Date: Tue, 16 Nov 1999 14:35:56 -0500
From: Steven J. McDonald
To: raimann@chemistry.ohio-state.edu
Cc: jim.ickes@admin.ohio-state.edu
Subject: Taking laptops abroad

PRIVILEGED -- ATTORNEY-CLIENT COMMUNICATION

Gerry --

Jim Ickes has looked into this, and it appears that it's OK to take a laptop containing ssh abroad temporarily under certain conditions, including, most importantly:

1. You don't go to Cuba, Iran, Iraq, Libya, North Korea, Sudan, Syria, or, possibly, Afghanistan, Armenia, Azerbaijan, Belarus, Tajikistan, Ukraine, Vietnam, Burma, China, the Federal Republic of Yugoslavia (Serbia and Montenegro), Haiti, Liberia, Rwanda, Somalia, or Zaire (the regulation is unclear on the latter set);
2. You take only one such laptop/software program with you;
3. You take the laptop/software with you for your exclusive personal use and not for copying, demonstration, marketing, sale, re-export, or transfer of ownership or control;
4. The laptop/software remain in your possession or the possession of another U.S. citizen or lawful permanent resident traveling with you from the time you leave the country until you return. They are considered to be in your possession if you take them in your carry-on luggage or lock them in checked luggage that travels with you on the same carrier, if you take normal security precautions such as locking them in your hotel room or a safe, and if you sleep with them under your pillow. (OK, I made that last part up.) You cannot mail them, send them in unaccompanied baggage, or transmit them electronically;
5. You maintain, for five years from the date of your trip, a record containing a self-certification that you complied with these conditions and that you have no reason to believe that the laptop/software were stolen, lost, copied, sold, or otherwise compromised or transferred while abroad; a description of the laptop/software; a list of the countries you entered and the dates of entry and exit for each; and the dates you left and re-entered the U.S.; and
6. If the laptop/software are stolen, lost, copied, sold or otherwise compromised or transferred while aborad, you report the incident to the department of State within 10 days of your return to the U.S.

For your amusement, I have attached a copy of the actual regulation (PDF file).

You may also want to read the following description of one person's attempt to comply with the even worse regulation that this regulation replaced:

http://www.epic.org/crypto/export_controls/blaze.html

Also, the law in this area is very much a moving target. The general trend over the last few years has been to loosen the restrictions (albeit slowly), but there's no guarantee that will continue. So, if you do post or distribute that message, please be sure to note that it is current information only as of right now (November 1999).

Let me or Jim know if you have any questions.

Steve