🚀 go-pugleaf

DISCLAIMER: I am not a lawyer, the company I work for probably disagrees
with everything I say.


In <1e9ka5INNbmt@roche.csl.sri.com> boucher@csl.sri.com (Peter K. Boucher) writes:

>DISCLAIMER:  The following information is provided as a public
>service.  It is explicitly NOT a commercial advertisement, and
>does not in any way represent, express or imply any policy or
>viewpoint of SRI International.

>First, it is illegal to "make, use, or sell" a patented device
>without a license.  PGP's disclaimer does not protect anyone making,
>distributing, or using PGP.  PKP owns the patent and sells licenses
>to companies who want to make and sell products that use RSA and
>other public-key cryptography.  PGP is not licensed.  A license to
>the maker of PGP has always been (and still is) available, but it
>would not be free (which would be unfair to other licensees, whose
>licenses were not free).

(1) The RSA patent is clearly overbroad.  Whether PGP falls under what it
should be restricted to would be up to the courts, if RSA wants to
prosecute.

(2) Some uses of PGP are protected under that patent law, even if it is
subject to patent.  Consult a patent lawyer for more information.

(3) Distributing source code with appropriate disclaimers (possibly as RSA
claims) is exactly what patent law was intented to encourage...
experimentation with concepts/ideas to create new ideas.

>Second, PGP may be illegal with respect to US export law.  The
>author states in the documentation that he "guided" its development
>overseas.  This might be construed an export of "technical know-how"
>under the ITAR (International Traffic in Arms Regulations).  By
>distributing or using PGP 2.0, you may be involved directly or
>indirectly in an illegal act.  Ignorance before the law, of course,
>is no excuse.  It's the responsibility of every one to seek their
>own legal advice.  I strongly urge potential PGP users to have their
>company's lawyers read the ITAR and read the PGP statement before
>making a decision.  It could be a serious mistake to assume that
>because this software "appeared" in the US or elsewhere, it and those
>who use it are not at any risk of violating export law.

Irrelevant.  Only Phil, himself, might be liable.  The is no restriction
under ITAR against importing arms that were illegal to export.  (If
datapaths from one foreign site to another pass through the US, it seems
likely the the re-exporter could also be prosecuted, if anyone can trace
the links to find out who it is.)

>The risks to those actively promoting PGP, and/or distributing it, are
>of course, greater than those for simple users, but even simple users
>would do well to seek an acceptable alternative, such as RIPEM.
>RIPEM is built on a piece of software called RSAREF.  RSAREF contains
>an embedded patent license, and is perfectly legal to use for
>non-commercial purposes.  Any software whatsoever can be built on
>RSAREF, even PGP-like programs, and distributed freely.  RSAREF does
>carry strong restrictions on export.  RIPEM source and executables can
>be found using archie.

Are RSAREF sources available?  If not, there is little benefit to it's use
by people who don't trust RSA/PKP not have put in a "trap door".
--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.