Crypto Legality Question

I have a theoretical situation which some person or
lawyer might know the answer to.  (not that lawyers are
not people...oh never mind).

Anyway..

ACME corporation, a mostly Canadian outfit with a major
subsidiary in the US, wants to roll out corporate wide crypto.

Most of their network operations are in the US except one
of their offices in Ireland.

Question (1): Can they buy a strong crypto package in the
US and physically roll it out to both Canada and Ireland.

Question (2): If Canada is OK, but Ireland is out of the
question, can Irish employees simply procure a compatible
strong crypto package from, say, Finland?  This assumes
that the message traffic from the Irish office to the US is
not covered by commerce dept regs, just the export of
software.  Since software isnt being exported, is everything
legal?

Thanks,

Jim Burnes


Jim Burnes
Engineer, Western Security, SSDS Inc
jim.burnes@ssds.com
----
When the world is running down
Make the best of what's still around
                   - Sting

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

At 01:25 PM 9/29/97 +0000, Jim Burnes wrote:
>
>I have a theoretical situation which some person or
>lawyer might know the answer to.  (not that lawyers are
>not people...oh never mind).
>
>Anyway..
>
>ACME corporation, a mostly Canadian outfit with a major
>subsidiary in the US, wants to roll out corporate wide crypto.
>
>Most of their network operations are in the US except one
>of their offices in Ireland.
>
>Question (1): Can they buy a strong crypto package in the
>US and physically roll it out to both Canada and Ireland.

Nope. Though Canada allows export of strong crypto generally, 
Canadians may not re-export US products once they enter the country.

>Question (2): If Canada is OK, but Ireland is out of the
>question, can Irish employees simply procure a compatible
>strong crypto package from, say, Finland?  This assumes
>that the message traffic from the Irish office to the US is
>not covered by commerce dept regs, just the export of
>software.  Since software isnt being exported, is everything
>legal?

Yup. As you could imagine, US export laws are set up to try to avoid 
such compatibility whenever possible. This is also a reason why PGP 
Inc.'s recent shift to crypto services and away from relying on 
crypto sales exclusively is a relatively big deal. If everyone has 
the software, PGP Inc. can provide services to those folks a lot more 
easily. PGP 5.0, of course, is out there on the Net for the taking 
worldwide.

Cheers.

Will Rodger
Washington Bureau Chief
Inter@ctive Week
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNDAVmNZgKT/Hvj9iEQIemwCeMsUUiMuPRE2we6t8WiPxQ9TGSAIAoPwN
O5C/FTnLEuGrJC2mY+DMb0IC
=5f31
-----END PGP SIGNATURE-----

Will Rodger wrote:
> At 01:25 PM 9/29/97 +0000, Jim Burnes wrote:
> >ACME corporation, a mostly Canadian outfit with a major
> >subsidiary in the US, wants to roll out corporate wide crypto.
> >
> >Most of their network operations are in the US except one
> >of their offices in Ireland.
> >
> >Question (1): Can they buy a strong crypto package in the
> >US and physically roll it out to both Canada and Ireland.
> 
> Nope. Though Canada allows export of strong crypto generally,
> Canadians may not re-export US products once they enter the country.

  Yo, dude!
  If the company buys PGP 5.0, then their Ireland office can obtain
the freeware version from an overseas site, or have their Canadian
office send it to them.
  Freeware is legally exportable from Canada. (I lost my pointer to
the site that explains the legal implications, but Adam Back might
have it unless he is doing as many drugs as myself, and has lost
it, as well.)

  Also, there is a Canadian company which has a decent full-strength
crypto package, can't remember the name of their product, but if you
contact Dimitri, he can tell you, although he will also point out
that the commie ratfucking cocksucker Chris Lewis is connected with
the company.

  And, realistically, regardless of the source of the crypto package
a Canadian company uses, or the restrictions against its export,
unless the company makes a point of advertising their sharing of the
software with their Irish subsiduary, it would be a point of extreme
embarassment for Canadian officials to harass a Canadian company for
sending strong crypto to another member of the British Commonwealth,
even if it no longer officially exists.
  I know several companies that do so, and they have no problems.

A Loser To Be Flamed Later
Bienfait Bureau Squaw
Electronic Forgery Foundation

Will Rodger <rodger@worldnet.att.net> writes:
> At 01:25 PM 9/29/97 +0000, Jim Burnes wrote:
> >
> >ACME corporation, a mostly Canadian outfit with a major
> >subsidiary in the US, wants to roll out corporate wide crypto.
> >
> >Most of their network operations are in the US except one
> >of their offices in Ireland.
> >
> >Question (1): Can they buy a strong crypto package in the
> >US and physically roll it out to both Canada and Ireland.
> 
> Nope. Though Canada allows export of strong crypto generally, 
> Canadians may not re-export US products once they enter the country.

This is not the way I understand it.

You can re-export strong crypto from Canada, you just have to inform
the appropriate Canadian government department that you have done so.

So procedure is: 1) import software from US, 2) write appropriate
Canadian export department telling "I'm going to export blah to xyz
corp offices in Ireland", 3) export it.

That is, there is a loop-hole, you don't have to ask permission for
export, you just have to inform them you're going to do it.  (You
might want to check this out with a Canadian lawyer familiar with the
rules, and loop-holes).

So you informed them.  They can't do anything about it.  They won't
like it, but they don't have to.

I'm told Kerebos was exported by this route.  US -> Canada -> UK.
100% legally.

Adam
-- 
Now officially an EAR violation...
Have *you* violated EAR today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`