HDTenEightyP/NetNews huggingface dataset:
From: smb@research.att.com (Steven Bellovin)
Subject: Re: PGP as a World Standard
Date: Thu, 17 Dec 1992 20:02:25 GMT
Organization: AT&T Bell Laboratories

In article <1992Dec17.124326.17185@infodev.cam.ac.uk>, rja14@cl.cam.ac.uk (Ross Anderson) writes:
> (2) If you don't live in the USA, US law doesn't apply and so neither
>     the ITAR regulations or the RSA patents have any force.

The ITAR regulations are simply the U.S. instantiation of the COCOM
restrictions on export of sensitive materials.  I believe that all NATO
members, and several other allied nations, are signatories to the COCOM
pact.  Now, it may be that cryptographic software isn't covered under,
say, British regulations, at least when it comes to other COCOM members.
But I dare say that you'd be in just as much trouble if you consciously
shipped PGP to, say, Libya or Iraq as I would.

You're quite correct about RSA not being protected outside of the U.S.
Within the U.S., a patent may be infringed by making, selling, or using
the protected device.
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp,alt.society.civil-liberty
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: PGP as a World Standard
Followup-To: alt.security,talk.politics.misc,alt.security.pgp,alt.society.civil-liberty
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Fri, 18 Dec 1992 12:16:34 GMT

In article <1992Dec17.124326.17185@infodev.cam.ac.uk>, rja14@cl (Ross Anderson) writes:
>(2) If you don't live in the USA, US law doesn't apply and so neither
>    the ITAR regulations or the RSA patents have any force.

Go tell that to Manuel Noriega or the graves of people who happened to
be in the wrong place in Panama at the time US law was applied there,
the crew of the chip recently attacked on by people working for the
U.S. government.

Also, the COCOM regulations are relatively succesful at implementing
the U.S. ideas of what export is legal and what is not in many
countries.  Some years ago a couple of people were charged with
treason in Finland for exporting old VAXen (computers, not vacuum
cleaners) to the Soviet Union, because of the export regulations.
(they were not convicted, though, I think).  I think also that
U.S.-based companies and their daughter companies abroad are required
to use the U.S. government's blacklists of persons and companies whom
not to do business with, again because of the export control.

As for patents - not quite yet, but wait for GATT which has clauses to
explicitly prohibit just about any restrictions on the scope of patent
law.  I'm not sure if there is work for unified patents (a la what
Berne is for copyrights), though.

Followups-To trimmed.

//Jyrki
Newsgroups: alt.security,sci.crypt
From: Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu>
Subject: Re: PGP v. 2.1 Released
X-Quoted: 47%
Organization: Computer Science Dept, Indiana University
Date: Fri, 18 Dec 1992 11:39:38 -0500

Thus said a_rubin@dsg4.dse.beckman.com (Arthur Rubin):
>In <1glvofINNc0o@roche.csl.sri.com> boucher@csl.sri.com (Peter K. Boucher) writes:
>>  1) RIPEM can be found with archie and obtained via anonymous ftp.
>(As can PGP).  So it's in violation of ITAR.  (I've seen the license -- all
>I NEED is an account at a US site, in order to get it, regardless of where
>_I_ am located.)

(Actually, RIPEM cannot be obtained thusly yet.)  Of course, people
outside the U.S. will get it.  The distribution site merely needs to
play CYA games to limit potential responsibility.

>>  3) RIPEM uses RSAREF, which comes with an imbedded license from PKP.
>The RSAREF license seems to be revokable without cause.  (I did read it,
>once.)

I find no such clause in my (casual, non-legal) reading of the most
recent one I have.  Can you please point me to the appropriate section?
-- 
Marc VanHeyningen    mvanheyn@whale.cs.indiana.edu    MIME & RIPEM accepted

The cultural elite are neither!
(Or at least they're certainly not the latter.)
Xref: sparky alt.security:5144 sci.crypt:5867
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP as a World Standard
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 17 Dec 92 22:40:48 GMT
Organization: Beckman Instruments, Inc.

In <1992Dec17.213627.28282@netcom.com> strnlght@netcom.com (David Sternlight) writes:


>Read my lips. PGP1.0 was contraband in the U.S., so much so that the
>author pulled out. It was illegally exported.  PGP2.0 was based on it.
>Thus the Europeans who use it don't have clean hands, regardless of
>the state of the law there.

