From: Rich Graves <llurch@networking.stanford.edu>
Date: Thu, 28 Mar 1996 11:47:19 +0800
To: cypherpunks@toad.com
Subject: Re: About Triple DES ......
In-Reply-To: <19960327040302.536.qmail@ns.crynwr.com>
Message-ID: <Pine.SUN.3.92.960326221907.4439A-100000@elaine41.Stanford.EDU>
MIME-Version: 1.0
Content-Type: text/plain


On 27 Mar 1996 nelson@crynwr.com wrote:

> Um, what if Victor and www.cs.hut.fi are only connected on a path that
> traverses the United States?  Can a person be convicted of ITAR
> violations when they've never been in the U.S.?  :)

If neither endpoint includes US citizens or residents, or people working
on the behalf of US citizens or residents, no.

Very interesting hypothetical, though. I'm pretty sure that in this case,
it's a fact, not a hypothetical.

A more complicated hypothetical: if Victor told MCI/Sprint/whatever, the
news media, and the US authorities of his intent to download triple-DES in
this way, would MCI/Sprint/whatever be liable? Any cypherpunks in Latin
America? How about from Asia to Finland -- what does that route look like?
Something along the lines of that "Pastors for Peace" media hoax, which
is a perennial show of an attempt to deliver US goods to embargoed Cuba,
might be worth engineering.

At some point in this exercise, though, we might be "raising awareness"
among the wrong people, to cite Tim May. I wouldn't want NAFTA, the WTO,
and so on enforcing ITAR.

-rich