12 ms·

Intel subsidiary fined for unlawful export of software that enables encryption

314 points by aburan28 12y ago

MattSteelblade 12y ago
Correction: "against Wind River Systems, an Intel subsidiary" not Intel.
sillysaurus3 12y ago
If this type of thing is interesting to you, here's some lovely historical perspective about government restrictions on crypto: http://www.foia.cia.gov/sites/default/files/DOC_0006231614.pdf http://www.foia.cia.gov/sites/default/files/DOC_0006231614.p... In particular, related to this $750k Wind River violation: Bidzos realized that there was a simple way to skirt the export limitation laws. Both the AECA and the ITAR are US laws, and, as, such, they pertain only to US companies. Bidzos went to Japan and established a Japanese subsidary, Nihon RSA. Nihon RSA qualified as a distinct Japanese company, subject only to Japanese law, and Bidzos was able to do whatever he wanted with his strong encryption technologies. Knowing that his encryption technology was a desired commodity, he shopped it around the Japanese marketplace. He promptly struck a deal to produce encryption chips for Nippon Telephone and Telegraph Corporation. If the US government continues to fine Wind River, then couldn't they just set up a foreign corporation?
- Taek 12y ago
  That is likely going to be a consequence of these actions. Digital security is a huge industry and is going continue being a huge industry for a long time. US companies are decreasingly in a position to market themselves as genuinely secure companies. Companies that want to have credibility in the industry are going to need to bring themselves out of the jurisdiction of restrictive laws, or lose business to companies that have set themselves up in more friendly jurisdictions.
- rasz_pl 12y ago
  This is no longer possible with all the international trade agreements. Lets take for example UK company selling their stuff manufactured in Asia on the Australian market - secret US blacklists still apply: http://www.eevblog.com/2014/02/24/element-14-holding-orders-based-on-us-government-watch-list/ http://www.eevblog.com/2014/02/24/element-14-holding-orders-...
willk 12y ago
It was an Intel subsidiary. The article is not very informative. It appears as if Wind River didn't file for an export permit and the BIS fined the because of it; moreover, they voluntarily disclosed it [0]. [0]:http://www.theregister.co.uk/2014/10/17/intel_subsidiary_crypto_export_fine/ http://www.theregister.co.uk/2014/10/17/intel_subsidiary_cry...
- the_ancient 12y ago
  Yes because one should have to file for a permit to export math (or anything else)
  - LLWM 12y ago
    The law says you do. If you want to change that law, fine. But if you choose not to comply, don't complain when you get fined for it.
    - nitrogen 12y ago
      Why shouldn't someone complain about a law, even if they already knew about it? The false dichotomy between "obey and complain" vs. "get caught and shut up" isn't necessary.
      - LLWM 12y ago
        Because it's obnoxious?
      - thoughtpolice 12y ago
        Because sometimes it's annoying and simply stupid. Case in point: posting stupid reductionist arguments about "exporting math" are obnoxious and completely frivolous, especially when it literally ignores everything substantial about the law. After all, if I give north korea blueprints for nuclear reactors, that's just paper right?! It's just math on paper! What, that's not the same? Sure it is - quit trying to stop me from exporting paper! You do see how the grandparents point is obnoxious and stupid, right? Or do you not because it simply aligns with your worldview?
tptacek 12y ago
Wind River is the vendor behind vxWorks, which is one of the most widely-used embedded operating systems in the world. vxWorks isn't especially common in consumer products (although you can find SOHO-type routers running it) but it's very important in industry, aerospace, manufacturing, RF and telecom, and things like that. The "sharp departure" Goodwin refers to here is the detente between industry and the USG for the past ~12 years. In the late '90s, crypto export controls were vigorously enforced. When you went to download Netscape, you had to select the US-specific installer to get cryptography that wasn't trivially brute-forced. If you shipped products that included SSL/TLS, or even just MD5, you had forms to fill out. It seems like there'd need to be a backstory on this Wind River enforcement action. Surely there's quite a bit of crypto code in various vxWorks distributions, but it pales in comparison to the cryptography shipped by Mozilla and the Chromium projects. Maybe the issue is "enabling technology" versus consumer products? It's also unclear to me whether this is a return to form or the BIS being especially aggressive about deliberate exports to specific countries.
- maxerickson 12y ago
  The BIS press release seems to narrow the scope a little: http://www.bis.doc.gov/index.php/component/content/article/107-about-bis/newsroom/press-releases/press-release-2014/763-intel-subsidiary-agrees-to-750-000-penalty-for-unauthorized-encryption-exports http://www.bis.doc.gov/index.php/component/content/article/1... It talks about the software in question being on some list and says some of the export recipients in China are on the BIS Entity List. Edit: "on some list" is a dumb way of saying that they decided some of the software was subject to "Export Administration Regulations".
- ganzuul 12y ago
  Incorrect... You sometimes had to download binaries from a source outside the US. Usually not, since the user was simply expected to click the link for the non-US version. In cases where the server actually looked at your source IP you could either proxy or just download the binary from a source in Europe. The dev teams were and still are seldom located in the US alone, but distributed all over the world. The authors of encryption packages were often not US citizens, either. The rest of the world looked at the US policy on encryption with wide-eyed disbelief due to the horrifying ignorance that just had to lie behind it.
perlpimp 12y ago
does this mean if I have developed a product based on encryption it is better to incorporate outside of USA? and perhaps register a satelite in US only to import said products?
- AlyssaRowan 12y ago
