Re: [Eben Moglen <moglen@columbia.edu>] Re: US crypto export restrictionsand GNU (fwd)

On Tue, 14 March 2000, Richard Stallman wrote: A concern that has been expressed to me several times is that the new regs are infectious, i.e. code that incorporates US exported patches becomes US export controlled, and hence may be affected by future regulatory changes. Eben, what do you have to say about this issue? I think don't fully understand the bearing of the statement. US export control regulations apply to code not because of its origin, but solely because of its function. Code developed in the United States is subject to export control if it performs functions listed in the so-called Munitions List. Without entering into too many of the endless unhappy technicalities, that means, roughly speaking, code that performs encryption or decryption using non-trivial algorithms and key lengths, or which performs key management activities, or code which would provide such functions if encryption/decryption algorithms were "dropped in" to "encryption-sized holes" in the code. It doesn't matter whether the routines were assembled abroad and reimported to the US, or whether any of the code is descended from code exported from the US in the past. The questions are (not to suggest that any of these are as simple as they look, or that NSA didn't play all sorts of silly games through its mouthpiece agencies in defining each of these criteria): [1] is the code "in" the US; [2] does it qualify as a munition because it performs functions defined on the munitions list; and [3] is it going "out" of the US? If and only if the answers are yes, the regs apply. With this in mind, the "infectiousness" argument seems hard to credit. If someone has heard it made in enough detail to clarify what is being asserted I can try to analyze the matter further, but as things stand I think the claim is likely to be based on a misunderstanding. As to the possibility of future restrictive changes in regulations, it is theoretically possible, but practically of vanishing likelihood. The absurdity of prohibiting export from the US of that which is pervasively available elsewhere already has been fully accepted by the non-secret portions of the federal government, and industry's stake in the new situation is profound. It would take circumstances capable of overriding that consensus to bring about restrictive change. Such circumstances are hard to define, let alone foresee.