4 ms·

Those last three are pretty concerning, I don't really understand what they mean: > - Providing cryptology services aiming to ensure confidentiality without ce

Those last three are pretty concerning, I don't really understand what they mean: > - Providing cryptology services aiming to ensure confidentiality without certified declaration, > - Providing a cryptology tool not solely ensuring authentication or integrity monitoring without prior declaration, > - Importing a cryptology tool ensuring authentication or integrity monitoring without prior declaration. What does "without certified declaration" mean? The others are pretty non-surprising, if the comms were unencrypted and the company refused to cooperate.

Hizonner 2y ago
France has at least theoretically had a licencing/declaration/whatever regime for all cryptography software since forever. Presumably they rarely enforce it, but I remember when they passed it. I think it was supposed to involve key-disclosure back doors somehow.
- codedokode 2y ago
  I wonder, did Google and Mozilla properly certified the cryptogrpahic tools they distribute? And Github is probably the worst offender, hosting thousands of uncertified, illegal cryptographic tools.
  - mdhb 2y ago
    Notably they didn’t run perhaps the worlds most popular child porn distribution network at the same time and didn’t have it all over their devices.
pera 2y ago
First time I hear about this as well and I'm not sure if I understand this correctly (because it's in French :p) but it sounds like if your software uses cryptography and you have French users then you need to submit a declaration to some French authority: https://forums.developer.apple.com/forums/thread/741830 https://forums.developer.apple.com/forums/thread/741830
- orwin 2y ago
  If you have French customers, not users. Basically you have to give an audit. If you already have an ISO certication it's no trouble.
  - pera 2y ago
    Ah so the import declaration required to publish in the French App Store is for Apple? Thanks for clarifying
    - orwin 2y ago
      Yes I think. For us the audit was part of our ISO27001 certification, but i'm pretty sure you can have other certification, as long as an official audit exist. Basically, do you know the saying 'never roll your own crypto'? It's a bureaucratization of this saying (to avoid people getting sold insecure crypto). Agree or not on the idea that the government should control that (I'm torn tbh), but it isn't a way to force people into illegality to pressure them.
- octacat 2y ago
  So basically all networking software uses cryptography... Yeah, with upcoming EU related changes for software, you need not only programmers, but layers too. Because pretty sure they would implement something similar and more.
- belter 2y ago
  Pag 3 and 4 are in English...
hnburner998877 2y ago
Looking at relevant French law it would appear there is a bureaucratic procedure to import cryptography into France. But how this gets interesting is if Telegram has no explicit office presence in France and the app and webapp are merely distributed to French users resulting in these charges. If I have a web server in the US that serves content that uses a cryptography JS library and a French user accesses it could I be arrested in France because I didn't declare the library to the French bureaucracy and get it approved? Has France basically just nuked themselves for non-France based cryptography providers? Is npm going to block France in case a French citizen imports a JS cryptography library? Are a bunch of apps going to get their app removed from app stores for France? Evidently this all seems incredibly selective and arbitrary but the lawyers are going to have to assess the risks of the French now in a way they didn't before, and once again another unclear rule haunts the EU software industry.
- semiquaver 2y ago
  Durov has French citizenship. Hard to argue there’s no presence in France.
- layer8 2y ago
  Telegram is selling Telegram Premium and other services in France, which means they are doing business in France and are thus subject to its laws.
- darkhorn 2y ago
  When a prosecutor writes accusation he writes extra accusations like when you go to a store and buy something you buy extra things. This way the prosecutor gets ekstra points, and prestige. I am talking for all countries. The system is f*d up.
  - pdpi 2y ago
    A kinder perspective: you only have one opportunity to prosecute, so you add all the charges you think might be relevant, and let the courts decide on guilt. I’m sure that the intent is at least somewhat cynical in some (many? Most?) cases, but this serves a legitimate purpose.
rozzie 2y ago
Tangentially-related, it remains surprising that many U.S.-based developers I've spoken with fail to realize that they need to obtain an Export Control Classification (ECCN) from the US Dept of Commerce's Bureau of Industry and Security (BIS) before publishing their apps in the app store or otherwise making them available on the net. And then devs need to submit annual updates for their products. Most will get a mass market exemption under 5D992, but a surprising number of modern applications making 'interesting' uses of crypto will need export licenses. https://www.bis.doc.gov/index.php/encryption-and-export-administration-regulations-ear https://www.bis.doc.gov/index.php/encryption-and-export-admi...
- codedokode 2y ago
  They probably think they live in a free country without stupid requirements.
  - reaperducer 2y ago
    They probably think they live in a free country without stupid requirements. …says the "PHP developer from Russia," according to his biography.
    - dvdkon 2y ago
      People generally expect more from self-declared democracies with free speech in their constitution, as they should.
- binary132 2y ago
  Weird way of making a case for US-only app stores but okay!
darkhorn 2y ago
It also looks like conserning to people who host their web sites in France. The cripto accusations look unclear and arbitrary.

