Forgot your password?
typodupeerror
Government Mozilla Software United States Technology

Mozilla Firefox Not In Violation of US Export Rules 127

Posted by Soulskill
from the no-news-is-good-news dept.
darthcamaro writes "While the internet may know no borders, the US government does. There are a number of rules that affect software vendors, including encryption export regulations from the US Department of Commerce and export sanctions by the Department of Treasury. But what do you do when your application is open source and freely available to anyone in the world? Do the same the rules apply? It's a question that Mozilla asked the US government about. The answer they received could have profound implications not just for Firefox but for all open source software vendors. 'We really couldn't accept the notion that these government rules could jeopardize the participatory nature of an open source project, so we sought to challenge it,' Harvey Anderson, VP and General Counsel of Mozilla, told InternetNews.com. 'We argued that First Amendment free speech rights would prevail in this scenario. The government took our filing and then we got back a no-violation letter, which is fantastic.'"
This discussion has been archived. No new comments can be posted.

Mozilla Firefox Not In Violation of US Export Rules

Comments Filter:
  • by Cheesetrap (1597399) on Friday September 18, 2009 @08:01PM (#29472963)

    http://xkcd.com/504/ [xkcd.com]

    Oh, and FireFirst? :)

    • Re:Oblig xkcd... (Score:5, Insightful)

      by Cheesetrap (1597399) on Friday September 18, 2009 @08:09PM (#29473025)

      Oh wow... Either /. searches and penalises for the letters f-i-r-s-t appearing in a primary post, or I just got bitchslapped at the speed of light.

      I apologise.

      Also, I should also mention the fact that legislation against encryption is ridiculously counter-productive; if the feds are after someone for any good reason, and that person is a criminal, they aren't going to respect such a restriction if they're already violating more serious laws. If all they succeed in doing is reducing legitimate commercial trade in such products, they're hurting themselves but at the same time improving the market tremendously for illicit dealers (note this observation applies to drugs as well, hmm).

      • Re:Oblig xkcd... (Score:5, Insightful)

        by NoYob (1630681) on Friday September 18, 2009 @08:35PM (#29473163)
        Crypto just takes some smart folks to create it. I get the impression that the US Government doesn't believe that people outside its borders are capable of developing their own.
        • by canuck57 (662392)
          That is why most companies do any crypto work offshore. It avoids this stupid law altogether as it can be freely imported. The result is the best crypto in the world is imported to the US. In fact, I don't trust crypto with origins in the US. You know, NSAKey and all.
      • Re:Oblig xkcd... (Score:4, Interesting)

        by Chris Burke (6130) on Friday September 18, 2009 @09:56PM (#29473543) Homepage

        If all they succeed in doing is reducing legitimate commercial trade in such products, they're hurting themselves but at the same time improving the market tremendously for illicit dealers (note this observation applies to drugs as well, hmm).

        Yeah, that's why the export restrictions were lifted in the late 90s. Because all it was doing was hurting our domestic encryption companies. Back then, when Mozilla was still Netscape, you had to assert that you were in the U.S. or download a version with weaker encryption. Free software that used strong encryption had to be hosted on sites outside the U.S.

        That was over 10 years ago. Now we still have restrictions about exporting to certain not-our-friend countries, but ultimately that's because (despite more cynical interpretations) we know that they can get this technology without our assistance, but that doesn't mean we're going to hand it to them.

        But while that makes sense for some technologies, it doesn't make much sense for a free software browser implementing SSL because for one there are plenty of other SSL implementations out there and for two us not handing it to them only leaves, oh, about a billion others more than happy to allow downloads from Iran.

        So look at that -- perhaps technically against the rules, but practically meaningless, and in the spirit of the law they decided there was no problem. Someone in the Commerce Department was wearing their thinking cap! Good for them, and good for Mozilla.

        • by jonbryce (703250)

          And you could still export it anyway. What you had to do was print out the source code, mail it to someone in Europe and have them scan it in and re-compile it.

          Given that Russian cryptographers are at least as good as American ones, what is the point of it anyway?

