New Zealand Crypto Policy - Confusion now hath made his masterpiece

Peter Gutmann

This page documents the recent history of, and current state of, New Zealands crypto export policy as decided by several intelligence agencies and a supporting cast of bungling bureaucrats. This policy has resulted in New Zealand enjoying the dubious distinction of having the strictest export controls on earth, with everything ranging from crypto hardware down to software, library books, computer magazines, and journals being restricted from export. It's not even possible for a university to publish academic research without prior permission from a government agency, and the requirements for obtaining this permission are structured to ensure that they can never be fulfilled.

This page contains links to a sizeable collection of never-before-published documents including correspondence with relevant government agencies, and media reports on the situation. Note that a number of the more interesting documents are currently not online as I'm still checking with the sources who liberated them that it's OK to publish them.

You can jump directly to relevant sections using the links below.

New Zealand export controls

The Cyphercom experience

Obtaining answers from MFAT

Summary of the New Zealand situation

(New) Parliamentary questions on NZ crypto policy

New Zealand Export Controls

Finding out about New Zealands export controls is a complicated and difficult process. The starting point is the
Customs Act of 1966, specifically the section on prohibited exports which was when the prohibited exports section was moved from 70 to 56 and the working was changed slightly.

There's no further information in the Customs Act, but NZ Customs have a short publication "New Zealand Customs Fact Sheet: Export Prohibitions and Restrictions" which contains, among such curious items as cat skins and a large list of agricultural products which can't be exported without going via the appropriate government department, the item "Strategic goods such as computers, navigation and marine equipment, firearms, ammunition, explosives, military aircraft and vessels". The responsible government department is the Ministry of Foreign Affairs and Trade (MFAT, pronounced "em-fat"). MFAT extend the Customs definition of "Strategic goods" to cover "Computer technology, information security systems, and telecommunications equipment", which includes computer software. The entity within MFAT which handles this is the International Security and Arms Control Division (ISAC), who are advised by the Government Communications Security Bureau (GCSB), the New Zealand subsidiary of the US National Security Agency, which acts as a big brother to a number of similar organisations scattered around the globe.

Once you get past the part where NZ Customs are involved, the whole setup is run like the mafia. Nothing is ever written down, everything is done verbally. Although it took only a paragraph to describe how this works, it took more than two months of work to find out in practice. Before publicity over the restrictions lead to front-page newspaper stories in early 1997, noone had ever heard of these restrictions. A search of NZ legal databases found nothing. Several IP lawyers had never heard of the restrictions. It wasn't until I ran into someone in January 1997 who knew what to ask for and where that I got a copy of the regulations.

MFAT's explanation of, and justitication for, the export controls was explained in their Business File, Vol.3, No.7, in which they claimed that they were required to control exports under the terms of the Wassenaar Arrangement, and retroactively altered some of the statements they had made in correspondence a few months earlier (there are links to this correspondence further down). The Business File article gives a good indication of MFAT's standard justification for and response to any queries about export controls.

The Cyphercom Experience

In early 1996, a US company called Cyphercom Solutions developed a mechanism for performing online credit card transactions of a type which protocols like SET still can't do nearly two years later. The only major remaining obstacle was that they didn't have a mechanism for securing the transactions, which was making it difficult to attract interest in the technology. In order to provide this security, they wanted to use my cryptlib encryption toolkit. Their lawyers advised them that it was necessary for them to obtain an official, physically exported copy of the software for due diligence purposes so that there wouldn't be any complications later if the source of the software were called into question. As the application involved financial transaction processing they had received indications from the NSA that it would be looked on favourably in terms of getting export permission. Somewhat strangely, they were given the distinct impression that to get anywhere they'd need to play ball with the NSA, even though it was New Zealand software being exported from New Zealand, where the NSA should have no jurisdiction.

