Subject: french crypto regulations relating to personal encryption usage by visitors?

From: Bill Sommerfeld <[email-masked]>
Date: Fri, 01 Apr 2005 13:11:09 -0500

As the next IETF meeting will be in Paris, and France has had something
a reputation for placing strict controls on the use of cryptography, I
took a look..

(This is, of course, a matter of potential concern to those of us who
carry laptops with encryption software for personal use to every IETF
meeting...)

It appears that France may have recently substantially liberalized its
regulation of cryptography.  A site at:

http://rechten.uvt.nl/koops/cryptolaw/cls2.htm#fr

has what claims to be a summary.  There appears to be a personal use
exemption of some sort but there's no mention of re-export of the laptop
you imported when you entered the country..

I'm not particularly worried as most of these laws are rarely enforced
in other countries.  Anyone have a better idea?

						- Bill

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Dean Anderson <[email-masked]>
Date: Fri, 1 Apr 2005 18:35:36 -0500 (EST)

The IETF could write a letter to the appropriate Ministry to ask for a
special exemption.

This may also motivate them to continue the liberalization of the crypto
laws.

'Rarely enforced' doesn't mean that they should be ignored.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Sam Hartman <[email-masked]>
Date: Fri, 01 Apr 2005 20:51:29 -0500

>>>>> "Bill" == Bill Sommerfeld <[email-masked]> writes:

    Bill> has what claims to be a summary.  There appears to be a
    Bill> personal use exemption of some sort but there's no mention
    Bill> of re-export of the laptop you imported when you entered the
    Bill> country..

Same deal with the US.  Take a look at 15 CFR 740.14.  While aliens
can bring crypto into the US, the exemption that would allow US
citizens to re-export their laptop does not apply to aliens.  It has
been a while since I read 15 CFR 740, although I have read it since
the 2002 changes.  As I recall, while the baggage exemption (740.14)
doesn't allow aliens to re-export their crypto, the US government is
not completely without understanding of the needs of visitors.  I seem
to recall that aliens are allowed to re-export their personal
allowance of shotguns and shotgun shells which they imported.  This
export is controlled by the same provision that would allow US
citizens to export crypto for personal use.

For many programs, it seems like 15 CFR 740.15 (e) or 15 CFR 740.17
will allow re-export.  I'm not a lawyer; I just had to argue too much
about this stuff with lawyers.

---

From: Sam Hartman <[email-masked]>
Date: Fri, 01 Apr 2005 21:06:20 -0500

>>>>> "Sam" == Sam Hartman <[email-masked]> writes:

>>>>> "Bill" == Bill Sommerfeld <[email-masked]> writes:

    Sam> For many programs, it seems like 15 CFR 740.15 (e) or 15 CFR
    Sam> 740.17 will allow re-export.  I'm not a lawyer; I just had to
    Sam> argue too much about this stuff with lawyers.

OK, I apparently haven't read these in a while.  It's 15 CFR 740.13 (e) not 15 CFR 740.15 (e).  

--Sam

---

From: "Anthony G. Atkielski" <[email-masked]>
Date: Sat, 2 Apr 2005 05:06:20 +0200

> you imported when you entered the country..

The legislation on cryptography in France is vast and complicated; I
believe it still holds the record for severity of restrictions in the
developed world.  However, the laws have been greatly liberalized in
recent years, and those laws that remain seem to be quite loosely
enforced.

In theory, from what I've been able to distill of the existing
legislation, you're supposed to declare exportation of any type of
crypto software, and unrestricted crypto applies only to effective key
lengths of 128 bits or less.  In practice, I don't know if any of this
is enforced for individuals travelling on business or for other reasons,
since almost everyone with any kind of PC today has some sort of
encryption software on the PC.

> in other countries.  Anyone have a better idea?

They appear to be rarely enforced in France as well.

