SA Government's Crypto Registration Up And Running

orange writes "Anyone who supplies crypto products to South Africans (and the government defines crypto as almost anything) has to register with the appropriate agency and pay a ZAR2000 fee (US$200). Failure to supply South Africans without being registered means potential jail time (How they're gonna get you unless you come to South Africa is another story). A copy of the legislation can be found can be found online."

Comments

How are they going to get you?

[gmhowell]

There are these things called 'extradition treaties'. I have no idea what the nature of one (if any) between {US|CA|UK|DE|etc.} and SA is, but it might exist.

Re:How are they going to get you?

[f97tosc]

US/South Africa treaty

Tor

Re:How are they going to get you?

[tomhudson]

Most extradition treaties only allow for extradition where the offence is an offence in the host country.

For example, if you, an American citizen, kill someone in south afric, you can be extradited to south africa because killing someone is a crime in both countries (some conditions apply: see CIA, etc... for exceptions).

However, if you, an American, are accused of the "crime" of "thinking bad thoughts about despot ruler tyrant so-and-so", this is not a crime in America, so any extradition request will be ignored. Or laughed at. Or both.

Re:How are they going to get you?

[slipgun]

Which is why the European arrest warrant is so dangerous. I don't know if it made the american papers, but about 6 months ago there was a row because some Brits, on holiday in Greece, had been handed down sentences of about a year for... planespotting. Now, if they had made it back to Britain, Greek's extradition request would have been lauged at. But because of the wisdom of Our Great European Leaders, any British citizen could now receive a knock on the door at 3am and be hauled away to Greece to face the charge of planespotting. The British Courts would have no say in it, and the fact that planespotting is perfectly legal in Britain is irrelevant.

(No offence intended to Greeks, just using this to highlight the dangers of the European arrest warrant).

Re:How are they going to get you?

[User 956]

Remember, this is the same country whose leader believes that HIV does not cause AIDS. Their leaders (and by default, government) are quite obviously insane.

This, of course, in stark contrast to our country, whose leader believes that Africans should, under no circumstances, be educated about how AIDS is spread.

This is the same man that believes, down to the letter, in a book that says women and unborn children are property, among other ridiculous assertions

Re:How are they going to get you?

[neocon]

Yup. It's actually even worse than this, because the treaty explicitly prohibits any court review of the extradition. Whereas before the treaty, someone being extradited from Britain to Greece for something illegal in both nations would be entitled to a court hearing to determine (in Britain) if the request was valid, now not only could he be extradited for something not illegal in Britain, this extradition would have to be done immediately and without court review of any sort.

Live in Italy and violate thew (very strict) British libel laws? Go straight to a British courtroom, with no review of this by Italian officials. Put up a web site in England violating the (again quite strict) Italian blasphemy laws? Go straight to an Italian court, even if you've never set foot in Italy in your life.

Hey

[VultureMN]

Let's get a collection to send Theo to South Africa on vacation!

uh-oh.

[penguin_punk]

I just double-checked my logs and it looks like I'll be canceling my winter vacation. Jailtime doesn't appeal to me.

WTF

[tomhudson]

Of course, if you don't supply them with the key, how are they going to proove it's YOUR product that did the encryption in the first place?

love that slashdot grammar

[StuffYourReligion]

Failure to supply South Africans without being registered means potential jail time

OK, I fully expect to fail to supply South Africans with any kind of crypto technology. I also don't expect to be registered. And you're saying I'll go to jail for this? That's crazy!

--
Will I be Boered?

Why language skills matter

[itp]

Failure to supply South Africans without being registered means potential jail time

I don't think that sentence means what the poster intended it to mean.

Ian Peters
itp at ximian dot com

Re:Why language skills matter

[Amazing Quantum Man]

I don't think that sentence means what the poster intended it to mean.

INCONCEIVABLE!!!

What about credit card numbers?

[jc42]

The obvious intent of all this is to make people pay the registration fee for every browser they may have on any machine. Otherwise, if you even accidentally download an encrypted page, i.e., you make a credit-card purchase over the web, you are risking a jail term.

Of course, the obvious thing is for vendors to supply Windows machines that don't have any encryption installed, so that the vendors don't have to pay the registration fee for every sale. This is likely to lead to a situation where credit-card orders are sent unencrypted. The SA spammers will love this.

