Re: WARNING: Crypto software to be included into main Debian distribution

[Sam Hartman <hartmans@debian.org>]

[CC trimmed.]

>>>>> "Florian" == Florian Lohoff <flo@rfc822.org> writes:

    Florian> Sorry - that is simply not true - As an effect of the
    Florian> laws the fact that i knowingly export non-us to "t7"
    Florian> countries now has no effect. Germany=20 has no laws on
    Florian> this. If we have the new crypt-in-main my export might
    Florian> fall back to the original uploader of the package as
    Florian> he/she/it is knowingly multi-step exporting packages to
    Florian> t7 countries.

Except of course that multi-step exporting is legal.  Well, is likely
to be legal in most cases.  If I'm operating a US mirror, and you tell
me that you're copying my mirror outside the US for the explicit
purpose of making it available to T7, then I might care.

Instead, please tell me that you're hapilly setting up a mirror of my
software outside the US, so anyone who wants it can get it.

Then, by exporting to you, I'm not knowingly exporting to a T7
country; I'm knowingly exporting to someone outside the US who wants to make a copy of my software available.

They are not bound by US laws; they may make the software available to
a T7 country.

The question that would come up in a US court would be whether I as a
mirror operator knew that your primary purpose (or one of the major
purposes) in setting up the mirror was to export to T7 country.

Please don't set up a mirror with that explicit purpose; so long as
there are mirrors outside the US that T7 countries can get to, we
don't need special mirrors for the primary/major purpose of exporting
to them.


I am not a lawyer; thi is just my understanding after reading about
these issues for months.

I suggest that if you care you wade through the long document James
pointed you at and it should become clear that even the US does not
believe it can enforce US laws on non-US mirror operators exporting to
people outside the US.