10

According to this article Iran has criminalized the usage of encryption and VPNs. According to this blog post it is still possible to use SSH tunnels in Iran.

For me SSH is encryption and thus forbidden in the Iran, but I wonder how online banking, which requires SSL, works over there and if OTR (eg for pidgin) and PGP/GPG are forbidden, too.

The reason why I ask this is pretty simple, I know some people traveling through asia who upload their videos to my server via sftp. I have no ftp installed because of security concerns, sftp was fine for me and them.

I don't want to bring them in any danger because of using sftp and would rather istall ftp and open ports till they are in india (I heard pakistan handles it pretty much the same way).

To clarify: I do not want any way to circumvent the iranian regulations, just a clear information on how encryption laws are applied in iran and under which circumstances.

Improve this question
9
  • 1
    As far as I understand it, Iran is spoofing CAs (can be done when you basically run the internet), so they can decrypt SSL info. As for the legal implications, no clue.
    – StrangeWill
    Jan 24, 2012 at 19:05
  • 5
    Wow, that policy makes even US lawmakers look sane.
    – rook
    Jan 24, 2012 at 19:30
  • 2
    Legal implications aren't a concern for the Iranian government.
    – Wayne In Yak
    Jan 24, 2012 at 23:37
  • 1
    How about asking the Iranian embassy? You don't have to mention your friends if that worries you; say that you may have to go to Iran yourself, and want to know ahead of time.
    – S.L. Barth is on codidact.com
    Jan 27, 2012 at 5:12
  • 2
    This is the wrong place to ask for clarification on Iranian law. You should consult with an attorney that is actually authorized to practice inside of Iran. The only thing you'll get here are some wild guesses. As a side note, I wouldn't actually travel there to ask this. Remote is probably best. ;)
    – NotMe
    Jan 31, 2012 at 16:57

3 Answers 3

Reset to default
4
+50

If you're just accepting files, opening FTP to help them comply with Iranian law is a good idea.

If your friends are taking videos and images which are even unintentionally slightly political in nature, then they should keep a low profile. I can't fathom why they'd enter the country with computers and start sending encrypted videos outside the country if that was their intent.

http://www.nytimes.com/2012/01/26/world/middleeast/iran-steps-up-arrests-of-journalists-and-bloggers.html

I was travelling in Iran a couple years ago and I didn't dare bring a computer into the country. They need to ensure that their computers are squeaky clean. Material offensive to Islam in the eyes of a corrupt government official could be anything. Concealing their encrypted volumes is not an option. If they didn't back up their data before crossing the border... I don't know what to say.

Iran's a nice place, but like anywhere in the world, you are subject to their laws in their country.

Without a computer, I carried a small stack of SD cards, had a USB card reader with a read-only flag and sent stuff out from cybercafes.

Improve this answer
2
  • The material is only about their travels, nothing political. As far as I know they do not use encryption on their computers, only for communication. My server is intended for their video-backups (everything else should be replaceable).
    – Baarn
    Jan 27, 2012 at 18:58
  • @blunders: Very true, thats is why I asked this question. I don't want (them) to cause any troble accidentialy, especially not by forcing them to use sftp and not just plain ftp.
    – Baarn
    Jan 27, 2012 at 20:54
3

This site is a good survey of laws on cryptography around the world. For Iran, they state:

According to the 2005 HRW report False Freedom, use of encryption for exchanging information requires a license. Users have to request permission by submitting crypto algorithm and keys and information about 'related parties' to the Supreme Council for Cultural Revolution, as regulated in art. 5.3.8 of the Rules and Regulations for Computer Information Providers.

Iran is not known to be a sanctuary for Human Rights... but it is a "civilized" country, in the following sense: they have written laws. They have procedures. They have bureaucracy. So it makes sense that if you want to do something which is banned on a general basis (such as encryption), there is still a definite procedure by which you could ask for permission. As @S.L.Barth suggests in a comment, asking at the local Iranian embassy would be the logical first step.

Note that your local laws might add some constraints. For instance, exporting cryptographic tools to Iran from the USA is illegal per US regulations because Iran is part of the list of "terrorist countries". Getting things clear with the Iranian authorities is thus necessary (to remain on the side of the Law) but not sufficient; you must also make things clear with the authorities of your own country.

(And, as for all legal matters: get a professional attorney. Legal matters rarely tolerate amateurism.)

Improve this answer
-2

I think you're looking at this all wrong. Who cares about the LETTER of their laws when the consequences of breaching the SPIRIT of their laws is so high?

Lawmakers don't understand technology (just look at the recent SOPA/PIPA debacle) and the people responsible for interpreting and enforcing them don't understand them either. With all those uncertainties in a paranoid police state, are you really proposing trying to suggest that your friends avoid possible life imprisonment or death by exploiting a loophole in their legal system?

Tell your friends not to attempt any uploads to/from your servers, and that you will be shutting your sftp daemon down for the entire time of their stay in Iran. Then actually shut it down.

Improve this answer
2
  • How's allowing them to use ftp while they're in Iran (as the OP suggested) breaking the spirit of the law? All data will be sent over the wire in the clear, unless of course the users choose to encrypt them prior to transmission. And, unless the server is hosted in Iran, I'm pretty sure it would be the users putting themselves at risk if they did that - not the server owner.
    – Iszi
    Feb 26, 2012 at 5:53
  • Who cares about the LETTER of their laws when the consequences of breaching the SPIRIT of their laws is so high? - People who don't want to spend 30 years in a dungeon. Honest people follow the LETTER of the law until they are able to change the law.
    – Ramhound
    Sep 4, 2012 at 10:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .