Bert-Jaap Koops homepage - Crypto Law Survey

What's new

Back to Crypto Law Survey

25 February 2013, version 27.0

new: Tonga (decryption order)
updates:
- Australia (penalty for violating decryption order raised to two years)
- Netherlands (report and Ministerial announcement on decryption order for suspects)
- Singapore (decryption order broadened to all arrestable offences, higher penalty for specified offences)
- United Kingdom (2010-2012 figures on decryption orders; two sentences mentioned in media)
- United States (minor relaxation of EAR; more case-law on decryption orders: Gavegnano, Kirschner, Fricosu, In re Grand Jury Subpoena Duces Tecum)
additions, clarification and corrections:

Belgium, France, Ireland (information added and some corrections on existing decryption order provisions)
China (added inofficial translation of 2000 Regulation)
Moldova (restrictive decrees were repealed in 2001; current status unknown)

28 July 2010, version 26.0

new: Thailand (decryption order in computer-crime cases)
updates: UK (2008-2010 figures of issued decryption orders and convictions for non-compliance), US (Boucher overturned: decryption order compatible with privilege against self-incrimination)

27 October 2008, version 25.2

updates: UK (R. v S and A: decryption order compatible with privilege against self-incrimination)

28 July 2008, version 25.1

updates: France (Decree 2007-663 implementing import/export/domestic regulation)

9 July 2008, version 25.0

new: Bahrain (no radio-frequency crypto allowed), Cambodia (no controls), North Korea (does not release information)
updates: Austria (no longer radio crypto controls), Morocco (severe import, export and domestic controls enacted), Netherlands (export by e-media controls; decryption order in terrorism investigation without probable cause), South Africa (minor corrections), Ukraine (severe import, export and domestic controls), United Kingdom (RIPA III decryption order entered into force), United States (Boucher v. US: Fifth Amendment protects password)

16 January 2007, version 24.0

new: Antigua and Barbuda (Bill with decryption order), Iran (strict domestic controls), Syria (no domestic controls)
updates: Egypt (domestic controls for communications service providers), Hong Kong (circular on import, export and transit controls), Netherlands (decryption command for wiretapped encrypted communications; privilege against self-incrimination restored), South Africa (regulations implementing registration requirements for crypto service providers), United Kingdom (consultation on RIPA-III; no revised draft Code of Practice yet)
clarification: Tunisia (more details on 2001 Decree)

16 January 2006, version 23.0

updates: Germany (no amateur radio-crypto), Hungary (import controls), Italy (sensitive personal-data encryption), Netherlands (data-delivery powers; accidentally abolishes privilege against self-incrimination), Slovenia (sensitive personal-data encryption), South Africa (draft regulations for crypto providers on customer info), United Kingdom (Crypto Service Provider registration sunsetted)

10 January 2005, version 22.3

updates: Hungary (implements EU export regulations), Norway (2001 crypto policy), United States (December 2004 export relaxation)

11 August 2004, version 22.2

new: Ghana (no controls), Kenya (no controls), Mauritius (no controls), Morocco ('02 mention of regulatory intention), Rwanda ('98 report intends to regulate), Tunisia (import and domestic regulations)
updates: Egypt ('02 mention of regulatory intention), France (elaborate new law, including raising punishments for crypto-enhanced crimes), Russia (FAPSI > FSB), South Africa (decryption order), United Kingdom (new OGEL)

15 January 2004, version 22.1

update: Singapore (export controls)

12 January 2004, version 22.0

new: Lithuania (export and import controls, no domestic law)
updates: Belgium (current state of Program Act), Brazil (working on policy), China (wireless crypto), Italy (radio-amateur law), Netherlands (no TTP law), Spain (new Telecommunications Act), Switzerland (radio-traffic law), United States (Patriot II; Bernstein case ends (for now))
clarification: China (clarification letter only pre-2000)
links added: Israel (new stats)

31 October 2002, version 21.0

updates: Belgium (crypto prohibition for telecom users?), France (Technical Assistance Center), Netherlands (government to stimulate crypto use), South Africa (regulation of crypto providers), Sweden (export), US (export liberalization)
clarification: Israel (personal-use exemption)
links added: EU (export documents)