Still wrong.  The author of PGP 1.0 didn't want to take the risk of
persecution (yes, that's what I said) by RSA/PKP, so he withdrew support. 
It was exported in apparent violation of ITAR, which is solely a US
concern.  (I say apparent because source code looks like technical
specifications to me, which are not subject to ITAR.)  RSA/PKP also claims
some of the code of PGP 1.0 was taken from an early RSA encryption program.
That would be a violation of copyright, which would make it illegal in most
European countries, as well, if there was any evidence of it.  There isn't.

There is no question of clean hands, as I see it.
--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
Xref: sparky alt.security:5139 sci.crypt:5856
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP v. 2.1 Released
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 9 Dec 92 17:49:39 GMT
 <1992Dec8.095852.4454@memstvx1.memst.edu> <1992Dec8.172944.19370@netcom.com> <Byyp56.265@acsu.buffalo.edu>
Organization: Beckman Instruments, Inc.

In <Byyp56.265@acsu.buffalo.edu> jcmurphy@acsu.buffalo.edu (Jeff Murphy) writes:

>In article <1992Dec8.172944.19370@netcom.com> strnlght@netcom.com (David Sternlight) writes:
>>
>>I don't understand the comment that "if you're living in the U.S.A.
>>you probably shouldn't be using it" (pgp2.1). I thought it was o.k.
>>for personal, educational, or research use, and only an infringement
>>if used commercially without permission of PKP.
>>
>>Can anyone clear this up once and for all?

>	yes. the algorithm employed in PGP is patented, and PKP
>(from what I have gathered) does not have permission to use it. Therefore,
>it is techically illegal to use the program...

>hope this helps

Well, the patent may be invalid, and it may not cover the algorithms uses
in PGP (if it does, it is IMHO too broad), and PKP (the patent holder),
although they claim to license anyone in the US to use it for a nominal
fee, refuse to license Zimmerman or the current updater of PGP.

However, it appears to be illegal to use the program in the US.
--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
Newsgroups: alt.security,sci.crypt,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP v. 2.1 Released
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Sat, 19 Dec 1992 05:57:31 GMT

In article <1992Dec19.000624.9746@news.cs.indiana.edu> Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu> writes:
>Thus said strnlght@netcom.com (David Sternlight):
>>Marc VanHeyningen posts an otherwise sensible message in which he
>>characterizes the protections ripem sites will have as "CYA games."
>>This constitutes both mind reading and the imputation of motives,
>>neither of which can, I think, be supported.
>
>David Sternlight posts a message in which he asserts that I am guilty of
>"mind reading".  It is in fact David Sternlight who is guilty of mind
>reading, since he is assuming that I merely am making guesses and have
>not been in touch with the people involved with setting up the RIPEM
>distribution server.
>-- 
It is not mind reading to suggest that a public slur should carry
some evidence. This is particularly true since there are several
possible ripem servers under consideration and unless Marc has been
in touch with them all, he's making it up as he goes along.

Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP as a World Standard
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Fri, 18 Dec 1992 20:22:05 GMT


In response to Vesselin Bontchev (who unlike many who sound off
here seems to have done some work on PGP2.0 and thus deserves
extra respect):

Since my position is an ethical one, not a legal one, for Vesselin
to say that "what is written in the docs doesn't matter" "you must
PROVE" they copied from a wrongful (PGP1.0) source comes with ill
grace. The docs amount to a confession which, from an ethical
point of view is all that's necessary.

Next he raises the law professor's post. Apparently he has not yet
received and read my extended response. The Professor doesn't have
a leg to stand on, since he argues, in effect:

It is a wrong but they might not get you for it.

Commit a crime and don't worry about it unless the police catch
you.

and similar pinnacles of ethical thinking.

The above is a crude summary of my response--before responding to
the summary, read the response in detail.

David
Xref: sparky alt.security:5159 sci.crypt:5896 talk.politics.guns:25440 talk.politics.misc:64826
From: jbuck@forney.berkeley.edu (Joe Buck)
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc
Subject: Re: PGP as a World Standard
Date: 18 Dec 1992 20:36:23 GMT
Organization: U. C. Berkeley
NNTP-Posting-Host: forney.berkeley.edu

In article <BzGy1v.16p@news.cso.uiuc.edu> StarOwl@uiuc.edu writes:
>Does it matter?  Remember this is the good ol' U.S. of A. (*ahort*),
>where the Supreme Court has said that it's ok for law enforcement
>officials to kidnap foreign nationals abroad and bring them to
>trial in the U.S. for violations of U.S. law.

Just an update for those who haven't heard: the foreign national who
was kidnapped has been freed and returned to Mexico.  The case against
him was tossed out for lack of evidence: the US gov't had nothing to
back up their accusations that the doctor who was kidnapped had anything
to do with the torture and killing of the American DEA agent, so the
judge threw them out of court.  It appears that the lower-level judges
are still somewhat honest even if the Supreme Court has been taken over
by "anything the executive branch does is fine" ideologues.

