From: strnlght@netcom.com (David Sternlight)
Subject: Re: RSAREF and RIPEM now available via anonymous FTP
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Thu, 7 Jan 1993 09:54:53 GMT

In article <1993Jan07.075317.15435@convex.com> hamrick@convex.com (Ed Hamrick) writes:
>
>The attached information clearly states that publicly available software
>is freely exportable.  There aren't ANY weasel words about types of software.

My reading of the English language seems to be somewhat different
from Ed Hamrick's. His quoted material is shot through with what he
calls "weasel words" and restrictions of all sorts, and is not as
open and shut as he would like to make it seem. Apologies for not
editing more than I've done--I'm only trying to show various
kinds of restrictions in the language. Not all apply to the current
case:

>   Note:  Paragraphs (a)(1) and (a)(2) of this section do not authorize the
>export of data contained in a patent application for purposes of filing and/or
>publishing for opposition abroad.  Such exports are controlled by the U.S.
>Patent and Trademark Office and must be licensed by that office.  See EAR $
>770.10(j).
>
>   Note 1:  See paragraph (1) regarding Government sponsored research covered
>by contractual national security controls and the note following this section
>regarding consulting and training.  Use of General License GTDA is subject to
>the prohibitions of $ 771.2(C) (1), (4), and (9), but not to the other
>prohibitions of $ 771.2 (c).
>
>However, General
>License GTDA does not authorize the release of information from a corporate
>sponsor to university researchers where the research results are subject to
>prepublication review.  See other sections in this part 779 for provisions
>that may authorize such releases without a validated license.  (See Questions
>D(7), D(9), and D(10).)
>   (iv) However, General License GTDA does not authorize the initial transfer
>of information from an industry sponsor to university researchers where the
>parties have agreed that the sponsor may withhold from publication some or all
>of the information so provided.  (See Question D(2).)
>   (vi) The provisions of paragraph (f) of this section will apply if a
>university or its researchers accept specific national security controls (as
>defined in paragraph (f) of this section) on a research project or activity
>sponsored by the U.S. Government.  (See Questions E(1) and E(2).)

>without restriction or delay based on proprietary concerns or specific
>national security controls as defined in paragraph (f) of this section.
>   (ii) Prepublication review by the company solely to ensure that the
>publication would compromise no proprietary information provided by the
>company to the researchers is not considered to be a proprietary restriction
>under paragraph (c)(4)(i) of this section.  However General License GTDA does
>not authorize the release of information to university researchers where the
>research results are subject to prepublication review.  See other sections in
>this part 779 for provisions that may authorize such releases without a
>validated license.  (See Questions D(8), D(9), and D(10).)

>   (iv) However, General License GTDA does not authorize the initial transfer
>of information from a business entity to researchers where the parties have
>agreed that the business entity may withhold from publication some or all of
>the information so provided.

>   (f) Government-sponsored research covered by contract controls. (1) If
>research is funded by the U.S. Government, and specific national security
>controls are agreed on to protect information resulting from the research,
>paragraph (a)(2) of this section will not apply to any export of such
>information in violation of such controls. 

>   (2) Examples of "specific national security controls" include requirements
>for prepublication review by the Government, with right to withhold permission
>for publication; restrictions on prepublication dissemination of information
>to non-U.S. citizens or other categories of persons; or restrictions on
>participation of non-U.S. citizens or other categories of persons in the
>research.  A general reference to one or more export control laws or
>regulations or a general reminder that the Government retains the right to
>classify is not a "specific national security control". (See Questions E(1)
>and E(2).)

>   (g) Advice concerning uncontrolled information.  Persons may be concerned
>that an export of uncontrolled information could adversely affect U.S.
>national security interests.  Exporters who wish advice before exporting such
>information can contact the appropriate Government scientific or technical
>personnel by calling the Bureau of Export Administration at (202) 377-4811.
>
> The exporter should be aware that the
>Department of Commerce maintains controls on exports of technical data that do
>not qualify for General License GTDA as described in paragraphs (a)(1) through
>(a)(3) of this section, including application abroad of personal knowledge or
>technical experience acquired in the United States.  (See also paragraph (g)
>of this section and Question F(1).)