28 March 2002, version 20.0

new: Bulgaria (export controls), Peru (no regulations), Trinidad & Tobago (decryption order)
updates: Council of Europe (Cybercrime Convention definitive), European Union (export Wassenaared), Australia (decryption order), France (decryption orders), Hungary (no signature-key encryption), Indonesia (personal-use exemption), Israel (patent attorneys), Kazachstan (personal-use exemption), the Netherlands (telecom provider decryption, security-service powers), South Africa (computer misuse bill), United States (export cases, Scarfo), Vietnam (personal-use exemption)
links added: Australia (background paper)

25 July 2001, version 19.0

updates: Council of Europe (draft cybercrime convention), European Union (pro-crypto statements); Belgium (decryption order), France (info-soc bill proposes extensive revisions), Germany (E-Gov handbook on cryptography), Hong Kong SAR (report advises decryption order), India (decryption order), Netherlands (update Legal Access project, Mevis Committee proposals for decryption powers), UK (export regulations)
links added: Israel (MoD pages), US (DMCA exemptions and cases)

25 January 2001, version 18.4

updates: Wassenaar (mass-market 64-bit limit lifted), Finland (export)
links added: EU, Wassenaar (thesis on export controls); UK (FIPR pages)
address list: extensively enlarged

23 October 2000, version 18.3

updates: US (export relaxation implemented)

19 October 2000, version 18.2

updates: European Union (new export regulation), Malaysia (decryption orders), the Netherlands (Legal Access project), Russia (intends change), Singapore (decryption order), UK ("prohibition" of key escrow), US (AES selected)

15 August 2000, version 18.1

updates: Council of Europe (suggests decryption order), Burma (import/export), Denmark (government publishes abstract policy), the Netherlands (bill on national-security decryptions), United Kingdom (RIPA enacted with decryption order)
clarification: Israel (export and domestic laws)

10 August 2000, version 18.0

updates: Belgium (draft law with decryption order), China ("clarifies" rules to core crypto), Ireland (E-Commerce Act includes decryption order), US (July export relaxation; Junger reversed, Bernstein remanded and Karn dismissed; aggregate crypto-encounter reports)
clarification: Estonia (export)
links added: new EPIC survey

17 February 2000, version 17.0

updates: European Union (ECJ on jurisdiction over dual-use goods), Belarus (import and export controls), China (new, sweeping controls), France (policy paper reaffirms policy), Hong Kong SAR (no domestic regulations), Netherlands (draft law on re-export), Singapore (import controls lifted), Sweden (government policy published), United Kingdom (draft RIP Bill), United States (January 2000 export regulations)
new entries: Moldova (restrict import, export, use), Venezuela (no use regulations)

25 October 1999, version 16.1

updates: Sweden (general export licenses), United States (SAFE votes in House Committees; Gramm/Enzi Bill; Goss Tax Review, National Interests Bills; EAA emergency again extended)

21 October 1999, version 16.0

new: Egypt (free use, import controls)
updates: European Union (free internal mass-market crypto), Australia (Wassenaars export; e-export), Germany (mass-market liberalization; government crypto policy), Ireland (consultation paper), Luxembourg (draft e-commerce law), Netherlands (TTP document, draft Computer Crime II bill), New Zealand (Wassenaars export), Switzerland (telecom crypto), United Kingdom (draft E-Communications Bill), United States (export liberalization announced, Bernstein rehearing; CESA act)
corrections and clarifications: Wassenaar (asymmetric limits), South Africa (import & export), Switzerland (export)
URL added: Canada (summary)

15 July 1999, version 15.0

new: an address list for crypto export licenses (far from exhaustive)
updates: European Union (export to "friendly" countries), Argentina (reference to 1998 rumor deleted), Australia (also controls plug-in software), France (liberalizing decrees), Ireland (implements Wassenaar's 64-bit limit), Italy (fiscal encryption), the Netherlands (export), New Zealand (also controls plug-in software and publications), South Korea (import controls abolished?), UK (March 1999 consultation document), US (Karn hearing granted, Bernstein appeal decision, SAFE and PROTECT Acts)
URLs added to Wassenaar (FAQ), US (BXA Wassenaar page)

1 February 1999, version 14.3

images added that summarize the worldwide import, export, and domestic controls
update on UK (personal-use exemption, white paper proposes controlling intangible export, Roche speech parrots principles, OFTEL to license TTPs)

