If I have encrypted files and I'm going to US, do I break any encryption import laws? Likewise, if I go out of US with those files, do I break any encryption export laws?
2
-
The encryption-related laws I'm aware of (arms-export control) deal with encryption software, not the result of using that software, but there might be other laws out there.– MarkMay 5, 2016 at 23:37
-
Does that include the software that's on the laptop which is used to encrypt and decrypt the files?– Foxcat385May 6, 2016 at 15:26
Add a comment
|
2 Answers
The Electronic Frontier Foundation, a San Francisco-based digital rights non-profit, specifically advises to use encryption when crossing the US borders. Read more at https://www.eff.org/wp/digital-privacy-us-border-2017.
While the EFF doesn't say that using encryption would be illegal, keep in mind that the US borders are a gray area, legally-speaking, and US Government agents have a wide range of powers that would not be available elsewhere - within the US, or outside the US.
The EFF also advises this:
We appreciate and respect technologists’ efforts to find ways to help travelers protect their data. However, we recommend against using methods that may be, or even appear to be, calculated to deceive or mislead border agents about what data is present on a device. There is a significant risk that border agents could view deliberately hiding data from them as illegal. Lying to border agents can be a serious crime, and the agents may take a very broad view of what constitutes lying.11 We urge travelers to take that risk very seriously.
Wikipedia's list of countries with restrictions on import of cryptography does not include the United States of America. Their page on export of crypography from the United States has a list of currently restricted technologies, but files which have been encrypted are by themselves not technologies at all, just data that is the output of some technology.
If you have encryption software on that computer, that may still be subject to restrictions.
The "current status" section on the latter page has a "needs update" badge; but the technologies it currently lists are
Militarized encryption equipment, TEMPEST-approved electronics, custom cryptographic software, and even cryptographic consulting services
So if you have custom decryption software, you are at risk, but bog-standard GPG should not be liable as per this documentation.
(I obviously am in no position to guarantee rational behavior from a country whose current administration seems hellbent on reviving the dark ages. This answer is in whole based on what I could find on Wikipedia, not on personal insights into the matter.)