  It is better to not be in the US as a crypto developer, yes (especially since there are some concerns that CALEA, National Security Letters and other provisions have been used to strongarm people into backdooring crypto products as described in the classified "SIGINT Enabling Project" budget, although so far I have not seen any backdoors that were not put in willingly). That has pretty much always been true. The crypto export laws are weaker than they used to be back in the PGP days, when PGP 2.6.2 was exported as a book to call the bluff of the whole thing, but they're still there and of some concern (especially if you intend your software to be used by citizens inside oppressive regimes which might be on The Export List). I don't see why you'd need a 'satellite' to 'import'. There are no import restrictions I'm aware of in the US? For a brief, non-normative summary of crypto law, please see: http://www.cryptolaw.org/ http://www.cryptolaw.org/
nathanm412 12y ago
This might be an attempt to use existing means to pressure mobile device manufacturers from enabling full device encryption by default. I know the executive branch hasn't been too happy with the latest announcements from Google and Apple.
- maxerickson 12y ago
  I would speculate they did something closer to providing source code to Chinese defense contractors. (Which probably doesn't really matter in the scheme things, but it's the sort of thing that will really piss off the U.S. Government)
Someone1234 12y ago
How utterly pathetic. Encryption export restrictions are an absolute joke. I can go read a Wikipedia article right now that heavily details the inner workings of most block ciphers. They're still fining people for exporting anything over 64 bits (which is most things), even if almost every individual let alone government has access to the technological knowledge to reproduce such encryption at home. Seems like this fine is about them exporting a custom Linux distro' with all the normal encryption libraries still in-place (e.g. 256 AES). Why do I get the strong sense that this fine isn't really about exporting encryption and is really about Wind River failing to place backdoors into this equipment? Because frankly that makes a lot more sense than what it appears to be on the surface. Wind River got fined for "something" to do with encryption. Now you can either take the government at their word and assume that that thing is just exporting AES 256 within a standard OS, or maybe consider it a little deeper and wonder if it was punishment for something else Wind River did or didn't do.
- api 12y ago
  Not only that, but anyone in any embargoed country can trivially redirect through a VPS or Tor and bypass any controls. It's sort of like the war on drugs if pot could be sent electronically. Hilarious security theater...
- tptacek 12y ago
  If the USG wanted to coerce Wind River into backdooring vxWorks, they have better ways to do it than a newsworthy enforcement action regarding cryptography exports. Export controls for crypto are stupid and counterproductive, though; I agree with you there.
- Kalium 12y ago
  The amount in question doesn't make sense for that. Nor does the voluntary disclosure. 750k isn't a scary and punishing fine when you have Intel backing you.
  - lotsofmangos 12y ago
    This could be just meant as a message to other firms. Intel might even be getting the money back through routes like tax breaks and just be playing along.
thrush 12y ago
What is the justification of this law? Seems arbitrary to me. Another question. Is not providing ample security the same as explicitly granting a backdoor?
- peterwwillis 12y ago
  The justification is we don't help our enemies, even if it doesn't make a difference in the grand scheme. Edit: looks like one of the countries is our ally... so that's weird. For the rest of them makes sense from a geopolitical standpoint.
  - stan_rogers 12y ago
    It can get weird. I remember when the export list was significantly expanded for high-bit crypto (2000? 2001?), and France was still on the no-go list - not because the US prohibited export as such, but because France prohibited import (except through authorized channels). Israel may be in the same camp.
    - yuhong 12y ago
      To be more precise, France allowed import of 128-bit crypto before US allowed export of it and months after US allowed 56-bit crypto to be exported. I also found out that it took until 2004 for France to formally allow import of 256-bit crypto.
barisser 12y ago
US Company Fined for Exporting Math. We ain't got enough Math in the US to be sending it abroad!
- lordbusiness 12y ago
  "US Company Fined for Exporting Math." This.
- dabockster 12y ago
  We have enough math, but the bureaucracy keeps us from teaching it effectively.
- tzs 12y ago
  Isn't that like saying someone fined for exporting missiles was fined for "exporting physics", or someone fined for exporting chemical weapons was fined for "exporting chemistry"? If not, how do you distinguish them? Note: I'm not suggesting that the cryptography export restrictions are useful or make any sense it all. They don't, as far as I can tell. I'm just trying to get some discussion going as to whether reductionist arguments like "exporting math" make sense.
  - superuser2 12y ago
    Neither missiles nor chemical weapons are ideas. They are not information; they are tangible. A better analogy would be someone exporting a piece of paper with the reactions involved in a chemical weapon on it, or the formulas that describe where a missile will land given certain parameters.
  - djrogers 12y ago
    Missiles and chemical weapons are physical objects which one can reasonably presume to maintain at least some degree of control over. Encryption algorithms are math, theory, information. They can be reproduced, copied, and transmitted at-will, for no cost. If the difference is still non-obvious, google around for instructions to make ricin. Easy to find, and it's not illegal to share that information. Why should it be illegal to share any other data? And how could one reasonably expect to enforce it?
wnevets 12y ago
I feel like the title should be updated, a tad misleading IMO.
e40 12y ago
Can anyone provide details on what is forbidden to distribute and to where?
- maxerickson 12y ago
  http://www.bis.doc.gov/index.php/regulations/export-administration-regulations-ear http://www.bis.doc.gov/index.php/regulations/export-administ... I guess you have to read it all before you can go back and try to understand part of it (that is, I got a headache looking at a few paragraphs, and don't think I learned anything).