26 January 1999, version 14.2

update on Council of Europe (draft convention yet unclear about escrow), Denmark (opposition to Wassenaar changes), France (complete liberalization of domestic use), India (draft bill to mandate decoding by sender), the Netherlands (to implement Wassenaar by April 1999), Sweden (1998 export rule), United States (September 1998 export relaxation implemented; Rep. wants to reintroduce SAFE)
clarification and URL added to Belarus (1995 decree); URL added to UK (copy of Labour policy)

23 December 1998, version 14.1

update on Wassenaar (restrictions and relaxations), EU (to implement Wassenaar changes?), Mexico (no use restrictions), Spain (Telecoms Law may forebode key recovery), US (new export relaxations; Junger dismissed; TACDFIPSFKMI charter extended; copyright act may hinder crypto research)
new entries on Chile (no controls), Colombia (no controls), Costa Rica (no domestic controls), Kyrgyzstan (no export controls), Puerto Rico (no controls), Slovenia (no domestic controls), Uruguay (no controls), Vietnam (import controls)
clarification on China (no use restrictions), Poland (free GSN import)
unclarification on Indonesia (use restrictions?)

2 December 1998, version 14.0

update on Wassenaar (no revision yet), Australia (e-export fight, Gatekeeper project), Canada (responses to discussion paper, new crypto policy), Czech Republic (import and unenforced export controls), Denmark (Report on incentive solutions), Finland (new crypto policy), Germany (recommendation Enquiry Committee), Ireland (new crypto policy), South Africa (regulatory authority), South Korea (legislation considered), Switzerland (export controls), UK (Labour policy unWWWed)
mention of the Wassenaar Arrangement in each entry of signatory countries
clarification on India (import), Indonesia (import), South Korea (import)
URLs added to Wassenaar (secretariat; articles), UK (export control list)

11 June 1998, version 13.0

update on Wassenaar (to be revised), EU (proposal for new dual-use regulation; Copenhagen hearing; ETSI rejects RH; law-enforcement policy paper), Burma (domestic regulation), Brazil (no regulation plans), Germany (no regulation before elections), Kazakhstan (domestic controls), Malaysia (CAs must decrypt during search), Pakistan (regulation on sale and use), Spain (export), Sweden (export), US (Karn; Junger; new version Kerrey-McCain; Gore letter)
URLs added to EU (conditional access regulation), US (BXA Annual Report; Junger page)
start of mailing list announcing updates (subscribe by sending a message with subject "subscribe CLS-update")

13 May 1998, version 12.2

update on France (more decrees, summary table added), UK (DTI policy announcement, summary of consultation responses; 1996 House of Lords Agenda statement), US (E-PRIVACY Act)
URLs added to France (overview paper), Sweden (complete English version of report)

4 March 1998, version 12.1

update on France (decrees implementing the 26 July 1996 law published on 25 February 1998)

2 March 1998, version 12.0

update on European Union (ETSI on TTP; Eckhert statement; COM (97) 503 "not important"; Birmingham conference), Council of Europe (PC-CY), Belgium (law amended), Canada (crypto policy discussion paper), France (Lorentz report), Gemany (Sandl statement; no backdoor in Pluto), Israel (export revision), Netherlands (proposals to extend decryption command; TTP project; encrypt to "seize"; use remains free), Scandinavia (PSS no longer Nordic), United Kingdom (policy announcement delayed; SfL resolution), United States (interim export rule; California resolution; czar travels; Compsec Enhancement Act; Kerrey McCain revised; AES conference)
corrections on Estonia (controls were reported), Switzerland (telecom > radio)
clarification on Wassenaar Arrangement (General Software Note), Germany (export), Israel (case-by-case decisions), Sweden (Internet export), US (SAFE versions)
URL added to Canada (gov PKI), Hong Kong (export)

8 December 1997, version 11.0

new entries on Estonia, Hungary, Kazakhstan, Latvia, Romania, Turkey (import/export) and on Argentina, Malaysia, South Korea (domestic)
update on European Union (Commission Communication: advises export adaptation, wary of key recovery, EU will use encryption itself), Belgium (govt proposal), Brazil (import/ use controls possible in 1998), France (expected decrees delayed by NL), Germany (Kanther chip; no regulation intention), Sweden (Cabinet Office report), Turkey (perhaps domestic controls), UK (Red Pike), US (BXA seeks comments; Bernstein hearing scheduled; SAFE Act amended/ uncertain future; KMI FIPS meetings; AES candidate call)
clarification on Poland (import), Singapore, South Africa, UK (export)
URLs added to EU (KRISIS), France (critique), UK (list of responses), US (KMI FIPS, amendment S909)
URLs altered (France, Netherlands)

