Obeying UK crypto export restrictions on the Internet

[Mark RISON]

I wish to release source code implementing (triple) DES on the Z80.

I wrote to the Department of Trade and Industry, Export Control
Organisation, using their rating enquiry service.  About a month and a
couple of time-wasting questions later, they've replied as follows:

<<
It appears to us that the Triple DES Cryptographic Source Code for
Z80, intended for free download over the Internet, does not require an
export licence, unless you find the end-use of your intended export
described within the enclosed Notice to Exporters on Current Strategic
Export Control Legislation.  In particular, you are referred to the
sections relating to the End Use Control and to Trade Sanctions.
>>

What does this mean?  I think I'm OK on the End Use Control (in that
I'm reasonably confident that the source code won't be used in
connection with the chem/bio/nuc weapons they seem to be obsessed
with), but how am I supposed to ensure that the source code doesn't
get downloaded from countries with Trade Sanctions?

Is saying "you may not download this if you're in Iraq, Angola, or
Yugoslavia" enough?  If not, how am I supposed to implement "free
download over the Internet"?  I see that OpenSSL has a UK mirror --
how did they arrange to jump through all the legal hoops?

[I assume that in this forum there is no need for me to state my
opinions regarding restrictions on source code for an algorithm which
is freely available on the same Internet...]

Mark

--
CPC/IP - A TCP/IP stack for Amstrad CPCs
-- http://www.nenie.org/cpcip/
"Z88 vs CPC? Christ. How did we miss that platform war?"
-- http://www.ntk.net/index.cgi?back=archive00/now0128.txt&line=110#l


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp