5 ms·

Cryptography was considered a war weapon and only allowed for military use. The United States had to be brought to court to finally allow cryptography: https:/

Cryptography was considered a war weapon and only allowed for military use. The United States had to be brought to court to finally allow cryptography: https://en.m.wikipedia.org/wiki/Bernstein_v._United_States https://en.m.wikipedia.org/wiki/Bernstein_v._United_States > Years before, the government had placed encryption, a method for scrambling messages so they can only be understood by their intended recipients, on the United States Munitions List, alongside bombs and flamethrowers, as a weapon to be regulated for national security purposes. Companies and individuals exporting items on the munitions list, including software with encryption capabilities, had to obtain prior State Department approval. — Electronic Frontier Foundation: EFF's History Before that, export rules could be "worked around" by printing cryptography in books. See also https://en.m.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.m.wikipedia.org/wiki/Export_of_cryptography_from_...

tiernano 3y ago
not quite crypto related, or at least directly, i remember this old Mac G4 ad: https://youtu.be/lb7EhYy-2RE?si=3tvJK4BXbA71LbGQ https://youtu.be/lb7EhYy-2RE?si=3tvJK4BXbA71LbGQ
lloeki 3y ago
> Cryptography was considered a war weapon It still is. e.g in France: https://cyber.gouv.fr/en/protection-sensitive-and-restricted-information https://cyber.gouv.fr/en/protection-sensitive-and-restricted... This legal framework has been introduced in 2011 in order to protect facilities, knowledge, savoir-faire, information which, if intercepted, could: - Affect French economic interests (risk 1); - Reinforce military capacities of other country or weaken French military capacities (risk 2); - Lead to the proliferation of weapons of mass destruction in nuclear, ballistic, chemical or biological fields; - Lead to the development of terrorist activities on French territory or abroad. It's just that import/export constraints have been relaxed. See Annexe 1 here: https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000646995?init=true&page=1&query=catégorie+3+de+l’annexe+2+du+décret+n°+2007-663+du+2+mai+2007&searchField=ALL&tab_selection=all https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000646995?... This is one of the reasons why MobiusSync is not available in the French iOS App Store since it doesn't use iOS crypt which already has approval plus it doesn't fit into some of the exceptions to the restrictions, so they'd have to fill in paperwork which is only available in French and submit via snail mail (go figure, although they do accept answers written in English as a courtesy). https://github.com/MobiusSync/MobiusSync/issues/27 https://github.com/MobiusSync/MobiusSync/issues/27 Similar concerns, processes, and exceptions are effective for other countries, e.g for the U.S. you need Encryption Registration (ERN) approval from the U.S. Bureau of Industry (BIS). Exceptions are described in Category 5, Part 2 of the U.S. Export Administration Regulations.
cjbprime 3y ago
"You have to get an export license if you're distributing from inside the US to outside the US" is pretty different to "sending encrypted emails was illegal", no? For one thing, it sounds like sending wasn't impacted at all, once you had the software.
- mratsim 3y ago
  How would you send encrypted email without an encryption library?
  - Tor3 3y ago
    From what I remember, what was illegal was exporting a (useful) encryption library, and that Wikipedia link supports my memory: It talks about exporting munitions. I remember at the time that even though libraries existed inside the US they weren't supposed to be exported to other countries (i.e. the rest of us should get encryption libraries developed outside the US). Nothing prevented US citizens in the US to use encryption. Nothing in that "cryptography is considered munitions" legal issue, at least, because that was about export.
    - Thorrez 3y ago
      They can't use encryption if they can't get encryption software. I recall hearing that companies outside the US could distribute software with competent encryption without problems (to people inside and outside the US), but companies inside the US basically couldn't distribute software with competent encryption, because someone outside the US might download it.
      - Tor3 3y ago
        But I remember the time. The software could be downloaded from inside USA. Mid-nineties the internet wasn't particularly large and (what's nowadays) simple measures were in place. In practice you could get it from the US even if you were outside, but then again USA wasn't the only place where encryption software was made, so we all thought it a bit silly. What I'm getting at is that it's simply incorrect that encryption wasn't available in the US, and it's also incorrect that encryption couldn't or wasn't in use. It most definitely was. The regulations were only about export. 40 bits max and all that.
TedDoesntTalk 3y ago
Sending encrypted email in the US was NOT illegal. Sharing encryption libraries was.
- mratsim 3y ago
  How would you send encrypted emails without an encryption library?
  - DonHopkins 3y ago
    You're not reading or comprehending the multiple correct replies. I won't repeat them because apparently that won't get through to you, but you should go back and read them again and again until you understand, or at least stop repeating the same incorrect information, if not finally understanding the correct information people keep trying to tell you. https://en.wikipedia.org/wiki/Sealioning https://en.wikipedia.org/wiki/Sealioning
    - rnmmrnm 3y ago
      woah I'm so glad he did it, I now got better picture of twitter altogether.
    - mratsim 3y ago
      I am reading the replies. You don't understand the legal liabilities people open themselves to if they provide the software. Now they have to fully KYC customers to make sure they are from the US, with US only storage, and firewall so that people travelling cannot use the encryption library from out of the US. You've seen the lawsuits on just P2P link providers, this is even worse.
  - SAI_Peregrinus 3y ago
    People inside the US could trade encryption libraries. They just couldn't send those libraries to outside the US. You could download a cryptography library from outside the US, and your foreign recipient could do the same, and thus send emails back & forth. In practice all it meant was that US developers couldn't write make useful cryptography libraries, and the development got done elsewhere. The US still restricts the export of (some) cryptography to (some) countries & organizations. Mostly that just requires submitting a self-classification report to the BIS stating that the cryptography is "mass market" and matches the definition thereof in the export regulations.
deaddodo 3y ago
That's an oversimplification and also inferring a completely incorrect situation. It was perfectly fine for American citizens to use cryptography amongst each other or with outside nationals. It was also completely fine to download and use externally developed software. What was illegal was developing and exporting cryptographic software. This is why, for the longest time, you would see warnings on web pages (puTTy, for instance) saying the software was only intended for use in the United States.
- KMnO4 3y ago
  I remember publishing some apps to the iOS App Store and was asked to “declare cryptography to the US government”. I’m not even American. The form made it clear that using HTTPS is considered cryptography, so I’m fairly sure almost every app on the store has checked “yes” to that question.
- mratsim 3y ago
  I disagree. To fully comply with this you would need as a library provider to fully KYC your clients so that there is a firewall between their US and non-US entities, and that travelling people don't bring out an encryption library at the same time. It would be a operational nightmare.
  - tptacek 3y ago
    In the time period we're discussing, I was on a team shipping a commercial (shrink-wrap!) software project that extensively used cryptography, including an export version of same. It was not a big deal; it was not an operational nightmare; in the North American market, it wasn't a thing at all, you just did whatever you wanted.
  - deaddodo 3y ago
    Which part are you disagreeing with? I'm literally laymaning the law. The law never covered using cryptography, it was always about exporting it. Mostly it was written around keeping military specific cryptography from entering rival powers hands, but was overbearing. So they amended it to allow commercially developed/homegrown cryptography (explicitly not developed for governmental/military use) to be distributed normally. In practice, it's still a little muddy as many of those use DoJ/DoS-funded cryptography patterns, but the government has chosen to take a fairly hands off approach on those (RSA and DSA are key examples). You're correct that it would also be almost impossible to enforce the original wording in today's world of globalization. They also have little power to enforce it on foreign nationals, which is why a warning was usually Good Enough(TM) for American software developers.
tptacek 3y ago
So far as I'm aware, this was never the case. Bernstein's case started in 1995 (it was decided in 1999). I assure you, cryptographic software was widespread and, apart from export controls, unchecked in 1995. Source: my professional career started in 1995. In (I think) early 1995 I bought a "This T-Shirt Is A Munition" shirt with RSA source code on it, by typing the information from the bottom of a personal check(!) into a web page. It was a whole thing.