Then the prosecutors tried to get the poor guy held on the grounds that
he was an illegal immigrant!  (He was KIDNAPPED to bring him into the
US and he's being charged with being an illegal immigrant).

He's back in Mexico and here's the latest: now the US gov't has officially
asked the Mexicans to prosecute him!



--
Joe Buck	jbuck@ohm.berkeley.edu
Newsgroups: alt.security,sci.crypt
From: karn@servo.qualcomm.com (Phil Karn)
Subject: Re: The Boy Who Cried Wolf
Organization: Qualcomm, Inc
Date: Sat, 19 Dec 1992 04:48:29 GMT


While you're listing the politically motivated uses of the export control
system, don't forget to include Bush's approval of the F-15 and F-16 sales
to Saudi Arabia and Taiwan. They just happened to occur while he was
running for re-election, and were announced during campaign stops to
the companies that make them.

You fail to understand the true purpose of export controls. It's not
to keep dangerous weapons out of the hands of third world dictators.
No, the real purpose is to give a sitting president a way to buy votes
without having to use tax money (although he also exercised *that*
option, as in Florida and Louisiana.)

When you begin to analyze the export controls in the light of the
executive branch amassing as much political and economic power as it
possibly can, they start to make a lot more sense. They certainly
don't make much sense if you only look at their stated purpose.

Phil
Newsgroups: alt.security
From: marconna@imag.imag.fr (patrice de-marconnay)
Subject: login with the face
Keywords: face identification, protection, security
Organization: Institut Imag, Grenoble, France
Date: Wed, 16 Dec 1992 15:01:04 GMT

Hi,
I am looking for any information on automatic identification of users by looking at their face with a camera.

Do you have any information about this ?
Xref: sparky alt.security:5065 sci.crypt:5668 talk.politics.guns:25198 talk.politics.misc:64184 alt.security.pgp:167
From: rlglende@netcom.com (Robert Lewis Glendenning)
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
Subject: PGP as a World Standard
Date: 14 Dec 92 18:54:00 GMT
Article-I.D.: netcom.1992Dec14.185400.29644
Organization: Netcom - Online Communication Services  (408 241-9760 guest)

If PGP is to become a world standard, given RSAREF, import/export
restrictions, RIPEM, etc., then:

1) Somebody in Europe needs to re-design PGP to use RSAREF, or an equivalent
non-RSA algorithm.

I don't think their are non-RSA PK algorithms on the horizon which are proven.

2) Somebody in Europe needs to reverse engineer the RSAREF functionality.
Given that the whole world has re-implemented RSA itself, this shouldn't
be too big a deal.

So, the US can import PGP without any RSA PK code, and get the RSAREF
from a legitimate source.

Then, us poor subjects of US law can license RSA (large corporations) or use
RSAREF (individuals), and still correspond with a compatible PGP around
the globe. 

This doesn't seem hard, but of course I am not in Europe being charged
with doing the new work.

Lew
-- 
Lew Glendenning		rlglende@netcom.com
"Perspective is worth 80 IQ points."	Nils Bohr (or somebody like that).
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu>
Subject: Re: PGP v. 2.1 Released
Followup-To: alt.security.pgp
X-Quoted: 34%
Organization: Computer Science Dept, Indiana University
Date: Mon, 14 Dec 1992 10:12:38 -0500

Thus said neuhaus@vier.informatik.uni-kl.de (Stephan Neuhaus (HiWi Mattern)):
>Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu> writes:
>
>>Unfortunately, it's
>>possible that a distributor could be found responsible if someone
>>outside the U.S. gets the code from him.
>
>That is precisely the reason why I oppose the PEM RFCs.  There is no
>way that a worldwide software distribution can be created that uses
>RSAREF, without it violating export laws.

Perhaps you have read different PEM RFCs than the ones I read.  The ones
I read did not make any reference to RSAREF.  In fact, I think they were
written before RSAREF came out.

>And how good is an Internet standard if it's US-centric?  The Internet
>consists of more than the US.

There is nothing about the RFCs that is inherently US-centric.  There
are export laws regarding implementations of cryptography that follow
the RFCs (or, for that matter, that don't.)

There also is no reason that PGP couldn't have followed (at least
vaguely) the RFCs.  It doesn't.  My understanding is that the author
deliberately decided to do this because he didn't like the PEM system,
although I don't know this for sure.

>Please RSADSI and PKP, consider that, too.  You might force all US
>netters to use RIPEM, but the rest of the world will probably use PGP.

