I just sent this to the firewalls list in reply to a message there, but I thought it might be of interest here too. -Futplex <futplex@pseudonym.com> hmmm, haven't seen any mail from the list in a suspiciously long time.... Forwarded message:

Subject: Re: International Encryption Protocols To: Firewalls@GreatCircle.COM Date: Wed, 11 Oct 1995

Ted Doty writes:

...

Certainly the signatory countries to the CoCom treaty all enforce similar export controls to those enforced by the USA. Therefore, do not go looking to purchase cryptography in the UK for use outside the UK.

I think this is misleading. CoCom, the Coordinating Committee for Multilateral Export Controls, amounted to a non-proliferation pact to prevent the spread of supercomputers and other hot potatoes beyond the club of countries to untrusted (non-CoCom) countries. As far as I can tell it did not erect export barriers _between member countries_, except perhaps some ordinary red tape.

Before it officially dissolved in early 1994, CoCom included, among others, all of the G7 plus a healthy chunk of Western Europe: Australia, Belgium, Canada, Denmark, France, Germany, Greece, Italy, Japan, Luxembourg, the Netherlands, Norway, Portugal, Spain, Turkey, the U.K., and the U.S. According to http://www.chemie.fu-berlin.de/adressen/org-fact.html, Austria, Finland, Ireland, South Korea, New Zealand, Singapore, Sweden, and Switzerland were voluntarily cooperating with the export restrictions.

As far as CoCom was concerned, you could generally sell crypto from Britain to most of the net. This is a far cry from the position of the U.S. ITAR, which prohibits the export of strong confidentiality-protecting crypto to the U.K., for example.

Most of the other CoCom signatories do _not_ enforce export controls similar to the U.S. ones.

[...]

...

Note: the treaty has expired, but the signatory countries seem to still be willing to follow it. Nobody really wants to see strong crypto widely deployed.

Make that "No government really wants...." and I'll agree with you.

BTW, ftp://ftp.eff.org/pub/CAF/law/software-export-law contains an interesting, detailed memo dated 95/03/06, from a California law firm, giving an "Update on Current Status of U.S. Export Administration Regulations on Software Exports".

-Futplex <futplex@pseudonym.com>