France has traditionally been powerfully influenced by the strong
lobbying of military and spook agencies, both of whom predictably
believe that nobody shold have crypto but them.  Even so, the country
has very gradually come to realize that the information infrastructure
of the nation is impossible to keep secure without widespread and
unrestricted use of crypto, and I think this realization, plus the
embarrassment of having draconian legislation while other industrialized
nations have long ago seen the light, has encouraged the considerable
liberalization of the law and the very light enforcement of what
remains.

So in summary, you shouldn't have anything to worry about, but I'm not a
lawyer, and this isn't legal advice.

---

From: "Anthony G. Atkielski" <[email-masked]>
Date: Sat, 2 Apr 2005 05:09:52 +0200

> The IETF could write a letter to the appropriate Ministry to ask for a

It can't.  Declarations and requests for authorization must come from
the vendor or the user.

But in practice, most types of crypto are lightly regulated, or not at
all, if they use 128 effective bits or less (and I'm not aware of any
special efforts to verify key lengths).  "Effective" means,
incidentally, that the difficulty of cracking the encryption by brute
force must be equal to or less than 2^128 operations.

> 'Rarely enforced' doesn't mean that they should be ignored.

True, as it facilitates selective enforcement.  But in some countries
the official procedures are so complex and long that nobody can adhere
to them in practice, and so they are largely unenforced, except when the
government finds it convenient to enforce them.  Sort of a Catch-22.

---

From: Ole Jacobsen <[email-masked]>
Date: Fri, 1 Apr 2005 22:00:06 -0800 (PST)

If there was a pattern of random customs agents trying to "inspect" your
laptop for crypto, I would worry---mostly about the delay that this would
cause rather than anything else.

But, having travelled in and out of France for the last decade+ I can
categorically state that this has NEVER happened to me nor anyone I
know of/have heard of.

So, trying to get an "IETF Excemption", Sam, for a non-issue seems like
just a way to raise a bunch of flags we don't need raised.

Let's let the sleeping (clueless) dogs sleep.

Ole

Ole J. Jacobsen
Editor and Publisher,  The Internet Protocol Journal
Academic Research and Technology Initiatives, Cisco Systems
Tel: +1 408-527-8972   GSM: +1 415-370-4628
E-mail: [email-masked]  URL: http://www.cisco.com/ipj

---

From: Jaap Akkerhuis <[email-masked]>
Date: Sat, 02 Apr 2005 14:36:28 +0200

Neither have I. Nor have crypto laws seem a problem taking a lap top
over US borders.

    
I'm amazed about what non-issues are raised everytime the IETF is
not meeting in the USA.

Real serious issues seem to be waved away.  To my opinion, one
threat to the international nature of the IETF are the continuous
increasing difficulties entering the US. This morning I read in the
local papers that starting the 25th of october the Visa-Waiver
program will grind to a halt for (most) Europeans.

	jaap

---

From: "Elwyn davies" <[email-masked]>
Date: Sat, 2 Apr 2005 14:07:09 +0100

<<snip>>

> program will grind to a halt for (most) Europeans.
This depends on whether your passport issuing authority is getting it
together with some new requirements for machine readability.
 
See (e.g.) http://stockholm.usembassy.gov/Consulate/mr_passports.html

Summarizing: if you get a new passport on or after 26 Oct 2005, the Visa
Waiver Program will only apply if the passport includes machine readable
biometric data embedded in a 'contactless' chip (facial recognition data
apparently).

This doesn't apply if your passport is already machine readable (ie. Most
current European passports) and is issued before 26 Oct 2005.

Otherwise you will need to go through the hassle of getting a visa.

The last paragraph of the web page above indicates that 'several' European
governments won't be ready by 26 Oct.

So if your passport which previously gave you access to the VWP is close to
expiry (or like mine getting close to full) it might be good to renew it
before the critical date.

Given the current level of paranoia and the extreme politics of fear which
the US government is currently using to justify its actions, it is unclear
how long it will be before non-biometric passports will be totally
disallowed, but getting a new passport soon could give you a few extra
months of lower hassle.  It will be interesting (but doubtless frustrating)
to see what this does to US immigration throughput when it is introduced.