RSADSI and PKP don't make U.S. export law.  With regard to export law,
PGP and RIPEM are no different.

Really, with regard to "the rest of the world" the only difference is
that PGP has already been successfully smuggled out of the U.S., while
RIPEM has not (yet).  It's entirely possible that, within hours of its
release, RIPEM will mysteriously appear on FTP sites in Italy and
Finland.  I won't do it, but someone may well.
-- 
Marc VanHeyningen    mvanheyn@whale.cs.indiana.edu    MIME & RIPEM accepted


Patriotism is, in fact, the *first* refuge of the scoundrel.
Xref: sparky alt.security:5154 sci.crypt:5880 alt.security.pgp:288
From: mathew <mathew@mantis.co.uk>
Newsgroups: alt.security,sci.crypt,alt.security.pgp
Subject: Re: PGP as a World Standard
Date: Fri, 18 Dec 92 15:24:21 GMT
Distribution: world
Organization: Mantis Consultants, Cambridge. UK.

[ Removing talk.politics.guns from the newsgroups line; I'm sure they've had
  enough of this. ]

strnlght@netcom.com (David Sternlight) writes:
> mathew argues as if PGP was some European invention we have a problem
> with in the U.S.

Not at all.  I don't give a flying **** where PGP was created or invented. 
It could be written by Martians for all I care.

The point I am making is that whoever wrote it, *you* in the US are the ones
who have a problem with it, and so *you* are the ones to sort out the
problem.

> Read my lips. PGP1.0 was contraband in the U.S., so much so that the
> author pulled out. It was illegally exported.  PGP2.0 was based on it.
> Thus the Europeans who use it don't have clean hands, regardless of
> the state of the law there.

That's utter nonsense.  US law applies in the US and nowhere else.  I am not
a criminal for using PGP in contravention of US patent law, any more than I
am a criminal for blaspheming in contravention of Islamic law.

Your country's laws are your problem, and they do not apply to me unless my
country has agreed to have similar laws.  And it hasn't yet, although you and
your lawyer friends are trying to shove software patents down our throats in
the form of the GATT treaty.

I obtained PGP 2.1 from a site in the UK, who I assume got it from Italy. PGP
does not use any techniques which are patented in the EC.  The copyright and
license say I'm allowed to copy it and use it.  As far as I know there are no
restrictions on exporting encryption software from Italy to the UK, nor on
importing it from Italy to the UK. Therefore I have a perfect right to use,
distribute and advocate PGP.  And it doesn't matter who wrote it or where it
was written.  Another strawman on your part, I think.


mathew
-- 
"Even the most bizarre of the unions (probably that between a cat's gall
 stone and a single note 'G' from CNN's ident theme) managed to convey a
 sense of rampant impropriety."  -- 'Fortran Five', Simon G. Lawrence Leonard

Newsgroups: alt.security,sci.crypt
From: jbuhler@owlnet.rice.edu (Jeremy Daniel Buhler)
Subject: PKP actions?
Keywords: PKP litigation
Organization: Rice University
Date: Thu, 17 Dec 1992 19:18:31 GMT

Just out of idle curiosity, what legal action (ie suits, motions for 
injunctions, etc) has PKP taken since its creation against PGP or any other
PK software for that matter?  Please list the case refs so that I could look
'em up in a law library.  Thanks.
						 

-- 
<      Jeremy Buhler        * In real life: jbuhler@owlnet.rice.edu >
< Rice U., Houston, TX, USA * Ceci n'est pas une .sig - zut alors!  >
< All opinions expressed herein are my own and should not be in any > 
<     way construed to represent the views held by Jeremy Buhler    >
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: StarOwl@uiuc.edu (StarOwl)
Subject: Re: PGP as a World Standard
Originator: mda46419@uxa.cso.uiuc.edu
Reply-To: StarOwl@uiuc.edu
Organization: Actuarial Science Program at UIUC
Date: Fri, 18 Dec 1992 18:58:40 GMT

charlie@umnstat.stat.umn.edu (Charles Geyer) writes:

>Do you seriously believe that a court outside the U. S. of A. would buy
>that nonsense?

Does it matter?  Remember this is the good ol' U.S. of A. (*ahort*),
where the Supreme Court has said that it's ok for law enforcement
officials to kidnap foreign nationals abroad and bring them to
trial in the U.S. for violations of U.S. law.
--
Michael D. Adams       (aka StarOwl)	| Of all sexual aberrations, chastity
StarOwl@uiuc.edu       (NeXT mail OK)	| is the strangest. -- Anatole France
anon.46@pax.tpa.com.au (anonymously)	|------------------------------------
an692@anon.penet.fi    (anonymously)	| NBCS: B1f+t-w+g+k++s+me+h-qv	     

Yes, that was sarcasm if you couldn't guess....


