[3158] in cryptography@c2.net mail archive
My life as a Kiwi arms courier
daemon@ATHENA.MIT.EDU (Peter Gutmann)
Sat Aug 8 19:46:43 1998
From: pgut001@cs.auckland.ac.nz (Peter Gutmann)
To: cryptography@c2.net
Reply-To: pgut001@cs.auckland.ac.nz
X-Charge-To: pgut001
Date: Sun, 9 Aug 1998 03:28:27 (NZST)
Inspired by Matt Blaze's arms courier story, I decided to try the same thing
over here just to see what would happen. First, the paperwork: Earlier this
year I wrote to the Ministry of Foreign Affairs and Trade (MFAT) to see what
their idea of NZ's temporary export rules was (although the US, whose crypto
export policy NZ follows word for word, has temporary export rules, NZ doesn't
have any rules, or at least it didn't until I asked about them). My original
letter is available from
http://www.cs.auckland.ac.nz/~pgut001/policy/mfat_5l.html.
They replied to say that temporary export was OK, and that I should apply for
a standard export permit, listing myself as both the source and destination of
the export. The reply is available from
http://www.cs.auckland.ac.nz/~pgut001/policy/mfat_5r.html.
A few months later when my travel arrangements had been finalised, I submitted
the export permit application,
http://www.cs.auckland.ac.nz/~pgut001/policy/permit.html, along with a
covering letter, http://www.cs.auckland.ac.nz/~pgut001/policy/mfat_6l.html.
Shortly afterwards, the temporary export was approved,
http://www.cs.auckland.ac.nz/~pgut001/policy/mfat_6r.html.
Because Matt ran into all sorts of problems when he tried to export his goods
and only caught the plane on time because US Customs bent over backwards to
help him, I decided to determine well in advance of my departure time what
would be necessary. A good two weeks in advance I wandered over to the
Customs Building in Auckland and showed the permit to the people in charge of
exports.
The person behind the counter looked at it. He looked at the source of the
export (Auckland, New Zealand) and the destination of the export (Auckland,
New Zealand).
Pause.
"What are you exporting?".
I flipped a 3 1/2" disk onto the counter.
He looked back at the form, then at the disk. He went out to the back and
called someone else, who also looked at the form. They looked at each other.
They may have looked elsewhere as well to see whether there was a hidden
Candid Camera anywhere. Eventually, one of them asked:
"That's a COCOM thing".
"Precisely".
They both went out the back again.
Other people started to turn up at the counter and formed a queue behind me.
I could see activity going on out the back, but noone returned to the counter.
More people arrived and joined the queue. "Oh no, I've caused a deadlock in
the Customs kernel! They'll have to fly the Comptroller of Customs up from
Wellington to do a Stop-A and reboot the building!".
Eventually they came back, but didn't really know what to do with this permit.
I asked whether I had to show it to anyone at the airport when I left or
returned, but there was no need to do that (or, more precisely (as Matt found
out) there was no way to handle this at the airport, and noone there would
have known what to do with it). One of them recommended that I carry the
permit with me when I leave the country, and be prepared to present it if
challenged. I thanked them and left.
A fortnight later I left the country with my permit and the software on disk.
I was very careful to keep it on me at all times, and not allow anyone access
to it (it was never more than a foot or two away from me for the week in which
I was in the US). When I needed to distribute the software, I FTP'd it from a
site in Europe (it's freely available throughout the entire world) and gave it
to anyone who wanted it, but I made sure that the officially exported copy
never left my side and was never copied, as required by the permit. Before I
left the US I erased the disk to ensure I didn't violate US export laws, but
in any case I was never checked leaving the US. The only crypto I carried out
of the country with me was protected by the First Amendment (an autographed
copy of "Breaking DES", and a huge stack of crypto books which didn't contain
source code).
I returned as I'd left without incident. The signs at the airport mentioned
food, drugs, guns, etc, but not floppy disks (which, in any case, was blank),
so I came in through the "nothing to declare" section.
Well, that's what it's like to be a kiwi arms courier, and that's what it's
like to see our export controls in action.
Peter.
Postscript:
The permit allowed a 20,000km round trip of my software under the condition
that I end up at the same place where I started. It's folk wisdom that
dealing with bureaucrats is like running around in circles, but I may be one
of the few people on earth to have an official government permit to do this.
I should also mention that, as in the US case, NZ Customs were extremely
helpful in trying to resolve a completely bizarre export situation, and that
this writeup is in no way meant to cast blame on them for not knowing how to
handle MFAT's nonsensical requirements.