Initial Attempt at Export

Preliminary investigations by Cyphercom's lawyers indicated that MFAT would apply export controls under the COCOM export control regime (a Cold War defence agreement), and that export to countries like the US would be unlikely to require an export permit. Based on this advice, in May 1996 Cyphercom decided to try to export the software to the US (so they would have a copy to demonstrate to customers) and to Singapore (so that Asian business partners could examine it). Although MFAT initially verbally okayed the export, they changed their minds at the last minute and issued written instructions covering the export, one set covering the export to Singapore and one set covering the export to the US. The US export instructions were further expanded in a letter from MFAT covering the US export. As it turned out, the wording and terms of the instructions were completely nonsensical (for example the Singapore (non-)permit required the export of a single, nonexistant encryption algorithm, and didn't allow for the export of any technology which actually existed).

Inquiries by lawyers in the US indicated that there had been a flurry of communication between the NSA and the GCSB over this (as one person I talked to put it, "When the NSA says 'Bend over', the GCSB says 'How far?'"). The NSA might as well have signed the export (non-)permit themselves. The story from the US lawyers was that there was "repeated intervention of the NSA" and that "NZ is out of its depth, it was terrified of offending the US".

From the information I was later able to gather the whole thing seems to have been initiated by the GCSB rather than the NSA, who were afraid to do anything without NSA approval. The GCSB went to the NSA and asked them what they should do, and the result was the (non-)permit. A person from the Australian Defence Signals Directorate (DSD) (an Australian intelligence agency, the Australian version of the NSA) later told a reporter that the GCSB had gone to the DSD and asked them "Would you allow the export under these conditions?", to which the DSD said "No".

The upshot of this was that, after several months of work and many thousands of dollars in legal fees, MFAT had given Cyphercom a permit to export nothing.

The Canadian Foreign Affairs decision

Shortly before this, the Canadian Department of Foreign Affairs and Trade, which follows the same export guidelines as New Zealand (dual-use technology under the Wassenaar arrangement), had ruled that cryptlib was exportable to anywhere except the previously mentioned restricted countries, with no permit necessary, and no need to apply for a permit:

"Application No.278466 covering cryptographic software proposed for export to England, this software is not controlled according to Canada's ECL. Therefore, provided the product noted in this application is not of US origin within the meaning of the ECL item 5400, these goods may be exported to any country, except Libya and Angola, without an export permit. Please note that most goods to Iraq are still prohibited at this time, as well".

The interesting thing about the Canadian decision was that I was contacted twice by Canadian export controls people who asked me a number of very detailed questions about the software, whereas MFAT managed to come to their decision without ever examining the encryption software or talking to its author. As far as I've been able to tell MFAT had very little to do with the decision: They have to follow the GCSB's advice, and the GCSB won't do anything without the NSA's permission.

At about the time that the original export appeal was lodged, the GCSB had told Orion Systems, a New Zealand company which produces medical information and communication systems for transmitting medical information, that they couldn't export a product with the encryption necessary to protect patient medical data, lab results, patient referrals, and so on, without obtaining an end user certificate for each user. An end user certificate is a sworn statement that the end user isn't a terrorist or criminal and won't pass the technology being exported on to terrorists or criminals. This works fine for things like tanks and cruise missiles, is somewhat questionable for an item like a floppy disk, and is downright ludicrous for a fleeting electronic copy of a program which can be transmitted and copied almost anywhere in a fraction of a second.

In order to sell a copy of their medical software to just one overseas site, Orion would have been required to obtain two thousand certifications from all the end users. Larger sites with ten thousand users are not unknown. This meant that Orion would have had to somehow obtain 2000 sworn declarations from users of their software just to allow the exchange of medical records. Orion didn't even bother going to MFAT, because if the GCSB required these impossible-to-meet conditions then going to the next level down in the chain of command would make no difference.