rdtsc 12y ago
Could this all be a positive thing if it promotes development of open source libraries and tools ? Not only that, but I wander how feasible is to create binary APIs for most operating systems and CPU architectures, where you could download, verify (that they were build from a commit id of some know open source implementation), and plug in crypto modules as binaries. So you buy your software from any vendor, any country. If they implement the use of this API, then get your verified crypto modules and plug them in. Or you build your own in house from source. I can see how that mechanism would of course be a massive attack target by all kinds of actors, but in theory is that possible? Maybe make it decentralized as much as possible.
billpg 12y ago
Sorry, my time machine appears to be on the blink. I appear to be in the 1990s.
- revelation 12y ago
  Seems like they are trying to reignite the crypto wars, what with the FBI talking about mandatory backdoors. It's just utterly confusing. You would think their reaction to Snowden would be appeasement, not further repression and surveillance. Can't make it too obvious this ain't a democracy.
  - toyg 12y ago
    I can actually see their reasoning: "you thought we were being hard on you? So the gloves are off now? Ok, so we'll show you what happens when we really play hard".
- cremno 12y ago
  I'm not sure if it was intended, but using that idiom here looks to me as a clever reference to <blink>.
maerF0x0 12y ago
Is it illegal to opensource encryption implementations?
- zabcik 12y ago
  No, however, the export of it is still punishable. The GNU gcrypt tools, for example, are hosted exclusively on European servers for this reason. http://www.gnu.org/software/libgcrypt/ http://www.gnu.org/software/libgcrypt/
  - lectrick 12y ago
    What do words like "import," "export," and "country" mean in an Internet context?
    - logfromblammo 12y ago
      They mean whatever the regulator wants them to mean, when you're handcuffed to his table. Prudence dictates that you not expose yourself or your business to unnecessary risks. So by that standard, the "country" is wherever the enforcer has the power to hurt you, an "import" is bringing something within reach of the enforcer, and an "export" is moving something beyond his reach. Just stay out of the "country", and you never have to worry about being punished for "exports". If you look at the Byzantine import/export regulations, you don't have to be physically located outside of the geographical boundaries of the U.S. to be considered a foreign entity for the purpose of importing and exporting technical information. Just feed in this new input to your lawyer/accountant tax avoidance machine, and everything should be all sorted out by next fiscal year.
      - lectrick 12y ago
        Can I create a decentralized autonomous corporation with an incorporeal geographic location yet?
        lotsofmangos 12y ago
jldugger 12y ago
What better way to prove that your chips aren't NSA backdoors than to pay a hefty fine to the people you're supposedly in bed with?
- sitkack 12y ago
  Prove?
makmanalp 12y ago
This is exactly what I fear happens when we allow bad laws to stay in a "well it's there but we don't enforce it" state. Is the way around this to develop crypto systems outside the US?
- lucb1e 12y ago
  If I remember correctly, someone published a book which contained source code in monospace for PGP so that it would fall under freedom of speech and was allowed to leave the US. But that's from memory, I'm not sure it really did circumvent that law or that it was PGP. Edit: Ah, AlyssaRowan actually mentions[1] this further down the comment thread: > PGP 2.6.2 was exported as a book to call the bluff of the whole thing [1] https://news.ycombinator.com/item?id=8552169 https://news.ycombinator.com/item?id=8552169
  - rosser 12y ago
    Yes, it was PGP, and yes, it got around the law. The issue was indeed that exporting it as software made it subject to ITAR, but published as a book, it was considered speech. The tactic was never tested in court with PGP, but it was upheld in at least one other case I'm aware of, Bernstein v. United States. Thank you yet again, DJB.
  - LLWM 12y ago
    That doesn't prove anything. You can also export a physics textbook without the issues you would run into exporting a nuclear weapon.
    - lucb1e 12y ago
      Except that you don't really need to buy expensive and probably-hard-to-get-by stuff to turn the book with code into something useful (or munition, in the US government's eyes) whereas with nuclear weapons you somehow need to get a radioactive warhead or something.
      - LLWM 12y ago
deleted 12y ago
[deleted]
mariuolo 12y ago
$750,000? That'll show them!
tn13 12y ago
All this will eventually amount to American companies losing credibility around the world.
DennisP 12y ago
So if you're a U.S. software developer, perhaps opensource, working on something that uses encryption, how do you stay out of trouble? Are you ok if you use standard libraries, rather than implementing your own crypto algorithms?
- zerpa 12y ago
  Publicly available encryption source code is exempt from the ECCN[1] according to the License Exception[2], section 740.13(e), provided you notify the BIS. But do read the documents, IANAL. Interestingly, though I'm EU based, but ECCN list is literally the same over here. Have been wading through these documents countless times. [1] http://www.bis.doc.gov/index.php/forms-documents/doc_download/951-ccl5-pt2 http://www.bis.doc.gov/index.php/forms-documents/doc_downloa... [2] http://www.bis.doc.gov/index.php/forms-documents/doc_download/986-740 http://www.bis.doc.gov/index.php/forms-documents/doc_downloa...
- yuhong 12y ago
  And I think it is fairly easy to "self-classify" many kinds of encryption software, though you may have to file an annual self-classification report.
drderidder 12y ago
The damage to the US economy and tech industry caused by this sort of thing seems likely to outweigh any supposed security benefit. Celine's First Law: "National Security is the chief cause of national insecurity." [1] Related stories on HN recently involving Twitter et al [2] are enough to make one wonder how long before some of them relocate overseas. [1] http://en.wikipedia.org/wiki/Celine%27s_laws#Celine.27s_First_Law http://en.wikipedia.org/wiki/Celine%27s_laws#Celine.27s_Firs... [2] https://news.ycombinator.com/item?id=8422581 https://news.ycombinator.com/item?id=8422581
