1. To the best of my knowledge, there is nothing in the current US law that
prevents someone for USING encryption equipment,
sending or receiving encrypted mail, etc. This is NOT necessarily true in other
countries -- many of which have strict laws
about such things. (I remember a story about someone in Thailand who was
arrested for using the resistor color code as a
means of "encrypting" some price quotes for a bid.)
2. Exportation of encryption EQUIPMENT, SOFTWARE, and/or TECHNICAL DATA
(instruction manuals, theory of operation, etc.)
from the United States, Canada, and many if not most of the rest of the COCOM
countries without a license (from the Department of State,
in the case of the US) is a crime. Export control matters are being taken very
seriously after Iraq-gate, and punishment may range
from heavy fines, debarment from ANY type of export (including receiving an
export license to receive goods of any type from the US,
if the violator is a foreign national), and/or imprisionment. Ignorence of the
law may mitigate the severity of the sentence, but is no
excuse before the fact.
3. The only exception to number 2 is in the case of previously PUBLISHED
technical data, widely available in libraries, etc.
Whether widespread distribution of technical data via electronic bulletin
boards, etc., constitutes publication in the sense
of the First Amendment is a fascinating question. Volunteers who would like to
run the risk are encouraged to become a test case!:)
4. It seems highly unlikely that publishing the source code for a significant
crypto systems would avoid the restrictions on the eport
of software.
5. It is not exactly clear who may be criminally liable in the event a
foreign national (not a resident alien "green card holder") accesses
a bulletin board and downloads a system such as PGP. Almost certainly
the person who iINITIATES the transfer would be guilty of violating
the export control laws. Whether the person who POSTED the information
and/or OPERATED the bulletin board would be guilty of either the
export control violation and/or conspiracy to violate would be an interesting
question, but it is worth noting that people who have
"innocently" operated bulletin boards which were widely used to distribute
stolen credit card numbers, etc. have been prosecuted. And in
the meantime, all of their computer equipment, files, etc., were confiscated.
Think what this would mean for your company!
6. The question of how long is the reach of the arm of the (US) law is also
interesting. Presumably the foreign national who violates the
US export control law is guilty of that violation and could be prosecuted,
but first they have to catch him, and presumably extradite him. But
of course if he ever entered the US voluntarily, perhaps for a vacation,
he could be arrested at that time. I don't like it, and I certainly don't
approve, butin the case of drug law violations (Gen. Noriega and several
Mexican alleged violators), terrorists who murder US citizens, and crimes
against humanity (Adolph Eichmann comes to mind), even state-sponsored
kidnapping doesn't seem to be beyond the pale, at least as far as the US
Supreme Court is concerned.
7. Within the United States, there is no question about violating the
export laws in the case of PGP, assuming that you don't give it to a
foreign national. However, the issue of patent violation is certainly present.
Unless someone can overturn the patent on RSA that is held by
MIT and the one on public key cryptography that is held b y Stanford, both of
which are licensed and cross-licensed, as I understand, to Public
Key Partners and RSADSI, I would think that anyone who systematically goes
about violating the patent is putting both himself and his
company at serious legal risk.
8. Caveat--I am not a lawyer, and if I were, I certainly wouldn't go around
handing out free legal advice. If you have questions in this area, and
I would certainly hope that you would by now, I would strongly suggest that
you seek informed counsel. Sionce patent and export control law
are highly speciallized, I wouldn't just ask your Cousin Vinny, either.
Having said all that, I would also agree that the current export control
laws are costing the United States enormously in the area of
innovation, export sales, etc. Three options would seem to be in order:
1) Ignore the law, assuming that it won't be inforced.
2) Do the valient civil disobedience bit -- they can't arrest us all,
can they? But notice what happened to everyone from Jesus to
Martin Luther King before you go down that path.
3) Write to President-elect Clinton, your Congressman and Senator,
etc., demanding that these prohibitions be over-turned.
Good luck!