Exporting DES-XL

[Batman]

what is the law reguarding the expoting of DES-XL equipped radios.

I had a guy from Europe that wanted to know if i would export. the other country of interest is also canada since that and US will be the bulk of my bidders.

[alex]

Europe is sketchy... I'd say no...

Canada should be OK.

disclaimer: I'm not the legal authority on the above.

[jnglmassiv]

Hey! I thought we were supposed to be searching the forums for answers to our questions..

Anyhow, I did and found this:
http://batboard.batlabs.com/viewtopic.php?t=3470

which then links to this:
http://www.bxa.doc.gov/Encryption/19Oct2KFactsheet.html

Basically, for Europe, any EU nation plus a few others are A-OK. NOT OK is exporting this stuff to "axis of evil" countries. There's not really any surprises on this list.

[Cowthief]

Hello.

The government has taken a LOT of stuff of the controlled cryptographics list.
http://www.bxa.doc.gov/Encryption/Default.htm
There were several dozen people who had gotten in trouble for bringing back US secure capable radios.
The house took care of that after it was pointed out that the radios in question were made in China!

[mr.syntrx]

It should be fine. The US Government allows the exportation of far stronger cryptography than DES-XL to everywhere except evil countries like Libya.

[k4wtf]

As has been stated, you should be find but, if you want to make sure, you can call your local I.C.E. office and ask them. I personally won't export any securenet capable radios and especially not hybrids. That's my personal policy though.

You might also want to consider that while you may be able to legally export the radios and modules, the KVL might still be barred from export.

John

[Dan562]

Hello Bob,

The U.S. Department Of Commerce provides the Export Controls classifications known as ECCNs, anyway DES and DES-XL are classified as 5A992 NR for Hardware and 5D992 NR for Software for Securenet Products. Generally most if not all Crypt being exported to the off shore overseas approved country list receive the DVI-XL Encryption. I can remember that Iran, Iraq, Syria are on the no sell list but there are about 4 or 5 other countries that can not be sold this type of encryption.

Dan

[RadioSouth]

Certainlly the easy choice here is to sell them domestically only. I recently had an inquiry about sending to an FPO address, sure selling these to someone in the Military seems to be A-OK but could turn into a problem as the ultimate destination is unknown. A unknowing violation could turn into a real problem, and to the OK countries is an export permit required ? Too many technicalities to be bothered in my opinion.

[Dan562]

Hello RadioSouth,

You are absolutlely correct when shipping any /\/\ product off shore, overseas and out of the USA. The U.S. Department Of Commerce and the
Department Of State have no sense of humor when shipping items to unknown ultimate destinations such as an APO or FPO. The products could be tagged as a breach of our National Security (Agency) especially during our War in Iraq. The items could fall into enemy hands compormising the safety of our U.S. Military Commanders and Soldiers ability to communicate with each other while serving over there.

In April 2003, the U.S. government changed the fines from $1,000.00 / day to $10,000.00 / day, imprisonment in Leavenworth U.S. Prison for up to 10 years to the individuals and the company they are employed with. It's not a warm fuzzy feeling knowing this information.

Most U.S. citizens don't understand shipping /\/\ Talk About radios to their sons and daughters through an APO addresses while serving in the military overseas fall into this same situation regarding the fines and imprisonment. The /\/\ Talk About radios are assigned with an Export Control Classification Number for use in the U.S.A. only! The people read about these units have PL Codes and assume it's the same as Crypto, NOT! So many of our own soldiers have been ambushed while using these radios. The enemy can listen in on all of there communications while they're unknowningly setting themselves up to be ambushed. Again this could be considered a breach of our National Security, compromising the safety of our U.S. Military Commanders and Soldiers.

What seems harmless in one person's view can do more damage and lost of lives when backing up to evaluate the whole picture. Know what you are exporting and where it will ultimately be received. International sales are a lot more involved than selling the product, Frequebcies, RF Output Levels, Licensing, Export Controls are just a few items to keep in mind.

Dan

[jnglmassiv]

From the link in the third post:

Exports to the European Union (EU) plus an additional eight countries: U.S. exporters can export and reexport all encryption items, except cryptanalytic products and their related technology, immediately to the 15 EU member states and Australia, Czech Republic, Hungary, Japan, New Zealand, Norway, Poland and Switzerland without a license (i.e., under a license exception). Exports to worldwide offices of firms, organizations and governments headquartered in these nations and Canada are also permitted. U.S. exporters can ship their products under this new policy immediately after submitting a commodity classification request to BXA, rather than waiting for the review and classification to be completed.

and

Products Incorporating Short-Range Technologies: Products that incorporate components providing cryptographic functionality limited to short-range wireless technology can be exported to any end-user without a license (i.e., under a license exception), without a technical review or reporting requirements. These include consumer products such as audio devices, cameras, video recorders, computer accessories, hand held devices, mobile phones and household appliances (e.g., refrigerators, washing machines and microwave ovens) that communicate with each other via short range wireless technologies.

