At 11:24 AM -0700 7/18/96, Timothy C. May wrote:

This is a terribly important point: if a citizen of Foobaria succeeds in connecting to the Netscape site--perhaps by experimenting with various combinations of domain names and submitted address/zipcode combinations--and Netscape sends him the file, he has not committed a crime in his own country. (Unless they have their own laws....)

Incorrect. Netscape Navigator is as much commercial software as Microsoft Word, It is NOT freeware and if he pirates it without permission he's at least in violation of copyright which almost every country is a signatory to. Where I come from we call that "theft". Your ethics may vary in California.

Likewise, much "export-controlled" software is freely purchasable without any form of identification or proof of citizenship/residency in any of thousands of U.S. software stores.

True, but you have to agree to the licensing warning on the box (and let's not do the tired shrink-wrap licensing argument again, please--it's on the outside of the box).

(I don't know if the copies of Netscape Navigator on the shelves in U.S. stores are now the "U.S." version,

Yes.

as opposed to be a somwhat-crippled version, but I sure do know that a *lot* of nominally-export-controlled software _is_ freely purchasable.)

That no more gives you the legal right to violate ITAR after purchasing, or violate the license terms, than buying fertilizer gives you the legal right to make bombs in violation of the AT&F code. (No wise-guy complaints about how software isn't a bomb--though some I've bought clearly is :-). It's an analogy about principles, not function.)

Much of this software goes out of the country in luggage. In my various flights out of the U.S. over the years, never have my bags been so much as glanced at, except presumably for bombs with sniffers, scanners, etc. Further, I have mailed optical disks out of the country--a single one of these can store a whole lot of stuff.

I didn't say you couldn't do it. In fact I said the opposite--that I had no doubt it would leak. My point was that it wouldn't become mass-market software overseas because the leakers would be violating ITAR or copyright, or licensing and thus couldn't get away with selling or giving away the result at scale overseas. As Jeff pointed out, getting a licensed copy of Navigator does NOT include redistribution rights (unless you buy a site license directly from them--and they won't sell a site license for the US version for overseas use in violation of ITAR). In this respect it is significantly different from PGP or RSAREF. for which there ARE at least some redistribution rights under the license.

On a trip to France and Monaco last year, I deliberately carried several optical cartridges and couple of DATs, all crammed with software, PGP, RSADSI's MailSafe, Mathematica, etc. To make a point, and as props for my talk on crypto anarchy. Certainly there was no checking on the way out at SFO, and no checking whatsoever at Charles de Gaulle in Paris.

"Nyaah, nyaah, you can't catch me" doesn't mean that if they do they won't prosecute. Your waving around that stuff in France is not only juvenile, but also may put you in violation of French crypto law. That you can get away with 80 in a 55 mile zone until the cops see you doesn't mean 80 is legal nor that everyone else can do it with impunity.

(On my return trip, the bored inspector in San Francisco asked what my purpose in being overseas has been. Had I said "tourism" I would've been waved through. Instead, for interest, I said "Meeting with Russian cryptographers in Monte Carlo," just to see what would happen. He asked me what "cryptographers" are or do... "They make secret codes." He then waved me through. Sigh.)

There's no law against meeting, and customs inspectors aren't expected to launch interrogations to see what you told them if you're not on some watch list. Like many laws, this one might be used if something egregious happens. If the Russian got caught later with US Netscape by French authorities, and it came to the attention of US authorities that he said "Tim May gave it to me", THEN you might expect to "assist the police with their enquiries".

None of this is surprising, of course. Borders _are_ transparent. There are so _many_ degrees of freedom for getting stuff across borders. The hope that a bunch of *bits* can be stopped in ludicrous.

Again you make the long-discredited straw man argument that the purpose of ITAR is to hermetically seal. It is not. It is to keep legitimate US mass market purveyors from selling strong crypto overseas, and to provide a means to punish those who are caught violating it. I'm sure there are lots of tax cheaters. That doesn't mean the IRS code should be abolished (though I'd like to see massive simplification for other reasons). I'm sure there are still thieves. That doesn't mean we should make theft legal. I'm sure there are still those who cannot read. That doesn't mean teaching reading is useless or silly or should be stopped.

_This_ is why I expect the Netscape beta to arrive overseas pretty soon.

Nobody disputes that. It won't be readily available though, except for those who have no compunctions about software piracy. David