Crypto Atlas
In dem Cyberraum wir immer mehr zu dem Stichwort „Crypto-Wars“ diskutiert. Hierbei geht es um das Spannungsfeld von Regulierung der Staaten, um Verschlüsselung einerseits für die Strafverfolgung aufzubrechen und um die Gewährleistung sicherer Verschlüsselung und auch Anonymisierung im Netz, um die Bürger vor Überwachung von Staaten und vor allem Cybercrime zu schützen. Dabei geht es nicht nur um den NSA Skandal, sondern langfristig auch um die Frage, in was für einer (Cyber-)Welt wir leben werden und wollen. Diese Debatte braucht aber auch Versachlichung. Diese will der Bitkom durch das Projekt Crypto-Atlas ein Stück weit schaffen. Hier schauen wir in einem klassischen Content 2.0 Projekt auf die vorhandenen Regulierungen zum Thema und wollen den Blick in die Welt öffnen. Wir beleuchten in welchen Ländern Regulierungen zur Nutzung von Verschlüsselungstechnologien bereits vorhanden sind und wie sich diese Länder aufstellen. Es wird der Fokus darauf gerichtet, ob die Nutzung eingeschränkt ist, ob Verschlüsselung eingeführt oder Exportiert werden darf. Damit wollen wir die Reisesicherheit für Tourismus oder Dienstreisen und Expats aufzeigen aber auch die Marktchancen für die Deutsche Verschlüsselungstechnologie beleuchten.
Falls Sie weitere Erkenntnisse oder Erfahrungen aus diesem Land beitragen können, wenden Sie sich bitte an uns und teilen diese. Sie erreichen den Bitkom über den Kontakt oder über bitkom@bitkom.org .
Beteiligen Sie sich auch gerne aktiv als Mitglied über den Arbeitskreis Sicherheitspolitik.
| Country | Wassenaar signatory? | Import restrictions | Export restrictions | Domestic use restrictions |
|---|---|---|---|---|
| Argentina | Yes | None | None | None |
| Australia | Yes | None | Export regulated in accordance with Wassenaar. Exemptions for public domain software and personal-use. Approval is also required for software that does not contain cryptography but includes a plug-in interface for adding cryptography. | None |
| Austria | Yes | Follows EU regulations and Wassenaar Arrangement. | Follows EU regulations and Wassenaar Arrangement. | Laws forbid encrypting international radio transmissions of corporations and organizations. |
| Bangladesh | | | None apparent. | None apparent. |
| Belarus | | Import requires license | Export requires license. | A license is required for design, production, sale, repair, and operation of cryptography. |
| Belgium | Yes | | Requires license for exporting outside of the Benelux. | None currently, although regulations are under consideration. |
| Burma | | Import may be regulated by the Myanmar Computer Science Development Council. | None currently, but export may be regulated by the Myanmar Computer Science Development Council. | Use of cryptography may require license. |
| Brazil | | | None | None |
| Canada | Yes | Follows pre-December 1998 Wassenaar. | Follows pre-December 1998 Wassenaar regulations. Public domain and mass-market software can be freely exported. | None |
| Chile | | | None | None |
| People's Republic of China | | Requires license by State Encryption Management Commission for hardware or software where the encryption is a core function. | Requires license by State Encryption Management Commission for hardware or software where the encryption is a core function. | Use of products for which cryptography is a core function is restricted to specific products using preapproved algorithms and key lengths. |
| Columbia | | | None | None |
| Costa Rica | | | None | None |
| Czech Republic | Yes | Import allowed if the product is not to be used “for production, development, collection or use of nuclear, chemical or biological weapons.” | Export controls are not enforced. | None |
| Denmark | Yes | | Some export controls in accordance with Wassenaar. | None |
| Egypt | | Importers must be registered. | | None |
| Estonia | | | Export controlled in accordance with Wassenaar. | |
| Finland | Yes | | Export requires license in accordance with EU Recommendation and Wassenaar, although a license is not required for mass-market goods. | None |
| France | Yes | Some imports may require a license depending on intended function and key length. | Some exports may require a license depending on intended function and key length. | France liberalized its domestic regulations in March 1999, allowing the use of keys up to 128 bits. Work is underway on a new law that will eliminate domestic restrictions on cryptography. |
| Germany | Yes | Follows EU regulations and Wassenaar Arrangement. | Follows EU regulations and Wassenaar; companies can decide for themselves if a product falls within the mass-market category. | None |
| Greece | Yes | Follows pre-December 1998 Wassenaar. | Follows pre-December 1998 Wassenaar. | None |
| Hong Kong | | Import requires license | License required for export. | None, although encryption products connected to public telecommunication networks must comply with the relevant Telecommunications Authority’s network connection specifications. |
