At 1:23 AM -0700 7/29/97, Craig Strickland wrote:
This triggered a thought that may have already been discussed, but I thought I'd throw it out anyway. Since the export of cryptography = munitions, what happens if I write an application that's the "shell", and contract with a national and resident of a foreign country to write the crypto module. I do not export the crypto technology other than sending them a printed book (which Phil Karn's filing determined was exportable as a non-munition).
I then retail the software as a 2-component system (distantly like PGP 2.6.3i could have been) on the web. FTP the "shell" from my domestic site, and FTP the "crypto" from the foreign site. Both install to make the seamless finished product.
Anyone seen anything in ITAR addressing such a hiring arrangement?
This is called "providing crypto hooks," at least in the many threads on this list and on Usenet where the details of this have been discussed. It is generally interpreted--but there has not yet been a good court case to test it, that I know of--that providing a "hook" or place to drop in crypto is a violation of the ITARs/replacements for the ITARs. Ditto for exporting expertise designed to circumvent the ITARs. Thus, RSADSI cannot tell Rivest and the others to go take a 6-month in Monte Carlo or Switzerland and develop the next generation there. Again, this interpretation has not gotten a clear test in the courts. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."