From owner-freebsd-security  Fri Dec 15 10:49:19 1995
Return-Path: owner-security
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id KAA10822
          for security-outgoing; Fri, 15 Dec 1995 10:49:19 -0800 (PST)
Received: from netmail.austin.ibm.com (netmail.austin.ibm.com [129.35.208.98])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id KAA10816
          for <security@freebsd.org>; Fri, 15 Dec 1995 10:49:09 -0800 (PST)
Received: from ozymandias.austin.ibm.com (ozymandias.austin.ibm.com [9.3.140.170]) by netmail.austin.ibm.com (8.6.12/8.6.11) with SMTP id MAA46313; Fri, 15 Dec 1995 12:48:54 -0600
Received: from localhost.austin.ibm.com by ozymandias.austin.ibm.com (AIX 3.2/UCB 5.64/4.03-client-2.6)
          for security@freebsd.org at austin.ibm.com; id AA12246; Fri, 15 Dec 1995 12:48:42 -0600
Message-Id: <9512151848.AA12246@ozymandias.austin.ibm.com>
From: sjb@universe.digex.net
To: jis@mit.edu (Jeffrey I. Schiller)
Cc: Paul Traina <pst@shockwave.com>, Faried Nawaz <fn@pain.csrv.uidaho.edu>,
        security@freebsd.org
Subject: Re: legal to export DES outside of the US via Canada? 
In-Reply-To: (Your message of Sat, 09 Dec 1995 15:44:34 CST.)
             <acefb16e010210040158@[153.37.193.29]> 
Date: Fri, 15 Dec 1995 12:48:41 -0600
Sender: owner-security@freebsd.org
Precedence: bulk

Jeffrey I. Schiller writes
>Ah. But when a Canadian receives ITAR controlled code from the U.S. he/she
>has to agree not to export it from Canada (we have to require this
>otherwise we cannot send it to the Canadians!).

There's the rub.  ITAR says crypto may be exported to Canada without a
license "for end-use in Canada by Canadian citizens or return to the
United States, or from Canada for end-use in the United States or
return to a Canadian citizen in Canada" (126.5(a)).

U.S. law doesn't (normally) apply to Canadian citizens, even though the
U.S. LEAs seem to think it should, so, having received ITAR-controlled
code under the above exemption, the Canadian citizen may do with it
what he will.  It violates only the agreement he made with the
exporter, not law.  No one will come to get him, and the exporter
should be safe from judgements.

IANAL, but it sounds like the sum of all this is like all those other
dumb laws that probably made sense when they were passed, like the one
that makes it illegal to shoot indians on Congress Avenue, here in
Austin, Texas, or the one in (I think) Maryland requiring that when a
woman drives an automobile, a man must run at least 15 feet in front of
it with red flags to warn other motorists.