tiernano 3y ago

not quite crypto related, or at least directly, i remember this old Mac G4 ad: https://youtu.be/lb7EhYy-2RE?si=3tvJK4BXbA71LbGQ https://youtu.be/lb7EhYy-2RE?si=3tvJK4BXbA71LbGQ

lloeki 3y ago

> Cryptography was considered a war weapon It still is. e.g in France: https://cyber.gouv.fr/en/protection-sensitive-and-restricted-information https://cyber.gouv.fr/en/protection-sensitive-and-restricted... This legal framework has been introduced in 2011 in order to protect facilities, knowledge, savoir-faire, information which, if intercepted, could: - Affect French economic interests (risk 1); - Reinforce military capacities of other country or weaken French military capacities (risk 2); - Lead to the proliferation of weapons of mass destruction in nuclear, ballistic, chemical or biological fields; - Lead to the development of terrorist activities on French territory or abroad. It's just that import/export constraints have been relaxed. See Annexe 1 here: https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000646995?init=true&page=1&query=catégorie+3+de+l’annexe+2+du+décret+n°+2007-663+du+2+mai+2007&searchField=ALL&tab_selection=all https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000646995?... This is one of the reasons why MobiusSync is not available in the French iOS App Store since it doesn't use iOS crypt which already has approval plus it doesn't fit into some of the exceptions to the restrictions, so they'd have to fill in paperwork which is only available in French and submit via snail mail (go figure, although they do accept answers written in English as a courtesy). https://github.com/MobiusSync/MobiusSync/issues/27 https://github.com/MobiusSync/MobiusSync/issues/27 Similar concerns, processes, and exceptions are effective for other countries, e.g for the U.S. you need Encryption Registration (ERN) approval from the U.S. Bureau of Industry (BIS). Exceptions are described in Category 5, Part 2 of the U.S. Export Administration Regulations.

cjbprime 3y ago

"You have to get an export license if you're distributing from inside the US to outside the US" is pretty different to "sending encrypted emails was illegal", no? For one thing, it sounds like sending wasn't impacted at all, once you had the software.