DennisP 12y ago
Do we need to go back to Zimmerman's old trick and publish the code in books? What happens if we put the code in non-DRM'd ebooks?
ultramancool 12y ago
Time for DJB and the EFF to bring their old case back? https://en.wikipedia.org/wiki/Bernstein_v._United_States https://en.wikipedia.org/wiki/Bernstein_v._United_States "On October 15, 2003, almost nine years after Bernstein first brought the case, the judge dismissed it and asked Bernstein to come back when the government made a "concrete threat"." This sure sounds like a concrete threat.
- tptacek 12y ago
  It needs to be a concrete threat to Daniel J. Bernstein.
  - ultramancool 12y ago
    Yeah, you're likely correct. I didn't catch this at first due to my immediate feeling of threat simply for having published a few tools which use high-level cryptography libraries.
    - tptacek 12y ago
      Wind River seems to have been dinged for completing commercial transactions with organizations that happened to be on the BIS export blacklist. You're not going to get fined for posting code to Github.
      - ultramancool 12y ago
        But Wind River is only guilty of exporting the same already public information which I may be and it's quite possible that anyone on that "BIS export blacklist" could feel free to obtain my code.
        tptacek 12y ago
        No, I do not think that accurately captures what the USG is fining Wind River for.
learnstats2 12y ago
If US tech companies cannot legally offer encryption to international clients then we international clients shouldn't be using US tech companies.
jhallenworld 12y ago
The country classifications are interesting https://www.bis.doc.gov/index.php/forms-documents/doc_download/944-740-supp-1 https://www.bis.doc.gov/index.php/forms-documents/doc_downlo... A:1 countries are our friends. E:1 countries are "terrorists". The rest are in between. There is also the list of "Supplement 3" exception countries (friends): see last page of http://www.bis.doc.gov/index.php/forms-documents/doc_download/986-740 http://www.bis.doc.gov/index.php/forms-documents/doc_downloa... This charts shows what's allowed if you have crypto in your product: https://www.bis.doc.gov/index.php/forms-documents/doc_view/98-license-exception-enc https://www.bis.doc.gov/index.php/forms-documents/doc_view/9... I assume vxWorks is 5E002 (tools to create non-standard crypto systems), which is banned for D:1 countries. Well there is an exception "‐ 5E002: no D:1 countries (unless HQ'd in Supp. 3)".
demarq 12y ago
American tech companies still in america are becoming the unluckiest bunch. Their competitors pay a third of tax, are free from having to answer to the NSA, and generally don't have to put up with cold war nonsense from the likes of the BIS. If it weren't for american talent, many many more companies would make the move.
- adventured 12y ago
  I agree with your comment. There are also a lot more reasons than just talent for why the US tech industry does so well. It's the largest singular market in the world. A very technologically advanced economy in general. It's a very diverse economy, with the second largest manufacturing sector, the largest agriculture sector, the largest biotech + pharma sectors, as well as the largest space industry and service sectors - which provides for a very diverse tech demand and stimulant. Businesses in the US have very high productivity rates, so they seek out productive gains as a matter of fact, which incubates a higher demand for technology. The US tends to adopt technology rapidly, the culture is mostly accepting of new tech, which plays into that huge market. Businesses can change state locations fairly easily, shifting to jurisdictions that are more friendly in various ways (either for taxes, regulation, weather or talent depending). In the US the tech industry is regulated at a mostly low level, leaving the market free to innovate and change rapidly. There are a lot of other good reasons.
deleted 12y ago
[deleted]
tellor 12y ago
So what better software or hardware encryption?
lectrick 12y ago
Is open sourcing the sensitive bits a possible defense against this?
transfire 12y ago
Would this include the export of Navajo?
- sitkack 12y ago
  What do you think the reservations are for?
bigiain 12y ago
So vxWorks on the Curiosity Rover is - presumably - exporting strong encryption to Martian terrorists, right?
touseefliaqat 12y ago
Few years ago, I was in a team implementing IPSec/IKE protocols for a US based company in Pakistan. Though implemented in Pakistan, that product could not be sold there :)
beatgrass44444 12y ago
1 goal: Destroy Mid-size and Small USA business 2 goal: Destroy Software, IoT, embedded software 3 strategy: 2.3.1 Stomp the grass to scare the snake 4 scope: ALL business uses encryption 5 past: destroy short term crypto by brute force 6 present: destroy mid term crypto by Quantum Computing 7 future: destroy long term crypto security aka NTRU 8 open source: sel4 proved secure and safe 9 open source: Post-Quantum Cryptography NTRU 10 open source: secure against D-Wwaavve Goooogle cracking. 11 crime UNnatural: Nature, internet and Cybersecurity 12 crime UNnatural: Big banksters too big to fail. 13 crime UNnatural: Scapegoat the small business software 14 tactic: firing a drone is expensive. 15 tactic: firing malware at Michael Hastings car is easy 16 pretext: Wind River Fined for Encryption Software 17 bibliography 18 --books many titles destruction of middle class USA 19 en.wikipedia.org/wiki/Thirty-Six_Stratagems 20 --[PDF]On the Cryptographic Long Term Security 21 www.scienpress.com/Upload/JAMB/Vol%203_1_1.pdf 22 http://sel4.systems/ http://sel4.systems/ 23 http://arxiv.org/abs/1405.2034 http://arxiv.org/abs/1405.2034 24 http://arxiv.org/abs/1410.8317 http://arxiv.org/abs/1410.8317 25 --Insights from the Nature for Cybersecurity 26 --[PDF]Provably Secure LWE Encryption with Smallish Uniform ... 27 eprint.iacr.org/.../164.... 28 https://pqcrypto2014.uwaterloo.ca/.../post-quantu.. https://pqcrypto2014.uwaterloo.ca/.../post-quantu... 29 --[PDF]Making NTRU as Secure as Worst-Case Problems over ... 30 www.iacr.org/.../6632... 31 --Michael Hasting's Car Allegedly hacked? 32 http://www.huffingtonpost.com/2013/06/24/michael-hastings-car-hacked_n_3492339.html http://www.huffingtonpost.com/2013/06/24/michael-hastings-ca...

