Hi, all, I am a Debian user and a Union-side labor lawyer in Massachusetts. I have lurked briefly on this list and have followed the above thread. I have very limited knowledge about US export controls, so what I have to say will deal with generalities and should be taken for what it is, friendly personal advice, not professional legal advice.
First, Debian should be congratulated for seeking legal guidance before acting. I realize this is coming at a very late date, but I am concerned that Debian may be relying to too great an extent on the guidance it has obtained. My primary concern is that the guidance was given on July 31, 2001. Perhaps the passage of seven months should not, normally, be considered significant. The regulations themselves may not have changed. I don't know. The prosecutorial atmosphere has certainly changed since September 11. This is particularly true with respect to any relations with the T7. The guidance obtained specifically warns: "Please note that the regulations are subject to change. We recommend that you obtain your own legal advice when attempting to export." The suggestion that further advice be sought raises questions to me as to whether the attorney preparing what he refers to as a "guideline" intended the guideline to be relied upon. The crypto-in-main thread may also have parsed the advice from Attorney Thomsen to a greater degree than was originally intended. Finally, the thread pays a great deal of attention to where the ultimate boundary between lawful and unlawful lies. This should not necessarily be Debian's only legal concern. SPI, Debian and its developers should also consider the possibilty of becomming the target of a legally incorrect overly-zealous suit or prosecution and the costs associated with one. I do not mean to suggest that Debian should not move the crypto packages into main, only that further current advice be sought from Attorney Thomsen. Yours, Streph