Regards,
Elwyn

---

From: Sam Hartman <[email-masked]>
Date: Sat, 02 Apr 2005 08:35:58 -0500

>>>>> "Jaap" == Jaap Akkerhuis <[email-masked]> writes:

    Jaap> I'm amazed about what non-issues are raised everytime the
    Jaap> IETF is not meeting in the USA.

I think there is some bias on both sides.  The US folks would love to
show that either the rest of the world is as bad as the US or there
are problems having IETF meetings elsewhere so we should have them in
the US so it is nice and cheap for the US attendies.  Similarly the
rest of the world would like to show that we should have the meetings
closer to them.  This creates a lot of FUD on both sides.

Also, most of us are engineers.  We'd like to know that what we are
doing is absolutely legal.  We don't want to know that if some customs
agent really wants to make our life difficult they could and it would
be hard for us.  "Your trip will be safe unless you manage to make
someone at the airport hate you," is not as reassuring as "our
algorithm has been proved correct."

Some of the people ar actually concerned about the issues they bring
up.  Some people, are just interested in confirming there is no
problem.

Let's try and reduce the pro-US and anti-US FUD.  In particular let's
try and stick to facts and accept that it is the practical reality
that matters, not the worst possible thing that could happen if a
country decided to enforce its most draconian laws.

Whenever people spread FUD on either side it makes me discount their
statements.  That's bad.  It means that if there is a real problem it
will take longer to recognize it.  Useful facts would be information
about people who have had trouble getting to an IETF meeting.  This is
probably not the right list and this is certainly not the right
thread, but someone should be collecting that information so we can
act on it and make *informed* judgements about where to hold our
meetings.

Meanwhile I'll mock every country's laws and try to do so equally;
they all seem deserving.

---

From: Jaap Akkerhuis <[email-masked]>
Date: Sat, 02 Apr 2005 15:37:08 +0200

Since I get more private reactions, let me paraphrase the
article:

---
Dutch travellers need a a visum after the 25th of October. The US
Congres doesn't want to delay requirements for digital fingerprints
in european passports.

This is the reaction in a letter from Jameson Sensenbrenner, chair
of the relevant comittee in the US Congres to the Euro commisioner
Fratini (Justice). ``The concern about the weak border control of
the US will make an extra delay difficult''.

European passports will only in 2008 be fulfill the requirements.

It will be difficult for the US authorities to prcess th visa for
the 13 million people which now are under the Visa Waiver program.

---

Well, I'm not sure how to read the following in the VisaWaferProgram
side (http://travel.state.gov/visa/temp/without/without_1990.html). It
states:

	Biometric Passports - President Bush signed legislation,
	which delays until October 26, 2005 the requirement for
	Visa Waiver Program (VWP) countries to include biometrics
	in their passports. The Department of Homeland Security now
	enrolls Visa Waiver Program travelers in the U.S.  Visitor
	and Immigrant Status Indicator Technology (US-VISIT) program
	at all airports and seaports. To read more, select News
	Release and Fact Sheet .

Seems that after 26/10/2005 (that's 10/25/2005 for americans :-)),
you need a ``biometric enabled passport''.

	jaap

---

From: "Elwyn davies" <[email-masked]>
Date: Sat, 2 Apr 2005 15:00:56 +0100

A bit more input on this subject... 

It appears that (as one could have predicted) trying to get this piece of
universal technology in place in < 10 years is going to be difficult. It
appears that there is a limited agreement on content (actually a digitized
mugshot) but very little on the nature of the chip.  Security and
interoperability are big problems (surpise, surprise) and the privacy
lobbies on both sides of the Atlantic are having a field day.

Diplomatic negotiations are ongoing to postpone the requirement (till
mid-2006) but it sounds like there are several entrenched positions around
this and whether there will be a universal standard implemented by then is a
very moot point.

See http://www.theregister.co.uk/2005/04/01/eu_bio_passport_delay/

Still, I think I might get my passport refreshed before October.