314 points by aburan28 12y ago

Correction: "against Wind River Systems, an Intel subsidiary" not Intel.

If this type of thing is interesting to you, here's some lovely historical perspective about government restrictions on crypto: http://www.foia.cia.gov/sites/default/files/DOC_0006231614.pdf http://www.foia.cia.gov/sites/default/files/DOC_0006231614.p... In particular, related to this $750k Wind River violation: Bidzos realized that there was a simple way to skirt the export limitation laws. Both the AECA and the ITAR are US laws, and, as, such, they pertain only to US companies. Bidzos went to Japan and established a Japanese subsidary, Nihon RSA. Nihon RSA qualified as a distinct Japanese company, subject only to Japanese law, and Bidzos was able to do whatever he wanted with his strong encryption technologies. Knowing that his encryption technology was a desired commodity, he shopped it around the Japanese marketplace. He promptly struck a deal to produce encryption chips for Nippon Telephone and Telegraph Corporation. If the US government continues to fine Wind River, then couldn't they just set up a foreign corporation?

Taek 12y ago
That is likely going to be a consequence of these actions. Digital security is a huge industry and is going continue being a huge industry for a long time. US companies are decreasingly in a position to market themselves as genuinely secure companies. Companies that want to have credibility in the industry are going to need to bring themselves out of the jurisdiction of restrictive laws, or lose business to companies that have set themselves up in more friendly jurisdictions.
rasz_pl 12y ago
This is no longer possible with all the international trade agreements. Lets take for example UK company selling their stuff manufactured in Asia on the Australian market - secret US blacklists still apply: http://www.eevblog.com/2014/02/24/element-14-holding-orders-based-on-us-government-watch-list/ http://www.eevblog.com/2014/02/24/element-14-holding-orders-...

willk 12y ago

It was an Intel subsidiary. The article is not very informative. It appears as if Wind River didn't file for an export permit and the BIS fined the because of it; moreover, they voluntarily disclosed it [0]. [0]:http://www.theregister.co.uk/2014/10/17/intel_subsidiary_crypto_export_fine/ http://www.theregister.co.uk/2014/10/17/intel_subsidiary_cry...

the_ancient 12y ago
Yes because one should have to file for a permit to export math (or anything else)
- LLWM 12y ago
  The law says you do. If you want to change that law, fine. But if you choose not to comply, don't complain when you get fined for it.
  - nitrogen 12y ago
    Why shouldn't someone complain about a law, even if they already knew about it? The false dichotomy between "obey and complain" vs. "get caught and shut up" isn't necessary.
    - LLWM 12y ago
      Because it's obnoxious?
    - thoughtpolice 12y ago
      Because sometimes it's annoying and simply stupid. Case in point: posting stupid reductionist arguments about "exporting math" are obnoxious and completely frivolous, especially when it literally ignores everything substantial about the law. After all, if I give north korea blueprints for nuclear reactors, that's just paper right?! It's just math on paper! What, that's not the same? Sure it is - quit trying to stop me from exporting paper! You do see how the grandparents point is obnoxious and stupid, right? Or do you not because it simply aligns with your worldview?

tptacek 12y ago

Wind River is the vendor behind vxWorks, which is one of the most widely-used embedded operating systems in the world. vxWorks isn't especially common in consumer products (although you can find SOHO-type routers running it) but it's very important in industry, aerospace, manufacturing, RF and telecom, and things like that. The "sharp departure" Goodwin refers to here is the detente between industry and the USG for the past ~12 years. In the late '90s, crypto export controls were vigorously enforced. When you went to download Netscape, you had to select the US-specific installer to get cryptography that wasn't trivially brute-forced. If you shipped products that included SSL/TLS, or even just MD5, you had forms to fill out. It seems like there'd need to be a backstory on this Wind River enforcement action. Surely there's quite a bit of crypto code in various vxWorks distributions, but it pales in comparison to the cryptography shipped by Mozilla and the Chromium projects. Maybe the issue is "enabling technology" versus consumer products? It's also unclear to me whether this is a return to form or the BIS being especially aggressive about deliberate exports to specific countries.

maxerickson 12y ago
The BIS press release seems to narrow the scope a little: http://www.bis.doc.gov/index.php/component/content/article/107-about-bis/newsroom/press-releases/press-release-2014/763-intel-subsidiary-agrees-to-750-000-penalty-for-unauthorized-encryption-exports http://www.bis.doc.gov/index.php/component/content/article/1... It talks about the software in question being on some list and says some of the export recipients in China are on the BIS Entity List. Edit: "on some list" is a dumb way of saying that they decided some of the software was subject to "Export Administration Regulations".
ganzuul 12y ago
Incorrect... You sometimes had to download binaries from a source outside the US. Usually not, since the user was simply expected to click the link for the non-US version. In cases where the server actually looked at your source IP you could either proxy or just download the binary from a source in Europe. The dev teams were and still are seldom located in the US alone, but distributed all over the world. The authors of encryption packages were often not US citizens, either. The rest of the world looked at the US policy on encryption with wide-eyed disbelief due to the horrifying ignorance that just had to lie behind it.

perlpimp 12y ago

does this mean if I have developed a product based on encryption it is better to incorporate outside of USA? and perhaps register a satelite in US only to import said products?

