{"id":119,"date":"2006-09-02T21:01:38","date_gmt":"2006-09-02T21:01:38","guid":{"rendered":"http:\/\/www.reactivated.net\/weblog\/archives\/2006\/09\/us-export-control-laws\/"},"modified":"2006-09-02T21:08:22","modified_gmt":"2006-09-02T21:08:22","slug":"us-export-control-laws","status":"publish","type":"post","link":"http:\/\/www.reactivated.net\/weblog\/archives\/2006\/09\/us-export-control-laws\/","title":{"rendered":"NFIS2 and U.S. export control laws"},"content":{"rendered":"

On the journey to find some working fingerprint matching code for use in dpfp<\/a> and future projects, several people have pointed me towards NFIS2<\/a>.<\/p>\n

NFIS2 is a set of utilities for fingerprint analysis and matching. It has been developed by NIST<\/a> for DHS and the FBI, so presumably it is of a decent quality. Additionally, Andrei Tchijov tells me that it does work<\/a>.<\/p>\n

This sounds great, and to get a copy all you have to do is ask for them to send you a CDROM. The CD includes source code and documentation. The code is mostly public domain, some with BSD-style “preserve this copyright notice” licensing terms.<\/p>\n

There is only one possible problem, the NFIS website makes the following point rather clear:<\/p>\n

Distribution of this software is subject to U.S. export control laws.<\/strong><\/p><\/blockquote>\n

I’m not sure what this means, so I’ve done some research. The following may be incorrect – this is just my interpretation, which I’m seeking clarification on…<\/p>\n

The most important point is that export control laws apply to almost everything that exits the United States – regardless of origin and regardless of transportation method (mail, internet, …). I was encouraged to read this, as surely the U.S. don’t place restrictions on source code — otherwise the whole open source thing would not be happening, however:<\/p>\n

All exports should be classified with an ECCN<\/a> number. If they can be classified, certain restrictions apply — mostly that you cannot export to certain countries.<\/p>\n

Even if you can’t be classified with an ECCN, there are still restrictions. For example, you cannot export anything<\/em> to any entities listed here<\/a>, people listed here<\/a>, etc. I find this immensely confusing considering that this effectively means a US-based open source software mirror site is violating export control laws if someone on one of those lists happens to download some software. How is open-source even possible in the US with these kinds of restrictions in place?<\/p>\n

Anyway, going back to the NFIS2 thing. It seems fairly redundant for them to point out that NFIS2 is covered by export control laws, when software of any type automatically is. So I ventured further and looked into the ECCN classification lists. Unfortunately, some entries do explicitly cover fingerprint systems, although I’m having trouble determining if they are talking about hardware or software (would they apply to a software-only generic fingerprint matching library distribution?). These entries restrict distribution to a number of countries (for purposes of “crime control”, etc).<\/p>\n

I’d be extremely grateful if anyone can confirm or deny any of the above. The question I’m looking to answer is: If I get my hands on NFIS2, can I include it in an open-source project and share it with the world?<\/strong><\/p>\n

Here are some sources which I used in the above research:<\/p>\n