( ) United States Department of State ( State Dept ) Bureau of Politico-Military Affairs ( Logo ) Office of Defense Trade Controls ( ) Washington, D.C. 20522-0602 In reply refer to Feb 1 1994 OTDC Case: CJ-012-94 YOUR LETTER DATED: January 13, 1994 REQUEST FOR COMMODITY JURISDICTION FOR: "Kerberos 900104 bones.tar.Z patchlevel 6" software program This commodity jurisdiction (CJ) request was referred to the Departments of Commerce and Defense for their review and recommendations. As a result, the Department of State has determined that the referenced commodity falls under the licensing jurisdiction of the Department of Commerce. Please consult that agency's Office of Technology and Policy Analysis at (202) 482-4145 to determine their requirements prior to export. Should you require further assistance on this matter, please contact Maj. Gary Oncale at (703) 875-5655. Sincerely, (signed -- but it doesn't look anything like the name below) William B. Robinson Director Office of Defense Trade Controls John Gilmore Cygnus Support 1937 Landings Drive Mt. View, CA 94043 -- end of letter from State Department -- Now, what does it mean that we got a Commodity Jurisdiction for the Kerberos Bones? It means that the State Department has formally excused itself from worrying about us exporting the Bones. If the Commerce Department lets us do it, it's fine with the State Department. Exporting the Bones will not violate the International Traffic in Arms Regulations (ITAR). (Doing so might still violate other laws -- the State Dept has expressed no opinion on that.) This is no surprise, since the Kerberos Bones were deliberately emasculated to remove anything that might cause the State Department or the NSA to get upset. The letter just confirms that that effort was a success. I will do a formal check with the Commerce Department, as suggested in the State Department letter. My current understanding is that under Commerce rules (the Export Administration Act), publicly available software can be exported to any destination. In particular, I believe this means that there's nothing to fear from putting up the Bones for ordinary FTP. (There's a serious First Amendment issue being debated, over whether export control laws can prevent you from publishing software via FTP at all -- but even the most paranoid should now figure it's not an issue for the Bones.) I encourage people and companies who are interested in export issues to submit a commodity jurisdiction request for some software that you want to export, and go through the process. In public. The State Department and NSA don't publish their guidelines for what is exportable and what isn't, so the only way we-the-public are going to find out is by asking, and then telling each other. I've set up an FTP archive of such information on ftp://ftp.cygnus.com/pub/export. It includes `cjr.kit', which is the info you need to file your own CJ Requests, and three files regarding Commerce Department licensing. `commerce.gtda.license.faq' in particular is a FAQ from the Commerce Department about when the General license for Technical Data to All destinations lets you export without any paperwork. -- John Gilmore gnu@toad.com -- gnu@cygnus.com -- gnu@eff.org Can we talk in private? Join me in the Electronic Frontier Foundation. Not if the FBI and NSA have their way. Ask membership@eff.org how.