Maybe the IETF could help;-)

Elwyn

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Jaap Akkerhuis
> Sent: 02 April 2005 14:37
> To: 'IETF Discussion'
> Subject: Re: New regulations for US Visa Waiver Programme (was RE:
> frenchcrypto regulations relating to personal encryption usagebyvisitors?
> )
> 
> 
>

---

From: Henk Uijterwaal <[email-masked]>
Date: Sat, 02 Apr 2005 16:09:31 +0200

>the US will make an extra delay difficult''.

[...]

>         which delays until October 26, 2005

This is not the first time that this program has been delayed.  Originally
the biometric requirement was supposed to come into effect in 2004.  Given
that it is still 6 months before the deadline, I would not be suprised if
the US and EU discussed this issue for a few more months, then postponed it
again.

(And we nicely postponed the problem by having the fall IETF outside the
US :-)

Henk

------------------------------------------------------------------------------
Henk Uijterwaal                           Email: henk.uijterwaal(at)ripe.net
RIPE Network Coordination Centre          http://www.amsterdamned.org/~henk
P.O.Box 10096          Singel 258         Phone: +31.20.5354414
1001 EB Amsterdam      1016 AB Amsterdam  Fax: +31.20.5354445
The Netherlands        The Netherlands    Mobile: +31.6.55861746
------------------------------------------------------------------------------

Look here junior, don't you be so happy.
And for Heaven's sake, don't you be so sad.                 (Tom Verlaine)

---

From: Eric Rescorla <[email-masked]>
Date: Sat, 02 Apr 2005 06:37:44 -0800

Sam Hartman <[email-masked]> writes:

> the US so it is nice and cheap for the US attendies.

FWIW, the strategy I advise for Americans in this situation is to push
for meetings in Canada. The parts of Canada where meetings actually
get held are generally fairly close to the US border and you don't get
the anti-US responses.

-Ekr

---

From: Dean Anderson <[email-masked]>
Date: Sat, 2 Apr 2005 17:50:02 -0500 (EST)

On Sat, 2 Apr 2005, Jaap Akkerhuis wrote:

> To my opinion, one threat to the international nature of the IETF are
> the continuous increasing difficulties entering the US. This morning I
> read in the local papers that starting the 25th of october the
> Visa-Waiver program will grind to a halt for (most) Europeans.

And as an American, I'd just like to say that this is an embarrassment to 
me.  Free trade, but not free travel. How can you have one without the 
other?

In the NYTimes this week was an article about a Uruguayan Flight
Instructor who worked at the Oklahoma Flight School attended by Moussaui
(sp?) the so-called 20th hijacker.  He was very cooperatative with the
FBI, and wound up on a no-fly list, apparently as a result of his
cooperation--The FBI found him helpful, so they wanted to keep track of
him.  So now he isn't allowed to learn to fly light business jets, the
logical next step in the career of a professional pilot.  Sigh. I have to
find a hole to crawl into, to hide my shame.

		--Dean

---

From: Carsten Bormann <[email-masked]>
Date: Sun, 3 Apr 2005 07:13:39 +0200

On Apr 02 2005, at 15:35 Uhr, Sam Hartman wrote:

> Similarly the
> closer to them.

You are making an assumption about the motives of the people that point 
out the continuing decline of suitability of the US as a meeting place 
for an international organisation.
This assumption may suggest itself, but it certainly does not apply to 
all of those making the argument.
I for one live in central Europe, but would be happy with all further 
meetings located in Seoul or Yokohama (if organized as well as these 
were).
I would be less happy with Pyongyang, although the distance from here 
is almost the same.

The US/non-US dichotomy in the argument probably stems from a 
difference of experience:
Of course, US residents experience less of a problem traveling to US 
destinations, so they subjectively may still consider those 
destinations viable IETF venues.

(I'm not arguing for an all-out change of IETF policy tomorrow, but 
this little misunderstanding needs to be set straight.
Canada does look more attractive every day, though, so I'm quite happy 
with the current plans.)