-- 
Michael D. Adams       (aka StarOwl)	| Of all sexual aberrations, chastity
StarOwl@uiuc.edu       (NeXT mail OK)	| is the strangest. -- Anatole France
anon.46@pax.tpa.com.au (anonymously)	|------------------------------------
an692@anon.penet.fi    (anonymously)	| NBCS: B1f+t-w+g+k++s+me+h-qv
From: russotto@vnet.ibm.com (Matthew T. Russotto)
Date: Fri, 18 Dec 92 09:14:10 EST
Newsgroups: alt.security
Subject: Re: PGP v. 2.1 Released
Disclaimer: This posting represents the poster's views, not those of IBM
News-Software: UReply 3.1

In <1992Dec18.072702.659@rose.com> robert heuman writes:
>Date Entered: 12-18-92 02:15
>kyle@uunet.uu.net (Kyle Jones) replied:
>
>K(> Unless you do something that aggravates our authorities enough,
>K(> in which case they will come across the border and get you.
>
>In which case they will have to kidnap me and be subject to
>extradition to Canada for violation of Canadian LAW. Of course, then
>the RCMP could go into the US and get the authorities who came and got
>me, to bring them back here... and remember, they always get their
>men... BTW, this happened to some US bounty hunters.  They kidnapped
>someone in Ontario wanted in the US and took him back.  They were
>extradited and convicted.  Still in Kingston Pen, if I remember...

They'll also have violated US law...  Canada had better lawyers than
Mexico when the extradition treaty was drawn up.  (probably the reason
those bounty hunters were extradited-- you won't see any bounty hunters
being extradited to Mexico....)
Newsgroups: alt.security
From: "dave iwankow" <dave.iwankow@canrem.com>
Subject: luc - test
Reply-To: "dave iwankow" <dave.iwankow@canrem.com>
Organization: Canada Remote Systems
Distribution: alt
Date: 15 Dec 92 16:36:48 EST

To: grhiggie@ccu1.aukuni.ac.nz

MGRH>  Newsgroup: alt.security
MGRH> Message-ID: <1992Dec15.024950.18668@ccu1.aukuni.ac.nz>
MGRH>    Subject: LUC - test

MGRH>This is a test to see if it works

MGRH>---
MGRH> * PCB/UseNet Gateway from Sparkware #1


MGRH>HEADER:USENET

MGRH>Path: dosgate!canrem!uunet.ca!uunet!wupost!waikato.ac.nz!aukuni.ac.nz!grhi
MGRH>Newsgroups: alt.security
MGRH>Subject: LUC - test
MGRH>Message-ID: <1992Dec15.024950.18668@ccu1.aukuni.ac.nz>
MGRH>From: grhiggie@ccu1.aukuni.ac.nz (Mr. Gavin R. Higgie)
MGRH>Date: Tue, 15 Dec 1992 02:49:50 GMT
MGRH>Organization: University of Auckland, New Zealand.
MGRH>Summary: LUC test
MGRH>Lines: 2

Coming in loud and clear here in Canada!
---
  OLX 2.2  3:14 pm  12-15-92 Oakville, Ontario. Canada
--
Canada Remote Systems  - Toronto, Ontario
World's Largest PCBOARD System - 416-629-7000/629-7044
Xref: sparky alt.security:5110 sci.crypt:5788 talk.politics.guns:25357 talk.politics.misc:64654 alt.security.pgp:237
From: strnlght@netcom.com (David Sternlight)
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
Subject: Re: PGP as a World Standard
Date: 17 Dec 92 17:03:26 GMT
Organization: Netcom - Online Communication Services (408 241-9760 guest)


Ross Anderson correctly points out that New Zealand isn't part of
Europe. Others have caviled at my use of the term "stolen goods."

These are all legalisms. The point i was making has to do with the
notion of "clean hands." If one creates PGP1.0 in the U.S. as
a violation of somebody's ownership/patent rights, it is 
"contraband" (like that word better for those who quibble to
make what is clearly unethical "right"?). The act of moving
that item to another country where the patents don't apply
(as distinct from programming from scratch in that country)
doesn't alter the fact that the item is tainted. Using that
code in the other country to create a later (2.0) version
(as distinct from programming 2.0 de novo) doesn't change
that the pro0duct is still tainted.

Clearer, now.

David
Xref: sparky alt.security:5172 sci.crypt:5921