(A Javascript-enabled browser is required to email me.)



Letter on U.K. encryption export
From TBTF for 1997-03-01



The Cryptography list carried a discussion of Mike Cobb's <mikec@cobweb.co.uk> attempts to find out if he needed a license to export his KeyRing file-encryption and password-tracking program from the UK. Here is his note to the list summarizing the outcome and reproducing the letter he eventually got from the Department of Trade and Industry.
Date: Fri, 21 Feb 1997 05:29:20 -0000
From: "Mike Cobb" <mikec@cobweb.co.uk>
To: "Cryptography Mailing List" <cryptography@c2.net>
Subject: UK Encryption Policy

Thanks for all your replies. 
I have copied the complete text that I received from the DTI so that you
can each draw your own conclusions.
I am certainly no legal expert and the opinions I expressed in my first
email were just that. It amazes me that the people who make the law, will
not or cannot interpret it, their advice is always consult a lawyer. In my
efforts to get this far I definitely found that I had to ask just the right
question to get any information, it was never offered freely. That said I
did find one very helpful individual who helped me ask the right questions.

As I understand it, as I am only making KeyRing available via the Internet
I do not need a licence, and so I will not be applying for one.
I do not mind if the following is posted elsewhere on the net, as long as
it is only done in an attempt to help others understand the situation in
the UK.  I would like to ruffle as few feathers as possible, if that's
possible.

The letter from the DTI was dated 18 February 1997 and any spelling
mistakes are mine.

  Thank you for your letter of 30 January 1997 providing further
  information.(*)
  
  It appears to us that the KeyRing Version 1.0 Encryption Software Program,
  when exported by intangible means, does not require an export licence,
  unless you find the end-use of your intended export falls within the
  categories outlined in the Supplementary Notice of Export Licensing
  Procedures (ECO Notice STU/1, Issue 14) dated November 1996.
  
  Please note, however, that software programs of the type covered by your
  enquiry do require an export licence if exported  in a tangible form, (e.g.
  on floppy disc or CD ROM) and a licence application form should be
  submitted.
  
  Although The Import, Export and Customs Powers (Defence) Act 1939, Council
  Regulation (EC) No. 3381/94, The Export of Goods (Control) Order 1994 and
  the Dual-Use and Related Goods (Export control) Regulations 1995 do not
  contain any provisions covering the export of technology by intangible
  means, the absence of regulations under the above Orders does not mean that
  export by intangible means is totally free from obligations. The attached
  points to Note on the Transfer of Technology by Intangible Means should be
  carefully considered. Clearly, the government would prefer that exports
  such as yours be made by tangible means only, under the authority of an
  export licence.
  
  You can obtain further information and advice on the procedures for
  obtaining an export licence from the DTI's Export Control Organisation
  Enquiry Unit on 0171-215-8070.  To assist in the processing of a subsequent
  licence application, on the items referred to in this letter, please quote
  the reference number on this letter or send a copy of this letter with your
  application.
  
  this assessment has been made on the information given in your letters
  dated 18 December and 30 January 1997 and attachments.(**)

(*)  I stated that I would only being making KeyRing available via the
     Internet.

(**) I described how the program worked and that it used the Blowfish
     algorithm

I received a copy of ECO Notice STU/1 Ref: STU/9/3/2 Issue 14 which refers
to weapons of mass destruction. I also received a two page attachment as
follows.

  TRANSFER OF TECHNOLOGY BY INTANGIBLE MEANS
  
  POINTS TO NOTE
  
  1. The Import, Export and Custom Powers (Defence) Act 1939, Council
  Regulation (EC) No. 3381/94, The Export of Goods (Control) Order 1994 and
  the Dual-Use and Related Goods (Export control) Regulations 1995 do not
  contain any provisions covering the export of technology by intangible
  means.
  
  2.  However this does not mean that there are no controls on intangible
  technology or that, as an exporter, you are free from obligations:
  
      -  United Nations Act 1946: in certain circumstances, some intangible
         transfers of technology might constitute a breach of one of 
         the Orders made under this Act implementing sanctions; but 
         none of the Orders controls intangible technology transfer 
         as such;
  
      -  Official Secrets Act 1989: technology developed under government
         contract which falls into one of the categories of information 
         protected by the Act is also covered because the Act prohibits
         the transfer by whatever means;
  
      -  Copyright conditions apply in certain cases;
  
      -  Patents Act 1977 contains relevant provisions;
  
      -  Contractual obligations may apply.
  
  3. You must refer to legal advisers to check what applies in your own case.
  
  4. Government is aware of the potential for abuse of the spirit of export
  controls. If it appears HMG's export control policies are being undermined,
  then further action may have to be considered.
  
  5. HMG works with exporters in pursuit of the policy of preventing the
  spread of weapons of mass destruction. Public support for this policy is
  strong.
  
  6. Exporters whose actions work against that policy risk damaging their
  good reputations with regulatory authorities and the public: and both
  domestically and internationally.
  
  7. The public relations and longer term economic costs of any such  action
  must be set against any apparent advantages which may be gained.
  
  8. Advise against any employee embarking on such a course of action without
  consulting the officer responsible for export control policy compliance.
  
  9. Hard to see what practical advantage there is to exporters in exporting
  technology by intangible means because they could get licences anyway if no
  concerns about the export itself.
  
  10. And if concerns are sufficient for a licence to be refused, what
  reputable exporter would wish to export it by any means?
  
  Policy Unit
  Export Control and Non-Proliferation Division (XNP)
  DTI
  January 1996

Regards Mike Cobb
CobWeb Applications
http://www.cobweb.co.uk

[ TBTF for 1997-03-01 ]