From: hughes@ah.com (Eric Hughes)
Date: Fri, 27 May 94 22:10:11 PDT
To: cypherpunks@toad.com
Subject: "illegal": law and tort
Message-ID: <9405280516.AA25630@ah.com>
MIME-Version: 1.0
Content-Type: text/plain


Not everything that lands you in court is illegal.

If there's a law passed and you violate it, that's an illegal act.  If
you cause someone harm, that's a tortious act.  Law is a criminal
matter; tort is a civil matter.  Both end up in court, but the
difference between civil and criminal is enormous.

I got some private mail that pointed out that I didn't address the
copyright issue on PGP 2.6.  I'll do so here.  The RSAREF-1 license
doesn't apply outside US and Canada, as I recall.  (And let me be
explicit--I'm feeling too lazy to look it up right now.)  So use of
RSAREF-1 products, including PGP 2.6, in Europe is not licensed, and
therefore infringes the copyright of RSADSI.

Copyright infringement is a tort (a harm), not a violation of law.
Saying that infringing software is "illegal" because it infringes is
incorrect.  Infringing software is tortious, certainly.  Let's put an
end to confusing tortious with illegal.

This distinction makes a big difference.  In the case of illegality,
the government takes you to court.  In the case of tort, the offended
party takes you to court.  Now while one could conceivably be
extradited for the ITAR (criminal), one couldn't be for copyright
infringement (civil).

Now, if someone in Europe were to use PGP 2.6, what could RSADSI do
about it?  They could sue in civil court for damages.  Which court?
If in the USA, then their remedy is limited to what the USA civil
court can order, and if the European user were to have no assets in
the USA, that's pretty much the end of the remedy.  If the court were
in Europe, RSADSI would have to sue in a European court.  Now _you_
guess what that costs.  For an individual user, there's almost nothing
to worry about.

Eric