Hacker News Reader

Comment by tptacek | Hacker News Reader

Where were you that PGP was banned, or encrypting emails was illegal?

Cryptography was considered a war weapon and only allowed for military use.

The United States had to be brought to court to finally allow cryptography: https://en.m.wikipedia.org/wiki/Bernstein_v._United_States

> Years before, the government had placed encryption, a method for scrambling messages so they can only be understood by their intended recipients, on the United States Munitions List, alongside bombs and flamethrowers, as a weapon to be regulated for national security purposes. Companies and individuals exporting items on the munitions list, including software with encryption capabilities, had to obtain prior State Department approval. — Electronic Frontier Foundation: EFF's History

Before that, export rules could be "worked around" by printing cryptography in books.

not quite crypto related, or at least directly, i remember this old Mac G4 ad: https://youtu.be/lb7EhYy-2RE?si=3tvJK4BXbA71LbGQ

> Cryptography was considered a war weapon

It still is.

e.g in France:

https://cyber.gouv.fr/en/protection-sensitive-and-restricted...

    This legal framework has been introduced in 2011 in order to protect facilities, knowledge, savoir-faire, information which, if intercepted, could:
    
    - Affect French economic interests (risk 1);
    - Reinforce military capacities of other country or weaken French military capacities (risk 2);
    - Lead to the proliferation of weapons of mass destruction in nuclear, ballistic, chemical or biological fields;
    - Lead to the development of terrorist activities on French territory or abroad.

It's just that import/export constraints have been relaxed.

See Annexe 1 here: https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000646995?...

This is one of the reasons why MobiusSync is not available in the French iOS App Store since it doesn't use iOS crypt which already has approval plus it doesn't fit into some of the exceptions to the restrictions, so they'd have to fill in paperwork which is only available in French and submit via snail mail (go figure, although they do accept answers written in English as a courtesy).

https://github.com/MobiusSync/MobiusSync/issues/27

Similar concerns, processes, and exceptions are effective for other countries, e.g for the U.S. you need Encryption Registration (ERN) approval from the U.S. Bureau of Industry (BIS). Exceptions are described in Category 5, Part 2 of the U.S. Export Administration Regulations.

"You have to get an export license if you're distributing from inside the US to outside the US" is pretty different to "sending encrypted emails was illegal", no?

For one thing, it sounds like sending wasn't impacted at all, once you had the software.

How would you send encrypted email without an encryption library?

From what I remember, what was illegal was exporting a (useful) encryption library, and that Wikipedia link supports my memory: It talks about exporting munitions. I remember at the time that even though libraries existed inside the US they weren't supposed to be exported to other countries (i.e. the rest of us should get encryption libraries developed outside the US). Nothing prevented US citizens in the US to use encryption. Nothing in that "cryptography is considered munitions" legal issue, at least, because that was about export.

They can't use encryption if they can't get encryption software. I recall hearing that companies outside the US could distribute software with competent encryption without problems (to people inside and outside the US), but companies inside the US basically couldn't distribute software with competent encryption, because someone outside the US might download it.

But I remember the time. The software could be downloaded from inside USA. Mid-nineties the internet wasn't particularly large and (what's nowadays) simple measures were in place. In practice you could get it from the US even if you were outside, but then again USA wasn't the only place where encryption software was made, so we all thought it a bit silly.

What I'm getting at is that it's simply incorrect that encryption wasn't available in the US, and it's also incorrect that encryption couldn't or wasn't in use. It most definitely was. The regulations were only about export. 40 bits max and all that.

I understand where you're getting at, but lawyers would see "is it possible for people out of the US to download this? Yes? Well lawsuit incoming, by the government/military."

This is way too much of an unknown. And we've seen with P2P/Napster and DMCA where just listing links without distributing still opens people to legal issues.

Those of us who were active back then did see the software. It was not kept off servers. It's just that I don't think archive.org was active at the time so we have no way of showing it to you, I believe.

Edit: As for Napster and DMCA, the Napster story happened in 1999 and the DMCA in 1998. The limitations on crypto were loosened in 1998 and 1999 and removed in 2000. In other words, Napster and DMCA isn't really relevant here - the encryption story mostly unfolded before that time.

You are speaking past the GP by missing the de jure (their point) versus de facto (your point) aspect of the discussion, I think.

Possibly - but my impression is that the GP is rejecting as impossible what I'm stating - that in fact you could use cryptographic libraries in the US, because they were, indeed, available. GP seems to argue that they could not have been available because that would have allowed them to potentially be downloaded (exported) outside of the US, which was illegal at the time.