AlyssaRowan 12y ago
It is better to not be in the US as a crypto developer, yes (especially since there are some concerns that CALEA, National Security Letters and other provisions have been used to strongarm people into backdooring crypto products as described in the classified "SIGINT Enabling Project" budget, although so far I have not seen any backdoors that were not put in willingly). That has pretty much always been true. The crypto export laws are weaker than they used to be back in the PGP days, when PGP 2.6.2 was exported as a book to call the bluff of the whole thing, but they're still there and of some concern (especially if you intend your software to be used by citizens inside oppressive regimes which might be on The Export List). I don't see why you'd need a 'satellite' to 'import'. There are no import restrictions I'm aware of in the US? For a brief, non-normative summary of crypto law, please see: http://www.cryptolaw.org/ http://www.cryptolaw.org/

nathanm412 12y ago

This might be an attempt to use existing means to pressure mobile device manufacturers from enabling full device encryption by default. I know the executive branch hasn't been too happy with the latest announcements from Google and Apple.

maxerickson 12y ago
I would speculate they did something closer to providing source code to Chinese defense contractors. (Which probably doesn't really matter in the scheme things, but it's the sort of thing that will really piss off the U.S. Government)

Someone1234 12y ago

How utterly pathetic. Encryption export restrictions are an absolute joke. I can go read a Wikipedia article right now that heavily details the inner workings of most block ciphers. They're still fining people for exporting anything over 64 bits (which is most things), even if almost every individual let alone government has access to the technological knowledge to reproduce such encryption at home. Seems like this fine is about them exporting a custom Linux distro' with all the normal encryption libraries still in-place (e.g. 256 AES). Why do I get the strong sense that this fine isn't really about exporting encryption and is really about Wind River failing to place backdoors into this equipment? Because frankly that makes a lot more sense than what it appears to be on the surface. Wind River got fined for "something" to do with encryption. Now you can either take the government at their word and assume that that thing is just exporting AES 256 within a standard OS, or maybe consider it a little deeper and wonder if it was punishment for something else Wind River did or didn't do.

api 12y ago
Not only that, but anyone in any embargoed country can trivially redirect through a VPS or Tor and bypass any controls. It's sort of like the war on drugs if pot could be sent electronically. Hilarious security theater...
tptacek 12y ago
If the USG wanted to coerce Wind River into backdooring vxWorks, they have better ways to do it than a newsworthy enforcement action regarding cryptography exports. Export controls for crypto are stupid and counterproductive, though; I agree with you there.
Kalium 12y ago
The amount in question doesn't make sense for that. Nor does the voluntary disclosure. 750k isn't a scary and punishing fine when you have Intel backing you.
- lotsofmangos 12y ago
  This could be just meant as a message to other firms. Intel might even be getting the money back through routes like tax breaks and just be playing along.

thrush 12y ago

What is the justification of this law? Seems arbitrary to me. Another question. Is not providing ample security the same as explicitly granting a backdoor?

peterwwillis 12y ago
The justification is we don't help our enemies, even if it doesn't make a difference in the grand scheme. Edit: looks like one of the countries is our ally... so that's weird. For the rest of them makes sense from a geopolitical standpoint.
- stan_rogers 12y ago
  It can get weird. I remember when the export list was significantly expanded for high-bit crypto (2000? 2001?), and France was still on the no-go list - not because the US prohibited export as such, but because France prohibited import (except through authorized channels). Israel may be in the same camp.
  - yuhong 12y ago
    To be more precise, France allowed import of 128-bit crypto before US allowed export of it and months after US allowed 56-bit crypto to be exported. I also found out that it took until 2004 for France to formally allow import of 256-bit crypto.

barisser 12y ago

US Company Fined for Exporting Math. We ain't got enough Math in the US to be sending it abroad!

lordbusiness 12y ago
"US Company Fined for Exporting Math." This.
dabockster 12y ago
We have enough math, but the bureaucracy keeps us from teaching it effectively.
tzs 12y ago
Isn't that like saying someone fined for exporting missiles was fined for "exporting physics", or someone fined for exporting chemical weapons was fined for "exporting chemistry"? If not, how do you distinguish them? Note: I'm not suggesting that the cryptography export restrictions are useful or make any sense it all. They don't, as far as I can tell. I'm just trying to get some discussion going as to whether reductionist arguments like "exporting math" make sense.
- superuser2 12y ago
  Neither missiles nor chemical weapons are ideas. They are not information; they are tangible. A better analogy would be someone exporting a piece of paper with the reactions involved in a chemical weapon on it, or the formulas that describe where a missile will land given certain parameters.
- djrogers 12y ago
  Missiles and chemical weapons are physical objects which one can reasonably presume to maintain at least some degree of control over. Encryption algorithms are math, theory, information. They can be reproduced, copied, and transmitted at-will, for no cost. If the difference is still non-obvious, google around for instructions to make ricin. Easy to find, and it's not illegal to share that information. Why should it be illegal to share any other data? And how could one reasonably expect to enforce it?

wnevets 12y ago

I feel like the title should be updated, a tad misleading IMO.

e40 12y ago

Can anyone provide details on what is forbidden to distribute and to where?

maxerickson 12y ago
http://www.bis.doc.gov/index.php/regulations/export-administration-regulations-ear http://www.bis.doc.gov/index.php/regulations/export-administ... I guess you have to read it all before you can go back and try to understand part of it (that is, I got a headache looking at a few paragraphs, and don't think I learned anything).

rdtsc 12y ago

Could this all be a positive thing if it promotes development of open source libraries and tools ? Not only that, but I wander how feasible is to create binary APIs for most operating systems and CPU architectures, where you could download, verify (that they were build from a commit id of some know open source implementation), and plug in crypto modules as binaries. So you buy your software from any vendor, any country. If they implement the use of this API, then get your verified crypto modules and plug them in. Or you build your own in house from source. I can see how that mechanism would of course be a massive attack target by all kinds of actors, but in theory is that possible? Maybe make it decentralized as much as possible.

