🚀 go-pugleaf

 -=> Quoting David Sternlight to All <=-

 DS> I'm curious. What are the crypto laws in the U.K., Germany, and
 DS> Finland, from which most of the posts come. Is it really true
 DS> that PGP is legal there, or do such countries also have laws
 DS> about import, posession, or use of cryptographic software,
 DS> which have conveniently not been mentioned in this discussion?

 What a good question! I wish I could promise you as good an answer. 
 The following are some of the facts for UK, as I understand them I 
 would be grateful for others' addition, correction or amplification as 
 may be required.

 I believe we have no law dealing specifically with the import/
 ownership/use of cryptologic systems. We have a maze of regulations, 
 whose establishment is no doubt based in statute law. These regulations can 
 be changed or re-interpreted from time to time by the public servants 
 charged with their administration without recourse to Parliament or to the 
 courts. However such changes or re-interpretations may be challenged in the 
 courts on a case-by case basis. The government agents do not always win. 
 
 In practice at least, software implementations seem to be treated differently 
 from hardware implementations; there are also further observeable 
 distinctions attempted between hardware designed to protect the transmission 
 of information over formal networks as opposed to the protection of 
 (principally) speech in wireless transmission.

 Taking these in reverse order:
               - A cryptologic device to secure wireless transmissions 
        requires a licence (as does any transmitter) from the Department of 
        Trade and Industry. To the best of my knowledge, no licence has been 
        granted in UK to allow possession of such equipment by other than 
        governmental or quasi-governmental organisations. Digital encryptors 
        for speech over the PSTN etc. may be supplied to UK corporate users 
        on a case-by-case basis; also, before such devices may be used in 
        direct or indirect connection to the PSTN, the devices must be 
        thoroughly examined and approved by the Office of Telecommunications.   
        
        - On-line systems for the protection of textual and graphical 
        information are slowly increasing in corporate hands, led by the 
        banks and other financial institutions. Despite the inherent 
        difficulties with the technology, fax encryption is slowly 
        becoming more common. Such equipment is both made in the UK and 
 imported. Where direct or indirect connection to the PSTN is intended
        approval is requires as above.

        - Software cipher implementations for the protection of 
        information held in storage is more widespead than any of the foregoing
        and is not subject to end-user licencing. Some cryptosystems are 
        available that include the protection of information in transmission 
        on area networks. These do not seem to be subject to licencing control. 
        Software designed to allow the off-line crypto protection of 
        information intended for transmission via the PSTN or packet switched 
      networks is quite uncommon. I believe this to be due to the fact that 
        such systems are essentially limited to low traffic density situations 
        and also that the penetration of data comms into small business and 
        personal use is still quite limited in the UK. One commercial software 
        PC security package with a LAN and PSTN suited cipher system is Fifth 
        Generation's S.A.F.E. product. This is imported from the US and sold,  
        as I understand it, without additional UK licencing restrictions. 
        There are (or were) a choice of ciphers offered to suitable customers. 
        A DES implementation, subject to the US rules governing that system, 
        and a proprietary algorithm.

  There is a British freeware product that would seenm to ante-date PGP. This 
  too uses a software RSA implementation for the key management of any one of 
  a range of main ciphers, including a DES CFB option.  
  
  PGP has well and truly arrived in the UK but is unknown (asis any cipher 
  system) to the vast majority of the population, who are unconcerned with 
  such things. It is not in the least probable that PGP's arrival has gone 
  unnoticedby the government's Communications and Electronic Security Group 
  and it isreasonable to assume that that information is therefore available 
  to all interested government agencies, such as the Department of Trade and 
  Industry. My understanding is that neither the possession nor use of PGP2.x 
  in the UK can constitute an offence against UK law. The unlicenced export 
  of PGP2.x from the UK to other countries might be in breach of the COCOM
  regulations to which the UK is signatory. Such unlicenced export might
  therefore create an offence in English law. 
  
  Others maycare to post and fill in or correct some of this outline. I 
  am not a lawyer and will therefore try and get the view of a UK lawyer,
  knowledgable in the field, to answer you with more authority.

  Regards,

  Owen 




.. Enter any 12-digit prime number to continue.
___ Blue Wave/QWK v2.11