Subject: [93attendees] U.S. Attendees: Export Control Documentation??

From: "Livingood, Jason" <[email-masked]>
Date: Sat, 25 Jul 2015 09:46:26 +0000

Hi - I was wondering if any other U.S.-based attendees have been asked by their employers to fill out "export control forms" for the laptop you took along to the IETF focuses on so-called "dual use" technologies.

This was the first time during international travel that I was asked to do so and, frankly, the whole thing seems kind of odd. Our legal folks said that all large companies do this, especially companies like Cisco, Apple, Facebook, Google, etc., but I have never heard another IETF participant mention it.

The form I filled out had a special emphasis on any software that contained encryption, and for each line item of software (e.g. MS Office) they located an Export Control Classification Number (ECCN) that they then included in whatever they sent to the U.S. government (presumably the Dept. of Commerce, Dept. of State, Dept. of Treasury).

Thanks for any feedback!

Jason

---

From: Warren Kumari <[email-masked]>
Date: Sat, 25 Jul 2015 13:21:46 +0200

On Saturday, July 25, 2015, Livingood, Jason <
[email-masked]> wrote:

>   Hi – I was wondering if any other U.S.-based attendees have been asked
> by their employers to fill out “export control forms” for the laptop you
> took along to the IETF focuses on so-called “dual use” technologies.
>
>  This was the first time during international travel that I was asked to
> do so and, frankly, the whole thing seems kind of odd. Our legal folks said
> that all large companies do this, especially companies like Cisco, Apple,
> Facebook, Google, etc., but I have never heard another IETF participant
> mention it.
>
>
Me neither... Odd....

W

> The form I filled out had a special emphasis on any software that
> contained * encryption*, and for each line item of software (e.g. MS
> Office) they located an Export Control Classification Number (ECCN) that
> they then included in whatever they sent to the U.S. government (presumably
> the Dept. of Commerce, Dept. of State, Dept. of Treasury).
>
>  Thanks for any feedback!
>
>  Jason
>

-- 
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf

---

From: Diego Garcia del Rio <[email-masked]>
Date: Sat, 25 Jul 2015 12:42:06 +0100

I Work for one of the big companies and regularly need to deal with export
control. But never for a laptop I was carrying for my own.

If I had to ship equipment to a conference, yes. But for personal carry
never

On Jul 25, 2015, at 12:21, Warren Kumari <[email-masked]> wrote:

Me neither... Odd....

W

_______________________________________________
93attendees mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/93attendees

---

From: Samuel Weiler <[email-masked]>
Date: Sat, 25 Jul 2015 08:23:56 -0400 (EDT)

On Sat, 25 Jul 2015, Livingood, Jason wrote:

> Our legal folks said that all large companies do this, ...

One of the fun things about large organizations is that there are so 
many data points to choose from.  Nevermind having different practices 
in different parts of the organization, white noise in the 
implementation can make all sorts of unlikely claims technically 
correct.

"The US government ran out of toilet paper!"  Yeah, they probably did. 
Somewhere.

> I was wondering if any other U.S.-based attendees have been asked by 
> their employers to fill out ?export control forms? for the laptop
> you took along to the IETF...

I have never been asked to do export control paperwork while working 
for SPARTA (a defense contractor) and its successors.

On two IETF trips they asked me to carry a special laptop provided 
just for the one trip.  But there was no paperwork.

-- Sam

---

From: Richard Lamb <[email-masked]>
Date: Sat, 25 Jul 2015 14:08:58 +0000

I didn't have any issues either and had a few routers, pc s, smart cards, piv cards, used cac card readers (which I hand out), Mac mini all of which I use regularly for training in distant places.

Such regulations would certainly put a damper on training efforts encouraged and supported by other usg departments.

R

Sent from my iPhone

On Jul 25, 2015, at 07:22, Warren Kumari <[email-masked]<mailto:[email-masked]>> wrote:

On Saturday, July 25, 2015, Livingood, Jason <[email-masked]<mailto:[email-masked]>> wrote:
Hi - I was wondering if any other U.S.-based attendees have been asked by their employers to fill out "export control forms" for the laptop you took along to the IETF focuses on so-called "dual use" technologies.

Me neither... Odd....

W

Thanks for any feedback!

Jason

--
I don't think the execution is relevant when it was obviously a bad idea in the first place.
This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants.
   ---maf
_______________________________________________
93attendees mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/93attendees

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Sat, 25 Jul 2015 19:56:40 +0000

No. But I did just last week get asked (required) to fill out a survey about whether I participate in acquisition / distribution of software across int'l boundaries to or from company-owned assets. This may be a sign of things to come.
Barbara

Hi – I was wondering if any other U.S.-based attendees have been asked by their employers to fill out “export control forms” for the laptop you took along to the IETF focuses on so-called “dual use” technologies.

Thanks for any feedback!

Jason

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Sat, 25 Jul 2015 23:09:57 +0200

Some of this may be a response to a US government rulemaking around
implementation of the Wassenaar Agreement on expert controls; the rules are
currently written amazingly broadly and would prohibit intra-company
transfer of security vulnerability information and proofs of concept. (It
had a noble purpose in terms of controlling offensive surveillance
technologies to repressive regimes.)

The IAB recently issued a statement aimed to be responsive to that:

https://www.iab.org/documents/correspondence-reports-documents/2015-2/iab-statement-on-the-trade-in-security-technologies/

For more background you might be interested in reading a joint civil
society comment from CDT, Collin Anderson, EFF, HRW, and OTI

blog post from myself and Andy Sayler:

Coalition Seeks Revisions to Potentially Restrictive Wassenaar Proposal
https://cdt.org/blog/coalition-seeks-revisions-to-potentially-restrictive-wassenaar-proposal/

Full comment:

https://cdt.org/files/2015/07/JointWassenaarComments-FINAL.pdf

On Saturday, July 25, 2015, STARK, BARBARA H <[email-masked]> wrote:

>  No. But I did just last week get asked (required) to fill out a survey
> about whether I participate in acquisition / distribution of software
> across int'l boundaries to or from company-owned assets. This may be a sign
> of things to come.
> Barbara
>
>
> Hi – I was wondering if any other U.S.-based attendees have been asked by
> their employers to fill out “export control forms” for the laptop you took
> along to the IETF focuses on so-called “dual use” technologies.
>
>

-- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[email-masked]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871