I'm an independent software developer who has developed a program that links to the OpenSSL libraries for the purpose of allowing users to decrypt, filter and re-encrypt secure content. For example, one of the filtering engines in this software contains a transparent HTTPS proxy where the user can load filtering rules such as Adblock Plus Filters (EasyList) and have the proxy transparently remove matching content before presenting it the user.
I intend on publishing the entire source code on Github.com and publishing binaries releases, both under the GNU GPL v3 (or any later version). I've spoken with EXCOL to try to get a formal ruling on whether or not such a program is subject to control under Import/Export law in Canada. However, they simply don't want to make a ruling over the phone or email and the only clear ruling they've given me is that due to the nature of the product and how I'm releasing it, I'm not eligible to apply for an export permit (because there is no Consignee). The other thing they made clear is that uploading something to a website is classified as "exporting".
As such, they've told me the only thing I can do is apply for an Advisory Opinion, which they told me straight up is going to take "a very long time" because their priority is on processing actual applications, not giving opinions. Plus they basically told me that the opinion is useless, because it's based on your supplied specification and not the actual "product", so the opinion can be revoked/changed/thrown out.
There is some language in the official guide to applying for a permit that suggests that software placed in "the public domain" is not subject to control, with the definition of "public domain" meaning generally available to the public, not the typical interpretation as applied to copyright.
This does not release such "technology" controlled in entries 1-1.E.2.e. and 1-1.E.2.f . and 1-8.E.2.a. and 1-8.E.2.b.
Controls do not apply to "technology" in the "public domain", to "basic scientific research" or to the minimum necessary information for patent applications. General Software Note:
The Lists do not control "software" which is any of the following:
1. Generally available to the public by being: Sold from stock at retail selling points, without restriction, by means of : 1. Over-the-counter transactions; 2. Mail order transactions; 3. Electronic transactions; or 4. Telephone call transactions; and Designed for installation by the user without further substantial support by the supplier; or Note: Entry 1 of the General Software Note does not release "software" controlled by Category 5, Part 2 ("Information Security"). 2. "In the public domain"; or 3. The minimum necessary "object code" for the installation, operation, maintenance (checking) or repair of those items whose export has been authorised. Note : Entry 3 of the General Software Note does not release “software” controlled by Category 5 - Part 2 (“Information Security”).
The definition of "public domain" is given as:
"In the public domain" - General Technology Note, General Software Note, 2-22 This means "technology" or "software" which has been made available without restrictions upon its further dissemination.
Note: Copyright restrictions do not remove "technology" or "software" from being "in the public domain".
Also, I was able to find a presentation a Canadian Firm made to TD Bank, posted here that seems to interpret this language as meaning that open source software is exempt from control:
"Open Source” Exception – permit is not required if the software containing the cryptographic function is in the public domain
They then further qualify this with the following statement:
Does not apply where open source software is combined with proprietary software – i.e. open source cryptographic program (OpenSSL, etc...) integrated as security feature in or linked into company’s proprietary software.
OpenSSL is a collection of open source crypto libraries, so this further qualification on the exception is meaning to say that closed source applications linking to open source crypto are not covered. Since this is a negating statement, the inverse must necessarily be true, that open source software linking to something like OpenSSL is covered. This is my interpretation, I have contacted the lawyer who made the presentation hoping to get clarification.
So my question is, am I interpreting this information correctly? That as long as the source is open to the public, made generally available, that one can legally "export" aka publish such a work legally without an export permit?