NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/sci/crypt/6025

Text File | 1992-12-22 | 3.9 KB | 82 lines

Newsgroups: sci.crypt
Path: sparky!uunet!zaphod.mps.ohio-state.edu!cs.utexas.edu!qt.cs.utexas.edu!yale.edu!spool.mu.edu!umn.edu!csus.edu!netcom.com!tenney
From: [e-mail] (Glenn S. Tenney)
Subject: Re: Legal Stuff!
Message-ID: <[e-mail]>
Organization: Netcom - Online Communication Services (408 241-9760 guest)
References: <bontchev.724943800@fbihh> <[e-mail]> <a_rubin.724977120@dn66>
Date: Tue, 22 Dec 1992 09:27:36 GMT
Lines: 71

In article <a_rubin.724977120@dn66> [e-mail] (Arthur Rubin) writes:
> ...
>(1>) Do you have any basis for your premise that a computer program CAN
>infringe a patent?  My understanding of the law (confirmed by some experts)
>is that, as we don't have algorithm patents in this program, a computer
>program alone cannot be covered by a patent.  The program must be RUNNING
>on a computer before there is any infringement.

When asking for legal advice, omitting even a tiny detail can
make all the difference.  For example, you need to ask whether
using something produced USING a patented process can violate
that patent.  In other words, technically of course, importing email
encrypted using PGP, *if* PGP violates a US patent, is something
that is not allowed by US patent law.  Cut through all of this
software patent red herrings.  If you import a box made using
a patented process, that box can become an infringing device.

As I started to mention above, your comments here about software
patents is bogus.  The RSA patents are not patents of an algorithm.
They are applications of an algorithm.  Fine line?  Perhaps, but
many physical inventions are nothing more than applications of
various equations.  The point is:  Writing a book about a patent
is NOT infringing.  Providing something that has the utility of
exercising (performing) a patent is likely infringing.

>(2>) We've gone through this.  I haven't tracked the exception to the
>exception to the exceptions in the regulations, but it is unclear whether
>"public domain" (meaning essentially, published) crypto software is covered
>by ITAR.

This is *VERY* clear.  You may personally choose to ignore the ITAR,
and no one may come after you, but...  Any company who wants to stay
in business has got to try to follow the laws.  Let me give you an
example that I know to be true:  A friend of mine published a
public domain FORTH system.  This was widely available in bookstores,
by mail order, etc.  This included books with full source code, and
machine readable disks.  When they got an order to send one to the
USSR (this was 5-7 years ago), the Feds told them "No Way!".  Could
they have sent it?  Yes.  Would they have gotten into Federal trouble?
Who knows?  Did they?  NO.  Does it make sense?  Not for computer
software, but this is a Federal bureaucracy.


Not directed to you, but this makes me think...

*IF* PGP does violate either ITAR or a US patent, and *if*
sending PGP encrypted email or decrypting PGP sent mail is
a patent infringement, then who are you putting at risk?
Just you, or your company?  Would your company want you
using PGP on their email systems / machines if they knew
that it probably infringes a US patent?  It's one thing
to take a personal act of civil disobedience and another
to pull in your entire company or University.  I don't know
of many corporations or schools that would allow any employee
to jeopordize the entire company like that.

Is it likely that either the Feds or RSA will come after
someone?  I don't know, but the more people using PGP at
large US corporations or universities, the more likely
it is (in my guess) that RSA will choose one as an example.

As for the ITAR restrictions...  I think that removing such
restrictions on exporting RSA would be in RSA's best interests.

Just my own opinions here...


--
Glenn Tenney
voice: [phone]      fax: [phone]
[e-mail]          Ham radio: AA6ER