Date: Mon, 10 Sep 2012 18:39:51 +0000 From: jacob@appelbaum.net To: liberationtech@lists.stanford.edu CC: eric@privacy.org Subject: Re: [liberationtech] FinFisher is now controlled by UK export controls

Eric King:

...

Hi all,

I thought this list would be interested to know that the British Government has decided to place FinFisher under UK export controls. There are a ton of questions that remain to be answered, and it's only part of the bigger goal to control the export of surveillance technology, but it's a good first step!

...

In a letter sent earlier in August to Privacy International's lawyers Bhatt Murphy, a representative of the Treasury Solicitor stated:

The Secretary of State, having carried out an assessment of the FinSpy system to which your letter specifically refers, has advised Gamma International that the system does require a licence to export to all destinations outside the EU under Category 5, Part 2 (bInformation Securityb) of Annex I to the Dual-Use Regulation. This is because it is designed to use controlled cryptography and therefore falls within the scope of Annex I to the Dual-Use Regulation. The Secretary of State also understands

Export controls on cryptographic items is not a new development in the UK or anywhere else - https://www.gov.uk/specialist/export-of-cryptographic-items The question in the case of FinSpy was whether it was to be classed as a Dual Use item. The UK government appears to now be recognising that FinSpy is indeed a Dual Use item and falls under Annex I of EC export regulations. Annex I is designed to control exports of goods (cryptographic or otherwise) "designed or modified for military use." So what the UK government is implicitly recognising here is that FinSpy can be used as a military tool -- a bit like a weapon -- and should be subject to the same controls. If they implement this, it will mean Gamma will have to make an application for every sale it wants to make outside of the EU, and this will have to be assessed with the Dual Use criteria in mind. So any export will have to be considered in terms of "the respect of human rights and fundamental freedoms in the country of final destination." If the UK government suspects it could be used for internal repression in the country of final destination, for example, they will (theoretically at least) refuse the export. In short, this is progress. Good work Eric. Ryan that other products in the Finfisher portfolio could be controlled for export in the same way."

...

...

Press release is here:

https://www.privacyinternational.org/press-releases/british-government-admit... -it-has-already-started-controlling-exports-of-gamma

...

Full copy of the letter:

https://www.privacyinternational.org/sites/privacyinternational.org/files/do... nloads/press-releases/2012_08_08_response_from_tsol.pdf Best,

Eric

This is absolutely fucking horrible. They're controlling it based on *cryptography* after we WON the cryptowars? What. The. Fuck. And even worse, they must require a license? And they don't state categorically that they'll deny it on some kind of humanitarian or anti-crime related basis?

I mean, I am sure this is the result of a lot of hard work by many people and I don't mean to imply any disrespect. Did this just undercut the work from the 90s? Wany people explicitly fought hard to win the decision of having our free speech rights apply to the net for code as speech.

Argh, Jake

-- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech

-- Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE