[liberationtech] FinFisher is now controlled by UK export controls

[Ryan Gallagher]

Export controls on cryptographic items is not a new development in the UK or anywhere else - https://www.gov.uk/specialist/export-of-cryptographic-items

The question in the case of FinSpy was whether it was to be classed as a Dual Use item. The UK government appears to now be recognising that FinSpy is indeed a Dual Use item and falls under Annex I of EC export regulations. Annex I is designed to control exports of goods (cryptographic or otherwise) "designed or modified for military use." So what the UK government is implicitly recognising here is that FinSpy can be used as a military tool -- a bit like a weapon -- and should be subject to the same controls. If they implement this, it will mean Gamma will have to make an application for every sale it wants to make outside of the EU, and this will have to be assessed with the Dual Use criteria in mind. So any export will have to be considered in terms of "the respect of human rights and fundamental freedoms in the country of final destination." If the UK government suspects it could be used for internal repression in the country of final destination, for example, they will (theoretically at least) refuse the export.

In short, this is progress. Good work Eric.

Ryan

> Date: Mon, 10 Sep 2012 18:39:51 +0000
> From: jacob at appelbaum.net
> To: liberationtech at lists.stanford.edu
> CC: eric at privacy.org
> Subject: Re: [liberationtech] FinFisher is now controlled by UK export	controls
> 
> Eric King:
> > Hi all,   
> > 
> > I thought this list would be interested to know that the British Government has decided to place FinFisher under UK export controls. There are a ton of questions that remain to be answered, and it's only part of the bigger goal to control the export of surveillance technology, but it's a good first step!
> > 
> >> In a letter sent earlier in August to Privacy International's lawyers Bhatt Murphy, a representative of the Treasury Solicitor stated:
> >>  
> >> The Secretary of State, having carried out an assessment of the FinSpy system to which your letter specifically refers, has advised Gamma International that the system does require a licence to export to all destinations outside the EU under Category 5, Part 2 (‘Information Security’) of Annex I to the Dual-Use Regulation. This is because it is designed to use controlled cryptography and therefore falls within the scope of Annex I to the Dual-Use Regulation. The Secretary of State also understands that other products in the Finfisher portfolio could be controlled for export in the same way."  
> >>  
> >> Press release is here:
> >> https://www.privacyinternational.org/press-releases/british-government-admits-it-has-already-started-controlling-exports-of-gamma
> >>  
> >> Full copy of the letter: https://www.privacyinternational.org/sites/privacyinternational.org/files/downloads/press-releases/2012_08_08_response_from_tsol.pdf
> > Best,  
> > 
> > Eric
> 
> This is absolutely fucking horrible. They're controlling it based on
> *cryptography* after we WON the cryptowars? What. The. Fuck. And even
> worse, they must require a license? And they don't state categorically
> that they'll deny it on some kind of humanitarian or anti-crime related
> basis?
> 
> I mean, I am sure this is the result of a lot of hard work by many
> people and I don't mean to imply any disrespect. Did this just undercut
> the work from the 90s? Wany people explicitly fought hard to win the
> decision of having our free speech rights apply to the net for code as
> speech.
> 
> Argh,
> Jake
> 
> --
> Unsubscribe, change to digest, or change password at: https://mailman.stanford.edu/mailman/listinfo/liberationtech
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.stanford.edu/pipermail/liberationtech/attachments/20120910/c94b1b3a/attachment.html>