Re: PERL/RSA t-shirts for Americans only

[Dave Farber <farber () central cis upenn edu>]

Posted-Date: Tue, 6 Jun 1995 05:49:05 -0400
To: farber () central cis upenn edu (Dave Farber)
Cc: interesting-people () eff org (interesting-people mailing list), gnu () toad com
Subject: Re: PERL/RSA t-shirts for Americans only
Date: Tue, 06 Jun 1995 02:48:55 -0700
From: John Gilmore <gnu () toad com>


Steve Crocker said:
> I doubt
> that t-shirts containing a couple of lines of PERL code which implement the
> RSA algorithm are controlled under the ITAR.  The ITAR specifcally exempts
> publications.


The only way to find out what it's legal to publish in the crypto
realm is to ask the State Department with a Commodity Jurisdiction
request.  Trying to understand the plain language of the regulations
will lead you into exports (like those of publications) which the
State Department has ruled are illegal.  This mere fact makes the
regulations unconstitutionally vague and overbroad.


The regulations say that publicly available "information" is exempt
from export controls, in an obvious attempt to cut a First Amendment
notch in the regulations.  But the State Department has decided that
crypto software is not "information".  And they're trying to convince
a judge that software authors of all kinds are not entitled to the
protection of the First Amendment.


In the Dan Bernstein case, the government explicitly told Dan that he
could not publish a technical paper on crypto, nor an English-language
description of a crypto algorithm.  They also informally told him that
if you "published" some crypto material with the "intent" that it be
exempt from the export controls, e.g. by giving copies to a library,
then the State Department would feel free to come after you anyway,
First Amendment notwithstanding.


A T-shirt including ANY kind of computer language code that implements
crypto is STRONGLY likely to be embargoed (unless it's too easy to
break, like ROT13 or weakened RC2).  Even the New York Times hedged by
taking an "angled" shot of the PERL code so that their photo did not
reproduce an entire, working program.


See my Crypto Export Web Page at http://www.cygnus.com/~gnu/export.html
for more details.


Steve, it would be easy for you to file a CJ for an RSA-in-PERL
T-shirt (except that now it's after the June 1 deadline for buying
them).  I suggest sending three or four such T-shirts to the Office of
Defense Trade Controls along with your CJ request -- I bet they'd be a
big hit there.


        John Gilmore