Hacker News Reader

Hacker News

Comment by cube2222 | Hacker News Reader

Parent Full thread

cube2222

Those last three are pretty concerning, I don't really understand what they mean:

> - Providing cryptology services aiming to ensure confidentiality without certified declaration,

> - Providing a cryptology tool not solely ensuring authentication or integrity monitoring without prior declaration,

> - Importing a cryptology tool ensuring authentication or integrity monitoring without prior declaration.

What does "without certified declaration" mean?

The others are pretty non-surprising, if the comms were unencrypted and the company refused to cooperate.

View on HN

Looking at relevant French law it would appear there is a bureaucratic procedure to import cryptography into France.

But how this gets interesting is if Telegram has no explicit office presence in France and the app and webapp are merely distributed to French users resulting in these charges.

If I have a web server in the US that serves content that uses a cryptography JS library and a French user accesses it could I be arrested in France because I didn't declare the library to the French bureaucracy and get it approved?

Has France basically just nuked themselves for non-France based cryptography providers? Is npm going to block France in case a French citizen imports a JS cryptography library? Are a bunch of apps going to get their app removed from app stores for France?

Evidently this all seems incredibly selective and arbitrary but the lawyers are going to have to assess the risks of the French now in a way they didn't before, and once again another unclear rule haunts the EU software industry.

Telegram is selling Telegram Premium and other services in France, which means they are doing business in France and are thus subject to its laws.

Durov has French citizenship. Hard to argue there’s no presence in France.

When a prosecutor writes accusation he writes extra accusations like when you go to a store and buy something you buy extra things. This way the prosecutor gets ekstra points, and prestige. I am talking for all countries.

The system is f*d up.

A kinder perspective: you only have one opportunity to prosecute, so you add all the charges you think might be relevant, and let the courts decide on guilt.

I’m sure that the intent is at least somewhat cynical in some (many? Most?) cases, but this serves a legitimate purpose.

https://news.ycombinator.com/item?id=5046845

Sounds like selectively enforceable laws. And we thought Russia was bad with that. If we provide an XMPP server on github, should we not allow users from France to use it? Or at which point it gets enforceable?

France has at least theoretically had a licencing/declaration/whatever regime for all cryptography software since forever. Presumably they rarely enforce it, but I remember when they passed it. I think it was supposed to involve key-disclosure back doors somehow.

I wonder, did Google and Mozilla properly certified the cryptogrpahic tools they distribute? And Github is probably the worst offender, hosting thousands of uncertified, illegal cryptographic tools.

Notably they didn’t run perhaps the worlds most popular child porn distribution network at the same time and didn’t have it all over their devices.

Tangentially-related, it remains surprising that many U.S.-based developers I've spoken with fail to realize that they need to obtain an Export Control Classification (ECCN) from the US Dept of Commerce's Bureau of Industry and Security (BIS) before publishing their apps in the app store or otherwise making them available on the net. And then devs need to submit annual updates for their products.

Most will get a mass market exemption under 5D992, but a surprising number of modern applications making 'interesting' uses of crypto will need export licenses.

https://www.bis.doc.gov/index.php/encryption-and-export-admi...

They probably think they live in a free country without stupid requirements.

They probably think they live in a free country without stupid requirements.

…says the "PHP developer from Russia," according to his biography.

People generally expect more from self-declared democracies with free speech in their constitution, as they should.

Weird way of making a case for US-only app stores but okay!

First time I hear about this as well and I'm not sure if I understand this correctly (because it's in French :p) but it sounds like if your software uses cryptography and you have French users then you need to submit a declaration to some French authority:

https://forums.developer.apple.com/forums/thread/741830

If you have French customers, not users. Basically you have to give an audit. If you already have an ISO certication it's no trouble.

Ah so the import declaration required to publish in the French App Store is for Apple? Thanks for clarifying

Yes I think. For us the audit was part of our ISO27001 certification, but i'm pretty sure you can have other certification, as long as an official audit exist.

Basically, do you know the saying 'never roll your own crypto'? It's a bureaucratization of this saying (to avoid people getting sold insecure crypto). Agree or not on the idea that the government should control that (I'm torn tbh), but it isn't a way to force people into illegality to pressure them.

So basically all networking software uses cryptography... Yeah, with upcoming EU related changes for software, you need not only programmers, but layers too. Because pretty sure they would implement something similar and more.

Pag 3 and 4 are in English...

It also looks like conserning to people who host their web sites in France. The cripto accusations look unclear and arbitrary.

Reply on news.ycombinator.com