US export control

This document is adapted after a similar one on the fprint wiki, licensed under the Creative Commons Attribution-ShareAlike 3.0 License. The analysis below was performed by Daniel Drake in 2007 and it applies directly to the Madagascar project. In what follows, the US Export Administration Regulations are referred to as "EAR".

Justification for export safety

The starting point is section 732.2 of the EAR, which provides a set of steps for determining the scope of the EAR and whether an export falls below it.

Step 1: Items subject to the exclusive jurisdiction of another Federal agency

This step basically says "if your export falls under International Traffic in Arms Regulations, then follow ITAR and ignore the EAR". The Madagascar software does not fall under ITAR.

Madagascar does not appear to fall under the exclusive jurisdiction of any other Federal agency. On to Step 2.

Step 2: Publicly available technology and software

This step says:

"Determine if your technology or software is publicly available as defined and explained at part 734 of the EAR"

So the distribution of Madagascar now falls into part 734...

Part 734

Before we reach the real meat, here are some informative quotes from 734.1:

"This part is the first step in determining your obligations under the EAR. If neither your item nor activity is subject to the EAR, then you do not have any obligations under the EAR and you do not need to review other parts of the EAR."

"Conversely, items and activities that are not subject to the EAR are outside the regulatory jurisdiction of the EAR and are not affected by these regulations."

So, we're looking for something that makes us "not subject to the EAR".

Some software-related notes in part 734.2 explain that export of software includes release of EAR-subjected software in a foreign country and release of EAR-subjected source code to a foreign national. Similar logic applies to reexports.

734.2(9) starts talking about software again, but specifically about encryption, which does not concern this code.

Moving onto section 734.3, we see:

"Except for items excluded in paragraph (b) of this section, the following items are subject to the EAR:"

Skipping over those items, we reach paragraph (b).

"(b) The following items are not subject to the EAR:"

Item 3 of that paragraph says:

"Publicly available technology and software [...] that are already published or will be published as described in §734.7 of this part;"

Moving down to section 734.7, "PUBLISHED INFORMATION AND SOFTWARE":

"(a) Information is "published" when it becomes generally accessible to the interested public in any form, including:"

"(1) Publication in periodicals, books, print, electronic, or any other media available for general distribution to any member of the public or to a community of persons interested in the subject matter, such as those in a scientific or engineering discipline, either free or at a price that does not exceed the cost of reproduction and distribution"

It is clear that open source software, available as free download to anyone and everyone, would be classified as published information according to the above definition. Going back to 734.3, this indicates that such software is not subject to the EAR. Falling back further to section 734.1, we see that distributors of Madagascar do not have any obligations under the EAR and [...] do not need to review other parts of the EAR.

Back to 732.2 (step 2)

"(1) If your technology or software is publicly available, and therefore outside the scope of the EAR, you may proceed with the export or reexport if you are not a U.S. person subject to General Prohibition Seven."

General Prohibition Seven is briefly described in section 732.3(j) and applies to all U.S. nationals.

General Prohibition 7

736.2(b)(7) contains the exact text for GP7. This says:

• You may not export certain chemicals (not relevant here)
• You may not provide certain assistance to foreign nationals regarding encryption (not relevant here)
• You may not do anything mentioned in 744.6(a) or 744.6(b)
  • 744.6(a) covers contributions to nuclear explosives, missiles, or biological weapons. It also covers knowingly assisting an illegal export, and helping people build chemical weapons factories. (entirely irrelevant)
  • 744.6(b) says: BIS may decide to impose export license requirements for an export at will, if they feel it may contribute to something in (a) above.

So, it does not seem possible for GP7 to apply to someone regarding the export of Madagascar.

Having completed section 734.2, and it has been deduced that the Madagascar distribution is not subject to the EAR.

Further justification

Supplement 1 to part 734 contains an example which is directly relevant to the situation of the Madagascar project.

• Question A(1): I plan to publish in a foreign journal a scientific paper describing the results of my research, which is in an area listed in the EAR as requiring a license to all countries except Canada. Do I need a license to send a copy to my publisher abroad?
• Answer: No. This export transaction is not subject to the EAR. The EAR do not cover technology that is already publicly available, as well as technology that is made public by the transaction in question (§§734.3 and 734.7 of this part). Your research results would be made public by the planned publication. You would not need a license.

Later on in the same supplement, there are two more related questions:

• Question G(1): Is the export or reexport of software in machine readable code subject to the EAR when the source code for such software is publicly available?
• Answer: If the source code of a software program is publicly available, then the machine readable code compiled from the source code is software that is publicly available and therefore not subject to the EAR.

• Question G(2): Is the export or reexport of software sold at a price that does not exceed the cost of reproduction and distribution subject to the EAR?
• Answer: Software in machine readable code is publicly available if it is available to a community at a price that does not exceed the cost of reproduction and distribution.

Discussion with U.S. Exports office in Washington

For further clarification, Mr. Drake contacted the U.S. exports office in Washington and explained the situation. They confirmed that such distribution is not subject to the EAR.

Statement of the authors of Madagascar

Should open-source published material become export-controlled through future changes in EAR, the authors of Madagascar (as listed in the AUTHORS.txt file in the source code distribution) maintain that the statement from the Seismic Unix distribution applies to the Madagascar project as well:

"We believe that Madagascar is a low technology product that does not appear on the Department of Commerce CCL list of restricted exports. Accordingly, we believe that our product meets the qualifications of an ECCN (export control classification number) of EAR99 and we believe it fits the qualifications of NRR (no restrictions required), and is thus not subject to export restrictions of any variety."

This opinion was made public by the project lead (Sergey Fomel) on the rsf-user mailing list on 2011-05-09.

Conclusions

Madagascar can be exported freely out of the U.S.