- cypherpunks-legacy - lists.cpunks.org

Bidzos on PGP and ITAR verbatim
by L. Detweiler 17 Dec '03

17 Dec '03

Bidzos comments on PGP related to ITAR, from sci.crypt a while ago (not sure of date). Essential argument: it was illegally exported, and ITAR prohibits re entry of things illegally exported, therefore it is illegally imported. Relevant section, Software export: Section 123.2 of the ITAR reads: >"123.2 Imports. > >No defense article may be imported into the United States unless (a) >it was previously exported temporarily under a license issued by the >Office of Munitions Control; or (b) it constitutes a temporary >import/intransit shipment licensed under Section 123.3; or (c) its >import is authorized by the Department of the Treasury (see 27 CFR >parts 47, 178, and 179)." There is a section on `illegal export of unclassified technical data to foreign nationals' (paraphrase) and Bidzos claims it applies to PGP export. But he appears to me to be using a bit of sleight of hand to conflate this category with *cryptographic software* mentioned elsewhere (sections also as quoted also by H. Finney). I'll let others pick it apart for the loopholes. ===cut=here=== Date: Mon, 20 Sep 93 19:31:08 PDT Message-Id: <9309210231.AA16113(a)RSA.COM> To: ld231782(a)longs.lance.colostate.edu In-Reply-To: "L. Detweiler"'s message of Mon, 20 Sep 93 19:57:35 -0600 <9309210157.AA04992(a)longs.lance.colostate.edu> Subject: PGP & ITAR Here's the ITAR part. (This was posted in 1992, so I don't know, since pgp has changed since then I understand, how it would apply.) Also, the ITAR has changed recently, and I haven't studied the changes to see how they would affect these comments. Risks of using pgp One should be careful about assuming that the documentation in electronically distributed software is accurate, especially where law is concerned. There are a few things the documentation for a program called "pgp" does not tell you about patent and export law that you should be aware of. Further, there are a number of claims and offered interpretations of patent and export law that are simply false. pgp seems to be an attempt to mislead netters into joining an illegal activity that violates patent and export law, letting them believe that they run no serious risk in doing so. EXPORT LAW pgp leads users to believe that it has circumvented export controls "...since it is not illegal to import..." You are led to believe that since you didn't import it, it's legal to use it. The "no import restrictions" claim has been made so many times, many people probably believe it. One would be well advised not to accept this legal opinion. While stated as if it were a well-known fact, the claim that "there are no import restrictions" is simply false. Section 123.2 of the ITAR (International Traffic in Arms Regulations) reads: "123.2 Imports. No defense article may be imported into the United States unless (a) it was previously exported temporarily under a license issued by the Office of Munitions Control; or (b) it constitutes a temporary import/intransit shipment licensed under Section 123.3; or (c) its import is authorized by the Department of the Treasury (see 27 CFR parts 47, 178, and 179)." Was pgp illegally exported? Was pgp illegally imported? Of course. It didn't export or import itself. pgp 1 was illegally exported from the U.S., and pgp 2, based on pgp 1, is illegally imported into the U.S. Is a license required? According to the ITAR, it is. 125.2 Exports of unclassified technical data. Paragraph (c) reads: "(c) Disclosures. Unless otherwise expressly exempted in this subchapter, a license is required for the oral, visual, or documentary disclosure of technical data to foreign nationals in connection with visits by U.S. persons to foreign countries, visits by foreign persons to the United States, or otherwise. A license is required regardless of the manner in which the technical data is transmitted (e.g., in person, by telephone, correspondence, electronic means, telex, etc.)." ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ What is "export?" Section 120.10, "Export," begins: "'Export' means, for purposes of this subchapter: ...(c) Sending or taking technical data outside of the United States in any manner except that by mere travel outside of the United States by a person whose technical knowledge includes technical data; or..." Crypto software is controlled by the ITAR. See Part 121, the Munitions List, includes Category XIII, of which paragraph (b) reads, in part, "...privacy devices, cryptographic devices and software (encoding and decoding), and components specifically designed or modified therefore,..." A further definition in 121.8, paragraph (f) reads: "Software includes but is not limited to the system functional design, logic flow, algorithms, application programs, ..." pgp encourages you to post it on computer bulletin boards. Anybody who considers following this advice is taking quite a risk. When you make a defense item available on a BBS, you have exported it. pgp's obvious attempts to downplay any risk of violating export law won't help you a bit if you're ever charged under the ITAR. Penalties under the ITARs are quite serious. The ITARs were clearly designed to put teeth into laws that make exporting munitions illegal. It's unfortunate that cryptography is on the munitions list. But it is. pgp is software tainted by serious ITAR violations. ------- End of Forwarded Message