          • Not true. Applied Cryptography contains only the weaker version of RSA in sample code (listings in a book, not compiled code) to get around export restrictions. To demonstrate how stupid these laws are, the key length is a constant at the start of the program. If you changed it from 128 to 1024, the book became illegal for export, but you could distribute the book with 128 as the constant and let people outside the USA change it to 1024 when they typed it in without any problems.

            Oh, and the export res

      • Re:Oblig xkcd... (Score:4, Insightful)

        by msimm (580077) on Saturday September 19, 2009 @12:32AM (#29474195) Homepage
        Right, criminals will still use it but the majority of the citizenry wouldn't and who is it the NSA is spying on again?
      • Also, I should also mention the fact that legislation against encryption is ridiculously counter-productive; if the feds are after someone for any good reason, and that person is a criminal, they aren't going to respect such a restriction if they're already violating more serious laws. If all they succeed in doing is reducing legitimate commercial trade in such products, they're hurting themselves but at the same time improving the market tremendously for illicit dealers (note this observation applies to drugs as well, hmm).

        And guns, too, hmm?

    • Re: (Score:3, Insightful)

      by Kjella (173770)

      About the XKCD... munitions yeah, but do you think it's the sort of munitions they'd let you have? The military already got a lot of neat stuff you don't get to play with.

    • by MoxFulder (159829) on Friday September 18, 2009 @09:26PM (#29473423) Homepage

      Did someone not tell me? Is it Government Does The Right Thing Day today???

      So far we have, in succession, on Slashdot:

      Not bad for one day. The cynic in me assumes all this is going to be reversed tomorrow... :-p

      • by steelfood (895457)

        Or it's just an elaborate April Fools joke that the feds are going to spring on us on April 1.

      • Re: (Score:2, Informative)

        by Anonymous Coward

        Change you can believe in. :-)

      • by icebrain (944107)

        The cynic in me assumes all this is going to be reversed tomorrow...

        If similar decisions by the BATFE are any indication, the State department (or whoever decided this) is going to turn around in a year or two and decide that it is export-restricted... and then make Mozilla run around and delete it from every computer outside the US or something.

        Don't get too excited, in other words.

      • by webheaded (997188)
        It's only cynical when you aren't consistently proven right. In that case, you're just....realistic.
    • Re: (Score:3, Insightful)

      by jez9999 (618189)

      I know I'm taking that cartoon way too seriously, but what the hell. The 2nd amendment doesn't guarantee people to right to export arms from the US. :-) US citizens already have the ability to 'keep and bear crypto', WITHIN the US.

      • Re: (Score:3, Informative)

        by TheRaven64 (641858)
        The comic is also wrong. Strong crypto is still illegal to export from the US to any country under arms embargo. It is not illegal to export to other countries (it was until the mid '90s). It used to require an arms export license, and now it doesn't, but it is still regulated and still counts as a munition when exporting to embargo'd countries.
  • free speech (Score:1, Interesting)

    by wizardforce (1005805)

    if firefox is shielded from these export restrictions because of first amendment protection wouldn't any open source implementation of strong encryption also be protected? wouldn't this make those export restrictions very nearly mute?

    • Re: (Score:3, Interesting)

      by X0563511 (793323)

      I think the deal with this is that, being open, everyone is on the same level.

      Not so with closed algorithms.

      Hypothetical: Selling NewCrypto to Russia, would result in Russia having an advantage over China, and China then being pissed at us for it.

      • I think the deal with this is that, being open,

        I don't think this argument was made. The argument made was about freedom of speech. This is very interesting and profound. Speech is protected but different kinds of speech are protected differently. The stereotypical "shouting fire" to cause a panic isn't at all. At the other end, most systems, especially the USA legal system protect political speech very much. Practical proprietary programming where you don't communicate except inside your courporation and to your compiler is probably difficult to

        • by X0563511 (793323)

          Well, I was speaking more of the restriction on crypto export as a whole - and why this would be an exception. I was just discounting the whole Free Speech argument for the sake of a less Utopian reasoning. It is the Government, after all :)

    • by StikyPad (445176) on Friday September 18, 2009 @08:24PM (#29473115) Homepage

      Moot. M-O-O-T.
      n. Of no practical importance; irrelevant.

      Mute is what people wish you'd be. Moot is what you are.

