From: iang@cs.berkeley.edu (Ian Goldberg)
Date: Fri, 13 Dec 1996 14:30:33 -0800 (PST)
To: cypherpunks@toad.com
Subject: Re: ITAR -> EAR; loss of First Amendment Rights.
In-Reply-To: <199612131951.LAA03511@toad.com>
Message-ID: <58sldn$ftp@abraham.cs.berkeley.edu>
MIME-Version: 1.0
Content-Type: text/plain


-----BEGIN PGP SIGNED MESSAGE-----

In article <199612131951.LAA03511@toad.com>,
Peter Trei <trei@process.com> wrote:
>It appears that we will now have the unique
>situation that a book which contains cryptographic
>info or source code will be illegal to export or 
>sell to a non-citizen, without getting export permission.
>
>I am not aware of any prior time when the government
>attempted to claim that printed material, freely
>available in bookstores and newsstands to US citizens,
>became contraband when sold or given to a non-citizen.
>
>Who's responsible for enforcing this? The vendor? The
>clerk at Barnes & Noble? The publisher? If the latter,
>how many publishers will take the risk of printing 
>books with crypto information? Will Wiley pull "Applied
>Cryptography" from the shelves?

Part 744.9(c) of the draft regs:

# (c) Definition of U.S. person. For purposes of this section, the term
#     U.S. person includes: 
# 
#       (1) Any individual who is a citizen or permanent resident alien of
#           the United States; 
# 
#       (2) Any juridical person organized under the laws of the United States
#           or any jurisdiction within the United States, including foreign
#           branches; and 
# 
#       (3) Any person in the United States.

So it would be legal to sell books to foreigners in the US, unless that would
be "provid[ing] assistance to foreign persons" (744.9(a)).  Funnily enough,
"foreign person" isn't defined anywhere in http://jya.com/commerce.htm.
Is it safe to assume it means "a person who is not a U.S. person, as defined
in 744.9(c)"?  If that is the case, then teaching crypto classes to foreigners
in the US would be legal.

The new regs don't seem to have the exception for "mere travel outside of
the United States by a person whose personal knowledge includes technical
data" (ITAR, 120.17(1)).  Does that mean that such travel is now (or will
shortly be, when the new regs are enacted) illegal?  I find that hard to
believe (but I also find that virus checkers and firewalls are being
controlled hard to believe; hell, I find the whole crypto export policy
hard to believe).

   - Ian "heading back to Canada..."

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMrHY70ZRiTErSPb1AQE0VAP/Sa1+s9n5k9V0ybt+xgMqd+lWLRNwsCES
y5tBaaU+BApEMrt96EPcvJe/YX5BwhFbKjxMaXjl5brtGe8J3UmgP04lBDlNfS4R
XwVqagG8yjmya7e0+/b0//WmFEn+KJCcU7y9HNi/OB4j7aWyB/7lPvSG9rPt2sua
13oBHLnoZIQ=
=j7sS
-----END PGP SIGNATURE-----