Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Encryption Security Your Rights Online

SA Government's Crypto Registration Up And Running 249

Posted by Hemos from the bad-bad-policies dept.
orange writes "Anyone who supplies crypto products to South Africans (and the government defines crypto as almost anything) has to register with the appropriate agency and pay a ZAR2000 fee (US$200). Failure to supply South Africans without being registered means potential jail time (How they're gonna get you unless you come to South Africa is another story). A copy of the legislation can be found can be found online."
This discussion has been archived. No new comments can be posted.

SA Government's Crypto Registration Up And Running More

SA Government's Crypto Registration Up And Running

Comments Filter:

  • How are they going to get you? (Score:4, Insightful)

    by gmhowell ( 26755 ) <gmhowell@gmail.com> on Tuesday October 01, 2002 @03:47PM (#4369179) Homepage Journal
    There are these things called 'extradition treaties'. I have no idea what the nature of one (if any) between {US|CA|UK|DE|etc.} and SA is, but it might exist.

    • I strongly doubt the US will ever surrender a citizen to a foreign court to stand trial.

    • Re:How are they going to get you? (Score:4, Informative)

      by f97tosc ( 578893 ) on Tuesday October 01, 2002 @04:00PM (#4369307)
      US/South Africa treaty [state.gov]

      Tor
    • Extradition isn't for all crimes. eg. New Zealand & Australia will trade murder suspects, but not fraud suspects.
    • And even if they dont have one today, they might tomrrow..

  • Hey (Score:5, Funny)

    by VultureMN ( 116540 ) on Tuesday October 01, 2002 @03:47PM (#4369180)
    Let's get a collection to send Theo to South Africa on vacation!

  • uh-oh. (Score:4, Funny)

    by penguin_punk ( 66721 ) on Tuesday October 01, 2002 @03:48PM (#4369188) Journal
    I just double-checked my logs and it looks like I'll be canceling my winter vacation. Jailtime doesn't appeal to me.
  • This sounds like a terrible law, but it may have a good effect. The MPAA and the RIAA are crypto merchants, since they use schemes like CSS and CD copy protection to try to screw over their customers. But under this law, they should have to pay South America! It'll be nice to Hillary Rosin rotting in prison in Buenos Aires!
    • Yeah, because $200 is going to really break the MPAA and RIAA.

      Even if it were $200 per title, they would still make it up by selling 20 or so discs. I strongly doubt it's going to be interpretted as $200 per individual copy of a disc.
      • "Yeah, because $200 is going to really break the MPAA and RIAA."

        Yes, but, the idea of laws is that they carry enough force to dissuade people from routinely violating them. A party who willfully breaks a law, considering the fines to be merely a cost of doing business, should be punished harshly on the basis of their contempt for the law, regardless of the fine.

        If there's a $100.00 fine for dumping, you cannot dump your trash there once a week and drop off a check for $100.00 at the courthouse clerk's office. The willful, repetitive nature of your violation will take on a legal signifigance beyond the scope of the original violation.

        In practice, of course, many *do* get away with such practices, but not indefinitely, and not without risk.

    • Re:use it against the MPAA and RIAA! (Score:2, Funny)

      by Anonymous Coward
      Uhm. Yo. It's South Africa, not South America.
    • Your next assignment: at least read the slashdot blurb before posting, and then study a world atlas.

      * What's this about South America?
      * You really think a one-time $200 reg. fee (per product, $900 for changes/updates) will hurt the MPAA or RIAA?

    • Re:use it against the MPAA and RIAA! (Score:1, Informative)

      by Anonymous Coward
      Why would South Africa ship her to Argentina?
    • But under this law, they should have to pay South America! It'll be nice to Hillary Rosin rotting in prison in Buenos Aires!

      Maybe Johannesburg would work better as that is a city that is actually inside the South African borders?

      Then again, speaking as an ex-South African, the current government does have such boundless abilities to mess everything up that it would not surprise me in the least if they sent people off to prisons in Buenos Aires.

