EAR question

If crypto source code is published in printed form and distributed under a
non-disclousre agreement does it meet the uncontrolled export criteria
under the new EAR regs?  My question seems to hinge on the definition of
"general distribution," in Sec. 734.7.

The key passages seem to be:

Sec. 734.3  Items subject to the EAR.

* * * * *
    (b) * * *
    (3) Publicly available technology and software, except software
controlled for EI reasons under ECCN 5D002 on the Commerce Control
List, that:
    (i) Are already published or will be published as described in
Sec. 734.7 of this part;
    (ii) Arise during, or result from, fundamental research, as
described in Sec. 734.8 of this part;
    (iii) Are educational, as described in Sec. 734.9 of this part;
    (iv) Are included in certain patent applications, as described in
Sec. 734.10 of this part.

    Note to paragraphs (b)(2) and (b)(3) of this section: A printed
book or other printed material setting forth encryption source code
is not itself subject to the EAR (see Sec. 734.3(b)(2)). However,
notwithstanding Sec. 734.3(b)(2), encryption source code in
electronic form or media (e.g., computer diskette or CD ROM) remains
subject to the EAR (see Sec. 734.3(b)(3)).


Sec. 734.7  Published information and software.

* * * * *
    (b) Software and information is published when it is available for
general distribution either for free or at a price that does not exceed
the cost of reproduction and distribution. See Supplement No. 1 to this
part, Questions G(1) through G(3).

Steve Schear <azur@netcom.com> writes:
> If crypto source code is published in printed form and distributed under a
> non-disclousre agreement does it meet the uncontrolled export criteria
> under the new EAR regs?  My question seems to hinge on the definition of
> "general distribution," in Sec. 734.7.
> 
> The key passages seem to be:
> 
> Sec. 734.3  Items subject to the EAR.
> 
> * * * * *
>     (b) * * *
>     (3) Publicly available technology and software, except software
> controlled for EI reasons under ECCN 5D002 on the Commerce Control
> List, that:

Have you read 5D002?  I think this is the clause which says that you
can not export it for whatever reason.

My reason for thinking this is from reading some of Peter Jungers
docs at:

	http://samsara.law.cwru.edu/comp_law/jvd/pdj-bxa-gjs070397.htm

the decision the commerce department made on the RSA sig said that it
was not exportable, 5D002 was the paragraph quoted as the reason why
it was not exportable.

That is perhaps it is not that interesting what you can do with stuff
which isn't designated 5D002, as that is exportable anyway.

On a related note my understanding of what Peter Junger is saying is
that under EAR you can export anything you want just by printing it on
a piece of paper and snailing it.

Adam
--
Now officially an EAR violation...
Have *you* violated EAR today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`