billpg 12y ago

Sorry, my time machine appears to be on the blink. I appear to be in the 1990s.

revelation 12y ago
Seems like they are trying to reignite the crypto wars, what with the FBI talking about mandatory backdoors. It's just utterly confusing. You would think their reaction to Snowden would be appeasement, not further repression and surveillance. Can't make it too obvious this ain't a democracy.
- toyg 12y ago
  I can actually see their reasoning: "you thought we were being hard on you? So the gloves are off now? Ok, so we'll show you what happens when we really play hard".
cremno 12y ago
I'm not sure if it was intended, but using that idiom here looks to me as a clever reference to <blink>.

maerF0x0 12y ago

Is it illegal to opensource encryption implementations?

zabcik 12y ago
No, however, the export of it is still punishable. The GNU gcrypt tools, for example, are hosted exclusively on European servers for this reason. http://www.gnu.org/software/libgcrypt/ http://www.gnu.org/software/libgcrypt/
- lectrick 12y ago
  What do words like "import," "export," and "country" mean in an Internet context?
  - logfromblammo 12y ago
    They mean whatever the regulator wants them to mean, when you're handcuffed to his table. Prudence dictates that you not expose yourself or your business to unnecessary risks. So by that standard, the "country" is wherever the enforcer has the power to hurt you, an "import" is bringing something within reach of the enforcer, and an "export" is moving something beyond his reach. Just stay out of the "country", and you never have to worry about being punished for "exports". If you look at the Byzantine import/export regulations, you don't have to be physically located outside of the geographical boundaries of the U.S. to be considered a foreign entity for the purpose of importing and exporting technical information. Just feed in this new input to your lawyer/accountant tax avoidance machine, and everything should be all sorted out by next fiscal year.
    - lectrick 12y ago
      Can I create a decentralized autonomous corporation with an incorporeal geographic location yet?
      - lotsofmangos 12y ago

jldugger 12y ago

What better way to prove that your chips aren't NSA backdoors than to pay a hefty fine to the people you're supposedly in bed with?

sitkack 12y ago
Prove?

makmanalp 12y ago

This is exactly what I fear happens when we allow bad laws to stay in a "well it's there but we don't enforce it" state. Is the way around this to develop crypto systems outside the US?

lucb1e 12y ago
If I remember correctly, someone published a book which contained source code in monospace for PGP so that it would fall under freedom of speech and was allowed to leave the US. But that's from memory, I'm not sure it really did circumvent that law or that it was PGP. Edit: Ah, AlyssaRowan actually mentions[1] this further down the comment thread: > PGP 2.6.2 was exported as a book to call the bluff of the whole thing [1] https://news.ycombinator.com/item?id=8552169 https://news.ycombinator.com/item?id=8552169
- rosser 12y ago
  Yes, it was PGP, and yes, it got around the law. The issue was indeed that exporting it as software made it subject to ITAR, but published as a book, it was considered speech. The tactic was never tested in court with PGP, but it was upheld in at least one other case I'm aware of, Bernstein v. United States. Thank you yet again, DJB.
- LLWM 12y ago
  That doesn't prove anything. You can also export a physics textbook without the issues you would run into exporting a nuclear weapon.
  - lucb1e 12y ago
    Except that you don't really need to buy expensive and probably-hard-to-get-by stuff to turn the book with code into something useful (or munition, in the US government's eyes) whereas with nuclear weapons you somehow need to get a radioactive warhead or something.
    - LLWM 12y ago

deleted 12y ago

[deleted]

mariuolo 12y ago

$750,000? That'll show them!

tn13 12y ago

All this will eventually amount to American companies losing credibility around the world.

DennisP 12y ago

So if you're a U.S. software developer, perhaps opensource, working on something that uses encryption, how do you stay out of trouble? Are you ok if you use standard libraries, rather than implementing your own crypto algorithms?

zerpa 12y ago
Publicly available encryption source code is exempt from the ECCN[1] according to the License Exception[2], section 740.13(e), provided you notify the BIS. But do read the documents, IANAL. Interestingly, though I'm EU based, but ECCN list is literally the same over here. Have been wading through these documents countless times. [1] http://www.bis.doc.gov/index.php/forms-documents/doc_download/951-ccl5-pt2 http://www.bis.doc.gov/index.php/forms-documents/doc_downloa... [2] http://www.bis.doc.gov/index.php/forms-documents/doc_download/986-740 http://www.bis.doc.gov/index.php/forms-documents/doc_downloa...
yuhong 12y ago
And I think it is fairly easy to "self-classify" many kinds of encryption software, though you may have to file an annual self-classification report.

drderidder 12y ago

The damage to the US economy and tech industry caused by this sort of thing seems likely to outweigh any supposed security benefit. Celine's First Law: "National Security is the chief cause of national insecurity." [1] Related stories on HN recently involving Twitter et al [2] are enough to make one wonder how long before some of them relocate overseas. [1] http://en.wikipedia.org/wiki/Celine%27s_laws#Celine.27s_First_Law http://en.wikipedia.org/wiki/Celine%27s_laws#Celine.27s_Firs... [2] https://news.ycombinator.com/item?id=8422581 https://news.ycombinator.com/item?id=8422581

DennisP 12y ago

Do we need to go back to Zimmerman's old trick and publish the code in books? What happens if we put the code in non-DRM'd ebooks?

ultramancool 12y ago

Time for DJB and the EFF to bring their old case back? https://en.wikipedia.org/wiki/Bernstein_v._United_States https://en.wikipedia.org/wiki/Bernstein_v._United_States "On October 15, 2003, almost nine years after Bernstein first brought the case, the judge dismissed it and asked Bernstein to come back when the government made a "concrete threat"." This sure sounds like a concrete threat.