Dodgy Dealings with the DSD

At this point, things started to get weird. At about the time I wrote the letter, I was FedEx'd an NDA sent by lawyers representing PGP Inc (a US encryption software vendor) to Orion Systems, sent in a standard FedEx letter envelope. It was intercepted by New Zealand Customs and opened, and the contents examined, before I got it. This wasn't the usual random (and quite rare) "Examined by Customs" spot check when they make sure there's no kiddie porn on your Linux CD's (seriously!), the letter had a large red "Customs - Hold" sticker on it with an LAX flight number, so I assume they knew in advance what they were looking for. Customs couldn't tell me why it was intercepted, but seemed a bit surprised that the letter had been opened. They said that they may have been "acting on information".

In early October 1997, about a fortnight after a sent the letter to MFAT questioning the export refusal and asking for clarification on what law they were using to block the export (and many months after the export itself), Kiss Audio Video (an Australian video production company and the parent of Cyphercom), got a call from the Australian Ministry of Defence (it was actually the DSD, but they generally identify themselves as Ministry of Defence just like NSA employees are usually identified as Department of Defence rather than NSA). This company, Kiss Audio Visual, are a video production house who have nothing at all to do with encryption software (or, in fact, anything but video production and graphics design, which they are very good at). They were called by Alan Owen of the DSD who said that they had been informed that New Zealand Customs had intercepted a shipment containing a high-security encryption product which was being illegally exported from New Zealand. According to the story, when NZ Customs went back to the party who exported the software, they claimed it was on behalf of Kiss. The Managing Director of Kiss called the Ministry of Defence to make sure this was actually for real, and they confirmed that it was.

This story has several very large holes in it:

Alan said that this export had very serious consequences, and that they would be coming to Melbourne to talk to Kiss at 2pm the next day. The Kiss Director immediately called Cyphercom in the US, and they discussed having serious quantities of lawyers present at the meeting, and taking the whole story to the media (being a video production company, they had strong tries to the television industry who would probably have taken strong exception to trumped-up charges being brought against a business partner).

The visit was cancelled without any explanation. Who says governments never listen to their citizens?

(The DSD side of the story was that they were rather busy that day and didn't have time to carry out their investigation).

The implications of this are interesting. Despite the fact that MFAT had already in effect denied permission for the export, someone with the ability to listen in to international phone conversations had used discussions about the export to fabricate a story about New Zealand Customs with which the Australian government could harass Kiss, who had done nothing wrong and in fact had nothing to do with the whole affair (unfortunately I don't have any proof of the phone-conversation monitoring, but I can't see how anyone could possibly have connected Kiss with Cyphercom except for the phone conversations - they simply have nothing else in common). Apparently whoever was pulling the strings saw it necessary to bypass MFAT entirely in an attempt to suppress the encryption software. The DSD later revealed to the media that the whole phony story had come from the GCSB.

Little man with the big eraser, changing history

In early September 1996, I wrote to MFAT questioning their export policy and including a number of documents which proved that other countries didn't apply these restrictions to the software, including a letter from the Canadian Department of Foreign Affairs and Trade which stated that the very same software which MFAT had blocked the export of wasn't export-controlled.

A mere 1 1/2 months and several phonecalls later, MFAT replied to this letter stating that the export (non-)permit was in fact not final, and was still under consideration, which was at odds with what they had told Cyphercom and with the wording of the permit itself. The letter also stated that this was a very new area and one they weren't familiar with, in direct contradiction to their statements in their Business File publication which indicated that such exports were common.

MFAT declined to answer my question as to whether this portion of NZ's foreign trade policy was being controlled by US intelligence agencies.

Meanwhile, back at the DSD...

In early January 1997, Kiss were again informed by Alan Owen of the DSD that he and an associate would again be flying in from Canberra to talk to them, using as justification the same fictitious story about New Zealand Customs that they had used before. They spent about two hours at Kiss, saw that they were indeed a video production house (and nothing but a video production house), and left. Before they left, they told the Kiss people that the source of the bogus story about NZ Customs was "their counterparts in NZ" (the GCSB). Kiss had a lawyer present to witness this.

