From: scs@adam.mit.edu (Steve Summit)
Newsgroups: comp.lang.c
Subject: Re: 1992 International Obfuscated C Code Contest winners
Summary: U.S. export control nonsense
Date: 14 Sep 92 16:44:38 GMT
Article-I.D.: athena.1992Sep14.164438.26697
Followup-To: somewhere else
Organization: none, at the moment

In article <shrchin.716270955@reading>, shrchin@csug.cs.reading.ac.uk (Jonathan H. N. Chin) writes:
> barmar@think.com (Barry Margolin) says:
>> In article <268@talgras.UUCP> david@talgras.UUCP (David Hoopes) writes:
>>> In article <1992Sep10.135002.25527@wraxall.inmos.co.uk> nathan@elberton (Nathan Sidwell) writes:
>>>> As chongo stated, my entry can't be posted from the USA.
>>> Why couldn't your program be posted from the U.S?
>> I haven't examined it, but I'll bet... that posting it from the US...
>> would be a violation of export control laws regarding munitions.
> So what happens now that it has (I assume) entered the US via news?

It's my understanding, based on occasional reading in other
groups (see below), that the U.S. export control laws regarding
munitions are universally regarded as ludicrous by almost
everyone who understands the issues, with the possible exception
of the hypothesized high-level "spooks" in the NSA and elsewhere
who perpetuate them.

Cryptographic software is still defined as a "munition," and
export of munitions is very tightly regulated.  I think there's
an exception in the case of cryptographic software which is
already widely available internationally, but the exception is
not enforced consistently, and I have heard of U.S. authors of
intended-to-be public-domain cryptographic software finding
themselves under the heavy boots of humorless "authorities" who
weren't at all interested in the author's claims that what he was
doing was legal.  Stupid as it sounds, the difference between
chongo receiving some software from Nathan via private e-mail
and then posting it (which chongo didn't do) and Nathan posting
it from the U.K. whence it entered and then again left the U.S.
(which Nathan did do) might well be significant.  Furthermore,
now that Nathan has posted it, Americans might not even have to
worry about distributing it (including via manual means).

Now, I thoroughly agree that it's hard to imagine some G-man
monitoring comp.lang.c and arresting chongo over the IOCCC.
But being under those heavy boots is excessively and
excruciatingly unpleasant, so if Nathan's program really is
"cryptographic software," I don't blame chongo a bit for being
wary, especially since Nathan can post it with impunity.

Unfortunately, in between the people who'd like to see these
things changed, and the people (the aforementioned spooks) who
are apparently in a position to keep them in place, sits a
government, and a public which it represents, both of which for
the most part don't really understand and don't really care, so
I'm pessimistic about the prospects for any real change soon.
(The NSA is allegedly working hard to control the quality of
publicly-available cryptographic software entirely within the
U.S., and by "control the quality" I do not mean "assure that it
is unquestionably of the highest quality possible.")

This obviously has nothing to do with comp.lang.c; I'd encourage
anyone who is curious about these issues to check out a few
groups such as comp.risks, comp.soc.privacy, misc.int-property,
gnu.misc.discuss, sci.crypt, or alt.privacy.  (Don't just
redirect followups to one of these groups; it's an old and
somewhat tired debate there (just as e.g. null pointers are
here)).

					Steve Summit
					scs@adam.mit.edu

P.S. Please don't take any of my comments above on cryptographic
software and/or munitions export controls as gospel; I'm hardly
an authority on these matters.
Xref: sparky comp.lang.c:13246 comp.os.vms:14630