From: Carl Ellison <cme@TIS.COM>
Date: Wed, 20 Sep 95 14:09:11 PDT
To: kelli@zeus.towson.edu
Subject: Re: My new perspective on ITAR (was Re: Munitions shirt (again))
In-Reply-To: <Pine.ULT.3.91.950920151359.6005A-100000@zeus.towson.edu>
Message-ID: <9509202056.AA14060@tis.com>
MIME-Version: 1.0
Content-Type: text/plain


>Date: Wed, 20 Sep 1995 15:26:08 -0400 (EDT)
>From: "K. M. Ellis" <kelli@zeus.towson.edu>

[re. wearing an RSA T-shirt in the presence of furreners]

The CRYPTO conference sounds like a better alleged violation of export --
unless you take your shirt off and give it to the furrener or lie down on
his scanner to scan your bar codes (or maybe let him take a picture of
the bar codes). :-)

It was the late 70's when an over-enthusiastic person from NSA complained
to the IEEE that it was about to hold a conference including foreign
nationals at which crypto would be discussed.  This is clearly in violation
of the ITAR (dissemination of controlled technical data).  The IEEE
generally thumbed its nose at the NSA person and shortly thereafter (1980)
the ICAR was founded and CRYPTO conferences were held.

CRYPTO includes multiple attendees from the crypto services of (former)
(?current?) unfriendly governments.  (is France friendly? :-) It also has
multiple NSA attendees -- so it's not going on in secret from the gov't.

>I might add, however, that two days ago I wore my RSA shirt to my sound
>design class, where the guy I happened to sit down next to recognized it,
>was familiar with what it stood for, and knew all about the Zimmerman
>case; not because he was a crypto enthusiast or a comp sci major, but
>because he works for customs at Baltimore-Washington International
>Airport. 
>
>This event really changed my point of view considering ITAR... I figured 
>that it was just one of those dumb laws that _nobody_ really paid much 
>attention to except for the FBI and that was only because they were 
>looking for a way to nail Zimmerman for writing good crypto.  I had 
>assumed that ITAR was something that  customs agents/L. E. O's/etc. 
>learned about, took a  test on it, then forgot about it the next day.
>
>Interesting... they _really_ are serious, aren't they?

Well ...

I was at an AFCEA talk about export rules about 1.5 years ago and met a
special agent from Customs.  I asked him for Customs' policy on export of
crypto S/W and technical data by USENET News, FTP and WWW.  He seemed very
interested -- wanted my phone number -- was going to come out to visit to
see these sites offering this stuff.

He never came out.

I started e-mailing him asking him whether he was going to come get a tour
of the net -- and he stopped replying.

I can only assume that when he thought it was a single incident (like PRZ)
which could be tracked, he might follow it -- but when I started talking
about dozens or hundreds of people involved (e.g., all US persons talking
crypto techniques on sci.crypt) he lost interest.  I was going to show him
the MIT and TIS sites which release crypto code.  (Those sites have letters
from the State Dept. saying that what we do to restrict export is OK --
even if it is the honor system.)  I was going to show him how easy it is to
get crypto from overseas.

As I said, he lost interest.

 - Carl


+--------------------------------------------------------------------------+
|Carl M. Ellison    cme@acm.org    http://www.clark.net/pub/cme		   |
|PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2  |
|  ``Officer, officer, arrest that man!  He's whistling a dirty song.''    |
+---------------------------------------------- Jean Ellison (aka Mother) -+