To sum: Anything goes to the 15 EU members and the handfull of others listed and all 'handheld, short-distance wireless' devices are OK anywhere without and special licensing or other handling. I don't see 'short range' defined anywhere, however.

[oh2lak]

I've exported a lot of DES-XL from US to Finland (EU).

No trouble at US customs or export offices, no troubles in Finnish customs etc.

I cant see why not export encryption. There is life outside US too, many true encryptions live outside just because.

..
Erik

[Timmuc]

I´m from germany and you can buy all the motorola encryption stuff here (new). My problem is, that there are no uesd saber parts available here. And at ebay.com where it is available nobody want to shipp to germany. So if it is legal why is nobody shipping?

[Cam]

People think that they are more likely to get ripped off and it would be harder to sue someone in another country.

[RadioSouth]

PayPal's seller protection policy does not apply to many areas out of the
U.S. (basically if the payment bounces to PayPal they reimburse themselves out of your account). Also the level of delivery confirmation required from PayPal is not possible when shipping to some countries, so if the item gets lost or the buyer reports non-receipt (yes, some play the system and know the loopholes) your also out. Many types of Money Orders have been forged and a M.O. coming from out of the country which the seller has no familiarity with is much riskier. It's unfortunate that many folks out of the U.S. don't have access to a lot of the items being offered on EBay but International shipping poses risks concerning M.O.'s and the maze PayPal puts sellers thru (they won't risk their funds on many International payments and put the risk back on the seller) along with mandating unattainable proofs of delivery it becomes not worthwhile for many. Also add on the fact that International buyers usually want their items via Postal so they can avoid brokers fees.
I don't blame them but this adds on an additional burden, Customs forms must be filled out (simple) but they must be presented in person at the postal counter (how long is the line for this?) versus using the automated shipping system in the lobby. So for our International friends, sorry but it's much more complicated than you might think. It would be nice if PayPal would get on board and assume at least 'some' risk and process International payments reasonably but apparently they only want the gravy when it's poured over another pile of gravy.

[jnglmassiv]

My problem is, that there are no uesd saber parts available here.

Of course, I'd look to Batlabs for Saber parts. I'd feel much more confident shipping to a Batmember than a mystery shopper on Ebay.

[borisf]

Hint: The website stated above has moved. Replace all bxa with bis in order to get the links working again.

[AEC]

I am pretty certain exporting DES-XL would be quite simple, given the fact that the algorithm is now 'old' and no longer thought to be 'secure', especially for government use, so I doubt you need much in the way of paperwork to satisfy the customs/border patrol/DEA/FBI/CIA...yada yada.

AES256 on the other hand...that's where you will get the big red flag, it's too new and is supposedly the 'ultimate' in secure comms, so if this is what you are possibly looking to export, forget it, and NOT to the 'axis of evil' nations...no way Jose.

DES-XL and 'lesser' forms of encryption are pretty much now granted an open door for export to 'good' and 'approved' nations, but even AES256 will be given a much closer scrutiny even to them I'm sure.

Choose wisely grasshopper....Or you may be under Herr Bush's foot and branded a terrorist aid in these days of wanton paranoia.

[MattSR]

AES256 on the other hand...that's where you will get the big red flag, it's too new and is supposedly the 'ultimate' in secure comms, so if this is what you are possibly looking to export, forget it, and NOT to the 'axis of evil' nations...no way Jose.

I work for a large American firm here in Sydney and we recently rolled out hard disk encryption on our laptop/desktop fleet. Its part of the global standard and it is being rolled out worldwide. Its a product called Pointsec and guess what!!! it uses AES256. The exact same algo that you are saying cannot be exported.

People in the US are far too protective/paranoid when it comes to encryption - at the end of the day these are all Type 3 algorithms which are perfectly legal to export to non axis of evil type countries.

[AEC]

AES256 on the other hand...that's where you will get the big red flag, it's too new and is supposedly the 'ultimate' in secure comms, so if this is what you are possibly looking to export, forget it, and NOT to the 'axis of evil' nations...no way Jose.

I work for a large American firm here in Sydney and we recently rolled out hard disk encryption on our laptop/desktop fleet. Its part of the global standard and it is being rolled out worldwide. Its a product called Pointsec and guess what!!! it uses AES256. The exact same algo that you are saying cannot be exported.

