From: rja14@cl.cam.ac.uk (Ross Anderson)
Subject: The Boy Who Cried Wolf
Organization: U of Cambridge Computer Lab, UK
Date: Fri, 18 Dec 1992 18:31:24 GMT

In article <1992Dec17.124326.17185@infodev.cam.ac.uk>, I wrote:

>(2) If you don't live in the USA, US law doesn't apply and so neither
>    the ITAR regulations or the RSA patents have any force.
 
Jyrki Kuoppala replied:

|> Also, the COCOM regulations are relatively succesful at implementing
|> the U.S. ideas of what export is legal and what is not in many
|> countries.  Some years ago a couple of people were charged with
|> treason in Finland for exporting old VAXen (computers, not vacuum
|> cleaners) to the Soviet Union, because of the export regulations.
|> (they were not convicted, though, I think).

Why are the Americans so stupid? An international arms technology control 
regime which worked would be a good thing, and COCOM is the nearest there
is to it. But Washington has shot its credibility to bits, by abusing it
again and again for trade protection and other trivial purposes. 

I recall two cases in particular (there have been many more):

(1)	Sir Clive Sinclair used to have a firm here in Cambridge making 
	cheap home computers. He got an order for about a million of them
	from Eastern Europe (this was about 1984 or 85). No way, said
	the US embassy in Paris (which manages COCOM); you can't sell
	anything containing a Z80 microprocessor to the commies. No Siree.

	The following month, Commodore came along and stole the order. They 
	had no difficulty at all getting US (sorry, COCOM) licences. Shortly 
	afterwards, Sinclair got taken over by Amstrad and closed down. 
	Goodbye to a few thousand jobs in Cambridge and at the assembly plant 
	in Scotland.

(2)	Cryptech in Brussels was Europe's main producer of DES chips. They
	exported a lot - the Belgian government is traditionally very relaxed
	about arms exports. So after the US put sanctions on South Africa,
	and about six companies there (predictably) started making crypto kit, 
	a number of them used Cryptech chips.

	All of a sudden, in 1990, US crypto kit flooded into South Africa, 
	and despite protests from Cryptech's OEMs to the State department, 
	the Bush government would not enforce US law and stop the trade. 
	Some say this was a deliberate play by the NSA to nobble the emerging 
	South African industry. Others say it was just IBM and Racal cutting 
	corners to make a few more sales, and being covered by pals in 
	Washington.

	Last year Cryptech went bust. Its assets were bought by a German 
	firm, Utimaco, and I just wish them better luck.

So is it at all surprising that when the US asks China not to sell missiles
to Iraq, the answer is `get stuffed'?

If it's crazy to endanger your missile components and nuclear materials 
control in order to win a few more sales for a US company, then it's also
crazy to endanger it in order to wave a stick at people who write and 
distribute crypto software.

Hopefully the new administration will be a bit less shortsighted, and take
crypto products off the munitions list. All computer and telecomms products, 
for that matter. If they don't, then we'd probably better tear up COCOM and 
replace it with something which isn't administered out of a US embassy,

Ross
Newsgroups: alt.security,alt.security.pgp,sci.crypt