ITAR

If someone writes a piece of software, a networking layer, or anything else
with support for later cryptographic enhancement but doesn't actually
include the cryptographic implementation and it is later added by somebody
outside of the United States does this fall under ITAR? 

In other words the original U.S. authors wrote the software with support for
crypto, function hooks, etc. They didn't include any crypto at all. Somebody
outside the United States uses these hooks and writes strong cryptography.
These modifications are kept as patches and never exported from the U.S.. Is
this allowed? What if the U.S. authors are actively collaborating with the
non-US authors?

First of all, you're the first person I've seen with a Niue address -
congratulations!  (South Pacific Island suburb of Lompoc :-)

At 05:27 PM 11/18/1997 -0800, Brian W. Buchanan <brian@smarter.than.nu> wrote:
>I've always been told that software with function hooks for crypto was
>just as unexportable as crypto itself.  

The legal status of crypto-equipment-without-the-crypto-plugin is
fuzzier under the current regime than the previous one, but it was
basically illegal to export components of a cryptosystem.

> doesn't make sense
You answered that correctly later:
>Of course, this is the goobermint we're dealing with...

So don't export that crypto-cellphone - export a phone with
voice amplifier software implemented as a plugin, 
or a digital background noise reducer,
or programmable muzak-on-hold replacement, or
or even enhanced authentication protocols.
They're not crypto devices, they're perfectly normal commercial products,
and you're shocked, _shocked_ at the free scratchy-white-noise background
music plugin that somebody with entirely no musical taste is shipping,
or that some Bulgarian hackers are abusing your phone to provide service
to Colombian narcoterroristas in blatant violation of their warranty.
				Thanks! 
					Bill
Bill Stewart, stewarts@ix.netcom.com
Regular Key PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639

On 19 Nov 1997, lcs Mixmaster Remailer wrote:

> 
> If someone writes a piece of software, a networking layer, or anything else
> with support for later cryptographic enhancement but doesn't actually
> include the cryptographic implementation and it is later added by somebody
> outside of the United States does this fall under ITAR? 
> 
> In other words the original U.S. authors wrote the software with support for
> crypto, function hooks, etc. They didn't include any crypto at all. Somebody
> outside the United States uses these hooks and writes strong cryptography.
> These modifications are kept as patches and never exported from the U.S.. Is
> this allowed? What if the U.S. authors are actively collaborating with the
> non-US authors?
 
I've always been told that software with function hooks for crypto was
just as unexportable as crypto itself.  This however doesn't make any
sense, because then anything with a plugin interface falls into that
category.  Hell, anything that can call external programs would qualify as
having a plugin interface, and all web browsers, mail/news readers, IRC
clients, editors, and possibly even all operating systems would fall into
that category.  Of course, this is the goobermint we're dealing with...
what did we expect but another arbitrary-arrest law.

-- 
Brian Buchanan                                      brian@smarter.than.nu

No security through obscurity!  Demand full source code!
4.4BSD for the masses - http://www.freebsd.org

--Boundary..3986.1071713753.multipart/signed
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

On Wed, Nov 19, 1997 at 01:00:02AM -0000, lcs Mixmaster Remailer wrote:
> If someone writes a piece of software, a networking layer, or anything else
> with support for later cryptographic enhancement but doesn't actually
> include the cryptographic implementation and it is later added by somebody
> outside of the United States does this fall under ITAR? 

Crypto exports have been governed (for the most part) by the EAR, not
ITAR, for about 11 months now. The EARs can be found at 15 CFR 730 et seq.

> In other words the original U.S. authors wrote the software with support for
> crypto, function hooks, etc. They didn't include any crypto at all. Somebody
> outside the United States uses these hooks and writes strong cryptography.
> These modifications are kept as patches and never exported from the U.S.. Is
> this allowed?

No. Software designed or modified to use cryptography is export controlled;
see ECCN 5D002 in 15 CFR part 744.

> What if the U.S. authors are actively collaborating with the
> non-US authors?

See 15 CFR 744.9, "Restrictions on Technical Assistance by US Persons With 
Respect to Encryption Items":

(a) General prohibition

No U.S. person may, without a license from BXA, provide technical assistance
(including training) to foreign persons with the intent to aid a foreign
person in the development or manufacture outside the United States of
encryption commodities and software that, if of United States origin, would
be controlled for"EI" reasons under ECCN 5A002 or 5D002. Note that this
prohibition does not apply if the U.S. person providing the assistance has a
license or is otherwise entitled to export the encryption commodities and
software in question to the foreign person(s) receiving the assistance. Note
in addition that the mere teaching or discussion of information about
cryptography, including, for example, in an academic setting, by itself would
not establish the intent described in this section, even where foreign persons
are present.

 ---

 also, see the definition of "technology" in 15 CFR 772 -

 "Technology". (General Technology Note)-- Specific information necessary for
 the "development", "production", or "use" of a product. The information takes
 the form of "technical data" or "technical assistance". Controlled "technology"
 is defined in the General Technology Note and in the Commerce Control List
 (Supplement No. 1 to part 774 of the EAR).

      N.B.: Technical assistance--May take forms such as instruction, skills
      training, working knowledge, consulting services.

      Note: "Technical assistance" may involve transfer of "technical data".

 "Technical data".--May take forms such as blueprints, plans, diagrams, models,
 formulae, tables, engineering designs and specifications, manuals and
 instructions written or recorded on other media or devices such as disk,
 tape, read-only memories.


-- 
axlotl@cyberpass.net


--Boundary..3986.1071713753.multipart/signed
Content-Type: application/octet-stream; name="pgp00013.pgp"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="pgp00013.pgp"
Content-Description: "PGP signature"

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogMi42LjIK
CmlRQ1ZBd1VCTkhLbkoyMytLbE90ZUh6bEFRRWlSZ1ArUGZQNTY5dHVNUDNa
U0lTenptaFppYkFYejlTakJNbncKYTlGaFRDYUpMWDFieTB6OTUydmNUb0dq
ODNNczdWeTlaZHMrZUJIWmdjZEhibVU4ZDhXQUdqelYwTkxiWXlEVQpPdnht
OEhxbDVYVVF5Ymg3eE5FUmdlT1RSTm9rb1FZd1hlanlqWXhCRHYvMno3Vyt4
WStDTzhJUTM0R0RUSlZsClVWaHlzWjA4VVRjPQo9SUFZQQotLS0tLUVORCBQ
R1AgU0lHTkFUVVJFLS0tLS0K
--Boundary..3986.1071713753.multipart/signed--