Gruesse, Carsten

---

From: Eric Rescorla <[email-masked]>
Date: Sat, 02 Apr 2005 23:39:08 -0800

Carsten Bormann <[email-masked]> writes:

> You are making an assumption about the motives of the people that
> point out the continuing decline of suitability of the US as a meeting
> place for an international organisation.

Maybe not, but I doubt it's coincidence that the people who are
most enthusiastic about Europe are European and that the people who
seem most enthusiastic about Asia are Asian.

> this little misunderstanding needs to be set straight.

I'm not sure what you think the misunderstanding is. That people
are often self-interested and prefer to minimize travel time?
I doubt that's a misunderstanding at all.

-Ekr

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 03 Apr 2005 09:47:10 +0200

The key change that people from visa waiver countries need to
understand is this (from the official site that Elwyn kindly mentioned):

> BIOMETRIC PASSPORT REQUIREMENT:
> 
> October 26, 2005 also marks the deadline by which VWP travelers
 > will be required to present passports incorporating biometric
 > identifiers, if their passports were issued on or after October 26, 2005.

Since the next two IETFs are outside the US, this will only
affect IETF travellers by March 2006 (location TBD, but probably US).

However, for Vancouver in November, avoid transit through the US if you
will have a passport that doesn't meet the above rule and you don't
plan to get a visa.

    Brian

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Brian E Carpenter
IETF Chair
Distinguished Engineer, Internet Standards & Technology, IBM

Elwyn davies wrote:
...
> See (e.g.) http://stockholm.usembassy.gov/Consulate/mr_passports.html
...

---

From: Eric Rescorla <[email-masked]>
Date: Sat, 02 Apr 2005 23:54:15 -0800

> seem most enthusiastic about Asia are Asian.

The word "generally" should appear in the above sentence.

And of course, not that it needs saying, but the people most
enthusiastic about North America are generally North American, which,
purely as a mattter of population distribution, mostly means the
United States.

-Ekr

---

From: "Anthony G. Atkielski" <[email-masked]>
Date: Sun, 3 Apr 2005 10:21:06 +0200

> algorithm has been proved correct."

Unfortunately, many societies operate in just that way: there is a huge
difference between the letter of the law and enforcement. And the law
itself is so restrictive that nobody can actually obey it in real life.
So everyone is effectively violating it to some effect, which means that
the government (and its representatives) can selectively enforce it
against anyone who displeases it, while allowing the majority to violate
the law without consequences.

This principle of selective enforcement allows a government to control a
population far more effectively than mere laws alone.  Virtually all
countries engage in it to some extent, but it is far worse in some
countries than in others.  For example, it's much worse in France than
it is in the United States.

The general principle is to make sure that everyone is somehow doing
something illegal, so that anyone can be arrested and thrown in jail if
it becomes convenient to do so. The laws are designed to guarantee that
nobody can fully obey them, and selective enforcement keeps the masses
from complaining about them (most people equate non-enforcement with the
absence of a law in the first place, even though they are two very
different things).

--
Anthony

---

From: [email-masked]
Date: Sun, 3 Apr 2005 08:03:52 -0300

> I doubt that's a misunderstanding at all.

I don't agree with this assessment.  I think that if the decision where 
to continue the North American meeting allocation, just requiring them 
all to be in Canada, most of the complaints would come from people in 
the US and not from Europeans even though the US travel time would 
still be optimized.

a.

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 03 Apr 2005 16:08:13 +0200

Let's assume that the crypto regulations are a red herring as far
as Paris is concerned. I'd like to state the obvious - every location
we choose for an IETF is a compromise. Jordi Palet took on the job of
writing a first draft of site selection criteria. Things like visa
requirements and crypto regulations should surely figure in that,
and so should travel time, weather, etc. But we have to give a lot
of weight to meeting facilities and the budget, as well.

    Brian

[email-masked] wrote:
> the US and not from Europeans even though the US travel time would still 
> be optimized.
> 
> a.
> 
>

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 03 Apr 2005 09:45:23 -0700

[email-masked] writes:

> I don't agree with this assessment.  I think that if the decision
> where to continue the North American meeting allocation, just
> requiring them all to be in Canada, most of the complaints would come
> from people in the US and not from Europeans even though the US travel
> time would still be optimized.