None of this is true. It really feels like there are a couple people who were, like, alive in the 1990s trying to explain to people that cryptography was not in fact illegal or even regulated in the USA during the heyday of Ace of Base, and then a lot of younger people trying to axiomatically derive an alternate history where nobody could encrypt anything. You could just download PGP and run it, and if you go look at back issues of Wired, you'll see that lots of people were begging Americans to do just that.

The fact that it was not enforced doesn't mean there wasn't a sword of Damocles above your head.

As someone who watched all of that at the time.. I believe nobody in the US felt any sword of Damocles above their heads. The net was a very different place from now. A simple automated download check was what was needed, or even just a statement. There was other kind of software as well, and I remember having to fill out a form stating that I wasn't going to re-export the software to [short-list of certain countries] before I got the actual download link. That was about it, back then.

What would that check do? Check IPs?

Some companies literally just provided two links, one for the US version and one for the international version. That's how not-serious this whole thing was.

Really, even back in 1995, people did understand how the Internet works. Nobody was under any illusions that you could actually control "export" of cryptographic software. If you were a US-based company that sold shrink-wrap software, you probably also filled out some paperwork once a year. For "open source" software (note: not a thing, as such, in 1995): forget about it.

geoiplookup wasn't a thing until 1999 or so, plus/minus, but "whois" was, and mid-nineties the net was pretty small compared to now (for a definition of "small"). So yes, knowing where an IP address came from was a thing even then. But there were also the two-versions links mentioned by the sister comment. Among other things. This was not a big deal. Really.

There was nothing to enforce. This concern is made-up. Again: the people telling you this were there in the 90s, in the workforce, "dealing with" this stuff. The far bigger problem was that the maintainers of Apache's SSL code wanted a license fee to use it. I do get that if you were 7 years old at the time, and in France, it might have seemed complicated, because of the (unenforced) export rule, but that rule didn't matter to Americans or in any meaningful way restrict our access to encryption.

You (as a US citizen or company) would acquire one from a US vendor. Exporting outside the US was illegal, using it within the US was not.

How would US vendors prevent people from outside the US to acquire the software?

They put a notice above the download link that said it was illegal to export to certain countries. Really. The onus was on the person downloading the software, not the person providing it.

You would use an "encryption library"? I don't understand what's complicated about this. I thought perhaps that top comment was talking about some country other than the USA, where cryptography had actually been outlawed, but it seems people really believe the US outlawed crypto in the 1990s? No, they did no such thing. They didn't even regulate it, excepting export controls.

Sending encrypted email in the US was NOT illegal. Sharing encryption libraries was.

How would you send encrypted emails without an encryption library?

You're not reading or comprehending the multiple correct replies. I won't repeat them because apparently that won't get through to you, but you should go back and read them again and again until you understand, or at least stop repeating the same incorrect information, if not finally understanding the correct information people keep trying to tell you.

https://en.wikipedia.org/wiki/Sealioning

woah I'm so glad he did it, I now got better picture of twitter altogether.

I am reading the replies.

You don't understand the legal liabilities people open themselves to if they provide the software.

Now they have to fully KYC customers to make sure they are from the US, with US only storage, and firewall so that people travelling cannot use the encryption library from out of the US.

You've seen the lawsuits on just P2P link providers, this is even worse.

People inside the US could trade encryption libraries. They just couldn't send those libraries to outside the US. You could download a cryptography library from outside the US, and your foreign recipient could do the same, and thus send emails back & forth. In practice all it meant was that US developers couldn't write make useful cryptography libraries, and the development got done elsewhere.

The US still restricts the export of (some) cryptography to (some) countries & organizations. Mostly that just requires submitting a self-classification report to the BIS stating that the cryptography is "mass market" and matches the definition thereof in the export regulations.

But what happens if the company you're trading with has non-US entities? Or traveling salesmen?

The issue here is the complexity of complying and closing all loopholes that would allow the government to bring the full weight of the legal system against a library writer.

Nothing happened. Nobody cared.

That's an oversimplification and also inferring a completely incorrect situation.

It was perfectly fine for American citizens to use cryptography amongst each other or with outside nationals. It was also completely fine to download and use externally developed software.

What was illegal was developing and exporting cryptographic software. This is why, for the longest time, you would see warnings on web pages (puTTy, for instance) saying the software was only intended for use in the United States.

I remember publishing some apps to the iOS App Store and was asked to “declare cryptography to the US government”. I’m not even American.

The form made it clear that using HTTPS is considered cryptography, so I’m fairly sure almost every app on the store has checked “yes” to that question.

I disagree.

To fully comply with this you would need as a library provider to fully KYC your clients so that there is a firewall between their US and non-US entities, and that travelling people don't bring out an encryption library at the same time.

It would be a operational nightmare.