It is quite probable that the DSD weren't actually aware that they had been fed a false story by the GCSB - they were simply following up a request by a fellow intelligence agency to investigate some suspected military weapons smugglers (or whatever it is that people who sell encryption software are classed as). This still leaves open the question of what motivated the GCSB to do this in the first place, and why they decided to victimise Kiss. Unfortunately while Alan was very helpful throughout the whole affair, the GCSB declined to comment on any of it. I was thankful that, the previous year, I had insisted on the application for the export being done through a shell company rather than doing it myself, in which case it's not unlikely that I would have been the subject of the GCSB's stories, and any ensuing investigation.

The implications of this are pretty scary. The GCSB first used their position to impose impossible-to-meet conditions on Orion and influence MFAT to indefinitely delay export of software which the Canadian government had already ruled wasn't export restricted. However, not content with this, they then fed a fictitious story to the Australian government to convince them to begin an investigation into a company which had done nothing wrong, and who had very little to do with the whole issue.

Media coverage

The National Business Review (NBR), a fairly influential paper read by (apparently) half the NZ business world, covered significant parts of this story on the front page of the 17th January issue. The GCSB declined to comment on anything except to acknowledge that there had been a meeting between a GCSB person and the manager of Orion Systems. The story also confirms (from comments from some of the people involved which were quoted in the article) the GCSB - MFAT and GCSB - DSD connections.

The following week MFAT claimed in the Letters to the Editor column that they were only following orders, and were required by the Wannsee arrangement to restrict exports of crypto which was "40-bit or stronger". This means that anything including 40 bits is restricted. If they're going to try to blindly parrot US policy then they should at least get their facts straight (they later changed their story, possibly in reaction to this writeup appearing online).

A few days later I found someone who knew who and what to ask for in order to get a copy of the NZ export regulations. I called MFAT and talked to a gentleman by the name of John Borrie, who had recently taken over responsibility for this affair from someone else who, to put it mildly, had been a real nuisance to deal with. I suggested to him that the GCSB were feeding him just the information they wanted him to know and no more, and that perhaps he should avail himself of alternate sources of advice. He didn't see it quite that way.

A copy of the export regulations arrived shortly afterwards, and were identical to the Australian regulations, even down to the layout style. A few of the fonts differ, but that may be due to different systems/printers/whatever.

The following week the story was again on the front page of the NBR. This time the story covered the financial difficulties that Cyphercom had been plunged into. Because MFAT had stopped them from having any access to their product for nine months, the company was considering filing for bankruptcy. The companies involved had bent over backwards to try and comply with the vague and obscure rules and regulations, and in return had been subjected to harassment through threats of government investigations, endless delays and legal costs, and eventually bankruptcy because of the delays involved. That weeks issue also contained a Letter to the Editor which summed up the situation.

In September 1997, an article in Computerworld further documented the fact that the export policy was really being controlled by the GCSB, and indicated that other companies had also run into problems, with export delays of eight to nine months being typical (one exporter summed the situation up with "It takes MFAT nine months just to say no").

Obtaining answers from MFAT

In the same week that the second NBR article was published I decided to try applying the Mongolian Stupidity Test ("Can I borrow your sword?") to MFAT. Getting anything out of them was like drawing teeth. I initially wrote to them to ask about the possibility of re-exporting the Finnish ssh program (of which the commercial version of ssh is sold over here through a NZ agent for Datafellows), and the Dutch Python encryption library back to the people who wrote them . For ssh I asked about sending it back to the author and to someone in Germany. For Python I asked about sending it back to someone who occupies the office next door to the author, and to someone in the UK. I thought that the export choices given in my letter to them pretty much covered all possibilities.

In early February MFAT replied to my inquiry with (amongst the usual stuff about terrorists and whatnot) the ruling that I wasn't allowed to send some encryption software back to the person who had originally written it. Based on this text it appears that MFAT are under the impression that if hordes of Finnish terrorists (???) were to suddenly develop a need for Finnish encryption software, they would be expected to make a formal request to MFAT for it in order to provide a nice paper trail, rather than just obtaining it from the source in the country they're located in. Earlier on an MFAT person had told me on the phone that "this is our policy and we're not going to change it", and this written reply confirmed my suspicions - they weren't trying to apply any kind of logic or reason to this, but were just "following policy" like blind automata.

