Re: [LINUX5250] BXA export notification

[Scott Klement <klemscot@xxxxxxxxxxxx>]

Yes, the "form" was a matter of writing an e-mail containing 8 or 10
pieces of info such as "location of source", "contact name", "product
name/model", etc.  very easy to do.

Thanks for following up on this.  I've been adding SSL support to many
open source apps that I work on, in all cases I'm calling external APIs,
so understanding this is useful to me.


On 19 Dec 2001, Steve Fox wrote:
> > >
> > > I'm not a lawyer, nor do I have one that I can ask.  Does anyone have
> > > access to a lawyer that this could be run past?   I'd hate to have to
> > > hire one for the purposes of free software...
> >
> > I can give it a shot, but I can't promise a fast response...IBM lawyers
> > take forever to do anything ;0)
>
> I went ahead and asked about this. I asked:
>
> "If an Open Source project dynamically links to an encryption library
> (OpenSSL), even though there is no encryption in the project itself,
> does that mean the project has to be classified as an encryption
> product? In other words, does it need to be reported to Bureau of Export
> Administration at
> http://www.bxa.doc.gov/Encryption/PubAvailEncSourceCodeNofify.html ?"
>
> and the response I got was:
>
> "No. We're not required to do anything special for open source code as
> long as it doesn't contain cryptography."
>
> All standard disclaimers apply...this is not an official legal
> statement, yadda, yadda, yadda.
>
> But I think that Scott was going to do it anyways. So no big deal if the
> form was easy to fill out. Just thought I'd follow up.
>