On Wed, Nov 19, 1997 at 01:00:02AM -0000, lcs Mixmaster Remailer wrote:
If someone writes a piece of software, a networking layer, or anything else with support for later cryptographic enhancement but doesn't actually include the cryptographic implementation and it is later added by somebody outside of the United States does this fall under ITAR?
Crypto exports have been governed (for the most part) by the EAR, not ITAR, for about 11 months now. The EARs can be found at 15 CFR 730 et seq.
In other words the original U.S. authors wrote the software with support for crypto, function hooks, etc. They didn't include any crypto at all. Somebody outside the United States uses these hooks and writes strong cryptography. These modifications are kept as patches and never exported from the U.S.. Is this allowed?
No. Software designed or modified to use cryptography is export controlled; see ECCN 5D002 in 15 CFR part 744.
What if the U.S. authors are actively collaborating with the non-US authors?
See 15 CFR 744.9, "Restrictions on Technical Assistance by US Persons With Respect to Encryption Items": (a) General prohibition No U.S. person may, without a license from BXA, provide technical assistance (including training) to foreign persons with the intent to aid a foreign person in the development or manufacture outside the United States of encryption commodities and software that, if of United States origin, would be controlled for"EI" reasons under ECCN 5A002 or 5D002. Note that this prohibition does not apply if the U.S. person providing the assistance has a license or is otherwise entitled to export the encryption commodities and software in question to the foreign person(s) receiving the assistance. Note in addition that the mere teaching or discussion of information about cryptography, including, for example, in an academic setting, by itself would not establish the intent described in this section, even where foreign persons are present. --- also, see the definition of "technology" in 15 CFR 772 - "Technology". (General Technology Note)-- Specific information necessary for the "development", "production", or "use" of a product. The information takes the form of "technical data" or "technical assistance". Controlled "technology" is defined in the General Technology Note and in the Commerce Control List (Supplement No. 1 to part 774 of the EAR). N.B.: Technical assistance--May take forms such as instruction, skills training, working knowledge, consulting services. Note: "Technical assistance" may involve transfer of "technical data". "Technical data".--May take forms such as blueprints, plans, diagrams, models, formulae, tables, engineering designs and specifications, manuals and instructions written or recorded on other media or devices such as disk, tape, read-only memories. -- axlotl@cyberpass.net