People in the US are far too protective/paranoid when it comes to encryption - at the end of the day these are all Type 3 algorithms which are perfectly legal to export to non axis of evil type countries.

While AES256 is software form may be legit, but if you use it for voice encryption, there's where the rub is.

I don't export anything and do not deal with customs, so this surely doesn't affect me in the slightest.

But I'd be willing to bet, if said AES256 was being exported to 'X' nation or nations from the U.S, you can bet there will be a lot of paperwork following along with it, tracking it to its final destination and to anybody that even touches the blasted things.

And yes, OUR government is paranoid about everything, and it's INSANE also, they see terrorists at every bus stop, Seven-11 store and just about everywhere...Sad how it all got so quickly out of hand with no signs of stopping or slowing.

[MattSR]

While AES256 is software form may be legit, but if you use it for voice encryption, there's where the rub is.

I don't export anything and do not deal with customs, so this surely doesn't affect me in the slightest.

But I'd be willing to bet, if said AES256 was being exported to 'X' nation or nations from the U.S, you can bet there will be a lot of paperwork following along with it, tracking it to its final destination and to anybody that even touches the blasted things.

And yes, OUR government is paranoid about everything, and it's INSANE also, they see terrorists at every bus stop, Seven-11 store and just about everywhere...Sad how it all got so quickly out of hand with no signs of stopping or slowing.

Hi AEC, I agree with everything you have said though I cant see how the intended application affects the export laws - the laws only apply directly to the algorithm, not the type of data it is being used to encrypt (be it a word file on a hard disk or a voice codec)

There is a difference in that ASTRO radios use a hardware module for the encryption as opposed to a peice of software, but its still the same algorithm.

On a different note, Australian government has low laws regarding the importation of encryption, but there are harsh penalties for exporting restricted stuff. (DES and AES are fine tho)

Cheers,
Matt

[mr.syntrx]

AES wasn't even developed in the USA. It was developed in Belgium.

It's hardly the "ultimate" in cryptography, anyway. There are far stronger, openly available algorithms out there.

If you want to keep your conversations private, it really isn't hard at all to build your own equipment to do so. Snag a couple of preloaded AMBE ICs for $20 each, a cheap ARM development board for $30, a few bucks for a codec and the audio electronics, throw some bits of software together from the Internet, toss it in a nice case and you're good to go. A couple of days work, at the most.

[MattSR]

Precisely - Its original name was Rijndael (pronounced rindale) which comes from the names of the two guys that created it.

Its a completely open standard too - its been published extensively and it even has been made into a freeware application:-

http://www.aescrypt.com/


DES is exportable basically anywhere these days. Originally, yes there were export restrictions sactioned by the US and others but these days DES is considered largely a joke by the cryptographic community. You can send it where ever you want really.

Cheers,
Matt

[oh2glg]

DES is exportable basically anywhere these days. Originally, yes there were export restrictions sactioned by the US and others but these days DES is considered largely a joke by the cryptographic community. You can send it where ever you want really.

Cheers,
Matt

Sorry to bring an old thread up again, but it seems that there's still a lot of misunderstanding about whether DES-XL can be exported outside US to e.g. Europe.

It still is fully legal to do that. No problems what-so-ever to sender nor receiver from Customs. Nope, no black helicopters following your life. Nada.

Also, some of them who deline to send DES-XL stuff to outside US seem to be hiding behind this "it's not legal - sorry" excuse, but actually it seems that shipping outside US is the problem.

It really isn't any different than shipping it as domestic mail, except you'll have to fill out ONE small form, CN-22, Customs Declaration. Quite easy, really! (A short description of contents, value in $, weight. That's all!)

Or am I wrong? Those of you who have sent Moto-stuff around can verify this. If payment clears out (with Paypal - no problems) it's as easy as sending chocolate to your grandpa.

So, why to bring up this again? I'm really becoming more and more frustrated while trying to get DES-XL module to my AS III and XTS 3000R. It's really boring to hear same lame excuses. Maybe my money isn't green enough? :D

*sigh*

Edit: Some typing errors corrected

[escomm]

Yes, you are wrong about how international shipping works here in the US.

Domestic shipments can be done online and picked up by your carrier, or dropped off at the local post office. International shipments require you to stand in line and have the clerk scan the package and ensure everything is filled out properly (even if you paid the int'l postage online). Lines at the post office can be anywhere from non-existant to all the way out the door. Many post offices are always busy like that, so standing in line can take a big chunk of time.

According to the USPS, you can have a courier come to your house or office to pick up an int'l shipment, however there is a $13.95 "on demand pickup" charge.

