Slashdot Mirror
Mozilla Firefox Not In Violation of US Export Rules
darthcamaro writes "While the internet may know no borders, the US government does. There are a number of rules that affect software vendors, including encryption export regulations from the US Department of Commerce and export sanctions by the Department of Treasury. But what do you do when your application is open source and freely available to anyone in the world? Do the same the rules apply? It's a question that Mozilla asked the US government about. The answer they received could have profound implications not just for Firefox but for all open source software vendors. 'We really couldn't accept the notion that these government rules could jeopardize the participatory nature of an open source project, so we sought to challenge it,' Harvey Anderson, VP and General Counsel of Mozilla, told InternetNews.com. 'We argued that First Amendment free speech rights would prevail in this scenario. The government took our filing and then we got back a no-violation letter, which is fantastic.'"
http://xkcd.com/504/
Oh, and FireFirst? :)
Firefox isn't breaking any laws, and neither am I! I for one decided not to break into a store and steal all of their merchandise. So both me and Firefox are not breaking any laws. What a great day it is to be alive.
if firefox is shielded from these export restrictions because of first amendment protection wouldn't any open source implementation of strong encryption also be protected? wouldn't this make those export restrictions very nearly mute?
Sigs are too short to say anything truly profound so read the above post instead.
So could this be used as a precedent for 'exporting' other decrypting code?
my band is more brutal techno punk than yours
Or some way to break the encryption, eg. they've got the boss of Verisign in their back pocket.
No sig today...
However, that exemption is nullified if the source code is distributed to any of the countries on the U.S embargo list, such as Cuba, Iran or North Korea.
Huh. I didn't realize that Cuba, Iran, and North Korea didn't have any mathematicians or anyone else that is capable of developing their own cryptography. Or that other countries that do not have a problem with those particular countries do not have that expertise either. I guess the US has a monopoly on that talent. It's a good thing that the US Government is embargoing crypto. It worked great for nuclear bomb technology after all!
It's NOT me! It's the meds! I'm on 1000mg of Fukitol.
Why else would OpenBSD be distributed from Canada? And contributions of crypto code from the USA are very carefully checked IIRC.
http://michaelsmith.id.au
... that an innovative business like Mozilla needs to live in fear of the government and nervously await its blessing.
A virtual country to own virtual propery, including software as this. A country which by definition has no rules of any kind, and is outside of every jurisdiction, because you can't sue or attack anyone from it. It would work like an encrypted multi-mirrored darknet. Every real server participating, would store a set of "random noise" data blocks on his systems. Nobody could decrypt it, including that server. Only people inside the darknet with access to their private block could. Nobody could delete it, because there would always be at least 3 copies, floating in the darknet, encrypted differently, so that you would not be able to know that they contain the same data.
As an easter egg it would contain a honeypot, which would contain only one short sentence: "NOW WHAT, BITCHES?" ;)
Any sufficiently advanced intelligence is indistinguishable from stupidity.
but that thought, or words on a page, are very simply not munitions, disingenuous government definitions be damned.
"National Security is the chief cause of national insecurity." - Celine's First Law
Getting an approval by local laws saying that local laws don't apply? Looks pretty much to the liar paradox. Or local laws (as in US country laws, like the ones that forbids exporting crypto) don't apply or apply (like the US country laws that gives the 1st amendment),
If you want to push that open source projects, developed with the cooperation from people from all countries are not restricted to the laws of a single country, thats ok, no need to put a country-specific 1st amendment to justify it. Else the exporting crypto restrictions could be applied but was made an exception in hat case.
Debian 3.1 corresponds to 2005. I'm amazed that Mozilla was unaware of this and needed to ask someone.
I thought this was all sorted out after the PGP fiasco? I wasn't too sure if it was sorted out when us.gov decided that some relevant law had expired, but I definitely thought it was sorted out. After all, debian dropped non-us because of this clearing up.
"Industry and public interest groups lobbied for liberalization, and the Clinton Administration reformed the outdated U.S. export controls on encryption items in a series of graduated steps, culminating the new US Regulations" -- http://www.debian.org/legal/cryptoinmain.
Buying hosting in a few countries without this particular silly law isn't difficult. Why waste time with the government? Especially when what they got isn't all that good:
However, that exemption is nullified if the source code is distributed to any of the countries on the U.S embargo list, such as Cuba, Iran or North Korea.
"Welcome to our world. We are the wasted youth. And we are the future too." Yes, I know these are stupid lyrics.
Ho-hum. Unrestricted export of open-source products incorporating encryption from the US has been legal for quite a while. All you have to do is file an application with the Feds under the Export Regs Section 740.13 "TECHNOLOGY AND SOFTWARE -- UNRESTRICTED (TSU)" before you make the source and binaries available, and you don't have to screen downloads or worry if the Officially Designated Bad Guys download your code: your ass is covered.