  • WTF (Score:5, Insightful)

    by tomhudson ( 43916 ) <barbara,hudson&barbara-hudson,com> on Tuesday October 01, 2002 @03:48PM (#4369192) Journal
    Of course, if you don't supply them with the key, how are they going to proove it's YOUR product that did the encryption in the first place?
    • They find stupid users computer:

      Stupid user has *.yap files on it, encrypted...

      your app makes .yap files when it encrypts things

      Don't think that could happen?

      I've noticed this trend on slashdot as part of the geek influence no doubt. Repeat after me... things don't have to be mathematically proven to count as proof in a court of law.


      ---Lane
      • How about this:

        "my app" assigns random file extensions;

        They find files that end in .txt, .gif, .mpg, etc.

        They look elsewhere...

        Seriously, on systems that rely on the filename/extension, this MIGHT be a workable scenario ...

        But in reply to your statement that things don't have to be mathematically proven to count as proof in a court of law, they do have to be proven. the standard of proof is:

        - in civil courts, the preponderance of the evidence;

        - in criminal courts, beyond a reasonable doubt.

        A simple way to show that not all .yap files are encrypted files would be to rename a .gif file to .yap. It's not encrypted, and shows that "my app" is not the only way to create such files. They would then have to look for, say, signature bytes in the file header (a la MAGIC filetypes). If there is no header, they're shit out of luck.

        This "trend" for geek influence is actually a good thing, certainly better than the tyranny of political correctness that the "Moral Majority" had previously attempted to impose on the "Real Majority", who saw them as a bunch of self-important pig-fucking hypocrites.

        Best regards, and thanks for taking the time to point out a potential problem for all those designing new crypto packages :-)

  • Failure to supply South Africans without being registered ...
    It's more like a failure to write a story without knowing English.
  • Failure to supply South Africans without being registered means potential jail time

    OK, I fully expect to fail to supply South Africans with any kind of crypto technology. I also don't expect to be registered. And you're saying I'll go to jail for this? That's crazy!

    --
    Will I be Boered?

  • Slashdot (Score:2, Funny)

    by penguin_punk ( 66721 )
    Rule #1 of slashdot etiquette

    If you begin to get hammered, point your cname to someone elses machine.

    And do it FAST!
    • But they got phones and faxes!

      0a. Last Update: Mon Sep 30 21:15:37 SAST 2002
      0b. Sender: dns-admin@uunet.co.za
      0c. Posted: Sun, 29 Sep 2002 21:08:35 +0200 (SAST)
      0d. Subject: UPDATE DOMAIN aspa.co.za
      0g. Hist Cnt: 2
      0h. Inv Number: 0
      0i. Contract: NEW
      1a. Domain: aspa.co.za
      1b. Action: U
      2a. Domain Owner: Eskom Information Technology Services
      2b. Owner Postal: P O Box 1096, Johannesburg, 2000
      2c. Owner StAddr: P O Box 1096, Johannesburg
      2j. Owner Phone: +27 11 203 6075
      2k. Owner Fax: +27 11 203 6075
      2l. Owner E-Mail: heinz.kollner@arivia.co.za
      3a. Opp Date: 2002/09/30 21:15:23
      4a. Adm Contact: Kollner, Heinz
      4b. Adm Title: UUNET South Africa DNS Administration
      4c. Adm Company: Eskom Information Technology Services
      4d. Adm Postal: P O Box 1096, Johannesburg, 2000
      4e. Adm Phone: +27 11 203 6075
      4f. Adm Fax: +27 11 203 6075
      4g. Adm E-Mail: heinz.kollner@arivia.co.za
      4h. Adm Nic:
      5a. Tec Contact: UUNET (SA) Operations
      5b. Tec Title: UUNET South Africa DNS Administration
      5c. Tec Company: UUNET South Africa
      5d. Tec Postal: PO Box 44633, Claremont
      5e. Tec Phone: +27 21 658 8700
      5f. Tec Fax: +27 21 683 0160
    • But they got phones and faxes!

      And I'd use this for what? Oh. I forgot. I'm supposed to call them with my VISA, right?

      "Hi, yes, I checked through my logs and it turns out I had one of your citizens download some ssh source from me. I'm just calling to give you my credit card number so you can bill me the the registration fee."
  • the certificate authority has a headquarters in
    South Africa...

