# Can I get into trouble for publishing a strong cypher algorithm? **URL:** \ **Category:** Factual Questions\ **Created:** [February 17, 2005, 10:10pm UTC](https://boards.straightdope.com/t/can-i-get-into-trouble-for-publishing-a-strong-cypher-algorithm/290605 "2005-02-17T22:10:42Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Capt.Ridley\_s\_Shooting\_Party](https://avatars.discourse-cdn.com/v4/letter/c/cc9497/32.png) [@Capt.Ridley\_s\_Shooting\_Party](https://boards.straightdope.com/u/Capt.Ridley_s_Shooting_Party)\ **Post date:** [February 17, 2005, 10:10pm UTC](https://boards.straightdope.com/t/can-i-get-into-trouble-for-publishing-a-strong-cypher-algorithm/290605/1 "2005-02-17T22:10:42Z")
Suppose that I was able to create a really strong cypher algorithm and then I decided to publish it on a website for anyone to implement. Bearing in mind some countries have restrictions on the strength of encryption that is allowed to be exported (I know the US does, does the UK?), could I get into trouble? If not, what’s the point in the restrictions? It seems to me that any nation could employ virtually any computer science graduate to implement my strong cypher and be out of the reaches of the NSA, GCHQ et al. ---
**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\ **Post date:** [February 17, 2005, 10:23pm UTC](https://boards.straightdope.com/t/can-i-get-into-trouble-for-publishing-a-strong-cypher-algorithm/290605/2 "2005-02-17T22:23:57Z")
As I understand it, the law says you can’t export an implementation, but publishing it is fine–but I’m not going to swear that I’m right. Your second question really isn’t GQ material. ---
**Author:** ![FyreFiend](https://avatars.discourse-cdn.com/v4/letter/f/919ad9/32.png) [@FyreFiend](https://boards.straightdope.com/u/FyreFiend)\ **Post date:** [February 17, 2005, 10:35pm UTC](https://boards.straightdope.com/t/can-i-get-into-trouble-for-publishing-a-strong-cypher-algorithm/290605/3 "2005-02-17T22:35:08Z")
From what I understand (I’m a little too pressed for time to look it up) you wouldn’t be able export a program that does strong encryption but you can export the source code to such a program because that would be consittered free speech. ---
**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\ **Post date:** [February 17, 2005, 10:37pm UTC](https://boards.straightdope.com/t/can-i-get-into-trouble-for-publishing-a-strong-cypher-algorithm/290605/4 "2005-02-17T22:37:44Z")
> [@FyreFiend](#): > > From what I understand (I’m a little too pressed for time to look it up) you wouldn’t be able export a program that does strong encryption but you can export the source code to such a program because that would be consittered free speech. I remember somebody put source code of DES on a t-shirt. The appeal of it was that you could wear it across the border and break the law, and there was virtually no chance of getting arrested for it. Unfortunately, Google is not helpful. ---
**Author:** ![mks57](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@mks57](https://boards.straightdope.com/u/mks57)\ **Post date:** [February 17, 2005, 10:53pm UTC](https://boards.straightdope.com/t/can-i-get-into-trouble-for-publishing-a-strong-cypher-algorithm/290605/5 "2005-02-17T22:53:25Z")
No. Publishing an algorithm isn’t going to get you in trouble. Emailing a working program to someone in North Korea is much more likely to get you in trouble, as would shipping a secure telephone system to an enemy state. The law and regulations are primarily concerned about militarily useful hardware and software. One area that is treated differently is missile technology. Exporting technical data about missile technology can get you in a great deal of trouble. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [February 17, 2005, 11:18pm UTC](https://boards.straightdope.com/t/can-i-get-into-trouble-for-publishing-a-strong-cypher-algorithm/290605/6 "2005-02-17T23:18:18Z")
Strong encryption algorithms are routinely published on the web. They are openly discussed in meetings. ---
**Author:** ![micco](https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/32.png) [@micco](https://boards.straightdope.com/u/micco)\ **Post date:** [February 18, 2005, 2:02pm UTC](https://boards.straightdope.com/t/can-i-get-into-trouble-for-publishing-a-strong-cypher-algorithm/290605/7 "2005-02-18T14:02:18Z")
The US export regulations have relaxed considerably from the old days when encryption was regulated by DoD as a munition. In the old days, source code was regulated and it would have been illegal, for instance, to email a non-US person the source code for PGP or the contents of the CD-ROM that accompanied the book “Applied Cryptography”. Encryption export is now regulated by DoC with other technology exports. You can export almost anything these days, but some products require different levels of review and licensing. I am not an export expert, but it’s my understanding that source code is not restricted as long as it is “publicly available” but may require notification (not review or license). Export basics can be found [here](http://www.bxa.doc.gov/licensing/exportingbasics.htm). A clarification of the rules for source code is [here](http://www.bxa.doc.gov/Encryption/PubAvailEncSourceCodeNofify.html). What’s the point of the restrictions? I don’t know. The old restrictions seemed to rely on the fact that only good loyal patriotic Americans can do math. The fact that plenty of non-Americans can do math and/or write software implementations of other peoples’ math was inconvenient and ignored. The US government was trying to limit the export of anything that could be used against it. This makes sense when talking about hardware like weapons, but makes no sense when talking about software. Luckily, they’ve realized that the export controls only hurt American business and don’t do anything to increase national security, so we’ve come a long way in approaching a more rational stance. /rant off. ---
**Author:** ![micco](https://avatars.discourse-cdn.com/v4/letter/m/5f8ce5/32.png) [@micco](https://boards.straightdope.com/u/micco)\ **Post date:** [February 18, 2005, 2:05pm UTC](https://boards.straightdope.com/t/can-i-get-into-trouble-for-publishing-a-strong-cypher-algorithm/290605/8 "2005-02-18T14:05:45Z")
> [@ultrafilter](#): > > I remember somebody put source code of DES on a t-shirt. The appeal of it was that you could wear it across the border and break the law, and there was virtually no chance of getting arrested for it. Actually, it was RSA not DES, which may be why google was no help. I haven’t seen a link to the shirts in a long time since the export rules changed. Having RSA in a few lines of Perl on a tshirt was funny when encryption actually was classed as a munition, but now it’s just quaint.