Of course, FedEx and UPS will pick up the package at your door, but I'm sure you're aware they charge 500-1000% more for int'l shipments than the USPS.

Me personally, I have no problem sending stuff int'l if it's something I can send int'l, but I won't stand in line so it may take several days til I swing by the post office and there's no line.

[High_order1]

Another thing I have run across, too:

It doesn't matter how right you are. If everwho is checking packages at the Customs point of (whatever the term for leaving the country is) decides you are shipping contraband, you can expect a long, hard road trying to recover your item.

I can easily see where an examiner sees a radio with too many buttons on it and says, hmm, crypto, and sets it aside.

I bought a fiber optic scope from Hong Kong. The Customs boys determined it was a nuclear weapons maintenance item because the case was marked EOD, and it took the intervention of a Congressman to retrieve my item.

So, I have a policy that if it even seems sketchy or has a potential for argument, I don't ship it overseas. And, I sell a lot of stuff to deployed Soliders and contractors.

-Shawn

[RESCUE161]

Another thing I have run across, too:

It doesn't matter how right you are. If everwho is checking packages at the Customs point of (whatever the term for leaving the country is) decides you are shipping contraband, you can expect a long, hard road trying to recover your item.

I can easily see where an examiner sees a radio with too many buttons on it and says, hmm, crypto, and sets it aside.

I bought a fiber optic scope from Hong Kong. The Customs boys determined it was a nuclear weapons maintenance item because the case was marked EOD, and it took the intervention of a Congressman to retrieve my item.

So, I have a policy that if it even seems sketchy or has a potential for argument, I don't ship it overseas. And, I sell a lot of stuff to deployed Soliders and contractors.

-Shawn

I will second that as a Maxtrac that I mailed someone ended up in the hands of Customs and they drilled holes in it. I guess they were trying to look inside with a scope? Anyway the drill also went through one of the circuit boards. They did take it completely apart, lost most of the screws and then taped it back together. It eventually made it to the guy I sold it to. Needless to say he was pissed. So I was out a radio. The only thing I had was a bunch of Kuwaiti Customs tape all over it and the box that I shipped it in. I was in no way even near Kuwait (I was shipping from a military base in Rota, Spain to a small town in Georgia in the US. For some reason, it got on the wrong plane and the Kuwaiti guys destroyed it.

[mr.syntrx]

While AES256 is software form may be legit, but if you use it for voice encryption, there's where the rub is.

I don't export anything and do not deal with customs, so this surely doesn't affect me in the slightest.

But I'd be willing to bet, if said AES256 was being exported to 'X' nation or nations from the U.S, you can bet there will be a lot of paperwork following along with it, tracking it to its final destination and to anybody that even touches the blasted things.

And yes, OUR government is paranoid about everything, and it's INSANE also, they see terrorists at every bus stop, Seven-11 store and just about everywhere...Sad how it all got so quickly out of hand with no signs of stopping or slowing.

Hi AEC, I agree with everything you have said though I cant see how the intended application affects the export laws - the laws only apply directly to the algorithm, not the type of data it is being used to encrypt (be it a word file on a hard disk or a voice codec)

There is a difference in that ASTRO radios use a hardware module for the encryption as opposed to a peice of software, but its still the same algorithm.

On a different note, Australian government has low laws regarding the importation of encryption, but there are harsh penalties for exporting restricted stuff. (DES and AES are fine tho)

Cheers,
Matt

Australia has certain restrictions on export of cryptography, as we're required to have as signatories to the Wassenaar Arrangement.

There are no restrictions on the use of cryptography within Australia, or on the import of cryptography into Australia. To export cryptographic equipment using a symmetric cipher with a key length greater than 56 bits, you must have a permit from the Department of Defence, but typically applications for export to specific end users in "friendly" countries like the USA, UK and a fair chunk of Western Europe have a good chance of approval, and applications for products using well known cryptographic algorithms and common key-lengths go through with little or no trouble.

Exporting restricted goods without a license will earn you up to 5 years in jail, and/or a $110,000 fine.

The only question I have regarding the regulations on this topic is whether DES is considered to be a cipher with a key length > 56 bits. While the key length is said to be 64 bits, only 56 bits of that are actually used for cryptographic operations. I'll contact DTCC next week and find out.

[mr.syntrx]

The only question I have regarding the regulations on this topic is whether DES is considered to be a cipher with a key length > 56 bits. While the key length is said to be 64 bits, only 56 bits of that are actually used for cryptographic operations. I'll contact DTCC next week and find out.

DES is exportable.

[escomm]

Re-reading this thread.... sending radios out of the country that use PL tones is a threat to national security???

[mr.syntrx]

WTF?