What would be considered due diligence (or whatever the proper term is) in preventing users in export-control blacklisted countries from accessing a web application that features strong encryption software (symmetric keys longer than 56 bits)? Would checking the client's WAN IP against country's IP address range lists be enough?

3 Answers 3


Check the IP is the first step that helps you filtering requests, however even if they pass the IP check I would also ask to select the country they are from.

Allowing access only to those country allowed or provide an alternative output (if possible) based on weak encryption to those in other countries.

  • it's a web app, users don't don't need to download it.
    – Jasen
    Dec 31, 2016 at 7:59
  • I updated the answer to clarify it. In any case double checking (by IP and dropdown) that the user can legally use it, will show your diligence to abide to the laws.
    – David
    Dec 31, 2016 at 8:17

Add to your terms and conditions that you don't allow access to your site from certain countries. Now everyone doing so is violating your terms and conditions. That should stop them right in their tracks.

Just like certain websites have a button that says "I'm over 18" and don't give you access until you press the button.

  • How will this prevent a user in the black-listed country from using the web-app? I can't take the answer seriously when you explicitly compare its proposed solution to the "I'm over 18" button, which is laughably ineffectual at stopping the determined user from bypassing the control.
    – user4657
    Jan 4, 2017 at 12:25
  • 2
    @Nij The point isn't that it stops access, but that it may be enough to absolve you of liability.
    – Patrick87
    Jan 4, 2017 at 13:54
  • @Patrick87: Thanks. BTW, I have read similar things in both Apple's and Dell's computer hardware sales contracts - customers are not allowed to use an Apple or Dell computer (and probably any others) to control nuclear power plants or to construct weapons of mass destruction.
    – gnasher729
    Jan 4, 2017 at 14:02

Make the users register and purchase access to your site with a credit card. Require and verify a billing address and reject any purchases with addresses in blacklisted countries. You need revenue to maintain the site anyway, or donate the proceeds, or keep them.

  • So you'll process the registration and the credit card with weak encryption?
    – phoog
    Jan 4, 2017 at 14:20
  • @phoog Maybe I misunderstand the question or the laws around export control, but I don't think HTTPS can be prohibited since the application can't prevent incoming HTTP requests (though you might be able to do this at a lower layer, maybe by source IP). I'd imagine export controls target making strong encryption available to users for users to encrypt data they choose with a key that's useful to them, not encrypting app-defined data in a way that's useless to the end users. But lawyers may not know the difference.
    – Patrick87
    Jan 4, 2017 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.