It gets better than this. After receiving the copy of the export guidelines, I wrote another letter to MFAT asking about the status of academic research and books and magazines. In mid-February MFAT replied to my enquiry saying that no export of books, magazines, journals, or academic research was possible without the usual end user certification for anyone reading the item in question. In addition to the total impossibility of obtaining one of these sworn declarations from everyone who could potentially read the work in question, it implied that it would be used and stored under strictly controlled conditions (so that it couldn't be passed on to literate terrorists and other bogeymen). Publication in journals - probably the prime motivation for creating academic research - is therefore automatically excluded.

This also covers things like bookstores which handle mail orders, and libraries which do interloans. A quick check of NZ library holdings revealed that books, journals, and magazines containing encryption code were held by both public and educational-institution libraries situated all over New Zealand. This means that a significant number of New Zealands libraries could be prosecuted under the Customs Act for doing what it is they were created for - loaning out books.

This statement by MFAT represents a truly frightening development in the US's imposition of crypto controls on other countries. One of the arguments put forward during the Clipper debate in the US was that while the US government could promise to use Clipper in a fairly civilised manner (and were constrained by the US Constitution), other countries wouldn't be held back by such constraints and could apply it in ways which would be unheard of within the US. This is exactly what has happened in New Zealand. While any attempt by the US government to require a permit to publish a research paper or read a book would be immediately struck down by the Supreme Court, New Zealand doesn't have a First Amendment - there is no easy way to challenge this ruling. This is a real-life example of the Clipper argument in action - a country with less constitutional protection than the US is applying US-inspired restrictions in a manner which would be unheard of in the US.

The letter also contains a verbatim copy of the US position on encryption key lengths (40-bit conventional - they'd got their story right by now - and 512-bit public key). Based on these statements, I wrote another letter to MFAT asking whether I could automatically export algorithms which fell within the requirements they had given.

MFAT replied to my enquiry by negating their previous statement and saying that any export had to be approved by them, regardless of the key length, and that the best way to obtain cooperation from MFAT was to employ US-owned proprietary and patented algorithms!. Given MFAT's performance and demonstrated grasp of the subject in the past, it's fairly clear that this reply came more or less directly from the GCSB with little MFAT input, and that the GCSB took its cue directly from the NSA (gee, New Zealanders are being given permission to export US proprietary/trade secret/patented algorithms by NZ government decree. Why not just refer all NZ exports directly to the NSA to save time?). This means the New Zealand Ministry of Foreign Affairs and Trade, charged with fostering NZ trade, is setting a policy which requires NZ companies to use foreign technology.

In the meantime, MFAT are still solemnly vapourising about the need for export controls in order to stop terrorists armed with sophisticated military-grade library books and floppy disks of mass destruction. One recent example was in a reply to an article in the NZ Herald, this sort of statement from them is pretty much the standard response whenever anyone questions their policy.

We don't know where we're going, and we don't know where we've been

At this point it might be interesting to examine the varied and ever-changing nature of New Zealands software export restrictions as seen by MFAT.

31 May 1996:

"No objection the the export of [...] DES".

11 June 1996:

"No objection the the export of [...] 64-bit DES [sic]".

21 October 1996:

"We have not yet reached a final decision on [the export]".

31 January 1997:

"An export permit would only be required if it was 40-bit or stronger [sic]".

13 February 1997:

"The export of code in any form is regulated in New Zealand in terms of the guidelines below: They contain encryption limited to (i) 40-bit key lengths for symmetric algorithms; (ii) 512 bits for asymmetric algorithms; (iii) 56-bit DES for dedicated financial algorithms".

