Hacker News Reader

Comment by mmaunder | Hacker News Reader

Honorable mention for the ITAR regs that prevented Phil Zimmerman from exporting PGP 128 bit encryption until Zimmerman and MIT press printed the source as a book protected by the first amendment, exported it, and this enabled others to OCR it, and recompile it offshore.

Also that ITAR enabled Thawte in South Africa (where I’m from) as a business to completely dominate sales for 128 bit SSL certs outside the US. Thawte was eventually acquired by Verizon for $600 million and the founder Mark Shuttleworth used the cash to become an astronaut and then founded Ubuntu.

View on HN

At the time, I had a t-shirt that said "this t-shirt is a munition", because it also had on it the RSA public key algorithm encoded as a barcode.

Cane to say the same thing. It sparked a lot of interesting conversations over the years.

Haha I remember that. OG fist bump!

Had the same t-shirt with the barcode readable source code on it. I think prompted by seeing Greg Rose wear one, may have gotten it from him/mutual friends. As an foreign citizen I was never brave enough to wear it through a USA entry airport.

i seem to have vague recollection of a variant of this shirt that had a perl script on it? or was the perl script for decoding the barcode?

Memory claims: It was RSA in Perl, text shape of a dolphin, but it may be wrong.

Picture:

https://commons.wikimedia.org/wiki/File:Munitions_T-shirt_(f...

The code:

http://www.cypherspace.org/adam/shirt/design/

> [...] and this enabled others to OCR it, and recompile it offshore.

Did it? Or did it just give them plausible deniability?

I remember playing with OCR as a kid and all the software I could get my hands on gave horrendous results, even if the input was as perfect as one could hope for.

And even today I sometimes run tesseract on perfect screenshots and it still makes weird mistakes.

Would be interesting to know if the book had any extra OCR-enabling features. I'm sure the recipients would get access to proper tools and software but OCRing source-code still seems like a nightmare back then.

Banks used it on checques for ages, why would it be that difficult? You do need a compatible typesetting though.

Where did you get your information? MICR lines, the line of numbers at the bottom of the check, use magnetic ink. The acronym stands for Magnetic Ink Character Recognition. So for ages, they didn't use optics at all.

In the modern day, cheque OCR is monopolized by one company, Mitek. They may use tesseract somewhere in their stack but I've never read that anywhere.

Not so much plausible deniability, as a clear First Amendment argument. If you’re forbidden from exporting computer code, that was some new-fangled magic thing that nobody could possibly understand. If you’re banned from exporting a book, well that has some clear and obvious precedent as a restriction of free speech.

I never understood the story about the book-printed PGP source code. Isn't source code protected speech under the first amendment anyway, regardless of the form in which it is transmitted? All kinds of media receive first amendment protection, including things like monetary donations, corporate speech, art, etc. I've never heard of there being a requirement for the printed form. Did the interpretation of the first amendment change recently in this regard?

The idea was to make it blatantly clear that it's not a "munition".

Why would that matter, if source code is protected speech anyway?

And why is it more "clear" with a printed book vs. an emailed text file?

This was a time when we were happy when they managed to get congresspeople to understand that the internet is not like a truck, but more like a series of tubes.

I think anchoring it to something old school like a book was a good call.

I think if you’re looking for a logical answer from first principles, you won’t find one. It’s more that the legal system runs on precedent, and a book fits far more squarely in the fact patterns of previous First Amendment cases. Likely the source code case would end up with the same outcome, but it doesn’t hurt to make it more obvious.

Legally speaking, it didn't really matter. But symbolically, having the feds argue that a book constitutes "munitions" would be bad optics for them in a way that is more understandable to the average American, compared to more legal arcane arguments about software having 1A protections.

> source code is protected speech

That wasnt the case at the time.

The book was published in 1995 [1,2]. Free speech protection for source code under US law wasn't decided until 1996, in Bernstein v. United States [3].

[1] https://en.wikipedia.org/wiki/Phil_Zimmermann#Arms_Export_Co...

[2] https://www.eff.org/deeplinks/2015/04/remembering-case-estab...

[3] https://en.wikipedia.org/wiki/Bernstein_v._United_States

Thawte happily sold certs to US entities like universities (I was a sysadmin at one of those universities with such a cert :) )

RSA = Republic of South Africa

RSA (Rivest–Shamir–Adleman) is a public-key cryptosystem, one of the oldest widely used for secure data transmission.

I didn't know any of this. Thanks.

"The U.S. Munitions List changes over time. Until 1996–1997, ITAR classified strong cryptography as arms and prohibited their export from the U.S.[5]

Another change occurred as a result of Space Systems/Loral's conduct after the February 1996 failed launch of the Intelsat 708 satellite. The Department of State charged Space Systems/Loral with violating the Arms Export Control Act and the ITAR.[6][7]

As a result, technology pertaining to satellites and launch vehicles became more carefully protected." https://en.wikipedia.org/wiki/International_Traffic_in_Arms_....

Does that make crypto nerds arms dealers?

Reply on news.ycombinator.com