This page documents the recent history of, and current state of, New Zealands crypto export policy as decided by several intelligence agencies and a supporting cast of bungling bureaucrats. This policy has resulted in New Zealand enjoying the dubious distinction of having the strictest export controls on earth, with everything ranging from crypto hardware down to software, library books, computer magazines, and journals being restricted from export. It's not even possible for a university to publish academic research without prior permission from a government agency, and the requirements for obtaining this permission are structured to ensure that they can never be fulfilled.
This page contains links to a sizeable collection of never-before-published documents including correspondence with relevant government agencies, and media reports on the situation. Note that a number of the more interesting documents are currently not online as I'm still checking with the sources who liberated them that it's OK to publish them.
You can jump directly to relevant sections using the links below.
Summary of the New Zealand situation
(New) Parliamentary questions on NZ crypto policy
There's no further information in the Customs Act, but NZ Customs have a short publication "New Zealand Customs Fact Sheet: Export Prohibitions and Restrictions" which contains, among such curious items as cat skins and a large list of agricultural products which can't be exported without going via the appropriate government department, the item "Strategic goods such as computers, navigation and marine equipment, firearms, ammunition, explosives, military aircraft and vessels". The responsible government department is the Ministry of Foreign Affairs and Trade (MFAT, pronounced "em-fat"). MFAT extend the Customs definition of "Strategic goods" to cover "Computer technology, information security systems, and telecommunications equipment", which includes computer software. The entity within MFAT which handles this is the International Security and Arms Control Division (ISAC), who are advised by the Government Communications Security Bureau (GCSB), the New Zealand subsidiary of the US National Security Agency, which acts as a big brother to a number of similar organisations scattered around the globe.
Once you get past the part where NZ Customs are involved, the whole setup is run like the mafia. Nothing is ever written down, everything is done verbally. Although it took only a paragraph to describe how this works, it took more than two months of work to find out in practice. Before publicity over the restrictions lead to front-page newspaper stories in early 1997, noone had ever heard of these restrictions. A search of NZ legal databases found nothing. Several IP lawyers had never heard of the restrictions. It wasn't until I ran into someone in January 1997 who knew what to ask for and where that I got a copy of the regulations.
MFAT's explanation of, and justitication for, the export controls was explained in their Business File, Vol.3, No.7, in which they claimed that they were required to control exports under the terms of the Wassenaar Arrangement, and retroactively altered some of the statements they had made in correspondence a few months earlier (there are links to this correspondence further down). The Business File article gives a good indication of MFAT's standard justification for and response to any queries about export controls.
The Cyphercom Experience
In early 1996, a US company called Cyphercom Solutions developed a mechanism
for performing online credit card transactions of a type which protocols like
SET still can't do nearly two years later. The only major remaining obstacle
was that they didn't have a mechanism for securing the transactions, which was
making it difficult to attract interest in the technology. In order to provide
this security, they wanted to use my
cryptlib encryption
toolkit. Their lawyers advised them that it was necessary for them to
obtain an official, physically exported copy of the software for due diligence
purposes so that there wouldn't be any complications later if the source of the
software were called into question. As the application involved financial
transaction processing they had received indications from the NSA that it would
be looked on favourably in terms of getting export permission. Somewhat
strangely, they were given the distinct impression that to get anywhere they'd
need to play ball with the NSA, even though it was New Zealand software being
exported from New Zealand, where the NSA should have no jurisdiction.
Inquiries by lawyers in the US indicated that there had been a flurry of communication between the NSA and the GCSB over this (as one person I talked to put it, "When the NSA says 'Bend over', the GCSB says 'How far?'"). The NSA might as well have signed the export (non-)permit themselves. The story from the US lawyers was that there was "repeated intervention of the NSA" and that "NZ is out of its depth, it was terrified of offending the US".
From the information I was later able to gather the whole thing seems to have been initiated by the GCSB rather than the NSA, who were afraid to do anything without NSA approval. The GCSB went to the NSA and asked them what they should do, and the result was the (non-)permit. A person from the Australian Defence Signals Directorate (DSD) (an Australian intelligence agency, the Australian version of the NSA) later told a reporter that the GCSB had gone to the DSD and asked them "Would you allow the export under these conditions?", to which the DSD said "No".
The upshot of this was that, after several months of work and many thousands of dollars in legal fees, MFAT had given Cyphercom a permit to export nothing.
"Application No.278466 covering cryptographic software proposed for export to England, this software is not controlled according to Canada's ECL. Therefore, provided the product noted in this application is not of US origin within the meaning of the ECL item 5400, these goods may be exported to any country, except Libya and Angola, without an export permit. Please note that most goods to Iraq are still prohibited at this time, as well".