| Hungary | Yes | Mirror regulations requiring an import license if an export license is needed from Hungary. Mass-market encryption software is exempted. | Mirror regulations requiring an import license if an export license is needed from Hungary. Mass-market encryption software is exempted. | None |
| Iceland | | | None | None |
| India | | License required for import. | | None |
| Indonesia | | | Unclear | Unclear |
| Ireland | Yes | No import controls. | Export regulated under Wassenaar; no restrictions on the export of software with 64-bit key lengths. | Electronic Commerce Act 2000 gives judges the power to issue search warrants that require decryption. |
| Israel | | Import require a license from the Director-General of the Ministry of Defense. | Export require a license from the Director-General of the Ministry of Defense. | Use, manufacture, transport, and distribution of cryptography within Israel requires a license from the Director-General of the Ministry of Defense, although no prosecutions for using unlicensed cryptography are known and many Israeli users apparently do not have licenses. |
| Italy | Yes | Follows EU regulations. | Follows EU regulations. | Encrypted records must be accessible to the Treasury. |
| Japan | | | Export regulations mirror pre-December 1998 Wassenaar. Businesses must have approval for export of cryptography orders larger than 50,000 yen. | None |
| Kazakhstan | | Import requires license | Requires license. | License from the Committee of National Security required for research, development, manufacture, repair, and sale of cryptographic products. |
| Kyrgyzstan | | | None | None |
| Latvia | | Mirrors EU regulations. | Mirrors EU regulations. | None |
| Luxembourg | Yes | Follows pre-December 1998 Wassenaar. | Follows pre-December 1998 Wassenaar. | None |
| Malaysia | | | None | None |
| Mexico | | | None | None |
| Moldova | | Import requires a license from the Ministry of National Security. | Export requires a license from the Ministry of National Security. | Use requires a license from the Ministry of National Security. |
| Netherlands | Yes | Follows Wassenaar. No license required for export to Belgium or Luxemburg. | Follows Wassenaar. No license required for export to Belgium or Luxemburg. | Police can order the decryption of encrypted information, but not by the suspect. |
| New Zealand | Yes | Follows Wassenaar. Approval is also required for software that is designed for plug-in cryptography. | Follows Wassenaar. Approval is also required for software that is designed for plug-in cryptography. | None |
| Norway | Yes | Follows Wassenaar. | Follows Wassenaar. | None |
| Pakistan | | | None | Sale and use of encryption requires prior approval. |
| Philippines | | | None | Unclear |
| Poland | | Follows Wassenaar. | Follows Wassenaar. | None |
| Portugal | Yes | Follows pre-December 1998 Wassenaar. | Follows pre-December 1998 Wassenaar. | None |
| Romania | Yes | No import controls. | Exports according to Wassenaar. | None |
| Russia | | License required for import | License required for export. | Licenses required for some uses. |
| Saudi Arabia | | | None | “It is reported that Saudi Arabia prohibits use of encryption, but that this is widely ignored.” |
| Singapore | | No restrictions. | No restrictions. | Hardware equipment connected directly to the telecommunications infrastructure requires approval. Police, with the consent of the Public Prosecutor, may compel decryption of encrypted materials. |
| Slovakia | Yes | In accordance with pre-December 1998 Wassenaar. | In accordance with pre-December 1998 Wassenaar. | None |
| Slovenia | | | None | None |
| South Africa | | Import controls only apply to military cryptography. | Export controls only apply to military cryptography. | No regulations for commercial use or private organizations. Use by government bodies requires prior approval. |
| South Korea | Yes | Import of encryption devices forbidden by government policy, not legislation. Import of encryption software is not controlled. | Export in accordance with Wassenaar. | None |
| Spain | | | Export in accordance with Wassenaar and EU regulations. | None apparent. |
| Sweden | | | Export follows Wassenaar. Export of 128-bit symmetric mass-market software allowed to a list of 61 countries. | Use of equipment to decode encrypted radio and television transmissions is regulated. |
| Switzerland | | Import is not controlled. | Export mirrors Wassenaar. | Some uses may be regulated. |
| Turkey | | Follows pre-December 1998 Wassenaar controls. | Follows pre-December 1998 Wassenaar controls. | No obvious restrictions. |
| United Kingdom | | Follows EU and Wassenaar restrictions on export. | Follows EU and Wassenaar restrictions on export. | Regulation of Investigatory Powers Act 2000 gives the government the power to disclose the content of encrypted data. |
| United Stated of America | Yes | Restriction on boarder entry according to patriot act. | Few export restrictions. | None |
| Uruguay | | | None | None |
| Venezuela | | | None | None |
| Vietnam | | Import requires license. | | |