7 8

minor address correction
by bart＠netcom.com 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 21 Sep 93 21:35:16 -0600 > From: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> ... > > note: the new sci.crypt FAQ will have a much-improved section on public > key cryptography. watch for it on the newsgroup or > rtfm.mit.edu:/pub/usenet/news-answers/cryptography-faq if you want it right away. > > You'll do better in: /pub/usenet-by-group/news.answers/cryptography-faq" is current directory. ^^^^^^^^^^^^^^^ ^

1 0

Sorry about that...
by nobody＠soda.berkeley.edu 17 Dec '03

17 Dec '03

Aargggh! Sorry about the multiple postings of Master Key. The mailer here has been very strange lately. Sometimes it's down, and when it comes back up, things which were sent get sent again... --==<< Infocalypse >>==--

1 0

Re: REMAIL: policy
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Remailers: hfinney(a)shell.portal.com hal(a)alumni.caltech.edu I keep logs only of the date/time at which my remailers get used; no logging is kept of the message contents. I do this only to get a picture of the overall volume of messages passing through my remailer. The Unix systems on which I run these remailers may also do some logging; I haven't been able to determine exactly what is done. I presume this might include incoming and outgoing addresses as well as message date/time and possibly size. (I am familiar only with uucp mail and don't know where to look on these net-connected Unix systems for sendmail logs.) My account on alumni.caltech.edu is free, based on my membership in the school alumni association (for which I paid some $300 about fifteen years ago for a life membership). My account on shell.portal.com costs my about $20 a month in fixed costs, plus $2/hour connect charges which typically run another $30 a month or so. So I am paying these people quite a bit and I hope therefore that this will give me some bargaining strength if political problems arise from the remailers. However, due to the large number of users on these systems, there are many restrictions on my usage. I cannot leave daemon processes running, nor can I use at or cron to schedule periodic jobs. The nice thing about the current remailer scripts is that they can be triggered by incoming mail without having a high profile to system administrators. Both of these systems appear to be well connected on the net and are almost always available. Both support PGP encryption. I am hoping to add batch capabilities to the remailers soon, based on Karl's scripts. I also like Karl's suggestion to add message padding to outgoing messages. If this system were used in conjunction with batching then if all messages in a batch were outgoing-padded (undetectably) to the size of the largest message in the batch then there would be total hiding of the incoming-to-outgoing message mapping. Earlier I had assumed that both incoming and outgoing messages would have to be standardized in size but now I see that padding of outgoing-only messages would be sufficient. Hal Finney hfinney(a)shell.portal.com

2 1

Source code
by trestrab＠GVSU.EDU 17 Dec '03

17 Dec '03

I would be interested in taking a look at the source for the encryption program you mentioned in your post. Thanks. I would also be interested in your paper on the subject. Jeff trestrab(a)gvsu.edu

1 0

(1) PRZ excluded (2) PM vs. LD (3) grand jury procedure
by L. Detweiler 17 Dec '03