Hizonner 2y ago

France has at least theoretically had a licencing/declaration/whatever regime for all cryptography software since forever. Presumably they rarely enforce it, but I remember when they passed it. I think it was supposed to involve key-disclosure back doors somehow.

codedokode 2y ago
I wonder, did Google and Mozilla properly certified the cryptogrpahic tools they distribute? And Github is probably the worst offender, hosting thousands of uncertified, illegal cryptographic tools.
- mdhb 2y ago
  Notably they didn’t run perhaps the worlds most popular child porn distribution network at the same time and didn’t have it all over their devices.

pera 2y ago

First time I hear about this as well and I'm not sure if I understand this correctly (because it's in French :p) but it sounds like if your software uses cryptography and you have French users then you need to submit a declaration to some French authority: https://forums.developer.apple.com/forums/thread/741830 https://forums.developer.apple.com/forums/thread/741830

orwin 2y ago
If you have French customers, not users. Basically you have to give an audit. If you already have an ISO certication it's no trouble.
- pera 2y ago
  Ah so the import declaration required to publish in the French App Store is for Apple? Thanks for clarifying
  - orwin 2y ago
    Yes I think. For us the audit was part of our ISO27001 certification, but i'm pretty sure you can have other certification, as long as an official audit exist. Basically, do you know the saying 'never roll your own crypto'? It's a bureaucratization of this saying (to avoid people getting sold insecure crypto). Agree or not on the idea that the government should control that (I'm torn tbh), but it isn't a way to force people into illegality to pressure them.
octacat 2y ago
So basically all networking software uses cryptography... Yeah, with upcoming EU related changes for software, you need not only programmers, but layers too. Because pretty sure they would implement something similar and more.
belter 2y ago
Pag 3 and 4 are in English...

hnburner998877 2y ago

Looking at relevant French law it would appear there is a bureaucratic procedure to import cryptography into France. But how this gets interesting is if Telegram has no explicit office presence in France and the app and webapp are merely distributed to French users resulting in these charges. If I have a web server in the US that serves content that uses a cryptography JS library and a French user accesses it could I be arrested in France because I didn't declare the library to the French bureaucracy and get it approved? Has France basically just nuked themselves for non-France based cryptography providers? Is npm going to block France in case a French citizen imports a JS cryptography library? Are a bunch of apps going to get their app removed from app stores for France? Evidently this all seems incredibly selective and arbitrary but the lawyers are going to have to assess the risks of the French now in a way they didn't before, and once again another unclear rule haunts the EU software industry.

semiquaver 2y ago
Durov has French citizenship. Hard to argue there’s no presence in France.
layer8 2y ago
Telegram is selling Telegram Premium and other services in France, which means they are doing business in France and are thus subject to its laws.
darkhorn 2y ago
When a prosecutor writes accusation he writes extra accusations like when you go to a store and buy something you buy extra things. This way the prosecutor gets ekstra points, and prestige. I am talking for all countries. The system is f*d up.
- pdpi 2y ago
  A kinder perspective: you only have one opportunity to prosecute, so you add all the charges you think might be relevant, and let the courts decide on guilt. I’m sure that the intent is at least somewhat cynical in some (many? Most?) cases, but this serves a legitimate purpose.

rozzie 2y ago

Tangentially-related, it remains surprising that many U.S.-based developers I've spoken with fail to realize that they need to obtain an Export Control Classification (ECCN) from the US Dept of Commerce's Bureau of Industry and Security (BIS) before publishing their apps in the app store or otherwise making them available on the net. And then devs need to submit annual updates for their products. Most will get a mass market exemption under 5D992, but a surprising number of modern applications making 'interesting' uses of crypto will need export licenses. https://www.bis.doc.gov/index.php/encryption-and-export-administration-regulations-ear https://www.bis.doc.gov/index.php/encryption-and-export-admi...

codedokode 2y ago
They probably think they live in a free country without stupid requirements.
- reaperducer 2y ago
  They probably think they live in a free country without stupid requirements. …says the "PHP developer from Russia," according to his biography.
  - dvdkon 2y ago
    People generally expect more from self-declared democracies with free speech in their constitution, as they should.
binary132 2y ago
Weird way of making a case for US-only app stores but okay!

darkhorn 2y ago

It also looks like conserning to people who host their web sites in France. The cripto accusations look unclear and arbitrary.