NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/sci/crypt/6184

Text File | 1992-12-25 | 5.5 KB | 105 lines

Newsgroups: sci.crypt
From: [e-mail] (Owen Lewis)
Path: sparky!uunet!pipex!gate.demon.co.uk!demon!purplet!Owen.Lewis
Subject: Re: Non-U.S. crypto laws
Organization: FidoNet node 2:252/305.0 - The Purple Tentacle, Reading
Date: Wed, 23 Dec 1992 18:52:00 +0000
Message-ID: <[e-mail]>
Sender: [e-mail]
Lines: 94

 -=> Quoting David Sternlight to All <=-

 DS> I'm curious. What are the crypto laws in the U.K., Germany, and
 DS> Finland, from which most of the posts come. Is it really true
 DS> that PGP is legal there, or do such countries also have laws
 DS> about import, posession, or use of cryptographic software,
 DS> which have conveniently not been mentioned in this discussion?

 What a good question! I wish I could promise you as good an answer.
 The following are some of the facts for UK, as I understand them I
 would be grateful for others' addition, correction or amplification as
 may be required.

 I believe we have no law dealing specifically with the import/
 ownership/use of cryptologic systems. We have a maze of regulations,
 whose establishment is no doubt based in statute law. These regulations can
 be changed or re-interpreted from time to time by the public servants
 charged with their administration without recourse to Parliament or to the
 courts. However such changes or re-interpretations may be challenged in the
 courts on a case-by case basis. The government agents do not always win.

 In practice at least, software implementations seem to be treated differently
 from hardware implementations; there are also further observeable
 distinctions attempted between hardware designed to protect the transmission
 of information over formal networks as opposed to the protection of
 (principally) speech in wireless transmission.

 Taking these in reverse order:
               - A cryptologic device to secure wireless transmissions
        requires a licence (as does any transmitter) from the Department of
        Trade and Industry. To the best of my knowledge, no licence has been
        granted in UK to allow possession of such equipment by other than
        governmental or quasi-governmental organisations. Digital encryptors
        for speech over the PSTN etc. may be supplied to UK corporate users
        on a case-by-case basis; also, before such devices may be used in
        direct or indirect connection to the PSTN, the devices must be
        thoroughly examined and approved by the Office of Telecommunications.

        - On-line systems for the protection of textual and graphical
        information are slowly increasing in corporate hands, led by the
        banks and other financial institutions. Despite the inherent
        difficulties with the technology, fax encryption is slowly
        becoming more common. Such equipment is both made in the UK and
 imported. Where direct or indirect connection to the PSTN is intended
        approval is requires as above.

        - Software cipher implementations for the protection of
        information held in storage is more widespead than any of the foregoing
        and is not subject to end-user licencing. Some cryptosystems are
        available that include the protection of information in transmission
        on area networks. These do not seem to be subject to licencing control.
        Software designed to allow the off-line crypto protection of
        information intended for transmission via the PSTN or packet switched
      networks is quite uncommon. I believe this to be due to the fact that
        such systems are essentially limited to low traffic density situations
        and also that the penetration of data comms into small business and
        personal use is still quite limited in the UK. One commercial software
        PC security package with a LAN and PSTN suited cipher system is Fifth
        Generation's S.A.F.E. product. This is imported from the US and sold,
        as I understand it, without additional UK licencing restrictions.
        There are (or were) a choice of ciphers offered to suitable customers.
        A DES implementation, subject to the US rules governing that system,
        and a proprietary algorithm.

  There is a British freeware product that would seenm to ante-date PGP. This
  too uses a software RSA implementation for the key management of any one of
  a range of main ciphers, including a DES CFB option.

  PGP has well and truly arrived in the UK but is unknown (asis any cipher
  system) to the vast majority of the population, who are unconcerned with
  such things. It is not in the least probable that PGP's arrival has gone
  unnoticedby the government's Communications and Electronic Security Group
  and it isreasonable to assume that that information is therefore available
  to all interested government agencies, such as the Department of Trade and
  Industry. My understanding is that neither the possession nor use of PGP2.x
  in the UK can constitute an offence against UK law. The unlicenced export
  of PGP2.x from the UK to other countries might be in breach of the COCOM
  regulations to which the UK is signatory. Such unlicenced export might
  therefore create an offence in English law.

  Others maycare to post and fill in or correct some of this outline. I
  am not a lawyer and will therefore try and get the view of a UK lawyer,
  knowledgable in the field, to answer you with more authority.

  Regards,

  Owen




.. Enter any 12-digit prime number to continue.
___ Blue Wave/QWK v2.11