3 ms·

Full quote: -- "This action will not result in the decontrol of source code classified under ECCN 5D002, but it will result in a simplification of the regulat

by dchest 16y ago

Full quote: -- "This action will not result in the decontrol of source code classified under ECCN 5D002, but it will result in a simplification of the regulatory provisions for publicly available mass market software and specified encryption software in object code." -- ECCN 5A002 is "software". This simplifies provisions for "publicly available mass market software".

jcr 16y ago
And "simplification" means what exactly? --My main point. The real trouble is, unless these statements are very clear in the legal sense, some poor bastard might unintentionally become the poster child of bad litigation/direction. Even unintentional violation of the export laws is a federal offense, and must be taken very seriously.
- tptacek 16y ago
  It is already vanishingly unlikely that you would be prosecuted for "exporting" crypto software. I shipped commercial software in the mid-90's, when we actually had to fill out forms to export code that used (eg) Blowfish to protect secrets, and I didn't even remember that until this announcement. My understanding of this announcement is that it simply makes official what was already near-universal in practice: it's safe to export any non-classified crypto code. (What's "classified"? You'd know it if you had it. Classified crypto has more to do with the setting in which its used than the actual algorithms in use.)
  - jcr 16y ago
    I completely agree on the "vanishingly unlikely prosecution" and "accepting the obvious" of code already being available. Off the top of my head, I can think of only one person who has been in this particular hot water over the years; Phil Zimmerman for his PGP work [1]. For me at least, it's not a matter of whether or not I will get in trouble, instead, it's whether or not I can get in trouble? It's just like copyright infringement; you can probably get away with it, but it's still illegal. The question now is if it's now legal to export crypto code? [1] http://en.wikipedia.org/wiki/Phil_Zimmermann#Criminal_investigation_by_US_Customs http://en.wikipedia.org/wiki/Phil_Zimmermann#Criminal_invest...
    - tptacek 16y ago
      Back in the '90s, there was all manner of drama surround the "export" of RSA code. People got it patented, or mailed it printed on paper, or had "non-exportable" T-shirts printed (I bought one of those T-shirts in 1995; this was before SSL, so I had to send the vendor the bank account information off the bottom of a check). If those rules were still germane, just note that they've been violated many hundreds of times on Hacker News. I'm glad the government clarified these rules, but there's no genuine practical impact to this announcement.
      - jcr 16y ago
        I believe the RSA code was, initially at least, under a "sealed" patent? The PGP-based drama of printing books of the source code to get copyright protections, and then exporting the books rather than exporting the machine readable code, was just ridiculous. The "International Version" of PGP (www.pgpi.org) was intended to deal with both the ITAR export restrictions and also the RSA patents. Fun times, but a real PITA. Just for clarity, you're referring to 56-bit versus 128-bit SSL debacle of the mid 90's. Getting back to the real problem... how the heck is an open source developer in the US to know if the crypto code he's written can be legally exported? Though the announcement seems friendly, it is (intentionally?) not clear. There is no mention of the ITAR restrictions being lifted. Also, there's always the issue of unknowing reinvention of something classified. Other than stating the status quo of crypto code being currently exported, the announcement does not really offer any legal protection for exporting crypto code. Am I just reading the announcement wrong? Am I wrong in expecting the ITAR restriction being removed?
        ghshephard 16y ago
        Re: "how the heck is an open source developer in the US to know if the crypto code he's written can be legally exported?" tptacek: "My understanding of this announcement is that it simply makes official what was already near-universal in practice: it's safe to export any non-classified crypto code. "
        16y ago
- dchest 16y ago
  Here's the full document with this patch applied: http://www.gpo.gov/bis/ear/ear_data.html http://www.gpo.gov/bis/ear/ear_data.html

by dchest 16y ago

jcr 16y ago

And "simplification" means what exactly? --My main point. The real trouble is, unless these statements are very clear in the legal sense, some poor bastard might unintentionally become the poster child of bad litigation/direction. Even unintentional violation of the export laws is a federal offense, and must be taken very seriously.

tptacek 16y ago
It is already vanishingly unlikely that you would be prosecuted for "exporting" crypto software. I shipped commercial software in the mid-90's, when we actually had to fill out forms to export code that used (eg) Blowfish to protect secrets, and I didn't even remember that until this announcement. My understanding of this announcement is that it simply makes official what was already near-universal in practice: it's safe to export any non-classified crypto code. (What's "classified"? You'd know it if you had it. Classified crypto has more to do with the setting in which its used than the actual algorithms in use.)
- jcr 16y ago
  I completely agree on the "vanishingly unlikely prosecution" and "accepting the obvious" of code already being available. Off the top of my head, I can think of only one person who has been in this particular hot water over the years; Phil Zimmerman for his PGP work [1]. For me at least, it's not a matter of whether or not I will get in trouble, instead, it's whether or not I can get in trouble? It's just like copyright infringement; you can probably get away with it, but it's still illegal. The question now is if it's now legal to export crypto code? [1] http://en.wikipedia.org/wiki/Phil_Zimmermann#Criminal_investigation_by_US_Customs http://en.wikipedia.org/wiki/Phil_Zimmermann#Criminal_invest...
  - tptacek 16y ago
    Back in the '90s, there was all manner of drama surround the "export" of RSA code. People got it patented, or mailed it printed on paper, or had "non-exportable" T-shirts printed (I bought one of those T-shirts in 1995; this was before SSL, so I had to send the vendor the bank account information off the bottom of a check). If those rules were still germane, just note that they've been violated many hundreds of times on Hacker News. I'm glad the government clarified these rules, but there's no genuine practical impact to this announcement.
    - jcr 16y ago
      I believe the RSA code was, initially at least, under a "sealed" patent? The PGP-based drama of printing books of the source code to get copyright protections, and then exporting the books rather than exporting the machine readable code, was just ridiculous. The "International Version" of PGP (www.pgpi.org) was intended to deal with both the ITAR export restrictions and also the RSA patents. Fun times, but a real PITA. Just for clarity, you're referring to 56-bit versus 128-bit SSL debacle of the mid 90's. Getting back to the real problem... how the heck is an open source developer in the US to know if the crypto code he's written can be legally exported? Though the announcement seems friendly, it is (intentionally?) not clear. There is no mention of the ITAR restrictions being lifted. Also, there's always the issue of unknowing reinvention of something classified. Other than stating the status quo of crypto code being currently exported, the announcement does not really offer any legal protection for exporting crypto code. Am I just reading the announcement wrong? Am I wrong in expecting the ITAR restriction being removed?
      - ghshephard 16y ago
        Re: "how the heck is an open source developer in the US to know if the crypto code he's written can be legally exported?" tptacek: "My understanding of this announcement is that it simply makes official what was already near-universal in practice: it's safe to export any non-classified crypto code. "
        16y ago
dchest 16y ago
Here's the full document with this patch applied: http://www.gpo.gov/bis/ear/ear_data.html http://www.gpo.gov/bis/ear/ear_data.html