25 September 1997, version 10.4

URL changed in Australia (export regulations)

10 September 1997, version 10.3

clarification of US (draft amendment to Kerrey-McCain bill)

8 September 1997, version 10.2

update on European Union (ETS studies), US (Bernstein injunction on hold, DoC Karn ruling, Draft Encryption Items Rule, Kerrey-McCain proposed amendment, Freeh backs mandatory key recovery)

4 September 1997, version 10.1

update on Australia (Walsh recommendations), Denmark (report by Expert Committee), France (decree deemed imminent), Sweden (Inspection for strategic goods), US (Bernstein decision, Junger amended complaint)
change on Singapore (unclear availability domestic crypto)
URL added to Sweden (export law)
FAQ added
lay-out restyled

28 July 1997, version 9.4

update on EU (amendment to export regulation), Sweden (no position Fax�n, no escrow spokesman)

24 July 1997, version 9.3

update on Germany (Kanther: no law planned), US (SAFE bill passes House Committee)
clarification on Belgium (no general prohibition), Canada (PKI)
URL added to Germany (list of opinions and reports)

15 July 1997, version 9.2

update on European Union (Bonn conference statement), US (government e-commerce framework, Markey bill)
clarification on US (no import restrictions)

7 July 1997, version 9.1

update on Japan (MITI draft policy paper)
updated URL on Australia (Walsh report)

2 July 1997, version 9.0

update on Australia (Walsh report), Germany (Interior Ministry opinion), Sweden (IT commission report), US (government bill amended, Kerrey-McCain bill, SAFE act amended and passed House committees, czar travel FOIA request)
clarification on Singapore (import, domestic), Japan (government cannot choose)
adjustment to Hong Kong (new status as China SAR)
URLs added to Belgium (law proposals), Canada (export), UK (Labour policy, cyber-rights report)

7 May 1997, version 8.2

new entry on Philippines
update on Germany (Kanther statement), US (new export advisory committee, SAFE bill approved by subcommittee)
URL added to Germany (action page)

28 April 1997, version 8.1

URL Belgium deleted.

22 April 1997, version 8.1

Description of UK consultation paper, and URL added.

21 April 1997, version 8.0

New entries on Czech Republic (import/export, domestic), Malaysia (import/export)
Update on Wassenaar Arrangement (list of countries, public-domain and Internet export), European Union (wiretap directive), OECD (policy guidelines adopted), Germany (several statements by politicians), Israel (unclear restrictions), Singapore (import restriction?), Sweden (policy committee), US (EAR, personal use exemption, crypto bills reintroduced, Draft Key Recovery Legislation, Advanced Encryption Standard)
URLs added to Wassenaar Arrangement, OECD, US (Junger)

26 March 1997, version 7.1

Reference to new UK consultation paper on TTPs.

18 February 1997, version 7.0

New lay-out. Digital signatures replaced to a separate overview.
New entries on Finland (export), Hong Kong (import, export), New Zealand (export), Poland (import)
Update on Australia (government encryption of classified data), Finland (no key-escrow), France (TTP law published), Japan (general position, wiretap law), Netherlands (extend decryption command), OECD (Group of Expert okays guidelines), Scandinavia (secure email system), Switzerland (telecom encryption, export), US (Karn appeal, annual figures report)
Corrections or clarifications on Australia (export, public domain software), Belgium (export), Germany (export), US (Bernstein, NRC report)
URLs changed in France (TTP law), US (Bernstein)

8 January 1997, version 6.0

New entries on Bangladesh, Indonesia, Pakistan
Update on OECD (December 1996 draft), Australia (new export rules), France (TTP requirements draft), Germany (ongoing rumours, statement by Ministry of Interior official), Netherlands (December 1996 debate), US (new export regulations, Bernstein decision, crypto ambassador, KMI-FIPS meeting)
URL's added to Wassenaar Arrangement, Germany (digital signatures), US (digital signatures)