The interesting thing about the Canadian decision was that I was contacted twice by Canadian export controls people who asked me a number of very detailed questions about the software, whereas MFAT managed to come to their decision without ever examining the encryption software or talking to its author. As far as I've been able to tell MFAT had very little to do with the decision: They have to follow the GCSB's advice, and the GCSB won't do anything without the NSA's permission.
At about the time that the original export appeal was lodged, the GCSB had told Orion Systems, a New Zealand company which produces medical information and communication systems for transmitting medical information, that they couldn't export a product with the encryption necessary to protect patient medical data, lab results, patient referrals, and so on, without obtaining an end user certificate for each user. An end user certificate is a sworn statement that the end user isn't a terrorist or criminal and won't pass the technology being exported on to terrorists or criminals. This works fine for things like tanks and cruise missiles, is somewhat questionable for an item like a floppy disk, and is downright ludicrous for a fleeting electronic copy of a program which can be transmitted and copied almost anywhere in a fraction of a second.
In order to sell a copy of their medical software to just one overseas site, Orion would have been required to obtain two thousand certifications from all the end users. Larger sites with ten thousand users are not unknown. This meant that Orion would have had to somehow obtain 2000 sworn declarations from users of their software just to allow the exchange of medical records. Orion didn't even bother going to MFAT, because if the GCSB required these impossible-to-meet conditions then going to the next level down in the chain of command would make no difference.
In early October 1997, about a fortnight after a sent the letter to MFAT questioning the export refusal and asking for clarification on what law they were using to block the export (and many months after the export itself), Kiss Audio Video (an Australian video production company and the parent of Cyphercom), got a call from the Australian Ministry of Defence (it was actually the DSD, but they generally identify themselves as Ministry of Defence just like NSA employees are usually identified as Department of Defence rather than NSA). This company, Kiss Audio Visual, are a video production house who have nothing at all to do with encryption software (or, in fact, anything but video production and graphics design, which they are very good at). They were called by Alan Owen of the DSD who said that they had been informed that New Zealand Customs had intercepted a shipment containing a high-security encryption product which was being illegally exported from New Zealand. According to the story, when NZ Customs went back to the party who exported the software, they claimed it was on behalf of Kiss. The Managing Director of Kiss called the Ministry of Defence to make sure this was actually for real, and they confirmed that it was.
This story has several very large holes in it:
Alan said that this export had very serious consequences, and that they would be coming to Melbourne to talk to Kiss at 2pm the next day. The Kiss Director immediately called Cyphercom in the US, and they discussed having serious quantities of lawyers present at the meeting, and taking the whole story to the media (being a video production company, they had strong tries to the television industry who would probably have taken strong exception to trumped-up charges being brought against a business partner).
The visit was cancelled without any explanation. Who says governments never listen to their citizens?
(The DSD side of the story was that they were rather busy that day and didn't have time to carry out their investigation).
The implications of this are interesting. Despite the fact that MFAT had already in effect denied permission for the export, someone with the ability to listen in to international phone conversations had used discussions about the export to fabricate a story about New Zealand Customs with which the Australian government could harass Kiss, who had done nothing wrong and in fact had nothing to do with the whole affair (unfortunately I don't have any proof of the phone-conversation monitoring, but I can't see how anyone could possibly have connected Kiss with Cyphercom except for the phone conversations - they simply have nothing else in common). Apparently whoever was pulling the strings saw it necessary to bypass MFAT entirely in an attempt to suppress the encryption software. The DSD later revealed to the media that the whole phony story had come from the GCSB.
A mere 1 1/2 months and several phonecalls later, MFAT replied to this letter stating that the export (non-)permit was in fact not final, and was still under consideration, which was at odds with what they had told Cyphercom and with the wording of the permit itself. The letter also stated that this was a very new area and one they weren't familiar with, in direct contradiction to their statements in their Business File publication which indicated that such exports were common.
MFAT declined to answer my question as to whether this portion of NZ's foreign trade policy was being controlled by US intelligence agencies.
It is quite probable that the DSD weren't actually aware that they had been fed a false story by the GCSB - they were simply following up a request by a fellow intelligence agency to investigate some suspected military weapons smugglers (or whatever it is that people who sell encryption software are classed as). This still leaves open the question of what motivated the GCSB to do this in the first place, and why they decided to victimise Kiss. Unfortunately while Alan was very helpful throughout the whole affair, the GCSB declined to comment on any of it. I was thankful that, the previous year, I had insisted on the application for the export being done through a shell company rather than doing it myself, in which case it's not unlikely that I would have been the subject of the GCSB's stories, and any ensuing investigation.