      </nerdrage>

      • by master5o1 (1068594) on Friday September 18, 2009 @08:58PM (#29473277) Homepage
        2. Moot
        n. The founder of 4chan.org
        Synonym: mootle.
      • <pedant>While PP's correction of GP's improper choice of homonym is laudable, the incorrect definition PP provides, and the tacit approval of GP's errant usage that stems from that, are unfortunate. Give PP 1 point, but take away 2 points.

        In some common dialects of English, "moot" and "mute" are closer in sound than are "there" and "they're"; they are homonyms in those dialects.

        However while "moot" can take several different meanings, "Of no practical importance; irrelevant" is not one of them. Th

        • While PP's correction of GP's improper choice of homonym is laudable, the incorrect definition PP provides, and the tacit approval of GP's errant usage that stems from that, are unfortunate. Give PP 1 point, but take away 2 points.

          When you're correcting someone's correction, you really should double-check your assertions to make sure you're not talking crass nonsense, especially if you do it in that tone.

          Your point:

          However while "moot" can take several different meanings, "Of no practical importance; irrelevant" is not one of them.

          Your fault:

          moot, adj.

          2: deprived of practical significance : made abstract or purely academic

          (http://www.merriam-webster.com/dictionary/moot[3] [merriam-webster.com])

          • moot, adj.
            2: deprived of practical significance : made abstract or purely academic
            (http://www.merriam-webster.com/dictionary/moot[3])

            Yet the Webster's New Universal Unabridged Dictionary, 2nd ed, 1983, (Simon and Schuster) has
            moot, a. subject to or open for discussion or debate; debatable.
            Nothing more, nothing less, despite 6 column-inches of small type devoted to the various noun and verb forms of the word, none of which come close to suggesting "deprived of practical significance...."

            Wikipedia has an interesting article on the history of Webster dictionaries [wikipedia.org] that points out

            Throughout the 20th century, some non-Merriam editions, such as Webster's New Universal, were closer to Webster's work than modern Merriam-Webster editions. Indeed, further revisions by Merriam-Webster came to have little in common with their original source

            Looking elsewhere, Google's "define:moot" brings up Prince

            • by Estragib (945821)

              You said it isn't one of them. I showed it is one of them. Your backtracking to say it didn't use to be one of them acquiesces in this.

              Secondly, tangential to my point, but intersecting your new position:

              Etymology: [etymonline.com]

              moot

              1154, from O.E. gemot "meeting" (especially of freemen, to discuss community affairs or mete justice), from P.Gmc. *ga-motan (cf. Old Low Frankish muot "encounter," M.Du. moet, M.H.G. muoz), from collective prefix *ga- + *motan (see meet [etymonline.com] (v.)). The adj. senses of "debatable" and "not worth

              • While it would be easy to counter your last arguments, I am in full agreement with your second conclusion.

                Regards,

    • Re:free speech (Score:5, Informative)

      by Ronald Dumsfeld (723277) on Friday September 18, 2009 @08:47PM (#29473233)

      if firefox is shielded from these export restrictions because of first amendment protection wouldn't any open source implementation of strong encryption also be protected? wouldn't this make those export restrictions very nearly mute?

      Don't people remember what happened with Phil Zimmerman over PGP?

      The munitions classification on encryption software was used against him for posting the PGP source code on Usenet. They really, really wanted to nail him to the wall over that one.

      There was a certain irony in the restrictions on exporting crypto software deemed 'munitions'. You could take the source, publish it as a book in an OCR font (with the page numbers between comment delimiters), and export it anywhere in the world.

      • Re:free speech (Score:4, Interesting)

        by Watson Ladd (955755) on Friday September 18, 2009 @10:08PM (#29473587)
        In fact Phil did just that to bring the code to Canada.
      • by macbeth66 (204889)

        Don't people remember what happened with Phil Zimmerman over PGP?

        Yes. Nothing. There was an investigation and after about three years of wasted tax dollars, no charges were brought. Ya gotta tell the whole story with a lead-in like that!

        I think the whole thing was just a bully tactic by RSA. They didn't like the competition. Especially from an open source project.

    • by giorgist (1208992)
      Sure, can you launder me some money ? Maybe I can buy me a flag for my ship I got some flesh for sale.
      Can you hold my "profits" ?