This war was won a loooong time ago by Philip Zimmermann when the Feds wanted to crush him for releasing PGP. All props go to Phil!
It's a natural part of innovation. More entrenched companies don't test these boundaries, and so don't risk running afoul of government red tape.
Section 740.13 (e) "(6) "Knowledge" of a prohibited export or reexport. Posting of source code or corresponding object code on the Internet (e.g., FTP or World Wide Web site) where it may be downloaded by anyone would not establish "knowledge" of a prohibited export or reexport. See Section 740.13(e)(4) of the EAR for prohibited knowing exports to Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria. In addition, such posting would not trigger "red flags" necessitating the affirmative duty to inquire under the "Know Your Customer" guidance provided in Supplement No. 3 to part 732 of the EAR."
Just to establish that this is really... not news. Just PR, move along folks, nothing to see here.
You had the balls to sue the United States Government. http://export.cr.yp.to/
"The government took our filing and then we got back a no-violation letter, which is fantastic.'"
Mozilla basically asked if it would be okay if Mozilla (not you, not me, not everybody else) could put strong encryption in their software. They didn't get a court ruling--they got permission. And there's nothing wrong with that, but it doesn't mean they are some champions of free speech rights. No, it means that they have successfully looked after their own interests. And other, particularly smaller, open source developers shouldn't expect to have the same good fortune in getting permission.
Not to be too grumpy. It is good news that somebody was exempted from a stupid regulation.
Did someone not tell me? Is it Government Does The Right Thing Day today???
So far we have, in succession, on Slashdot:
Not bad for one day. The cynic in me assumes all this is going to be reversed tomorrow... :-p
My bicyles
Actually the case you meant to refer to was: http://en.wikipedia.org/wiki/Bernstein_v._United_States
I remember sometime back in the dark ages when I upgraded Netscape to 64 or 128 bit encryption and you had to do a song and dance saying "Yes, I live in America" to download the new version. Does the government really think that only the US can come up with tough-to-break encryption schemes?
Vote monkeys into Congress. They are cheaper and more trustworthy.
Huh? I mean seriously what are these Mozilla people talking about?
Open source projects have been exempted by the US from crypto export restrictions for years.
See this page:
http://www.bis.doc.gov/encryption/pubavailencsourcecodenofify.html
The only thing an open source admin needs to do is to notify the authorities of the fact that he is making it available for download. That's it.
I wonder how good the Mozilla lawyers really are...
The linked article doesn't clearly say so but articles elsewhere state that Mozilla sent their query to and received the no-violation letter from the Department of Commerce.
The problem here is that the Department of Commerce is the authoritative control over Export Administration Regulations (EAR), including the Commerce Control List which Mozilla likely (probably rightly) thought their exports could be considered to be violating, but encryption is (also) controlled under International Traffic in Arms Regulations (ITAR http://en.wikipedia.org/wiki/International_Traffic_in_Arms_Regulations) which is authoritatively administered by the Department of State. It does not matter what pronouncements you have from Commerce, you can still be prosecuted and penalized by State for ITAR violations.
That's not a theoretical-type warning either -- companies been prosecuted by State for ITAR violations and essentially been told 'so?' when they showed State their 'no-violation' letter from Commerce. Perhaps Mozilla's VP should augment the company's General Counsel with an import/export lawyer?
NO MONEY ... NO FOUL
... no money, no foul. Sounds like a good precedent for all kinds of TRADE restrictions.
A lot of posters (all of them) are mixing up 2 issues. The problem here is not that the crypto functions were exported from the US. The problem is that US companies are not permitted to do business with, for example, people or companies located with Iran.
When you make a product available on the internet, even a free one, people download it from all over and this could be considered "doing business" and IP filters are a rather silly way to try to stop it. The more straightforward approach is to "follow the money." In this case, there is no money to follow and
The export restrictions were lifted in the late 90s guys, they haven't cared for the past 10 years.
How the hell did they manage to the get the open source NSS module FIPS certified without anyone at all knowing the export restrictions went away.
And just curious, does not one remember that at one point they had to have a page up to make sure exports weren't out of the country?
Seriously, why is this news 10 years after the law changed?
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Buy some property in Second Life, host it there.
While PP's correction of GP's improper choice of homonym is laudable, the incorrect definition PP provides, and the tacit approval of GP's errant usage that stems from that, are unfortunate. Give PP 1 point, but take away 2 points.
When you're correcting someone's correction, you really should double-check your assertions to make sure you're not talking crass nonsense, especially if you do it in that tone.
Your point:
However while "moot" can take several different meanings, "Of no practical importance; irrelevant" is not one of them.
Your fault:
wtf the us is the dumbest country there ever was