>   Question A(2):   Would the answer differ depending on where I work or where
>I performed the research?
>   Answer:   No.  Of course, the General License would not relieve you from
>any restrictions on publications that your employer or another sponsor of your
>research may have imposed.

>   Question A(4):    The research on which I will be reporting in my paper is
>supported by a grant from the Department of Energy.  The grant requires
>prepublication clearance by DOE:  Does that make any difference under the
>Export Administration Regulations?
>   Answer:    No; GTDA would still apply.  But if you publish in violation of
>the controls you have accepted in the Grant, you will be subject to
>appropriate administrative, civil, and possible criminal sanctions under other
>laws.

> nothing in the Export Administration Regulations relieves you of
>responsibility for conforming to any controls you have agreed to in your
>Federal grant or contract.
>
>   Question C(4):  Even if that research is funded by the Government?
>   Answer:   the export
>Administration Regulations would not release you from any separate obligations
>you have accepted in your grant or contract.

>
>   Question D(5):  Could I properly do some work with him in his research
>laboratory inside the Soviet Union?
>   Answer:  Application abroad of personal knowledge or technical experience
>acquired in the United States constitutes an export of that knowledge and
>experience, and such an export is subject to the Export Administration
>Regulations ($ 779.1(b)(1)(iii) and (2)(iii) and $ 779.2).  Such an export
>must be licensed.  If any of the knowledge or experience you export in this
>way is not covered by general license, you would need a validated license.

>   Question D(9):  I am doing research on high-powered lasers in the central
>basic-research laboratory of an industrial corporation.  I am required to
>submit the results of my research for prepublication review before I can
>publish them or otherwise make them public.  I would like to compare research
>results with a scientific colleague from an East Bloc country and discuss the
>results of the research with her when she visits the United States.  Do I need
>a validated license to do so?
>   Answer:  You probably do need a validated license ($ 779.3(c)(4)).
>
>Section E:  Federal Contract Controls
>
>   Question E(1):  In a contract for performance of research entered into with
>the Department of Defense, we have agreed to certain national security
>controls.  DOD is to have ninety days to review any papers we proposed before
>they are published and must approve assignment of any foreign nationals to the
>project.  The work in question would otherwise qualify as "fundamental
>research" under $ 779.3(c).  Does the GTDA license cover information arising
>during or resulting from this sponsored research?
>   Answer:  Any "export" inconsistent with the controls you have agreed to
>will not qualify for export under GTDA as "fundamental research."

> you may subject yourself to the
>sanctions provided for under the Export Administration Regulations, including
>criminal sanctions, in addition to administrative and civil remedies for
>breach of contract.

>   Question E(2):  Do the Export Administration Regulations restrict my
>ability to publish the results of my research?
>   Answer:  The Export Administration Regulations are not the means for
>enforcing the national security controls you have agreed to.  If such a
>publication violates the contract, you would be subject to administrative,
>civil, and possible criminal penalties under other law.
>
>Section F:  Commercial Consulting
>
>   Question F(1):  I am a professor at a U.S. university, with expertise in
>design and creation of submicron devices.  I have been asked to be a
>consultant for a "third-world" company that wishes to manufacture such
>devices.  Do I need a validated license to do so?
>   Answer:  Quite possibly you do.  Application abroad of personal knowledge
>or technical experience acquired in the United States constitutes an export of
>that knowledge and experience that is subject to the Export Administration
>Regulations ($ 779.1(b)(1)(iii) and (2)(iii), and $ 779.2).  Such an export
>must be licensed.  If any part of the knowledge or experience you export in
>this way is not covered by general license, you would need a validated
>license.
>

>information contributed to an electronic bulletin board?
>   Answer:  Assume each of the following:
>   1.  Information is uploaded to an electronic bulletin board by a person
>that is the owner or originator of the information;
NOTE CAREFULLY HERE THAT THE OWNER OF THE RSA MATERIALS IS RSA, NOT
AN UNLICENSED INFRINGER.

-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Newsgroups: alt.security.ripem,sci.crypt