SA Government's Crypto Registration Up And Running

orange writes "Anyone who supplies crypto products to South Africans (and the government defines crypto as almost anything) has to register with the appropriate agency and pay a ZAR2000 fee (US$200). Failure to supply South Africans without being registered means potential jail time (How they're gonna get you unless you come to South Africa is another story). A copy of the legislation can be found can be found online."

Comments

How are they going to get you?

[gmhowell]

There are these things called 'extradition treaties'. I have no idea what the nature of one (if any) between {US|CA|UK|DE|etc.} and SA is, but it might exist.

Re:How are they going to get you?

[neocon]

Yup. It's actually even worse than this, because the treaty explicitly prohibits any court review of the extradition. Whereas before the treaty, someone being extradited from Britain to Greece for something illegal in both nations would be entitled to a court hearing to determine (in Britain) if the request was valid, now not only could he be extradited for something not illegal in Britain, this extradition would have to be done immediately and without court review of any sort.

Live in Italy and violate thew (very strict) British libel laws? Go straight to a British courtroom, with no review of this by Italian officials. Put up a web site in England violating the (again quite strict) Italian blasphemy laws? Go straight to an Italian court, even if you've never set foot in Italy in your life.

WTF

[tomhudson]

Of course, if you don't supply them with the key, how are they going to proove it's YOUR product that did the encryption in the first place?

What about credit card numbers?

[jc42]

The obvious intent of all this is to make people pay the registration fee for every browser they may have on any machine. Otherwise, if you even accidentally download an encrypted page, i.e., you make a credit-card purchase over the web, you are risking a jail term.

Of course, the obvious thing is for vendors to supply Windows machines that don't have any encryption installed, so that the vendors don't have to pay the registration fee for every sale. This is likely to lead to a situation where credit-card orders are sent unencrypted. The SA spammers will love this.

People keep talking like encryption is some military or law-enforcement topic. But the main use of encryption these days is to prevent the interception of commercial information. The fact that restrictions on encryption will make financial data easily available is not necessarily accidental. The goal could very easily be a desire on the part of the government to have easy access to everyone's financial transactions. Such information has a lot of political uses.

It's all about taxes

[vlad_petric]

It's very simple, really - they simply don't get enough money from taxes, so they have to keep inventing new taxes to sustain their budget.

One of the signs an economy is in free-fall.

The Raven

Re:Even more terrifying...

[0WaitState]

All critical databases will be identified and registered with the Department of Communications which includes the details of the database administrator, the location of the database and the general description of the categories or types of information stored in the critical database.The registered information will be treated as confidential.

Does anyone else realize what a whopping huge security hole this is? Go to one place to learn where all the secrets are! Even if you don't get the db contents (yet), you can infer all sorts of interesting things about organizations and people that show up on the lists. Using as a baseline the sad history of moles in US government security agencies, it shouldn't take much $$ relatively speaking to acquire the lists of secret dbs.

That's *in* SAf, not *to* SAf

[jon_eaves]

When will people read the friggin articles first. Oh, I forgot, this is /. with people having a reading age of about 10, and a concentration span in the nanoseconds.

When I saw it, I nearly had a heart attack, I write freely available Java crypto BouncyCastle.org and thought of the horrible problems that we're going to have keeping SAf off the site.

I spent the 2 seconds actually reading the paragraph at the SAf Gov Site and it says:

All Cryptography Providers providing services or products in South Africa are required to register their services or products with the register maintained by the Department of Communications.

Note, the wording is in.