Chatting about Cryptography and Exploit Regulations

Key Takeaways

all these doesn't matter after government spend secure crypto are you oh I just had this conversation recently with another person are you aware that cryptography is already heavy Lea regulated because as you remember cryptography was very important for Wars for you know encrypting communication so you still have actually a lot of regulations about crypto cryptography especially in terms of export export of cryptography from the United States the export of cryptography technology and devices from the United States was severely restricted by yes law until 1992 but was gradually erased until 2000 some restrictions still remain regulations were introduced as part of munitions controls which required license to export cryptographic methods and even their descriptions because it's kind of like a dual-use thing right cryptography was used a lot in in war so this knowledge for exporting this kind of knowledge outside of a nation is kind of a dual-use thing so there are regulations about if you are allowed to do this or not each look each country has their own kind of funny laws in that regard for example in Germany we have a lot of I really hate Wikipedia so please where's this coming from how is this politically loaded what are you talking about so for example in Germany we have export controls when it comes to exploits exploits or any kind of hacking tools our team duo use you can use them for basically military you know attacks or whatever so so if you want to sell an exploit to somebody - if I as a German want to sell an exploit to somebody I would first have to register and report that that I want to sell it and to whom I want to sell it and what I want to sell with the stay I need to ask the government if I'm allowed to sell it this will then go through several points inside of the German government basically different ministries including for example our Intelligence Agency we'll have a look over the exploit I want to export and for without giving me any reason any of these different parties that it will go through can decline my request for exporting that exploit this creates for example problems with if you have an exploit and you want to present this as a at a conference if we haven't published it before and you want to present that at the conference what you are doing is you have a secret exploit knowledge like if you want to go and make a owed a presentation at some conference in some other country for example go to the US or even go to somewhere in Asia to a Chinese conference or so you have an au day that you want to present I'm exporting it at this point it it's it's it's my knowledge I travel into a different country and then I present my and then I've released that knowledge about the expert in a different country that I'm exporting it at this point I'm cross I'm taking it out of Germany I'm taking it out of Germany and go into a travel into a different country with my with my laptop that has this exploit on it and then once it's published then yeah that's export control yeah what I'm saying is there are a lot of regulations about this kind of stuff and even with cryptography there are a couple of things wasn't there also this thing PGP publish book get around like I obviously have an absolutely no clue what I'm talking about I'm not into policy and not into law I don't understand all these different things all I'm just saying is there's a lot more regulations and laws that you may not be aware of that make things kind of crazy here for example apparently this is a thing PGP released at source code as a book to get around US export laws but yeah what I'm saying is like especially with like the discussion in Australia right now with cryptography things I think some people kind of forget that the internet is full of regulations already and especially in terms of exploits and cryptography you quickly run into military regulations of kind of export things already it's kind of really interesting I mean it the thing is these things also are not really applied we have these export controls in Germany but basically nobody cares about them there's not a single case where it was enforced court case or anything like that but they could change from one day to another it could be that Germany suddenly takes it super seriously I've heard that for example in Israel they also have export controls with exploits and apparently they are a lot more stricter but that's just what I heard I don't know like they take it really really seriously but I don't know I I don't I don't have a source for that that's just somebody what somebody told me so I for example also know that the Fraunhofer Institute which is like a kind of an academic research institution in Germany that do also security research that they when they go present their findings at some conference outside of Germany they go through the regulation steps they always tell the government with what kind of devices they travel outside of Germany and what exactly is on those devices and what they basically export and take out of Germany because they are closer to the government I guess with because of academia and being a research institution getting a lot of money from the government and stuff I guess so so I've talked to these kind of to these researchers before and they taught me about that that they do this every time it sounds a good way for the government to take advantage of free sort of the private sector you just you just I understand what what what where you're coming from but you just have to like imagine this to be weapons it's it's if you if you kind of and tell yourself okay these exploits are kind of like weapons and now think about the weapon industry then this is heavily regulated what kind of ammunition you are allowed to manufacture to sell and to export that's the main debate is it a weapon or knowledge well in the end you know yes we can kind of talk about the semantically I don't know exactly how the legal argument goes I'm just thinking you know do you sell the weapons directly or do you just sell the plans the CNC data how to mill some kind of gun is that is that not the same as the weapon you know I don't know in the in the entries you know they are lost and the question is always are they enforced and then how are they enforced they can always be interpreted in weird ways the same law might be decided differently from one judge to the next judge we simply don't know we just know that these regulations and laws exist and we know that they might be able to be interpreted in that way we also know that they haven't been interpreted that way yet but it's something to think about and something to pay attention to and something to see how it develops and you know all of this is fluid the government's changed new laws I introduced old law all the regulations fall away it's constantly changing it's it's just I think it's just I don't really know I wasn't really affected by it yet but I do think it's kind of interesting to kind of remind yourself of this complexity sometime you know I find it all so silly to consider an exploit a weapon or a dual use export control was in our kind of thing you know I find that silly myself too but in you also can understand that you could argue it in that way you know it's kind of like a thought experiment a legal kind of philosophical debate at this point let's say they are weapons because they could theoretically disrupt important infrastructure of a country okay if we if we define a weapon as something that can damage infrastructure and damage the you know the infrastructure of a country also like a bomb what if then yes some of these exponent might fall under that and many don't you know a wordpress exploit it's definitely not important for that for national secure but I know like if there's a crazy until any backdoor that maybe might be important I don't know [Music]