      What, you gonna have some rules ?
    • by jonbryce (703250)

      Yes it is, due to the First Amendment, and it does make the restrictions very nearly mute except that they already were.

  • So could this be used as a precedent for 'exporting' other decrypting code?
  • by Joce640k (829181) on Friday September 18, 2009 @08:03PM (#29472987) Homepage

    Or some way to break the encryption, eg. they've got the boss of Verisign in their back pocket.

    • Or some way to break the encryption, eg. they've got the boss of Verisign in their back pocket.

      What possible use would having the boss of Verisign in their back pocket be?

      Verisign fulfills a 'trust provider' function by signing people's website certificates. The only use for that would be to have a clean certificate for, say, a typosquatting site.

      • Re: (Score:3, Insightful)

        by Joce640k (829181)

        There's this thing called a "man in the middle attack" - see http://en.wikipedia.org/wiki/Man-in-the-middle_attack [wikipedia.org]
        .

        • Which can be fixed by having your own CA and disabling trust of the sent out list.
          • by cpghost (719344)
            But which no regular users would do, as they trust the public CAs by default (if they even know what that is).
      • What possible use would having the boss of Verisign in their back pocket be?

        Verisign fulfills a 'trust provider' function by signing people's website certificates. The only use for that would be to have a clean certificate for, say, a typosquatting site.

        If you had control of a CA's key — and I think it should be treated as obvious that the NSA could get one — you could write fake certificates. So say someone goes to https://evil.com/ [evil.com] and the government wants to spy. They can order the ISP to secretly log all the traffic, but it's worthless: the traffic is encrypted. You could provide a fake certificate, but then scary warnings would go up about domain name mismatches or whatever. But if you have a recognized CA's key, you can make your own

    • Or some way to break the encryption, eg. they've got the boss of Verisign in their back pocket.

      Um, VeriSign is a US company. All the governments needs is a warrant (and possibly not even that) to get them to hand over the keys. This is hardly a revelation. If you don't trust the US government, you can't trust any company based in the US either, because their executives are not likely to want to get hauled off to jail for not cooperating with law enforcement agencies.

      Besides, SSL is based on stuff like RSA, AES, and so on. The NSA has approved those for use with confidential government data. It

  • by NoYob (1630681) on Friday September 18, 2009 @08:06PM (#29473003)

    However, that exemption is nullified if the source code is distributed to any of the countries on the U.S embargo list, such as Cuba, Iran or North Korea.

    Huh. I didn't realize that Cuba, Iran, and North Korea didn't have any mathematicians or anyone else that is capable of developing their own cryptography. Or that other countries that do not have a problem with those particular countries do not have that expertise either. I guess the US has a monopoly on that talent. It's a good thing that the US Government is embargoing crypto. It worked great for nuclear bomb technology after all!

    • Re: (Score:2, Insightful)

      by Anonymous Coward
      Dude, you forgot the '/satire'.

      The mods are kinda stupid.

    • I didn't realise that Cuba, Iran and North Korea didn't have Internet access. Well, I kind of knew that Iran has/had crippled Internet from filtering, but who doesn't these days?
    • by Chris Burke (6130)

      It worked great for nuclear bomb technology after all!

      Hehe. Nice one.

    • I didn't realize that Cuba, Iran, and North Korea didn't have any mathematicians or anyone else that is capable of developing their own cryptography

      Honestly? They probably don't. None of the encryption algorithms used by the US government are entirely US-made. They are the result of collaboration and review between mathematicians in the US, the EU, and even Russia and China. Even then, there have still been vulnerabilities related to slightly flawed implementations of the algorithms, though the algorithms themselves are (believed to be) sound.

      Of course, that doesn't alter the fact that the embargo is stupid, especially given the fact that all of

    • by BitZtream (692029)

      What? Contrary to what the story says, the US doesn't really prevent export of cryptography software anymore, haven't for years. A clue would be useful for you at this point.

      Now lets look ... doesn't stop export of crypto ... everyone has it.

      Stops export of nuclear research and materials ... not everyone has it, in fact very few do, most of which were our allies at one point.