Oh, I doubt that. There were complaints about all the meetings in the
US long before 9/11 and the new more onerous immigration behavior.
-Ekr

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 4 Apr 2005 10:11:08 +0200

On Sat, Apr 02, 2005 at 05:06:20AM +0200,
 Anthony G. Atkielski <[email-masked]> wrote 
 a message of 58 lines which said:

> The legislation on cryptography in France is vast and complicated;

Yes and the last update was in last july so you have to apply a lot of
diffs to know the current situation (think of DNS-related RFCs...).

> believe it still holds the record for severity of restrictions in
> the developed world.

Yes.

> However, the laws have been greatly liberalized in recent years,

Yes.

> and those laws that remain seem to be quite loosely enforced.

It seems they have never been enforced at all. I remember talking in
the Parliament at a crypto hearing, wearing the famous RSA-in-3-lines
T-shirt and claiming "I use crypto illegally" and of course nothing
happened to me.
 
> In practice, I don't know if any of this is enforced for individuals
> travelling on business or for other reasons, since almost everyone
> with any kind of PC today has some sort of encryption software on
> the PC.

Practically speaking, I agree we whould ignore the problem.

---

From: "Anthony G. Atkielski" <[email-masked]>
Date: Tue, 5 Apr 2005 00:50:37 +0200

Stephane Bortzmeyer writes:

> It seems they have never been enforced at all.

The powers that be choose various laws to persecute those whom they seek
to bring down; presumably no recent target has been in a situation such
that prosecution on the basis of crypto regulations was the easiest way
to silence or neutralize him.

> Practically speaking, I agree we whould ignore the problem.

I agree, keeping in mind, of course, that there is always a risk as long
as the laws remain on the books.  Of course, that's the whole idea.

--
Anthony

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Tue, 05 Apr 2005 01:31:28 +0200

>as the laws remain on the books.  Of course, that's the whole idea.

Dont worry, we just have it in the books to retaliate when USA blocks 
Roquefort, Bordeaux, Renault, Alcatel or Airbus sales. In August politics 
on both sides should be on vacations.
jfc

---

From: "Anthony G. Atkielski" <[email-masked]>
Date: Tue, 5 Apr 2005 01:50:49 +0200

JFC (Jefsey) Morfin writes:

> Roquefort, Bordeaux, Renault, Alcatel or Airbus sales.

I wasn't talking about using the laws against foreigners.  Usually they
are used against French nationals who become a little too uppity for the
powers that be (e.g., by achieving success without having gone to the
right school, or without the right family connections, or without the
right last name).

--
Anthony

---

From: Ole Jacobsen <[email-masked]>
Date: Mon, 4 Apr 2005 17:03:49 -0700 (PDT)

I heard a rumor that North Korea is planning to invade France in August to
take possesion of strategic food and wine reserves, and to prove that they
are reading this list. I think they'll ignore crypto however.

:-)

ole

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Tue, 05 Apr 2005 03:22:24 +0200

>are reading this list. I think they'll ignore crypto however.

Heard that one too?

The confusion with computers comes from they are the last crypto-communists.
But I understand we intoxicated them, explaining them they could obvioulsy 
go through Afghanistan and Iraq, but USA were much safer with plenty of 
stocks on the way, from the anti-French boycott.
Belgium too helped. They were the first and only rfided passport compliant 
country. Until US imigration discovered rfided passports were great for 
terrorists to spot their target. So, they gave all their passports to North 
Korea, for free.
When you come in August just do not fly through Brussels, you could be 
stoped as a Belgium North Korean... and your crypto investigated.
But IMHO your only real risk is that they keep your old passport taking it 
for an over crypted smart new one.

Otherwise it should be OK.
If you make it, give me a ring.
But I may be on the beach: I do not speak Korean so....
jfc