From: hughes@ah.com (Eric Hughes)
Date: Tue, 1 Mar 94 14:08:16 PST
To: cypherpunks@toad.com
Subject: on international transmissions
In-Reply-To: <9402270646.AA25163@prism.poly.edu>
Message-ID: <9403012200.AA08101@ah.com>
MIME-Version: 1.0
Content-Type: text/plain


The situation:

-- non-USA person retains a USA-based email service
-- this person forwards mail to non-USA machine
-- this person requests crypto software be sent to the USA email address
-- another person sends software to the USA address
-- the forwarding works and the software is shipped outside the USA

>This way, the author has not broken the law by sending the software
>to anysite.com, 

This is correct, since the sender of the crypto was told that the
address was a US place.  If, however, the sender of the crypto knows
that it will be automatically forwarded outside of the country, the
they become liable because they have prior knowledge of the
consequences of their actions.

>and I haven't either because all I did was to tell
>the unix box to forward my mail out of the country.  

Such a direction is not improper _per se_, but the combination with a
request to have crypto software sent to that address means that the
requester has prior knowledge that the request will cause crypto
software to be exported across US boundaries.  And that prior
knowledge creates liability.

>Neither I nor Joey_CryptoAuthor broke ITAR.  Not really.  Not
>intentionally.  

Incorrect.  The person who sets up forwarding with the intention of
moving crypto software automatically outside of the country is in
violation.

But since I am not a lawyer I feel compelled to point out that the
cost of extradition of random people to the USA for trial under USA
laws is expensive and difficult, the most recent high-profile example
being Noriega.  In addition, detection of such an action will be
difficult at best, and near impossible to prove if encryption is used.

Proof that software was exported in encrypted mail would require at
least the following:

-- a copy of a particular piece of mail claimed to contain encryption
software

-- evidence that this particular piece of encrypted mail did in fact
contain encryption software

-- evidence that a particular piece of encrypted mail was sent outside
of the country at a particular time and between two given machines

So, someone has to supply the authorities with a copy of the mail,
with a decryption of the mail, and with mailer logs evidencing a
transmission across USA borders.

Mailer logs are typically purged after a week or two.  So if the
intermediate machine has purged logs and the .forward file is gone,
there will be precious little direct evidence left of an actual
transmission.  

If the encryption is addressed to only the receiver, and if the sender
did not keep a record of the session key, only the receiver can
provide the session key.  The session key is necessary to show that a
given piece of encrypted mail is an encrypted copy of a particular
piece of software.

And unless the NSA or the intermediate machine or the sender provides
a copy of the particular piece of mail, there's no fact in evidence
that any software was actually sent.

Of course, if the sender is out to sting you and ther intermediary
provides logging information, one might get screwed.  But then again,
all intermediaries would have to cooperate, were there more than one.

And finally, I have written so much only to point out that legality
and enforceability are two very different things.

Eric