The implications of this are pretty scary. The GCSB first used their position to impose impossible-to-meet conditions on Orion and influence MFAT to indefinitely delay export of software which the Canadian government had already ruled wasn't export restricted. However, not content with this, they then fed a fictitious story to the Australian government to convince them to begin an investigation into a company which had done nothing wrong, and who had very little to do with the whole issue.
The following week MFAT claimed in the Letters to the Editor column that they were only following orders, and were required by the Wannsee arrangement to restrict exports of crypto which was "40-bit or stronger". This means that anything including 40 bits is restricted. If they're going to try to blindly parrot US policy then they should at least get their facts straight (they later changed their story, possibly in reaction to this writeup appearing online).
A few days later I found someone who knew who and what to ask for in order to get a copy of the NZ export regulations. I called MFAT and talked to a gentleman by the name of John Borrie, who had recently taken over responsibility for this affair from someone else who, to put it mildly, had been a real nuisance to deal with. I suggested to him that the GCSB were feeding him just the information they wanted him to know and no more, and that perhaps he should avail himself of alternate sources of advice. He didn't see it quite that way.
A copy of the export regulations arrived shortly afterwards, and were identical to the Australian regulations, even down to the layout style. A few of the fonts differ, but that may be due to different systems/printers/whatever.
The following week the story was again on the front page of the NBR. This time the story covered the financial difficulties that Cyphercom had been plunged into. Because MFAT had stopped them from having any access to their product for nine months, the company was considering filing for bankruptcy. The companies involved had bent over backwards to try and comply with the vague and obscure rules and regulations, and in return had been subjected to harassment through threats of government investigations, endless delays and legal costs, and eventually bankruptcy because of the delays involved. That weeks issue also contained a Letter to the Editor which summed up the situation.
In September 1997, an article in Computerworld further documented the fact that the export policy was really being controlled by the GCSB, and indicated that other companies had also run into problems, with export delays of eight to nine months being typical (one exporter summed the situation up with "It takes MFAT nine months just to say no").
Obtaining answers from MFAT
In the same week that the second NBR article was published I decided to try
applying the Mongolian Stupidity Test ("Can I borrow your sword?") to MFAT.
Getting anything out of them was like drawing teeth. I initially wrote to them
to ask about the possibility of re-exporting the Finnish
ssh program (of which the commercial
version of ssh is sold over here through a
NZ agent for Datafellows), and the
Dutch Python encryption
library back to the people who wrote them . For ssh I asked about sending
it back to the author and to someone in Germany. For Python I asked about
sending it back to someone who occupies the office next door to the author, and
to someone in the UK. I thought that the export choices given in
my letter to them pretty much covered all
possibilities.
In early February MFAT replied to my inquiry with (amongst the usual stuff about terrorists and whatnot) the ruling that I wasn't allowed to send some encryption software back to the person who had originally written it. Based on this text it appears that MFAT are under the impression that if hordes of Finnish terrorists (???) were to suddenly develop a need for Finnish encryption software, they would be expected to make a formal request to MFAT for it in order to provide a nice paper trail, rather than just obtaining it from the source in the country they're located in. Earlier on an MFAT person had told me on the phone that "this is our policy and we're not going to change it", and this written reply confirmed my suspicions - they weren't trying to apply any kind of logic or reason to this, but were just "following policy" like blind automata.
It gets better than this. After receiving the copy of the export guidelines, I wrote another letter to MFAT asking about the status of academic research and books and magazines. In mid-February MFAT replied to my enquiry saying that no export of books, magazines, journals, or academic research was possible without the usual end user certification for anyone reading the item in question. In addition to the total impossibility of obtaining one of these sworn declarations from everyone who could potentially read the work in question, it implied that it would be used and stored under strictly controlled conditions (so that it couldn't be passed on to literate terrorists and other bogeymen). Publication in journals - probably the prime motivation for creating academic research - is therefore automatically excluded.
This also covers things like bookstores which handle mail orders, and libraries which do interloans. A quick check of NZ library holdings revealed that books, journals, and magazines containing encryption code were held by both public and educational-institution libraries situated all over New Zealand. This means that a significant number of New Zealands libraries could be prosecuted under the Customs Act for doing what it is they were created for - loaning out books.
This statement by MFAT represents a truly frightening development in the US's imposition of crypto controls on other countries. One of the arguments put forward during the Clipper debate in the US was that while the US government could promise to use Clipper in a fairly civilised manner (and were constrained by the US Constitution), other countries wouldn't be held back by such constraints and could apply it in ways which would be unheard of within the US. This is exactly what has happened in New Zealand. While any attempt by the US government to require a permit to publish a research paper or read a book would be immediately struck down by the Supreme Court, New Zealand doesn't have a First Amendment - there is no easy way to challenge this ruling. This is a real-life example of the Clipper argument in action - a country with less constitutional protection than the US is applying US-inspired restrictions in a manner which would be unheard of in the US.