mratsim 3y ago
How would you send encrypted email without an encryption library?
- Tor3 3y ago
  From what I remember, what was illegal was exporting a (useful) encryption library, and that Wikipedia link supports my memory: It talks about exporting munitions. I remember at the time that even though libraries existed inside the US they weren't supposed to be exported to other countries (i.e. the rest of us should get encryption libraries developed outside the US). Nothing prevented US citizens in the US to use encryption. Nothing in that "cryptography is considered munitions" legal issue, at least, because that was about export.
  - Thorrez 3y ago
    They can't use encryption if they can't get encryption software. I recall hearing that companies outside the US could distribute software with competent encryption without problems (to people inside and outside the US), but companies inside the US basically couldn't distribute software with competent encryption, because someone outside the US might download it.
    - Tor3 3y ago
      But I remember the time. The software could be downloaded from inside USA. Mid-nineties the internet wasn't particularly large and (what's nowadays) simple measures were in place. In practice you could get it from the US even if you were outside, but then again USA wasn't the only place where encryption software was made, so we all thought it a bit silly. What I'm getting at is that it's simply incorrect that encryption wasn't available in the US, and it's also incorrect that encryption couldn't or wasn't in use. It most definitely was. The regulations were only about export. 40 bits max and all that.

TedDoesntTalk 3y ago

Sending encrypted email in the US was NOT illegal. Sharing encryption libraries was.

mratsim 3y ago
How would you send encrypted emails without an encryption library?
- DonHopkins 3y ago
  You're not reading or comprehending the multiple correct replies. I won't repeat them because apparently that won't get through to you, but you should go back and read them again and again until you understand, or at least stop repeating the same incorrect information, if not finally understanding the correct information people keep trying to tell you. https://en.wikipedia.org/wiki/Sealioning https://en.wikipedia.org/wiki/Sealioning
  - rnmmrnm 3y ago
    woah I'm so glad he did it, I now got better picture of twitter altogether.
  - mratsim 3y ago
    I am reading the replies. You don't understand the legal liabilities people open themselves to if they provide the software. Now they have to fully KYC customers to make sure they are from the US, with US only storage, and firewall so that people travelling cannot use the encryption library from out of the US. You've seen the lawsuits on just P2P link providers, this is even worse.
- SAI_Peregrinus 3y ago
  People inside the US could trade encryption libraries. They just couldn't send those libraries to outside the US. You could download a cryptography library from outside the US, and your foreign recipient could do the same, and thus send emails back & forth. In practice all it meant was that US developers couldn't write make useful cryptography libraries, and the development got done elsewhere. The US still restricts the export of (some) cryptography to (some) countries & organizations. Mostly that just requires submitting a self-classification report to the BIS stating that the cryptography is "mass market" and matches the definition thereof in the export regulations.

deaddodo 3y ago

That's an oversimplification and also inferring a completely incorrect situation. It was perfectly fine for American citizens to use cryptography amongst each other or with outside nationals. It was also completely fine to download and use externally developed software. What was illegal was developing and exporting cryptographic software. This is why, for the longest time, you would see warnings on web pages (puTTy, for instance) saying the software was only intended for use in the United States.

KMnO4 3y ago
I remember publishing some apps to the iOS App Store and was asked to “declare cryptography to the US government”. I’m not even American. The form made it clear that using HTTPS is considered cryptography, so I’m fairly sure almost every app on the store has checked “yes” to that question.
mratsim 3y ago
I disagree. To fully comply with this you would need as a library provider to fully KYC your clients so that there is a firewall between their US and non-US entities, and that travelling people don't bring out an encryption library at the same time. It would be a operational nightmare.
- tptacek 3y ago
  In the time period we're discussing, I was on a team shipping a commercial (shrink-wrap!) software project that extensively used cryptography, including an export version of same. It was not a big deal; it was not an operational nightmare; in the North American market, it wasn't a thing at all, you just did whatever you wanted.
- deaddodo 3y ago
  Which part are you disagreeing with? I'm literally laymaning the law. The law never covered using cryptography, it was always about exporting it. Mostly it was written around keeping military specific cryptography from entering rival powers hands, but was overbearing. So they amended it to allow commercially developed/homegrown cryptography (explicitly not developed for governmental/military use) to be distributed normally. In practice, it's still a little muddy as many of those use DoJ/DoS-funded cryptography patterns, but the government has chosen to take a fairly hands off approach on those (RSA and DSA are key examples). You're correct that it would also be almost impossible to enforce the original wording in today's world of globalization. They also have little power to enforce it on foreign nationals, which is why a warning was usually Good Enough(TM) for American software developers.

tptacek 3y ago

So far as I'm aware, this was never the case. Bernstein's case started in 1995 (it was decided in 1999). I assure you, cryptographic software was widespread and, apart from export controls, unchecked in 1995. Source: my professional career started in 1995. In (I think) early 1995 I bought a "This T-Shirt Is A Munition" shirt with RSA source code on it, by typing the information from the bottom of a personal check(!) into a web page. It was a whole thing.