Mozilla Firefox Not In Violation of US Export Rules

darthcamaro writes "While the internet may know no borders, the US government does. There are a number of rules that affect software vendors, including encryption export regulations from the US Department of Commerce and export sanctions by the Department of Treasury. But what do you do when your application is open source and freely available to anyone in the world? Do the same the rules apply? It's a question that Mozilla asked the US government about. The answer they received could have profound implications not just for Firefox but for all open source software vendors. 'We really couldn't accept the notion that these government rules could jeopardize the participatory nature of an open source project, so we sought to challenge it,' Harvey Anderson, VP and General Counsel of Mozilla, told InternetNews.com. 'We argued that First Amendment free speech rights would prevail in this scenario. The government took our filing and then we got back a no-violation letter, which is fantastic.'"

Comments

This is a common problem for OSS

[MichaelSmith]

Why else would OpenBSD be distributed from Canada? And contributions of crypto code from the USA are very carefully checked IIRC.

What we obviously need:

[Hurricane78]

A virtual country to own virtual propery, including software as this. A country which by definition has no rules of any kind, and is outside of every jurisdiction, because you can't sue or attack anyone from it. It would work like an encrypted multi-mirrored darknet. Every real server participating, would store a set of "random noise" data blocks on his systems. Nobody could decrypt it, including that server. Only people inside the darknet with access to their private block could. Nobody could delete it, because there would always be at least 3 copies, floating in the darknet, encrypted differently, so that you would not be able to know that they contain the same data.

As an easter egg it would contain a honeypot, which would contain only one short sentence: "NOW WHAT, BITCHES?" ;)

this has been known for years

[Pretzalzz]

This is why the non-US archive for Debian went away.

Prior to the release of Debian 3.1, United States laws placed restrictions on the export of certain defense articles, which, unfortunately, included some types of cryptographic software. PGP and SSH, among others, fell into this category. It was legal however, to import such software into the US.

To prevent anyone from taking unnecessary legal risks, some Debian packages were only available from a site in Leiden, The Netherlands, until the release of Debian 3.1, which incorporates this software thanks to changes in United States law.

You should not need the non-US archive unless you are using a version of Debian from before Debian 3.1.

Debian 3.1 corresponds to 2005. I'm amazed that Mozilla was unaware of this and needed to ask someone.

What the heck is going on today?

[MoxFulder]

Did someone not tell me? Is it Government Does The Right Thing Day today???

So far we have, in succession, on Slashdot:

• a bill introduced that would limit warantless wiretapping and remove retroactive immunity for spying telecoms,
• the FCC set to introduce net neutrality regulations, and now
• the U.S. government takes an entirely reasonable stance on crypto exports, without having its arm twisted

Not bad for one day. The cynic in me assumes all this is going to be reversed tomorrow... :-p