The letter also contains a verbatim copy of the US position on encryption key lengths (40-bit conventional - they'd got their story right by now - and 512-bit public key). Based on these statements, I wrote another letter to MFAT asking whether I could automatically export algorithms which fell within the requirements they had given.
MFAT replied to my enquiry by negating their previous statement and saying that any export had to be approved by them, regardless of the key length, and that the best way to obtain cooperation from MFAT was to employ US-owned proprietary and patented algorithms!. Given MFAT's performance and demonstrated grasp of the subject in the past, it's fairly clear that this reply came more or less directly from the GCSB with little MFAT input, and that the GCSB took its cue directly from the NSA (gee, New Zealanders are being given permission to export US proprietary/trade secret/patented algorithms by NZ government decree. Why not just refer all NZ exports directly to the NSA to save time?). This means the New Zealand Ministry of Foreign Affairs and Trade, charged with fostering NZ trade, is setting a policy which requires NZ companies to use foreign technology.
In the meantime, MFAT are still solemnly vapourising about the need for export controls in order to stop terrorists armed with sophisticated military-grade library books and floppy disks of mass destruction. One recent example was in a reply to an article in the NZ Herald, this sort of statement from them is pretty much the standard response whenever anyone questions their policy.
31 May 1996:
"No objection the the export of [...] DES".
11 June 1996:
"No objection the the export of [...] 64-bit DES [sic]".
21 October 1996:
"We have not yet reached a final decision on [the export]".
31 January 1997:
"An export permit would only be required if it was 40-bit or stronger [sic]".
13 February 1997:
"The export of code in any form is regulated in New Zealand in terms of the guidelines below: They contain encryption limited to (i) 40-bit key lengths for symmetric algorithms; (ii) 512 bits for asymmetric algorithms; (iii) 56-bit DES for dedicated financial algorithms".
18 April 1997:
"It is the responbility of the Ministry in its capacity as the licensing authority - rather than the exporter - to assess whether an encryption algorithm falls outside the threshold of requiring an export permit".
So far MFAT's position on exports has changed every single time they've been questioned about them.
Non-legitimate export on the other hand is fine, just pack a crate full of crypto, put enough postage on it to get it where it's going, and drop it into the nearest mailbox. Provided you don't tell MFAT, noone will ever bother you.
As a result of MFAT's incompetence in handling this situation, New Zealand currently enjoys the dubious distinction of having the strictest crypto export controls on earth, including unheard-of restrictions on books and publication of academic research. MFAT (and the GCSB's) intent is to make export so difficult that any non-worthless encryption software (and books and academic research) will never leave New Zealand, ensuring that New Zealand is relegated to the role of a third-rate player in the emerging field of electronic commerce. The end effect is that New Zealands trade policy is being set by US intelligence concerns (via the GCSB and then MFAT) in a manner which would never be accepted if they were to try the same thing in the US.
Parliamentary questions on NZ crypto policy
In late 1997 a number of written parliamentary questions were submitted which
questioned NZ crypto policy and tried to obtain more information on what was
really going on (thanks to the person who asked them for providing me with
copies of the questions and replies). The replies indicated that David Aaron,
the US "crypto czar" whose job it was (by the US governments direct admission)
to persuade other goverments to adopt US crypto policies, had visited New
Zealand, but nobody could provide a precise answer as to what he'd spent two
days in NZ discussing [1]
[2]. An MFAT official attended a meeting in
Australia on crypto policy [3], and neither the GCSB
nor the NZ government were developing any form of key escrow
[4] [5]. Finally, the
GCSB holds meetings on information security and publishes various reports, but
none of these are available to the public [6]. A
question on GCSB involvement in export control matters was deflected
[7].
The issue of the GCSB's publications merits further examination. In early 1998, the manager of a company which handles medical communications services for a number of hospitals, medlabs, and health boards wrote to the GCSB requesting copies of several relevant publications as part of the bidding process for a Ministry of Health contract. The GCSB declined to make them available. Not having seen any of these publications I can't comment on their contents, but if I had, in theory, seen them I would be able to report that they consist of perfectly ordinary, run-of-the-mill reports on things like S/MIME and how digital certificates work, material which is identical to articles found in popular computer magazines, library books, and available on the net. The sole reason for withholding them seems to be to eliminate any chance of public accountability for the organisation which publishes them, since there's nothing in them which you can't read in PC Magazine or Computerworld.