
try not to get hit by the falling debris. :-)

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

-----BEGIN PGP SIGNED MESSAGE-----

In article <3.0.32.19961228225731.006b3080@netcom13.netcom.com>,
Lucky Green  <shamrock@netcom.com> wrote:
>First the good news: the export controls mentioned in the draft of the regs
>on any kind of data security software, regardless if it uses crypto or not
>did not carry into the final version.

But it _specifically_ restricts virus-checkers (and, also, it would seem,
backup programs, but that could be stretching it):

ECCN 5D002.c.3:
# ``Software'' designed or modified to protect against malicious
# computer damage, e.g., viruses

   - Ian "_not_ a U.S. Person"

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMsl//0ZRiTErSPb1AQH3UgP/a9usiLoJbIpn1XNzSvqDftGPxeuoHO00
WRlaYxm4xIsADedp8xheTQB+cl0gjb10HLwBJ5FUGdbzZkGTEbsW9RQe7OX2t4vB
/6t75K+N6le7A/uJN0oNkmNz+5v5JaaDcsmjOHADzHsGEUFkN3JhRa7YUz83PVOk
zAAyHoSECNs=
=aLLo
-----END PGP SIGNATURE-----