17 Dec '03

I was thinking. What is the significance that PRZ was not actually cited in any subpoena so far? This is very puzzling. It seems to contradict the theory that the investigation is primarily PGP oriented. On one hand, we might attribute it to the idea that the grand jury & the Attorneys don't have a very clear idea of what exactly is going on with PGP anyway, which would fit in with some of the tidbits I've posted. The president of ViaCrypt *was* subpoenaed -- but he has only been in associated with PGP for a few weeks, since the commercial announcement. But, still, how could they *not* query PRZ if they are inquiring on PGP? This is what I call a `conspicuous omission'. Also, the targeting of ViaCrypt and not PRZ directly is very interesting to contemplate. It definitely suggests that the move of PGP to a commercial company was critical in the timing of the subpoenas. Was it critical in convening a grand jury in the first place? what is it about the situation that caused action after a company was involved? are relevant laws only applicable to companies, not individuals? surely not, but there is very likely something going on here beneath the surface. (BTW, let the record show I have only replied directly to PM's voluminous onslaught of public flames [to say nothing of my vast, superb private collection] in one message on the list, which I think is sufficient [or more precisely, nothing could be sufficient, but it is the minimum]. If there is any `bickering' going on beyond this, it is only the reader's fertile imagination that I was *engaged* [*targeted*? definitely]. Or, feel free to cite the messages to contradict me, in email. I say all this only because I fear I am becoming a symbol in everyone's psyche of any message that challenges PM, no matter who wrote it, quite to the contrary of actual developments.) Here's a bit more which is helpful in describing a grand jury investigation (although I'd like to see more) from someone who gives me too much credit :) ===cut=here=== Date: Tue, 21 Sep 1993 11:49:33 -0400 From: [...] To: ld231782(a)longs.lance.colostate.edu Subject: Re: more musings You are absolutely right about the Grand Jury proceedings. They are simply a fact finding venture. They are secret hearings and I doubt that Phil Zimmerman will even be able to talk about the proceedings after they are done. In addition to this, you are also correct that attorneys are not permitted inside the grand jury hearing (although the witness may leave the room to confer with the attorney). Once inside the room, you will only have the Grand Jury (of 23 people I believe) and the D.A. While it may seem nice to believe that Phil Zimmerman will be able to make a grand Perry Mason like speech in front of the Grand Jury. In reality, he will be under the control of the D.A. and will probably not have much of a chance to say much of anything except to answer the questions of the D.A. On the last point, yes you are also right, since the Grand Jury is NOT a criminal trial. Any evidence that would normally be held as illegally obtained, or just generally inadmissable in court (ie. hearsay) is perfectly acceptable for a Grand Jury, and I'm sure that it will be used. The grand jury's only purpose is to pass either an indictment (called a True Bill ) or no indictment, they are not there to determine guilt.

3 2

Re: the $64K question?
by peter honeyman 17 Dec '03

17 Dec '03

> This definition does not > include information concerning general scientific, > mathematical, or engineering principles commonly > taught in academia. as a matter of fact, i am teaching a graduate course in cryptography this semester and am using pgp as a pedagogical tool. peter

1 0

Health Security Card
by Duncan Frissell 17 Dec '03

17 Dec '03

Senator Harris Wafford (sp?) on Larry King Live just flashed a mockup of the Health Security Card. It is white. It has a red, white, and blue flag on it. It looks like it has a 7 digit number on it in the EIN split pattern 99 99999. It was hard to count digits though. It might have 9 digits rather than 7. Wafford did use the term "smartcard." I'm sure Willy will feature one in his speech tomorrow night. Duncan Frissell "Where's your Health Security Smartcard." "Sorry, I'm don't believe in that sort of thing. I'm an anarchist. You know, that's an alternative life style sort of like sodomy. They're starting to teach it in the schools and everything." --- WinQwk 2.0b#0

1 0

Stunned and amazed
by msattler＠netcom.com 17 Dec '03

17 Dec '03

>Perry Metzger >Puzzled and incredulous I'm not one to snivel about bandwidth ('cause I think the Internet can deal with a lot more text messages from us to ourselves), but the kind of thing that's gotten Perry in the state he's in reminds me of a time-honored way of dealing with trivial, nonsensical, toxic waste messages: IGNORE THEM AND THEY'LL GO AWAY. It's the attention that's craved. We now return you to your insightful cypherpunks list, already in progress. :-) M ----------------------------------------------------------------------------- Michael S. Sattler msattler(a)netcom.com +1 (415) 358-3058 Digital Jungle Software Encrypt now; ask me how. (finger for PGP key) "Don't Panic!" -- Douglas Adams "Don't Panic. Stay Cool." -- PRZ

1 0

Subjects in anon msgs
by fnerd＠smds.com 17 Dec '03

17 Dec '03

Someone writes: > What do you put in the Subject: line of an encrypted or anonymous > message? > > We need something standard to prevent traffic analysis on this field. ... Isn't it okay to have the subject appear in the last hop, according to a :: field in the second-to-last message? ::Remail-with-Subject: All Right Bugsy Lets Get Down To Brass Tacks With remailers that unencrypt at each hop, this doesn't seem a problem to me. With remailers that accept unencrypted input, this is no more of a steganoweakness than the body of the message already is. -fnerd(a)smds.com

1 0