      I'm sorry wtf was your retarded point? I'm guessing you were trying to imply that we can't stop the world from finding out how to m

      • by s4m7 (519684)

        Your interpretation of the law is inaccurate. ask RSA. [rsa.com]

        and no, not everyone has nuclear technology, but containment of the information, which has been our national security strategy, obviously isn't working, or the news wouldn't be so full of reports of countries happy to show off their newly developed technology. Strangely it's somewhat difficult to keep the laws of nature a secret.

  • by MichaelSmith (789609) on Friday September 18, 2009 @08:08PM (#29473023) Homepage Journal

    Why else would OpenBSD be distributed from Canada? And contributions of crypto code from the USA are very carefully checked IIRC.

    • Re: (Score:3, Funny)

      by Cheesetrap (1597399)

      I could maybe understand this law making sense in the cold war era, and/or as it relates to hardware crypto, but it seems pretty irrelevant and ignorant for them to try and restrict the exchange of digital informa-- I'm sorry, for a second there I was thinking that politicians and legislators actually had a grasp on reality, please excuse my momentary lapse.

      • by Nyeerrmm (940927)

        Can you imagine the political difficulties in trying to reduce ITAR restrictions? Even if a politician does recognize that reform is needed, its unlikely they'll have the guts to do it, since the attack ads are so easy to write. Remember, ITAR stands for International Trade in Arms Restrictions. No one wants to be pro-proliferation.

        We deal with the same things in the space industry, since rockets tend to resemble missiles. ITAR is ultimately a stranglehold on American businesses in a globalized world an

        • Re: (Score:3, Informative)

          by MichaelSmith (789609)

          I work in Aerospace and it is much the same. The loss to US business is not that bad because ITAR extends to any business which deals with the USA. So most external competitors will be subject to the same laws.

          • by feronti (413011)

            The loss to US businesses is in the overhead of ensuring compliance. The cost of non-compliance is incredibly high; my company is currently listed as a restricted company because someone forgot to label some component specs that were covered under ITAR, and those specs then were sent to a non-US company. We now have to waste almost an hour a month on training that basically boils down to "If you're sending something outside the company, make sure to clear it with Trade Compliance first." Not to mention the

    • by Anonymous Coward on Friday September 18, 2009 @08:24PM (#29473111)
      You're right. See their Crypto page. [openbsd.org] In fact, they build their binary releases only in Canada, Sweden, and Germany to avoid ITAR type restrictions.
    • Re: (Score:3, Informative)

      by harmonise (1484057)

      Why else would OpenBSD be distributed from Canada?

      Because the project leader is Canadian. The lack of crypto export laws in Canada is just a bonus.

  • by dan_sdot (721837) on Friday September 18, 2009 @08:17PM (#29473065)
    ... that an innovative business like Mozilla needs to live in fear of the government and nervously await its blessing.
    • It's a natural part of innovation. More entrenched companies don't test these boundaries, and so don't risk running afoul of government red tape.
    • by glitch23 (557124)

      ... that an innovative business like Mozilla needs to live in fear of the government and nervously await its blessing.

      You mean just like regular citizens need to "live in fear of the government" when they break the law? You forget that every country has to have laws whether to protect its own citizens from themselves or from outside entities. There are also laws for corporations. There is no living in fear however. It is called simply "don't break the law" in this case. Other companies don't have issues with the export restrictions. It is a CYA thing related to national security. Would you want to be the person who allowe

  • by Hurricane78 (562437) <deleted AT slashdot DOT org> on Friday September 18, 2009 @08:31PM (#29473135)

    A virtual country to own virtual propery, including software as this. A country which by definition has no rules of any kind, and is outside of every jurisdiction, because you can't sue or attack anyone from it. It would work like an encrypted multi-mirrored darknet. Every real server participating, would store a set of "random noise" data blocks on his systems. Nobody could decrypt it, including that server. Only people inside the darknet with access to their private block could. Nobody could delete it, because there would always be at least 3 copies, floating in the darknet, encrypted differently, so that you would not be able to know that they contain the same data.

    As an easter egg it would contain a honeypot, which would contain only one short sentence: "NOW WHAT, BITCHES?" ;)

    • I felt a great disturbance in the Net, as if millions of anchors were suddenly dropped and it went silent.