  • Why language skills matter (Score:5, Funny)

    by itp ( 6424 ) on Tuesday October 01, 2002 @03:57PM (#4369269)
    Failure to supply South Africans without being registered means potential jail time

    I don't think that sentence means what the poster intended it to mean.

    Ian Peters
    itp at ximian dot com
    • Failure to supply South Africans without being registered means potential jail time

      Obviously, it means that if you supply South Africans to the market [1] all is fine, whereas if you fail to supply them to the market without registering as a non-supplier, you in a heap o' trouble, boy!

      [1] I thought slavery was illegal there; they must have relegalized it there once they kicked the whites out. Or maybe that really meant something else entirely? No ...

    • "Grammar"

      Inigo Montoya: You keep using that word. I do not think it means what you think it means.
    • I don't think that sentence means what the poster intended it to mean.

      INCONCEIVABLE!!!
    • > Failure to supply South Africans without being registered means potential jail time

      I don't think that sentence means what the poster intended it to mean.

      But... what if it does?!?! Ive failed to supply them crypto, AND im not registered...!

      In fact, quite a few of us have too, id bet. What are we going to do...? Aggghhhh!

      I suppose I could just read the article... what am I thinking, this is Slashdot, must be true... must be true...

      /me starts packing his stuff before the SA authorities break down his door...

    • For those who didnt' catch it:

      In the US, it hasn't been legal to supply South Africans to anyone since the Emincipation Proclaimation was signed. :-D

  • What about credit card numbers? (Score:5, Insightful)

    by jc42 ( 318812 ) on Tuesday October 01, 2002 @04:01PM (#4369315) Homepage Journal
    The obvious intent of all this is to make people pay the registration fee for every browser they may have on any machine. Otherwise, if you even accidentally download an encrypted page, i.e., you make a credit-card purchase over the web, you are risking a jail term.

    Of course, the obvious thing is for vendors to supply Windows machines that don't have any encryption installed, so that the vendors don't have to pay the registration fee for every sale. This is likely to lead to a situation where credit-card orders are sent unencrypted. The SA spammers will love this.

    People keep talking like encryption is some military or law-enforcement topic. But the main use of encryption these days is to prevent the interception of commercial information. The fact that restrictions on encryption will make financial data easily available is not necessarily accidental. The goal could very easily be a desire on the part of the government to have easy access to everyone's financial transactions. Such information has a lot of political uses.

    • In standard /. "I never need to read the articles" mindset, this argument is totally irrelevant. *Suppliers* of crypto have to register, not users, and *Suppliers* only have to register once. $200 to MS to give away Internet Explorer in South Africa is a drop in the bucket.
      • > In standard /. "I never need to read the articles" mindset

        Thats because some of us dont have to read the articles not to make wild crazy silly illogical assumptions.

        I didn't read the article (seems /.'d), but my BS detector went BEEP BEEP when I read his post. :)
    • ?!?!

      WHAT?!

      Anyone who supplies SA's with an encryption product .. this doesn't sound like a per-seat deal, just a registration of the fact that you are selling a crypto product in SA.

      Can you prove to me that this is a per-seat tarrif, or just an attempt at monitoring what crypto technologies have been imported into the country, let me know.

      Until then, to suggest that they want to eliminate crypto via this registeration fee makes me ask: Why don't they just ban crypto altogether then?
      • "...just a registration of the fact that you are selling a crypto product in SA."

        Why must everything be framed in terms of commerce and profit? Where does this leave a free OpenSSL mirror (not selling anything)?

        • > Where does this leave a free OpenSSL mirror (not selling anything)?

          Well, I'd bet that they would consider this a "sale" that requires registration.

          If not, then the law is pointless. As a vendor, I could just say "I'm only selling the hardware; the encryption is free." Sellers love to give things away "for free", if you only get the free things by paying for something else.

          Whether they could actually impose a registration fee on openssh.org isn't obvious. Who would they extradite and toss in jail?

          There's still the prospect that a clueless SA computer user will use encryption without realizing the fact. How many people realize that when you order a CD or a shirt from a web site, you are using encryption? But you can be sure that the software installed at the ISP will notice your encrypted messages.

          Unless you can present a receipt for the registration fee for your encryption library, what defense do you have when they come knocking on your door?
      • "Anyone who supplies SA's with an encryption product .. this doesn't sound like a per-seat deal, just a registration of the fact that you are selling a crypto product in SA."

        This type of law doesn't normally limit itself to commercial transactions: remember that the Californian courts will consider that you "do business in" california if someone from that state can access your website. In fact, you would also be "publishing" in california. Doesn't bother them that a user would have to post a request to your server in the UK, and retrieve a document created in the UK; as far as they're concerned, it's as good as living there and running a press.

        It may be illogical, uninformed, and just plain wrong, but don't be surprised if courts take a weird interpretation of things. Is pgpi.org visible from South Africa?

  • given the strained relations SA had with the US/UN/world at large (killing your majority black citizens with police raids has the habit of turning people against ya...) - I highly doubt any extradition treaty exists...

    besides, if there were, we'd just extradite all lawbreakers instead of waiting for them to come to the US (like Dimitry) -

    dumbasses...taking a page from the early 90's again.

    RB
  • There are only a couple of scenarios in which this makes any sense to me: 1. The SA gov't is trying to create an embargo on the importation of crypto in order to spur domestic development of crypto. 2. The SA gov't believes that if they know who is distributing and receiving crypto, it will make things easier for them to track and quash any political uprising that may come as a result of a particular group having the ability to communicate securely. I really don't think I understand why govenments are still concerned with crypto regulation. Even the NSA is finally easing exportation laws. Even Bruce Schiner (Atlanitic Monthly, Sept. 2002) has revamped his whole philosophy on crypto since Applied Cryptograpy was released...a very interesting article.... -me
    • 1. The SA gov't is trying to create an embargo on the importation of crypto in order to spur domestic development of crypto. Unlikely, the fees apply to local stuff as well. And foreigners are better able to pay them.

      The SA gov't believes that if they know who is distributing and receiving crypto, it will make things easier for them to track and quash any political uprising that may come as a result of a particular group having the ability to communicate securely. Also unlikely, they could use very rudimentary, but nonetheless worthwhile, crypto that came with their computers (i.e. ssh/sftp, ssl, etc.) This would be innocuous, because lots of people use ssl and the like.

      It seems more likely that the government is just paranoid and technologically illiterate. You would expect more of them, but the US government did (and is still doing, see my sig) similarly silly stuff, and SA does not exactly have a track record for having an enlightened government.
  • Registration form [aspa.co.za].
    I think I'll register my Wheaties Secret Code ring..
  • well, that might cause a re-naming of debian's "non-US" section into a "non-US-non-SA"

    how I hate to keep changing my sources.list...

  • In other news... (Score:4, Funny)

    by bobdotorg ( 598873 ) on Tuesday October 01, 2002 @04:08PM (#4369365)
    JOHANNERGURG (Rueters) - Bazooka Joe was arrested and being held without bail for posession of decoder rings with intent to encrypt.
  • Guess I won't be making millions on my super-secret MI6-type gung-ho classified Microsoft-Monopoly licensed Crypto-Magic 5000 All-In-Wonder program for encrypting Slashdot Sig files. And South Africa was my number one target market, too...

    Oh, wait... BrainRAM (TM) fried again. You may now return to your regularly scheduled thread...
  • More over-zealous governments that think cryptography is the tool of the devil... thats exactly what the world needs right now. Isnt Crypto export tough enough already? (from the U.S. that is)
  • What exactly constitutes 'supplying'..

    For example, would hosting a program on a website accessible to someone in South Africa count as supplying? What if someone in South Africa hacks into an ftp and downloads the program?
  • This is excellent news! Here's another country imposing it's laws upon the whole Internet. And personally I can't think of a good way to stop them. :-( Or maybe we could just gather email addresses of those responsible and post them on /. ?
    I personally feel that countries extending their jurisdiction over the Internet should be violating some kind of international treaty. After all, SA is restricting the freedom of all people here, not just their own. Perhaps we could convince G.W.O[fficeholder] to fight netwide oppression instead of perceived terrorism?

  • Where do I send my money? (Score:3, Funny)

    by grub ( 11606 ) <slashdot@grub.net> on Tuesday October 01, 2002 @04:20PM (#4369459) Homepage Journal

    I've added some nifty features to ROT13 and don't want to end up in a South African jail...

  • Who else feels like sending some crypto to postmaster@aspa.co.za?
  • Anyone who supplies my house with information owes me $1000/byte.

  • Even more terrifying... (Score:5, Informative)

    by Chastitina ( 253566 ) on Tuesday October 01, 2002 @04:34PM (#4369548)
    ... is the additional requirement to register all "critical databases":

    "The protection of sensitive data is essential for a functioning of a modern society. As stated in the Electronic Communications and Transaction Act, the information that is of importance to the protection of the national security of the country or the economic and social well-being will be declared as critical. All critical databases will be identified and registered with the Department of Communications which includes the details of the database administrator, the location of the database and the general description of the categories or types of information stored in the critical database.The registered information will be treated as confidential. The protection, management and control of critical databases must comply with the minimum standards that might be prescribed by the Minister. The audit will be performed, from time to time either by Cyber Inspectors or an independent auditor to evaluate the compliance."

    Given such vague standards for "critical" almost *any* commercial database could be deemed "of importance to the protection of the national security of the country or the economic and social well-being." Amazon.com's database contains names and addresses of persons purchasing "how-to" books on terrorism and building bombs? It's critical! A Pr0n site has kept track of all visitors? Some of them *might* be criminals and dangerous to "social well-being."

    Yes, there's also issues with persons living in SA downloading crypto software from foreign companies that haven't registered (are they liable or not?), but most of that is easily bypassed. Just have a visitor bring the "protected" code in on a floppy and distribute it internally.

    The database restrictions have much more serious implications...

    • All critical databases will be identified and registered with the Department of Communications which includes the details of the database administrator, the location of the database and the general description of the categories or types of information stored in the critical database.The registered information will be treated as confidential.

      Does anyone else realize what a whopping huge security hole this is? Go to one place to learn where all the secrets are! Even if you don't get the db contents (yet), you can infer all sorts of interesting things about organizations and people that show up on the lists. Using as a baseline the sad history of moles in US government security agencies, it shouldn't take much $$ relatively speaking to acquire the lists of secret dbs.
      • 56. (1) The Minister may prescribe minimum standards or prohibitions in respect of--
        (a) the general management of critical databases;
        (b) access to, transfer and control of critical databases;
        (c) infrastructural or procedural rules and requirements for securing the integrity and authenticity of critical data;
        (d) procedures and technological methods to be used in the storage or archiving of critical databases;
        (e) disaster recovery plans in the event of loss of critical databases or parts thereof; and
        (f) any other matter required for the adequate protection, management and control of critical databases.

    • The audit will be performed, from time to time either by Cyber Inspectors or an independent auditor to evaluate the compliance.

      Otherwise known Random J. Hacker.

      -
  • What a cool source of revenue for oppressed countries. Charge the providers to sell their services.
  • In other, off-topic, South Africa news, this report [suntimes.co.za] about Bill Clinton's recent visit:
    Renée de Wet, the waitress who served Clinton, said he chose a calamari starter, followed by Norwegian salmon, garlic mash and mayonnaise. He had no dessert and no wine.

    Clinton was "very down-to-earth and friendly", De Wet said. "As he left he asked if we'd like to have a picture taken and we rounded up all the staff. He was just such a cool guy.

    "As he was leaving, he put his arms round a girl in his party - I don't know what her name was, she was small and dark - and said, 'Hey, take a picture of this for your local paper. This is my other wife.' "

    Meanwhile, he's accompanied by -- Chris Tucker! Geez, it's embarassing enough when Bono gets treated like a head of state, but Chris Tucker? Was Carrot Top unavailable?

  • the south african government:

    People fear that which they don't understand.

  • Never Assume (Score:3, Interesting)

    by jasonditz ( 597385 ) on Tuesday October 01, 2002 @04:54PM (#4369678) Homepage
    that a foreign government can't get you if they really want to.

    I'd advise everyone to do a little reading on a man called Gerhard Lauck.

    He was/is an avowed neo-nazi who published material relating to his distasteful belief system in the United States (where it is of course perfectly legal, if considered bad form). He exported some of this material to Germany, where it is considered a serious crime.

    Obviously the U.S. wouldn't extradite him, because freedom of the press is so important, but unfortunately for him while travelling in another country he was picked up by German authorities and pretty much smuggled acrossed the border to Germany, where he spent several years in prison.

    • Re:Never Assume (Score:3, Informative)

      by WilliamX ( 22300 )
      He wasn't smuggled across the border. He was arrested in Denmark for hate statements as he was attending a Neo-Nazi convention there, and was, months later and following an appeal all the way to the Danish Supreme Court, extradited to German where he was tried, convicted and served 4 years in German prisons.

  • It's all about taxes (Score:3, Insightful)

    by vlad_petric ( 94134 ) on Tuesday October 01, 2002 @04:56PM (#4369705) Homepage
    It's very simple, really - they simply don't get enough money from taxes, so they have to keep inventing new taxes to sustain their budget.

    One of the signs an economy is in free-fall.

    The Raven

  • This is significant (Score:2, Insightful)

    by ACNeal ( 595975 )
    When you think of all the people that say "What do you need to encrypt stuff for, if you aren't doing anything wrong" and the best thing you can come up with is "Do you send everyone postcards?", think of this.

    One of the main reasons the entire world should be involved in strong, government free crypto is for nations that systematically deprive their citizens of basic human rights. And I am not talking about your right to fly without being frisked.

    South Africa has long been known for its obscene treatment of people, and it hasn't gotten any better since Mandella took over. If anything it has gotten worse.

    People need to be able to send out cries for help without those cries bringing down even more heat. Human rights workers are probably the most legitimate users of crypto, but until everyone uses crypto to send love notes, grocery lists, and the like, these messages and the people that send them, will stick out like sore thumbs.
  • so that certain people in that part of the world don't find out about the redirection of all the surplus government cheese...
  • have fun trying to extradite the millions of people who are "supplying crypto" to the people of your country, BTW, is it just me, or does "CRYPTO" sound like one of those fake "movie" drugs? Just an observation of mine.

  • That's *in* SAf, not *to* SAf (Score:4, Insightful)

    by jon_eaves ( 22962 ) on Tuesday October 01, 2002 @09:49PM (#4371154) Homepage
    When will people read the friggin articles first. Oh, I forgot, this is /. with people having a reading age of about 10, and a concentration span in the nanoseconds.

    When I saw it, I nearly had a heart attack, I write freely available Java crypto BouncyCastle.org [bouncycastle.org] and thought of the horrible problems that we're going to have keeping SAf off the site.

    I spent the 2 seconds actually reading the paragraph at the SAf Gov Site [aspa.co.za] and it says:

    All Cryptography Providers providing services or products in South Africa are required to register their services or products with the register maintained by the Department of Communications.

    Note, the wording is in.

    • I would not dismiss that so easily. The intent of the law is the basis for the ruling of a judge (in SA). Unless a lawyer can convincingly argue that only local providers of crypto were intended to be registered, it will be read as "any provider with a presence in the SA market providing crypto". This may limit the applicability to providers with some sort of physical presence / outlet / support in SA, and not extend to pure virtual trade. But I wouldn't count on it.

    • (3) A cryptography service or cryptography product is regarded as being provided in the Republic if it is provided--
      (a) from premises in the Republic;
      (b) to a person who is present in the Republic when that person makes use of the service or product; or
      (c) to a person who uses the service or product for the purposes of a business carried on in the Republic or from premises in the Republic.

  • Ok... (Score:2)

    by M@T ( 10268 )

    We won't mention the massive tariffs that the US places on imports like Australian lamb or Canadian timber or anything steel to subsidise poorly performing local industries...

    or those wonderful pieces of *US* legislation like the DCMA and CDBTPA, which, regardless of their intended jurisdiction, have ramifications on software developers and technology providers worldwide.

    The US doles out more shit like this SA crypto legislation than any other country in the world.

Slashdot Top Deals

Kleeneness is next to Godelness.

Close