Crypto Legality Question
I have a theoretical situation which some person or lawyer might know the answer to. (not that lawyers are not people...oh never mind). Anyway.. ACME corporation, a mostly Canadian outfit with a major subsidiary in the US, wants to roll out corporate wide crypto. Most of their network operations are in the US except one of their offices in Ireland. Question (1): Can they buy a strong crypto package in the US and physically roll it out to both Canada and Ireland. Question (2): If Canada is OK, but Ireland is out of the question, can Irish employees simply procure a compatible strong crypto package from, say, Finland? This assumes that the message traffic from the Irish office to the US is not covered by commerce dept regs, just the export of software. Since software isnt being exported, is everything legal? Thanks, Jim Burnes Jim Burnes Engineer, Western Security, SSDS Inc jim.burnes@ssds.com ---- When the world is running down Make the best of what's still around - Sting
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 01:25 PM 9/29/97 +0000, Jim Burnes wrote:
I have a theoretical situation which some person or lawyer might know the answer to. (not that lawyers are not people...oh never mind).
Anyway..
ACME corporation, a mostly Canadian outfit with a major subsidiary in the US, wants to roll out corporate wide crypto.
Most of their network operations are in the US except one of their offices in Ireland.
Question (1): Can they buy a strong crypto package in the US and physically roll it out to both Canada and Ireland.
Nope. Though Canada allows export of strong crypto generally, Canadians may not re-export US products once they enter the country.
Question (2): If Canada is OK, but Ireland is out of the question, can Irish employees simply procure a compatible strong crypto package from, say, Finland? This assumes that the message traffic from the Irish office to the US is not covered by commerce dept regs, just the export of software. Since software isnt being exported, is everything legal?
Yup. As you could imagine, US export laws are set up to try to avoid such compatibility whenever possible. This is also a reason why PGP Inc.'s recent shift to crypto services and away from relying on crypto sales exclusively is a relatively big deal. If everyone has the software, PGP Inc. can provide services to those folks a lot more easily. PGP 5.0, of course, is out there on the Net for the taking worldwide. Cheers. Will Rodger Washington Bureau Chief Inter@ctive Week -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNDAVmNZgKT/Hvj9iEQIemwCeMsUUiMuPRE2we6t8WiPxQ9TGSAIAoPwN O5C/FTnLEuGrJC2mY+DMb0IC =5f31 -----END PGP SIGNATURE-----
Will Rodger wrote:
At 01:25 PM 9/29/97 +0000, Jim Burnes wrote:
ACME corporation, a mostly Canadian outfit with a major subsidiary in the US, wants to roll out corporate wide crypto.
Most of their network operations are in the US except one of their offices in Ireland.
Question (1): Can they buy a strong crypto package in the US and physically roll it out to both Canada and Ireland.
Nope. Though Canada allows export of strong crypto generally, Canadians may not re-export US products once they enter the country.
Yo, dude! If the company buys PGP 5.0, then their Ireland office can obtain the freeware version from an overseas site, or have their Canadian office send it to them. Freeware is legally exportable from Canada. (I lost my pointer to the site that explains the legal implications, but Adam Back might have it unless he is doing as many drugs as myself, and has lost it, as well.) Also, there is a Canadian company which has a decent full-strength crypto package, can't remember the name of their product, but if you contact Dimitri, he can tell you, although he will also point out that the commie ratfucking cocksucker Chris Lewis is connected with the company. And, realistically, regardless of the source of the crypto package a Canadian company uses, or the restrictions against its export, unless the company makes a point of advertising their sharing of the software with their Irish subsiduary, it would be a point of extreme embarassment for Canadian officials to harass a Canadian company for sending strong crypto to another member of the British Commonwealth, even if it no longer officially exists. I know several companies that do so, and they have no problems. A Loser To Be Flamed Later Bienfait Bureau Squaw Electronic Forgery Foundation
Will Rodger <rodger@worldnet.att.net> writes:
At 01:25 PM 9/29/97 +0000, Jim Burnes wrote:
ACME corporation, a mostly Canadian outfit with a major subsidiary in the US, wants to roll out corporate wide crypto.
Most of their network operations are in the US except one of their offices in Ireland.
Question (1): Can they buy a strong crypto package in the US and physically roll it out to both Canada and Ireland.
Nope. Though Canada allows export of strong crypto generally, Canadians may not re-export US products once they enter the country.
This is not the way I understand it. You can re-export strong crypto from Canada, you just have to inform the appropriate Canadian government department that you have done so. So procedure is: 1) import software from US, 2) write appropriate Canadian export department telling "I'm going to export blah to xyz corp offices in Ireland", 3) export it. That is, there is a loop-hole, you don't have to ask permission for export, you just have to inform them you're going to do it. (You might want to check this out with a Canadian lawyer familiar with the rules, and loop-holes). So you informed them. They can't do anything about it. They won't like it, but they don't have to. I'm told Kerebos was exported by this route. US -> Canada -> UK. 100% legally. Adam -- Now officially an EAR violation... Have *you* violated EAR today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`
participants (4)
-
A Loser To Be Flamed Later -
Adam Back -
Jim Burnes -
Will Rodger