People keep talking like encryption is some military or law-enforcement topic. But the main use of encryption these days is to prevent the interception of commercial information. The fact that restrictions on encryption will make financial data easily available is not necessarily accidental. The goal could very easily be a desire on the part of the government to have easy access to everyone's financial transactions. Such information has a lot of political uses.

In other news...

[bobdotorg]

JOHANNERGURG (Rueters) - Bazooka Joe was arrested and being held without bail for posession of decoder rings with intent to encrypt.

Where do I send my money?

[grub]

I've added some nifty features to ROT13 and don't want to end up in a South African jail...

Even more terrifying...

[Chastitina]

... is the additional requirement to register all "critical databases":

"The protection of sensitive data is essential for a functioning of a modern society. As stated in the Electronic Communications and Transaction Act, the information that is of importance to the protection of the national security of the country or the economic and social well-being will be declared as critical. All critical databases will be identified and registered with the Department of Communications which includes the details of the database administrator, the location of the database and the general description of the categories or types of information stored in the critical database.The registered information will be treated as confidential. The protection, management and control of critical databases must comply with the minimum standards that might be prescribed by the Minister. The audit will be performed, from time to time either by Cyber Inspectors or an independent auditor to evaluate the compliance."

Given such vague standards for "critical" almost *any* commercial database could be deemed "of importance to the protection of the national security of the country or the economic and social well-being." Amazon.com's database contains names and addresses of persons purchasing "how-to" books on terrorism and building bombs? It's critical! A Pr0n site has kept track of all visitors? Some of them *might* be criminals and dangerous to "social well-being."

Yes, there's also issues with persons living in SA downloading crypto software from foreign companies that haven't registered (are they liable or not?), but most of that is easily bypassed. Just have a visitor bring the "protected" code in on a floppy and distribute it internally.

The database restrictions have much more serious implications...

Re:Even more terrifying...

[0WaitState]

All critical databases will be identified and registered with the Department of Communications which includes the details of the database administrator, the location of the database and the general description of the categories or types of information stored in the critical database.The registered information will be treated as confidential.

Does anyone else realize what a whopping huge security hole this is? Go to one place to learn where all the secrets are! Even if you don't get the db contents (yet), you can infer all sorts of interesting things about organizations and people that show up on the lists. Using as a baseline the sad history of moles in US government security agencies, it shouldn't take much $$ relatively speaking to acquire the lists of secret dbs.

Never Assume

[jasonditz]

that a foreign government can't get you if they really want to.

I'd advise everyone to do a little reading on a man called Gerhard Lauck.

He was/is an avowed neo-nazi who published material relating to his distasteful belief system in the United States (where it is of course perfectly legal, if considered bad form). He exported some of this material to Germany, where it is considered a serious crime.

Obviously the U.S. wouldn't extradite him, because freedom of the press is so important, but unfortunately for him while travelling in another country he was picked up by German authorities and pretty much smuggled acrossed the border to Germany, where he spent several years in prison.

Re:Never Assume

[WilliamX]

He wasn't smuggled across the border. He was arrested in Denmark for hate statements as he was attending a Neo-Nazi convention there, and was, months later and following an appeal all the way to the Danish Supreme Court, extradited to German where he was tried, convicted and served 4 years in German prisons.

It's all about taxes

[vlad_petric]

It's very simple, really - they simply don't get enough money from taxes, so they have to keep inventing new taxes to sustain their budget.

One of the signs an economy is in free-fall.

The Raven

That's *in* SAf, not *to* SAf

[jon_eaves]

When will people read the friggin articles first. Oh, I forgot, this is /. with people having a reading age of about 10, and a concentration span in the nanoseconds.

When I saw it, I nearly had a heart attack, I write freely available Java crypto BouncyCastle.org and thought of the horrible problems that we're going to have keeping SAf off the site.

I spent the 2 seconds actually reading the paragraph at the SAf Gov Site and it says:

All Cryptography Providers providing services or products in South Africa are required to register their services or products with the register maintained by the Department of Communications.

Note, the wording is in.

Re:That's *in* SAf, not *to* SAf

[Twylite]

(3) A cryptography service or cryptography product is regarded as being provided in the Republic if it is provided--
(a) from premises in the Republic;
(b) to a person who is present in the Republic when that person makes use of the service or product; or
(c) to a person who uses the service or product for the purposes of a business carried on in the Republic or from premises in the Republic.