crypto import to the UK

[Peter Gutmann]

I've already posted this to two lists whose coverage is somewhat nearer to NZ, 
but given the messages which have appeared here recently I thought ukcrypto 
readers might find it amusing as well.
 
Peter.
 
-- Snip --
 
My life as a Kiwi arms courier
 
Inspired by Matt Blaze's arms courier story, I decided to try the same thing
over here just to see what would happen.  First, the paperwork: Earlier this
year I wrote to the Ministry of Foreign Affairs and Trade (MFAT) to see what
their idea of NZ's temporary export rules was (although the US, whose crypto
export policy NZ follows word for word, has temporary export rules, NZ doesn't
have any rules, or at least it didn't until I asked about them).  My original
letter is available from
http://www.cs.auckland.ac.nz/~pgut001/policy/mfat_5l.html.
 
They replied to say that temporary export was OK, and that I should apply for a
standard export permit, listing myself as both the source and destination of
the export.  The reply is available from
http://www.cs.auckland.ac.nz/~pgut001/policy/mfat_5r.html.
 
A few months later when my travel arrangements had been finalised, I submitted
the export permit application,
http://www.cs.auckland.ac.nz/~pgut001/policy/permit.html, along with a covering
letter, http://www.cs.auckland.ac.nz/~pgut001/policy/mfat_6l.html.  Shortly
afterwards, the temporary export was approved,
http://www.cs.auckland.ac.nz/~pgut001/policy/mfat_6r.html.
 
Because Matt ran into all sorts of problems when he tried to export his goods
and only caught the plane on time because US Customs bent over backwards to
help him, I decided to determine well in advance of my departure time what
would be necessary.  A good two weeks in advance I wandered over to the Customs
Building in Auckland and showed the permit to the people in charge of exports.
 
The person behind the counter looked at it.  He looked at the source of the
export (Auckland, New Zealand) and the destination of the export (Auckland, New
Zealand).
 
Pause.
 
"What are you exporting?".
 
I flipped a 3 1/2" disk onto the counter.
 
He looked back at the form, then at the disk.  He went out to the back and
called someone else, who also looked at the form.  They looked at each other.
They may have looked elsewhere as well to see whether there was a hidden Candid
Camera anywhere.  Eventually, one of them asked:
 
"That's a COCOM thing".
 
"Precisely".
 
They both went out to the back again.
 
Other people started to turn up at the counter and formed a queue behind me.  I
could see activity going on out the back, but noone returned to the counter.
More people arrived and joined the queue.  "Oh no, I've caused a deadlock in
the Customs kernel!  They'll have to fly the Comptroller of Customs up from
Wellington to do a Stop-A and reboot the building!".
 
Eventually they came back, but didn't really know what to do with this permit.
I asked whether I had to show it to anyone at the airport when I left or
returned, but there was no need to do that (or, more precisely (as Matt found
out) there was no way to handle this at the airport, and noone there would have
known what to do with it).  One of them recommended that I carry the permit
with me when I leave the country, and be prepared to present it if challenged.
I thanked them and left.
 
A fortnight later I left the country with my permit and the software on disk.
I was very careful to keep it on me at all times, and not allow anyone access
to it (it was never more than a foot or two away from me for the week in which
I was in the US).  When I needed to distribute the software, I FTP'd it from a
site in Europe (it's freely available throughout the entire world) and gave it
to anyone who wanted it, but I made sure that the officially exported copy
never left my side and was never copied, as required by the permit.  Before I
left the US I erased the disk to ensure I didn't violate US export laws, but in
any case I was never checked leaving the US.  The only crypto I carried out of
the country with me was protected by the First Amendment (an autographed copy
of "Breaking DES", and a huge stack of crypto books which didn't contain source
code).
 
I returned as I'd left without incident.  The signs at the airport mentioned
food, drugs, guns, etc, but not floppy disks (which, in any case, was blank),
so I came in through the "nothing to declare" section.
 
Well, that's what it's like to be a kiwi arms courier, and that's what it's
like to see our export controls in action.
 
Peter.
 
Postscript:
 
The permit allowed a 20,000km round trip of my software under the condition
that I end up at the same place where I started.  It's folk wisdom that dealing
with bureaucrats is like running around in circles, but I may be one of the few
people on earth to have an official government permit to do this.
 
I should also mention that, as in the US case, NZ Customs were extremely
helpful in trying to resolve a completely bizarre export situation, and that
this writeup is in no way meant to cast blame on them for not knowing how to
handle MFAT's nonsensical requirements.