In the time period we're discussing, I was on a team shipping a commercial (shrink-wrap!) software project that extensively used cryptography, including an export version of same. It was not a big deal; it was not an operational nightmare; in the North American market, it wasn't a thing at all, you just did whatever you wanted.

Which part are you disagreeing with? I'm literally laymaning the law.

The law never covered using cryptography, it was always about exporting it. Mostly it was written around keeping military specific cryptography from entering rival powers hands, but was overbearing. So they amended it to allow commercially developed/homegrown cryptography (explicitly not developed for governmental/military use) to be distributed normally. In practice, it's still a little muddy as many of those use DoJ/DoS-funded cryptography patterns, but the government has chosen to take a fairly hands off approach on those (RSA and DSA are key examples).

You're correct that it would also be almost impossible to enforce the original wording in today's world of globalization. They also have little power to enforce it on foreign nationals, which is why a warning was usually Good Enough(TM) for American software developers.

Using is exporting though. If you made a client that had https, and a customer downloaded it in Toronto, you were breaking the law.

This is....yes, the exact point; thank you for finally getting to what everyone was saying from the outset. Now follow the conversation forward.

Re-read the first post and the last paragraph of the one you're replying to. Everything you're knee jerk contrarianizing is covered.

So far as I'm aware, this was never the case. Bernstein's case started in 1995 (it was decided in 1999). I assure you, cryptographic software was widespread and, apart from export controls, unchecked in 1995. Source: my professional career started in 1995.

In (I think) early 1995 I bought a "This T-Shirt Is A Munition" shirt with RSA source code on it, by typing the information from the bottom of a personal check(!) into a web page. It was a whole thing.

Encryption was (and in some countries, still legally is) considered dual use technology. You needed to go through paperwork and licensing to export cryptography across the border. Symmetric keys longer than 64 bits were considered too strong.

This led to all kinds of stupidity. Internet Explorer shipped with nerfed TLS capabilities, limiting key sizes to 40 bits or 56 bits depending on the version.

When the encryption laws changed in 2000, Microsoft allowed users to download an update to improve SSL encryption: https://learn.microsoft.com/en-us/previous-versions/tn-archi...

You could legally encrypt emails, of course, as long as you kept the key sizes small and didn't export the encryption software to another country.

If you sell and export encryption products from the USA (and a bunch of other countries, see the Wassenaar Accords) to certain places (including China and Russia), you're still obligated to register your product if you use modern key sizes. I'm not sure if governments still care now that OpenSSL and PGP are freely available to anyone, but if your proprietary email encryption program is found on North Korean computers, your government may ask you some uncomfortable questions.

You are probably from the US and not aware how things looked outside of it? https://en.m.wikipedia.org/wiki/Crypto_Wars

Quite recently, the researchers behind the Tetraburst attack (https://www.tetraburst.com/) discovered that Tetra's encryption has "levels" which depend on the intended recipient's country.

This leaves the critical infrastructure of emergency services and police force for a lot of countries (notably, US non-allies) wide open to attack.

The existence of the levels was previously known; what they discovered was just how bad some of them are.

PGP was not exactly banned but if you were in Europe when ITAR restricted its export, and you were trying to download from strait-laced corporate types like AOL, they wouldn't let you.

And even if a determined person could get around the blocks, they severely limited the network effects; office workers on their employers' PCs weren't going to be getting encryption software from IRC bots to bypass arms export laws.

Some time towards the late 90s PGP became much more easily available.

Its effects are still with us. Hardly anyone uses encrypted email even though it is now easy to set up. The (lack of) network effects has persisted.

IMO that's less due to the ease of setup and more due to the lack of any sane key exchange system & general impossibility of encrypting all email content (e.g. subject line).

As discussed on thread, not banned, but posting it somewhere could get you in significant trouble. In fact, Phil Zimmermann got in quite a bit of trouble for his contribution towards the world getting a hold of PGP, which was considered a export restricted munition. I believe there was at least one court case, harassment, tax audit, and hassle at the border. My memory is a big vague, but you get the idea.

I was at codecon, forget if Zimmerman was there, or just quoted. His story was recounted, then someone else who attended codecon and mentioned releasing ITAR restricted crypto. They were part of a leak of the RC4 source code. A copy was sent to a well known member of sci.crypt, saying along the lines of "I think you can post this anonymously", if you agree to this please post a "Looking for Joe Random" post on sci.crypt. The source code was posted and there was no lawsuit, no tax audit, and no hassling by the government.

This quickly led to a cottage industry of instructions on how to write your own RC4 CipherSaber util - https://github.com/search?q=ciphersaber&type=repositories -- http://ciphersaber.gurus.org/faq.html

Reply on news.ycombinator.com