Elsewhere someone stated that he couldn't publish his crypto software on the Internet, because US Export Regulations require approval, if the key size is greater than 56 bits. I know that several decades ago there were such extremely rigorous restrictions. Could anyone kindly check whether that indeed remains so even today?
First of all, this is not legal advice. However, I've been in the unfortunate position where I've had to deal with this legal nightmare. The new agreement which regulates export of cryptography internationally is called the Wassenaar Arrangement. If your product is what is called a mass market product, i.e available for purchase to the general public without restriction, you can ignore any export restrictions. You can also skip this if your software is open source and available for free for everyone. There's more exclusions such as if your only use is in DRM , if the input to the cryptographic algorithms can no be changed.
If you restrict your sales to a select subset of customers or if your product is exclusionary in some attribute, e.g price is too high to be considered mass market, you need to contact your local government body responsible for Wassenaar compliance.
The section you would be interested in is DUAL-USE LIST - CATEGORY 5 – PART 2 – "INFORMATION SECURITY".
If you feel you might fall under this arrangement it's best to follow the following rules:
If you do not follow these rules you will come under control of the government body responsible for Wassenaar compliance. Which is extremely likely to become a huge bureaucratic burden on your organization as export controls are extremely poorly set up to deal with things like software where you may have many thousands of customers. It is best to avoid it unless cryptography is an integral part of your product. Most companies and individuals are unaffected by the arrangement as it tries to be narrow enough to only capture the companies which trade with foreign governments.
If your system does any sort of cryptoanalytic work it's generally considered even more sensitive and your odds of being in export controlled territory increases.
|show 2 more comments|
The Wikipedia section referenced by @Thomas says:
Furthermore the commerce control list published by BIS states the following (p. 1):
so the answer to your question is no. Still programmers and researchers publish papers and code online all the time without BIS permission.
Taking the advice of @rath, I asked EFF with the question formulated in my comment to his post with the addition whether the US scientists doing online crypto publications could, at time points arbitrarily chosen by the authority, be accused of violation of the Export Regulations, or if it is juridically fully ensured that this could never happen. I have just obtained form EFF's Legal Intake Coordinator the following rather disappointing (though in some sense also rather interesting) answer: