Subject: Re: GNU and classified software
From: Frank Hecker <frank@collab.net>
Date: Tue, 27 Mar 2001 12:03:55 -0500

Ben_Tilly@trepp.com wrote:
> > This is exactly analogous to the former situation in the US with regard
> > to encryption software. Prior to the US government export control
> > regulations being changed (say, back in 1999) a US citizen and resident
> > could create software implementing an encryption algorithm (DES, RSA,
> > whatever), license it under the GPL and distribute it to another US
> > resident; however the recipient of the software would be prohibited from
> > redistributing that software to further persons, if those persons were
> > not in the US (or Canada). That restriction was not imposed by the
> > creator of the software, it was imposed by US government laws and
> > regulations relating to encryption software.
> 
> IANAL but please explain how section 7 of the GPL is consistent with
> this.  If you are prevented from distributing except to people who
> may not in turn distribute however they want, then you are not allowed
> to distribute at all.  Or at least that is how I read it.

This is an interesting point. I don't have time to comment in full, but
I wanted to make a brief comment. The document "What is Free Software"
comments on the issue of export control as follows: "Sometimes
government export control regulations and trade sanctions can constrain
your freedom to distribute copies of programs internationally. Software
developers do not have the power to eliminate or override these
restrictions, but what they can and must do is refuse to impose them as
conditions of use of the program. In this way, the restrictions will not
affect activities and people outside the jurisdictions of these
governments."

On rereading it, the last sentence seems to imply that this is written
from the point of view of a developer _outside_ the areas under
restriction. Thus, for example, if a developer lives in a country with
no export or other restrictions, they simply distribute the software
under a free software license, and don't worry about restrictions other
countries might impose; their only obligation is not to incorporate
these restrictions "as conditions of use of the program."

But consider this from the point of view of a developer living within a
country with export restrictions, releasing the exact same software
under the exact same free software licence, but knowing that the
software cannot be distributed outside their country. Is that developer,
purely releasing the software in this context, imposing restrictions "as
conditions of use of the program"? And thus that the developer cannot
therefore by definition release this software as free software? (The GPL
clauses you quote appear to be a special case of this.)

If this is true, then this same reasoning would apply to software
released under a free software license but for internal use only with an
organization, or to the case we've been discussing of classified
software which can be distributed only to those posessing the proper
security clearance: by definition these cannot be free software even if
they are nominally released under a free software license, and could not
be released under the GPL according to the clause you quote.

So then this by extension would mean that a government agency that took
GPLed software from outside for use in a classified environment, made
modifications, and distributed the resulting software to other agencies
or to contractors, also for use in classified environments, would be in
violation of the GPL. Which seems like we're leading up to a argument
that the US government should strongly discourage the use of GNU/Linux
software by government agencies, at least for classified applications
and other circumstances where government regulations might restrict
distribution of the software. I think I'm beginning to sound like Jim
Allchin :-)

Frank
-- 
Frank Hecker            work: http://www.collab.net/
frank@collab.net        home: http://www.hecker.org/