<story><title>Intel subsidiary fined for unlawful export of software that enables encryption</title><url>http://www.goodwinprocter.com/Publications/Newsletters/Client-Alert/2014/1015_Software-Companies-Now-on-Notice-That-Encryption-Exports-May-Be-Treated-More-Seriously.aspx</url></story><parent_chain><item><author>Someone1234</author><text>How utterly pathetic.&lt;p&gt;Encryption export restrictions are an absolute joke. I can go read a Wikipedia article right now that heavily details the inner workings of most block ciphers. They&amp;#x27;re still fining people for exporting anything over 64 bits (which is most things), even if almost every individual let alone government has access to the technological knowledge to reproduce such encryption at home.&lt;p&gt;Seems like this fine is about them exporting a custom Linux distro&amp;#x27; with all the normal encryption libraries still in-place (e.g. 256 AES).&lt;p&gt;Why do I get the strong sense that this fine isn&amp;#x27;t really about exporting encryption and is really about Wind River failing to place backdoors into this equipment? Because frankly that makes a lot more sense than what it appears to be on the surface.&lt;p&gt;Wind River got fined for &amp;quot;something&amp;quot; to do with encryption. Now you can either take the government at their word and assume that that thing is just exporting AES 256 within a standard OS, or maybe consider it a little deeper and wonder if it was punishment for something else Wind River did or didn&amp;#x27;t do.</text></item></parent_chain><comment><author>DenisM</author><text>&amp;gt;Encryption export restrictions are an absolute joke.&lt;p&gt;I don&amp;#x27;t think you give BIS &amp;amp; NSA the credit they deserve. Experto crede. The restrictions may serve a useful purpose and if you can&amp;#x27;t see it, that doesn&amp;#x27;t mean &lt;i&gt;they&lt;/i&gt; are the ones missing the point.&lt;p&gt;Having myself had to pass the export control for one of my apps, and so having the opportunity to pour over the these regulations in great detail, I came to conclusion that the actual purpose of the crypto export regulation is not to control export of the &lt;i&gt;technology&lt;/i&gt;. That sort of restrictions is impossible to implement, as you noted, and it&amp;#x27;s also quite unnecessary.&lt;p&gt;The actual purpose of the law is to prevent export of &lt;i&gt;expertise&lt;/i&gt;. Implementing a crypto &lt;i&gt;system&lt;/i&gt; that would be secure end-to-end is pretty much impossible without being an expert, and even then it&amp;#x27;s exceptionally hard. The best chances belong to a team of experts with a track record of fruitful collaboration and rich history in a particular area. Unlike bits and pieces of code, cohesive teams of experts are relatively easy to keep track of.&lt;p&gt;The way this control regime works, is that the entirety of the regulation revolves around two questions: 1) Are you supplying a turn-key end-to-end system to the client? 2) Are you supplying services to setup  a complete, tailored system for the client? If the answer is &amp;quot;yes&amp;quot; to either question, that raises the red flag for the BIS&amp;#x2F;NSA, and they want to see what&amp;#x27;s going on there. Otherwise it&amp;#x27;s just a minor bureaucratic hoop to jump through. You are certainly welcome to export bunch of crypto code, and they even have a special open-source exception to the paperwork requirements.&lt;p&gt;So, you may disagree with the goals of this regulation, but it&amp;#x27;s certainly not a joke you make it out to be.</text></comment>
<story><title>Intel subsidiary fined for unlawful export of software that enables encryption</title><url>http://www.goodwinprocter.com/Publications/Newsletters/Client-Alert/2014/1015_Software-Companies-Now-on-Notice-That-Encryption-Exports-May-Be-Treated-More-Seriously.aspx</url></story><parent_chain><item><author>Someone1234</author><text>How utterly pathetic.&lt;p&gt;Encryption export restrictions are an absolute joke. I can go read a Wikipedia article right now that heavily details the inner workings of most block ciphers. They&amp;#x27;re still fining people for exporting anything over 64 bits (which is most things), even if almost every individual let alone government has access to the technological knowledge to reproduce such encryption at home.&lt;p&gt;Seems like this fine is about them exporting a custom Linux distro&amp;#x27; with all the normal encryption libraries still in-place (e.g. 256 AES).&lt;p&gt;Why do I get the strong sense that this fine isn&amp;#x27;t really about exporting encryption and is really about Wind River failing to place backdoors into this equipment? Because frankly that makes a lot more sense than what it appears to be on the surface.&lt;p&gt;Wind River got fined for &amp;quot;something&amp;quot; to do with encryption. Now you can either take the government at their word and assume that that thing is just exporting AES 256 within a standard OS, or maybe consider it a little deeper and wonder if it was punishment for something else Wind River did or didn&amp;#x27;t do.</text></item></parent_chain><comment><author>AnimalMuppet</author><text>&amp;gt; I can go read a Wikipedia article right now that heavily details the inner workings of most block ciphers.&lt;p&gt;Yes, you can.  And from that, you can go implement those cyphers.  And the NSA is probably OK with that, because it&amp;#x27;s really hard to implement crypto correctly.  If I understand correctly, more crypto systems are broken because of implementation flaws than because of protocol flaws.  So if you have to implement it yourself, odds are that you will make a mistake that makes it insecure, especially if you aren&amp;#x27;t an expert on crypto.</text></comment>