Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I want to ask, is the US export control applicable only to US citizens?
E.g. I think Bouncy Castle are Australians.
Do use of their library fall into export control regulations?
I do not understand this export control

share|improve this question

3 Answers

up vote 4 down vote

As I understand it, if I build it from within the US and sell it to other countries it's under export control.

If I consume someone else's libraries while I am in the US that were built either in or out of the US and sell it to other countries its under export control.

If I consume someone else's libraries that were built in or out of the US and only sell to companies in the US, it's not under export control. However, those who I've sold it to are under export control if they resell the product to an external country.

share|improve this answer
What about open source? – Jim Sep 9 '11 at 16:23
A clarification request. When SteveS says "I", I suspect he means "a US citizen or person in the US or person subject to US jurisdiction", and when he says "export control", I suspect he means "US export control". (In other words, I suspect US export control law doesn't restrict the behavior of an Australian living in Australia.) SteveS, is that right? – D.W. Sep 9 '11 at 17:02
@D.W. I was meaning anyone who created the software while in the US. I wasn't talking citizenship. Updating... – SteveS Sep 9 '11 at 18:36
I am not a US citizen.My country is part of the Wassenaar Agreement.Seems not to control software in public domain – Jim Sep 10 '11 at 7:04
up vote 3 down vote

There are about four relevant concepts:

  • Usage: that's using the system (e.g. running some software which implements the algorithm).
  • Providing: making the system available to someone else. When you put some software on your Web page, you are providing it to whoever will download it.
  • Export: transferring the system outside of the country boundaries. The concept is not very well defined in the context of a worldwide network (the Internet), especially in the presence of peer-to-peer distribution (the data is not on a single specific physical computer).
  • Import: transferring the system into the country from "elsewhere".

Export control is a set of rules about exporting. If you are in the US and are downloading BouncyCastle from a server in Australia, then you are importing it, and thus you are theoretically subject to the US import rules. The people operating the Australian server, on the other hand, are subject to the Australian export rules. Also, those Australians are also providing the system to you.

Where the library was designed and/or compiled is irrelevant to import/export regulations; what matters is when the software crosses a border. At that time, the applicable laws are the export rules from the source country and the import rules from the destination country. Generally speaking, US rules are lenient about import, but still have a few requirements for export.

See this site for a thorough survey of cryptographic regulations around the world.

share|improve this answer
If I, who am a non-US citizen publish open source code that uses e.g. Bouncy Castle, am I under export control or not? – Jim Sep 9 '11 at 16:32
2  
Citizenship is not relevant to export regulations. If you publish code which uses Bouncy Castle, then you are providing your code and, if the publication is on a Web page accessible from the whole world, you are actually exporting it, too, from wherever the archive is. If you also provide Bouncy Castle (e.g. it is statically linked in a compiled binary you provide, or you simply make it available on your Web page), then you are also exporting that. – Thomas Pornin Sep 9 '11 at 16:41
2  
Or, just to be clearer, US export rules apply to your software if a copy of your software is physically in the US (on the harddisk of a server in the US) and you push it through the frontier (making it available on a public Web page is sufficient to qualify as such a "push"). If the software is not in the US then US export rules do not apply, because they only are about things which are leaving the US, not those which are already outside. – Thomas Pornin Sep 9 '11 at 16:44
So, if I upload the code to a server in US, then I am under export control restrictions? – Jim Sep 9 '11 at 17:01
@Jim, yes, as far as I know, that is correct. (I am assuming you are not a US citizen, you are not physically present in the US, and there is no particular reason why the US would have jurisdiction over you: you're not a company that is incorporated in the US, for instance.) If you need greater certainty, you may need to contact a lawyer. – D.W. Sep 9 '11 at 17:05
show 5 more comments
up vote 1 down vote

I want to ask, is the US export control applicable only to US citizens?

No, if you are working for a US company and produce a work for that company, the work is subject to US export control.

E.g. I think Bouncy Castle are Australians. Do use of their library fall into export control regulations?

I do not think it would fall under US export control if

  • You are not a US citizen or lawful permanant resident
  • You are not working for, partnering with, or otherwise cooperating with a US company
  • None of it was concieved of, designed, implement, document, or modified by a person who is a US citizen, lawful US permanant resident, or in a business relationship as described in the previous point

In short if it was made entirely outside the US by people who are unafillited with the US or US business then it would not be subject to US export regulations.

I do not understand this export control

Not many people do.

NASA has a good presentation http://oiir.hq.nasa.gov/nasaecp/Webbrfg/sld001.htm The introduction describes export as a transfer of anything to a 'foreign person' by any means, anywhere, anytime.

Basically if there is knowledge, technology, or artifacts that the US government does not want to be available to other countries, it can only be known, used, seen, described, or otherwise interacted with by US citizen, US lawful permant residents or US companies and organizations.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.