    • Re: (Score:3, Informative)

      by evanbd (210358)

      You mean something like Freenet [freenetproject.org]?

      The hard problems for such a network involve things like searching and routing. Freenet isn't exactly fast, but it's worlds more secure than anything else for this sort of thing (even so, it's far from perfect). It's also quite usable for things like browsing freesites (Freenet-hosted websites), and publishing controversial content (though large, unpopular files don't stay around forever, due to limits on disk space (and probably some bugs, but we're working on those)).

      Of c

  • by msauve (701917) on Friday September 18, 2009 @08:32PM (#29473137)
    but that thought, or words on a page, are very simply not munitions, disingenuous government definitions be damned.
    • So, do the blueprints for a nuclear bomb or for an ICBM count as munitions or free speech in your black-and-white world?
      • by msauve (701917)
        It's up to the state to protect the secrecy of such information.

        Once they're out, then it's free speech.

        Not just my opinion. Read up on "prior restraint."
  • Paradox (Score:3, Insightful)

    by gmuslera (3436) on Friday September 18, 2009 @08:33PM (#29473149) Homepage Journal
    Getting an approval by local laws saying that local laws don't apply? Looks pretty much to the liar paradox. Or local laws (as in US country laws, like the ones that forbids exporting crypto) don't apply or apply (like the US country laws that gives the 1st amendment),

    If you want to push that open source projects, developed with the cooperation from people from all countries are not restricted to the laws of a single country, thats ok, no need to put a country-specific 1st amendment to justify it. Else the exporting crypto restrictions could be applied but was made an exception in hat case.
    • by Itninja (937614)

      Getting an approval by local laws saying that local laws don't apply?

      Is that not the entire purpose of the Judicial branch of US Government(tm)?

    • by cpghost (719344)

      Getting an approval by local laws saying that local laws don't apply? Looks pretty much to the liar paradox.

      It's not a paradox if the law specifically says: "You can't do that, unless you get permission."

  • by Pretzalzz (577309) on Friday September 18, 2009 @08:37PM (#29473173)
    This is why the non-US archive for Debian went away.

    Prior to the release of Debian 3.1, United States laws placed restrictions on the export of certain defense articles, which, unfortunately, included some types of cryptographic software. PGP and SSH, among others, fell into this category. It was legal however, to import such software into the US.

    To prevent anyone from taking unnecessary legal risks, some Debian packages were only available from a site in Leiden, The Netherlands, until the release of Debian 3.1, which incorporates this software thanks to changes in United States law.

    You should not need the non-US archive unless you are using a version of Debian from before Debian 3.1.

    Debian 3.1 corresponds to 2005. I'm amazed that Mozilla was unaware of this and needed to ask someone.

    • by Nemyst (1383049) on Friday September 18, 2009 @08:59PM (#29473283) Homepage
      They probably wanted a clear, black-on-white reply that they could present to court or to potential litigators should any threat arise. Better safe than sorry, they say?
    • Re: (Score:3, Interesting)

      by rattaroaz (1491445)

      I'm amazed that Mozilla was unaware of this and needed to ask someone.

      Probably because if they asked Slashdot, everyone would be telling them to quit asking Slashdot and call a lawyer, so that's what they did.

    • They don't need to ask someone, but for open source code there is still a requirement to notify the Department of Commerce's Bureau of Industry and Security. Beyond that notification, no review is needed (and it's just a notification, not a request for permission).
  • Buying hosting in a few countries without this particular silly law isn't difficult. Why waste time with the government? Especially when what they got isn't all that good:

    However, that exemption is nullified if the source code is distributed to any of the countries on the U.S embargo list, such as Cuba, Iran or North Korea.

    • by PhxBlue (562201)

      Buying hosting in a few countries without this particular silly law isn't difficult. Why waste time with the government?

      So they can get a crack at replacing Internet Explorer as the browser of choice for U.S. Government computer systems?

    • by DMiax (915735)
      how do you suggest they put the code on those servers without breaking the law?
  • by bonze (1578437) on Friday September 18, 2009 @09:02PM (#29473307)

    Ho-hum. Unrestricted export of open-source products incorporating encryption from the US has been legal for quite a while. All you have to do is file an application with the Feds under the Export Regs Section 740.13 "TECHNOLOGY AND SOFTWARE -- UNRESTRICTED (TSU)" before you make the source and binaries available, and you don't have to screen downloads or worry if the Officially Designated Bad Guys download your code: your ass is covered.