tptacek 12y ago
It needs to be a concrete threat to Daniel J. Bernstein.
- ultramancool 12y ago
  Yeah, you're likely correct. I didn't catch this at first due to my immediate feeling of threat simply for having published a few tools which use high-level cryptography libraries.
  - tptacek 12y ago
    Wind River seems to have been dinged for completing commercial transactions with organizations that happened to be on the BIS export blacklist. You're not going to get fined for posting code to Github.
    - ultramancool 12y ago
      But Wind River is only guilty of exporting the same already public information which I may be and it's quite possible that anyone on that "BIS export blacklist" could feel free to obtain my code.
      - tptacek 12y ago
        No, I do not think that accurately captures what the USG is fining Wind River for.

learnstats2 12y ago

If US tech companies cannot legally offer encryption to international clients then we international clients shouldn't be using US tech companies.

jhallenworld 12y ago

The country classifications are interesting https://www.bis.doc.gov/index.php/forms-documents/doc_download/944-740-supp-1 https://www.bis.doc.gov/index.php/forms-documents/doc_downlo... A:1 countries are our friends. E:1 countries are "terrorists". The rest are in between. There is also the list of "Supplement 3" exception countries (friends): see last page of http://www.bis.doc.gov/index.php/forms-documents/doc_download/986-740 http://www.bis.doc.gov/index.php/forms-documents/doc_downloa... This charts shows what's allowed if you have crypto in your product: https://www.bis.doc.gov/index.php/forms-documents/doc_view/98-license-exception-enc https://www.bis.doc.gov/index.php/forms-documents/doc_view/9... I assume vxWorks is 5E002 (tools to create non-standard crypto systems), which is banned for D:1 countries. Well there is an exception "‐ 5E002: no D:1 countries (unless HQ'd in Supp. 3)".

demarq 12y ago

American tech companies still in america are becoming the unluckiest bunch. Their competitors pay a third of tax, are free from having to answer to the NSA, and generally don't have to put up with cold war nonsense from the likes of the BIS. If it weren't for american talent, many many more companies would make the move.

adventured 12y ago
I agree with your comment. There are also a lot more reasons than just talent for why the US tech industry does so well. It's the largest singular market in the world. A very technologically advanced economy in general. It's a very diverse economy, with the second largest manufacturing sector, the largest agriculture sector, the largest biotech + pharma sectors, as well as the largest space industry and service sectors - which provides for a very diverse tech demand and stimulant. Businesses in the US have very high productivity rates, so they seek out productive gains as a matter of fact, which incubates a higher demand for technology. The US tends to adopt technology rapidly, the culture is mostly accepting of new tech, which plays into that huge market. Businesses can change state locations fairly easily, shifting to jurisdictions that are more friendly in various ways (either for taxes, regulation, weather or talent depending). In the US the tech industry is regulated at a mostly low level, leaving the market free to innovate and change rapidly. There are a lot of other good reasons.

deleted 12y ago

[deleted]

tellor 12y ago

So what better software or hardware encryption?

lectrick 12y ago

Is open sourcing the sensitive bits a possible defense against this?

transfire 12y ago

Would this include the export of Navajo?

sitkack 12y ago
What do you think the reservations are for?

bigiain 12y ago

So vxWorks on the Curiosity Rover is - presumably - exporting strong encryption to Martian terrorists, right?

touseefliaqat 12y ago

Few years ago, I was in a team implementing IPSec/IKE protocols for a US based company in Pakistan. Though implemented in Pakistan, that product could not be sold there :)

beatgrass44444 12y ago

1 goal: Destroy Mid-size and Small USA business 2 goal: Destroy Software, IoT, embedded software 3 strategy: 2.3.1 Stomp the grass to scare the snake 4 scope: ALL business uses encryption 5 past: destroy short term crypto by brute force 6 present: destroy mid term crypto by Quantum Computing 7 future: destroy long term crypto security aka NTRU 8 open source: sel4 proved secure and safe 9 open source: Post-Quantum Cryptography NTRU 10 open source: secure against D-Wwaavve Goooogle cracking. 11 crime UNnatural: Nature, internet and Cybersecurity 12 crime UNnatural: Big banksters too big to fail. 13 crime UNnatural: Scapegoat the small business software 14 tactic: firing a drone is expensive. 15 tactic: firing malware at Michael Hastings car is easy 16 pretext: Wind River Fined for Encryption Software 17 bibliography 18 --books many titles destruction of middle class USA 19 en.wikipedia.org/wiki/Thirty-Six_Stratagems 20 --[PDF]On the Cryptographic Long Term Security 21 www.scienpress.com/Upload/JAMB/Vol%203_1_1.pdf 22 http://sel4.systems/ http://sel4.systems/ 23 http://arxiv.org/abs/1405.2034 http://arxiv.org/abs/1405.2034 24 http://arxiv.org/abs/1410.8317 http://arxiv.org/abs/1410.8317 25 --Insights from the Nature for Cybersecurity 26 --[PDF]Provably Secure LWE Encryption with Smallish Uniform ... 27 eprint.iacr.org/.../164.... 28 https://pqcrypto2014.uwaterloo.ca/.../post-quantu.. https://pqcrypto2014.uwaterloo.ca/.../post-quantu... 29 --[PDF]Making NTRU as Secure as Worst-Case Problems over ... 30 www.iacr.org/.../6632... 31 --Michael Hasting's Car Allegedly hacked? 32 http://www.huffingtonpost.com/2013/06/24/michael-hastings-car-hacked_n_3492339.html http://www.huffingtonpost.com/2013/06/24/michael-hastings-ca...