From: "Mike Cobb" To: "Cryptography Mailing List" Subject: UK Encryption Policy Date: Fri, 21 Feb 1997 05:29:20 -0000 Thanks for all your replies. I have copied the complete text that I received from the DTI so that you can each draw your own conclusions. [...] As I understand it, as I am only making KeyRing available via the Internet I do not need a licence, and so I will not be applying for one. [...] The letter from the DTI was dated 18 February 1997 and any spelling mistakes are mine. Thank you for your letter of 30 January 1997 providing further information.* It appears to us that the KeyRing Version 1.0 Encryption Software Program, when exported by intangible means, does not require an export licence, unless you find the end-use of your intended export falls within the categories outlined in the Supplementary Notice of Export Licensing Procedures (ECO Notice STU/1, Issue 14) dated November 1996. Please note, however, that software programs of the type covered by your enquiry do require an export licence if exported in a tangible form, (e.g. on floppy disc or CD ROM) and a licence application form should be submitted. Although The Import, Export and Customs Powers (Defence) Act 1939, Council Regulation (EC) No. 3381/94, The Export of Goods (Control) Order 1994 and the Dual-Use and Related Goods (Export control) Regulations 1995 do not contain any provisions covering the export of technology by intangible means, the absence of regulations under the above Orders does not mean that export by intangible means is totally free from obligations. The attached points to Note on the Transfer of Technology by Intangible Means should be carefully considered. Clearly, the government would prefer that exports such as yours be made by tangible means only, under the authority of an export licence. You can obtain further information and advice on the procedures for obtaining an export licence from the DTI's Export Control Organisation Enquiry Unit on 0171-215-8070. To assist in the processing of a subsequent licence application, on the items referred to in this letter, please quote the reference number on this letter or send a copy of this letter with your application. this assessment has been made on the information given in your letters dated 18 December and 30 January 1997 and attachments.** *I stated that I would only being making KeyRing available via the Internet. ** I described how the program worked and that it used the Blowfish algorithm I received a copy of ECO Notice STU/1 Ref: STU/9/3/2 Issue 14 which refers to weapons of mass destruction. I also received a two page attachment as follows. TRANSFER OF TECHNOLOGY BY INTANGIBLE MEANS POINTS TO NOTE 1. The Import, Export and Custom Powers (Defence) Act 1939, Council Regulation (EC) No. 3381/94, The Export of Goods (Control) Order 1994 and the Dual-Use and Related Goods (Export control) Regulations 1995 do not contain any provisions covering the export of technology by intangible means. 2 However this does not mean that there are no controls on intangible technology or that, as an exporter, you are free from obligations: - United Nations Act 1946: in certain circumstances, some intangible transfers of technology might constitute a breach of one of the Orders made under this Act implementing sanctions; but none of the Orders controls intangible technology transfer as such; - Official Secrets Act 1989: technology developed under government contract which falls into one of the categories of information protected by the Act is also covered because the Act prohibits the transfer by whatever means; - Copyright conditions apply in certain cases; - Patents Act 1977 contains relevant provisions; - Contractual obligations may apply. 3. You must refer to legal advisers to check what applies in your own case. 4. Government is aware of the potential for abuse of the spirit of export controls. If it appears HMG's export control policies are being undermined, then further action may have to be considered. 5. HMG works with exporters in pursuit of the policy of preventing the spread of weapons of mass destruction. Public support for this policy is strong. 6. Exporters whose actions work against that policy risk damaging their good reputations with regulatory authorities and the public: and both domestically and internationally. 7. The public relations and longer term economic costs of any such action must be set against any apparent advantages which may be gained. 8. Advise against any employee embarking on such a course of action without consulting the officer responsible for export control policy compliance. 9. Hard to see what practical advantage there is to exporters in exporting technology by intangible means because they could get licences anyway if no concerns about the export itself. 10. And if concerns are sufficient for a licence to be refused, what reputable exporter would wish to export it by any means? Policy Unit Export Control and Non-Proliferation Division (XNP) DTI January 1996