1

IANAL (I am not a lawyer). I am a programmer and I want to make software with OpenSSL functions or even my own implementation of cryptographic algorithms, such as MD5.

However, I am worried that I may need to get a license.

Is exporting software with cryptographic functions legal in the United Kingdom?

2) Subject to the following provisions of this license, any item specified in Schedule 1 may be exported from the United Kingdom, or from any other Member State by any person established in the United Kingdom, to any country specified in Schedule 2, provided the item is only for use: (1) by the exporter, or by any subsidiary or parent undertaking of the exporter in their own commercial cryptographic product development activities, or (2) by a business or academic collaborator in their own commercial cryptographic product development activities and pursuant to the agreement establishing the collaboration.

According to https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/697699/18-ogel-crypto-development.pdf (Open General Export License)

What does 'exporting' actually mean?

Does it mean putting my software on a website? Does it have to be commerical? Do I have to put "Licensed under the OGEL", despite me not even having a license? Is it automatically provided?

Will I get trouble by just making some software with cryptography (like a MD5 implementation or a library) in it, whether it's mine or not?

Well, am I? Anything more about the legal status? Seriously, I don't want to go to prison (criminal liability) or get sued (civil liability).

Does it matter if it's open source or not?

I already know about Section 49 (I think it's that one) of the Investigatory of Powers Act 2000.

Any help will be appreciated. Thank you.

1

For the actual legal situation you would need a lawyer, but I can tell you from personal experience that Apple's AppStore requires you to provide an "ITS Encryption Export Compliance Code" if you use encryption not provided by the operating system, and without that, your application will not be published. I assume they wouldn't do this if there was no legal requirement.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.