18 April 1997:

"It is the responbility of the Ministry in its capacity as the licensing authority - rather than the exporter - to assess whether an encryption algorithm falls outside the threshold of requiring an export permit".

So far MFAT's position on exports has changed every single time they've been questioned about them.

NZ Export Policy as a Road Speed Limit

To understand the way MFAT is enforcing its controls, it might be useful to consider the situation if the road speed limit were enforced in a similar manner. The situation would be:

  1. There is no set value. You can ask "Is this the speed limit", but not "What is the limit".
  2. The answer to (1) changes on a day-by-day basis. If the speed limit is 80 km/h today, it may be 50 km/h tomorrow, and 70 km/h the day afterwards.
  3. The answer to (1) changes depending on how the question is asked:
    "Is the limit 80 km/h" will be answered "Yes", but "Is the limit 50 mph" will be answered "No"
  4. It takes 6-12 months to obtain an answer.
  5. Anyone exceeding the speed limit will be prosecuted.
  6. If don't have a license to drive or have been disqualified, you can drive as fast as you want with no risk of prosecution (referring to the fact that if you don't ask MFAT about it, you can ship infinite quantities of encryption software anywhere you want and noone will bother you about it).

Summary of the New Zealand situation

It's somewhat difficult to provide a summary of MFAT's policy, because there isn't one. The policy changes every time MFAT are asked about it, and is more or less invented as they go along. The single consistent "policy" (if it can be called that) is to make any attempt at legitimate export as difficult as possible. Companies trying to follow MFAT's arbitrary and contradictory rulings may find themselves subject to harassment by government agencies, even when they've bent over backwards to follow whatever MFAT decides the export conditions will be on the day.

Non-legitimate export on the other hand is fine, just pack a crate full of crypto, put enough postage on it to get it where it's going, and drop it into the nearest mailbox. Provided you don't tell MFAT, noone will ever bother you.

As a result of MFAT's incompetence in handling this situation, New Zealand currently enjoys the dubious distinction of having the strictest crypto export controls on earth, including unheard-of restrictions on books and publication of academic research. MFAT (and the GCSB's) intent is to make export so difficult that any non-worthless encryption software (and books and academic research) will never leave New Zealand, ensuring that New Zealand is relegated to the role of a third-rate player in the emerging field of electronic commerce. The end effect is that New Zealands trade policy is being set by US intelligence concerns (via the GCSB and then MFAT) in a manner which would never be accepted if they were to try the same thing in the US.

Parliamentary questions on NZ crypto policy

In late 1997 a number of written parliamentary questions were submitted which questioned NZ crypto policy and tried to obtain more information on what was really going on (thanks to the person who asked them for providing me with copies of the questions and replies). The replies indicated that David Aaron, the US "crypto czar" whose job it was (by the US governments direct admission) to persuade other goverments to adopt US crypto policies, had visited New Zealand, but nobody could provide a precise answer as to what he'd spent two days in NZ discussing [1] [2]. An MFAT official attended a meeting in Australia on crypto policy [3], and neither the GCSB nor the NZ government were developing any form of key escrow [4] [5]. Finally, the GCSB holds meetings on information security and publishes various reports, but none of these are available to the public [6]. A question on GCSB involvement in export control matters was deflected [7].

The issue of the GCSB's publications merits further examination. In early 1998, the manager of a company which handles medical communications services for a number of hospitals, medlabs, and health boards wrote to the GCSB requesting copies of several relevant publications as part of the bidding process for a Ministry of Health contract. The GCSB declined to make them available. Not having seen any of these publications I can't comment on their contents, but if I had, in theory, seen them I would be able to report that they consist of perfectly ordinary, run-of-the-mill reports on things like S/MIME and how digital certificates work, material which is identical to articles found in popular computer magazines, library books, and available on the net. The sole reason for withholding them seems to be to eliminate any chance of public accountability for the organisation which publishes them, since there's nothing in them which you can't read in PC Magazine or Computerworld.