NetNews Usenet Archive 1992 #27/NN_1992_27.iso/spool/sci/crypt/5003

Internet Message Format | 1992-11-18 | 5.7 KB

Path: sparky!uunet!nntp1.radiomail.net!csl.sri.com!boucher
From: [e-mail] (Peter K. Boucher)
Newsgroups: sci.crypt
Subject: Re: Risks of Using PGP 2.0
Date: 19 Nov 1992 09:24:11 GMT
Organization: Computer Science Lab, SRI International
Lines: 129
Distribution: world
Message-ID: <[e-mail]>
References: <[e-mail]> <a_rubin.722037007@dn66> <[e-mail]>
NNTP-Posting-Host: affirmed.csl.sri.com
Keywords: legal, patent, export, ITAR

In article <bontchev.722038231@fbihh>, [e-mail] (Vesselin Bontch
ev) writes:
|> [e-mail] (Peter K. Boucher) writes:
|>
|> > First, it is illegal to "make, use, or sell" a patented device
|> > without a license.  PGP's disclaimer does not protect anyone making,
|> > distributing, or using PGP.  PKP owns the patent and sells licenses
|> > to companies who want to make and sell products that use RSA and
|>
|> In the RSA FAQ it is stated that PKP allows free usage of RSA for
|> non-commercial use. I was unable to obtain an official answer from
|> them why (and if) this excludes PGP.

Provided you use it in compliance with their license.  PGP doesn't.

|> > other public-key cryptography.  PGP is not licensed.  A license to
|> > the maker of PGP has always been (and still is) available, but it
|> > would not be free (which would be unfair to other licensees, whose
|> > licenses were not free).
|>
|> Nope, PKP promptly refuses to issue licenses for PGP, even if you
|> offer to pay them.

They told me that they would be happy to sell a license to Zimmerman,
who created PGP, but not to individual PGP users.


|> > Second, PGP may be illegal with respect to US export law.  The
|>
|> True, it is illegal to export PGP from the USA. Fortunately, the world
|> does not consist of the USA alone, so you can safely IMPORT the
|> package from dozens of ftp sites around the world. Importing it in the
|> USA is NOT illegal (actually using it is another story).

Are you sure it's not illegal to import it?

How do you read the following sections of the ITAR:

123.2 Imports.

No defense article may be imported into the United States unless (a)
it was previously exported temporarily under a license issued by the
Office of Munitions Control; or (b) it constitutes a temporary
import/intransit shipment licensed under Section 123.3; or (c) its
import is authorized by the Department of the Treasury (see 27 CFR
parts 47, 178, and 179).

Part 127 - Violations and Penalties - states in 127.1 (a):

(a) It is unlawful
    (1) to export or to attempt to export from the United States
        any defense article or technical data or to furnish any
        defense service for which a license or written approval
        is required by this subchapter without first obtaining
        the required license or written approval from the Office
        of Munitions Control;
    (2) to import or attempt to import any defense article whenever
        a license is required by this subchapter without first
        obtaining the required license or written approval from
        the Office of Munitions Control;


125.2 Exports of unclassified technical data.

Paragraph (c) reads:

(c) Disclosures. Unless otherwise expressly exempted in this
subchapter, a license is required for the oral, visual, or documentary
disclosure of technical data to foreign nationals in connection with
visits by U.S. persons to foreign countries, visits by foreign persons
to the United States, or otherwise.  A license is required regardless
of the manner in which the technical data is transmitted (e.g., in
person, by telephone, correspondence, electronic means, telex, etc.).

Also, 120.21 Technical Data.

"Technical data" means, for purposes of this subchapter:

(a) Classified information relating to defense articles or defense
services;

(b) Information covered by an invention secrecy order;

(c) Information which is directly related to the design, engineering,
development, production, processing, manufacture, use, operation,
overhaul, repair, maintenance, modification, or reconstruction of
defense articles.  This includes, for example, information in the form
of blueprints,drawings, photographs, plans, instructions, computer
software and documentation. (There's little more, not relevant.)

|> Using PGP outside the USA is
|> not illegal.

You may be right about this. (It might be illegal in the
People's Republic of China  :-)

In article <a_rubin.722037007@dn66>, [e-mail] (Arthur Rubin) writes:
|> DISCLAIMER: I am not a lawyer, the company I work for probably disagrees
|> with everything I say.

I'm not either.  Therefore I would never advise someone about what they should
do with PGP.  I advised people to get their own legal advice, in order to form
an informed decision.

|> Irrelevant.  Only Phil, himself, might be liable.  The is no restriction
|> under ITAR against importing arms that were illegal to export.  (If
|> datapaths from one foreign site to another pass through the US, it seems
|> likely the the re-exporter could also be prosecuted, if anyone can trace
|> the links to find out who it is.)

See above.  Do you read it differently than I do?

|> Are RSAREF sources available?  If not, there is little benefit to it's use
|> by people who don't trust RSA/PKP not have put in a "trap door".

Yes.  Send email to [e-mail]

DISCLAIMER 1:  I have no affiliation whatsoever with RSADSI, PKP, or RIPEM.

DISCLAIMER 2:  The opinions expressed here are strictly my own, not necessarily
               SRI International's.

METADISCLAIMER:  Any place where disclaimers like these appear can be safely
                 assumed to have *WAY* too many lawyers.

--
Peter K. Boucher
--
RIPEM public key available upon request.