    This war was won a loooong time ago by Philip Zimmermann [wikipedia.org] when the Feds wanted to crush him for releasing PGP. All props go to Phil!

    • by bonze (1578437)

      Section 740.13 (e) "(6) "Knowledge" of a prohibited export or reexport. Posting of source code or corresponding object code on the Internet (e.g., FTP or World Wide Web site) where it may be downloaded by anyone would not establish "knowledge" of a prohibited export or reexport. See Section 740.13(e)(4) of the EAR for prohibited knowing exports to Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria. In addition, such posting would not trigger "red flags" necessitating the affirmative duty to inquire under

    • by Toad-san (64810)

      Phil didn't win anything for anybody, at least not for a long long time. The Info-ZIP Workgroup went through the same grief back in the 80's when we were trying to back-engineer Phil Katz' ZIP / UNZIP utilities, porting them to virtually every known operating system in the world.

      We got unofficial rumbles from US Customs, NSA, etc. that they would crush our virtual fingers if we dared release source code (and everything in Info-ZIP was full open source) for the ZIP encryption. (PKWare had restrictions too a

  • You had the balls to sue the United States Government. http://export.cr.yp.to/ [cr.yp.to]

  • by Seor Jojoba (519752) on Friday September 18, 2009 @09:23PM (#29473411) Homepage

    "The government took our filing and then we got back a no-violation letter, which is fantastic.'"

    Mozilla basically asked if it would be okay if Mozilla (not you, not me, not everybody else) could put strong encryption in their software. They didn't get a court ruling--they got permission. And there's nothing wrong with that, but it doesn't mean they are some champions of free speech rights. No, it means that they have successfully looked after their own interests. And other, particularly smaller, open source developers shouldn't expect to have the same good fortune in getting permission.

    Not to be too grumpy. It is good news that somebody was exempted from a stupid regulation.

  • I remember sometime back in the dark ages when I upgraded Netscape to 64 or 128 bit encryption and you had to do a song and dance saying "Yes, I live in America" to download the new version. Does the government really think that only the US can come up with tough-to-break encryption schemes?

    • by cheros (223479)

      Does the government really think that only the US can come up with tough-to-break encryption schemes?

      Especially since AES [wikipedia.org] is in principle Rijndael, which is of Belgian origin :-)

  • Huh? I mean seriously what are these Mozilla people talking about?

    Open source projects have been exempted by the US from crypto export restrictions for years.

    See this page:
    http://www.bis.doc.gov/encryption/pubavailencsourcecodenofify.html [doc.gov]

    The only thing an open source admin needs to do is to notify the authorities of the fact that he is making it available for download. That's it.

    I wonder how good the Mozilla lawyers really are...

    • by yuna49 (905461)

      Open source projects have been exempted by the US from crypto export restrictions for years.

      Yes, but not to embargoed countries like Cuba, Iran, and North Korea. Mozilla consulted with the Federal Government after becoming aware of downloads to Iran.

      From TFA, "During a recent Firefox download event, Mozilla posted a map on its Web site showing where downloads were occurring. Anderson said it became clear that a substantial number of downloads were coming from Iran. Mozilla then had knowledge that it was exp

  • NO MONEY ... NO FOUL

    A lot of posters (all of them) are mixing up 2 issues. The problem here is not that the crypto functions were exported from the US. The problem is that US companies are not permitted to do business with, for example, people or companies located with Iran.

    When you make a product available on the internet, even a free one, people download it from all over and this could be considered "doing business" and IP filters are a rather silly way to try to stop it. The more straightforward app
  • The export restrictions were lifted in the late 90s guys, they haven't cared for the past 10 years.

    How the hell did they manage to the get the open source NSS module FIPS certified without anyone at all knowing the export restrictions went away.

    And just curious, does not one remember that at one point they had to have a page up to make sure exports weren't out of the country?

    Seriously, why is this news 10 years after the law changed?

Karl's version of Parkinson's Law: Work expands to exceed the time alloted it.

Working...