Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.project > #12776 > unrolled thread

several questions /Debian Source Code build 11.3/related to Unrestricted Encryption Source Code Notification Commodity

Back to article view | Back to linux.debian.project

Contents

  several questions /Debian Source Code build 11.3/related to Unrestricted Encryption Source Code Notification Commodity Екатерина Лапшина <ekater896@gmail.com> - 2022-04-13 16:00 +0200
    Re: several questions /Debian Source Code build 11.3/related to Unrestricted Encryption Source Code Notification Commodity "Andrew M.A. Cater" <amacater@einval.com> - 2022-04-13 16:20 +0200
      Re: several questions /Debian Source Code build 11.3/related to Unrestricted Encryption Source Code Notification Commodity Paul Wise <pabs@debian.org> - 2022-04-14 10:40 +0200
        Re: several questions /Debian Source Code build 11.3/related to Unrestricted Encryption Source Code Notification Commodity "Andrew M.A. Cater" <amacater@einval.com> - 2022-04-14 16:20 +0200

#12776 — several questions /Debian Source Code build 11.3/related to Unrestricted Encryption Source Code Notification Commodity

[Multipart message — attachments visible in raw view] — view raw

Good afternoon!



We are planning to use Debian Source Code build 11.3 (the “Software”) in
Russia and have several questions related to Unrestricted Encryption Source
Code Notification Commodity (
https://www.debian.org/legal/notificationforarchive, “Notification”) and
export restrictions of the US Export Control Act ("EAR").



In your Notification you mention that Debian is free access code
(accordingly we suppose that it can be EAR99 or Not subject to EAR). At the
same time you refer to the exception TSU specified in Part 740.13 EAR
(however, paragraph e(1) is missing in the text we saw
https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-740/section-740.13).
You also refer to the cryptography functionality thank can trigger
exception ENC as well



Accordingly we would like to know whether:

(1)   the Software can be freely distributed, including in Russia, due to
being EAR99 or Not subject to EAR

(2)   the Software is subject to other ECCN (please specify, which one) and
can be distributed only subject to exceptions (TSU, ENC or other - please
specify)



Thank you

[toc] | [next] | [standalone]

#12777

On Wed, Apr 13, 2022 at 04:44:02PM +0300, Екатерина Лапшина wrote:
> Good afternoon!
> 
> 

Good afternoon, Ekaterina
> 
> We are planning to use Debian Source Code build 11.3 (the “Software”) in
> Russia and have several questions related to Unrestricted Encryption Source
> Code Notification Commodity (
> https://www.debian.org/legal/notificationforarchive, “Notification”) and
> export restrictions of the US Export Control Act ("EAR").
> 
> 

Only source code: no binaries? The source code requirement is an old one - see
below - and effectively disappeared a long time ago.

This all dates initiallly from 200/2001 - Ben Collins was the Debian Project
Leader then.

The legal opinion then from US lawyers is at https://www.debian.org/legal/cryptoinmain.en.html.

At one point, we maintained cryptographic software in a separate "non-US" 
archive. That's not been necessary for approximately 15 or 20 years.

> 
> In your Notification you mention that Debian is free access code
> (accordingly we suppose that it can be EAR99 or Not subject to EAR). At the
> same time you refer to the exception TSU specified in Part 740.13 EAR
> (however, paragraph e(1) is missing in the text we saw
> https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-740/section-740.13).
> You also refer to the cryptography functionality thank can trigger
> exception ENC as well
> 

The review by the NSA went long ago. Debian has treated the code as being
exportable worldwide but has not normally accepted new official mirrors in 
countries subject to US sanctions like Iran, Syria or Cuba.

I'm unaware of Russian law at the moment: it is possible that import and
use in Russia would be legitimate under Russian law.
> 
> 
> Accordingly we would like to know whether:
> 
> (1)   the Software can be freely distributed, including in Russia, due to
> being EAR99 or Not subject to EAR
>

This appears to be the case, at least de facto.

> (2)   the Software is subject to other ECCN (please specify, which one) and
> can be distributed only subject to exceptions (TSU, ENC or other - please
> specify)
> 

Various people have asked about ECCN over the years: it seems that our 
software is acceptable for US export and import. I am NOT a registered lawyer
- none of this should be taken as legal advice.
> 
> 
> Thank you

With every good wish, as ever,

Andy Cater

[toc] | [prev] | [next] | [standalone]

#12785

[Multipart message — attachments visible in raw view] — view raw

On Wed, 2022-04-13 at 14:14 +0000, Andrew M.A. Cater wrote:

> The review by the NSA went long ago. Debian has treated the code as being
> exportable worldwide but has not normally accepted new official mirrors in 
> countries subject to US sanctions like Iran, Syria or Cuba.

There has been an official mirror for Iran ftp.ir.debian.org on and off
since around 2014. The first mirror in Iran seems to have been added to
the mirror list in 2013. There are currently six different mirrors in
Iran but no public mirrors in Syria/Cuba in the mirrors list though.

> I'm unaware of Russian law at the moment: it is possible that import and
> use in Russia would be legitimate under Russian law.

There already are Russian Debian derivatives like Astra Linux, so
presumably this is fine.

https://wiki.debian.org/Derivatives/Census/AstraLinux

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [next] | [standalone]

#12786

On Thu, Apr 14, 2022 at 04:27:28PM +0800, Paul Wise wrote:
> On Wed, 2022-04-13 at 14:14 +0000, Andrew M.A. Cater wrote:
> 
> > I'm unaware of Russian law at the moment: it is possible that import and
> > use in Russia would be legitimate under Russian law.
> 
> There already are Russian Debian derivatives like Astra Linux, so
> presumably this is fine.
> 
> https://wiki.debian.org/Derivatives/Census/AstraLinux
> 
> -- 
> bye,
> pabs
> 
> https://wiki.debian.org/PaulWise

Ekaterina,

To follow up to this:

https://www.debian.org/mirror/list suggests that there are already six
mirrors within the Russian Federation while one of them is an official
country top-level mirror of Debian.

Bandwidth varies: I'd suggest contacting the administrators there
to see how usable it is. You may also find that a local university
or higher education institution may have a private Debian mirror.

ftp.ru.debian.org appears to be at campus.mephi.ru
[National Research Nuclear University : MEphI] and the 
administrator's email is mirror-private@ut.mephi.ru 

That suggests that there is no particular problem either from
Debian or from within Russia. Any situation may change but you
will probably get the best information by talking to Russians
using/administering/responsible for Debian systems.

https://www.debian.org/international/Russian suggests two
Debian mailing lists. We also appreciate that not all our
documentation / websites / Wiki pages are translated but
https://www.debian.org/index.ru.html may also give you
useful information in Russian if this is of benefit.

With every good wish,

Andrew Cater

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.project

csiph-web