Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: legal-discuss@apache.org
Received-SPF: pass (nike.apache.org: domain of kevan.miller@gmail.com
 designates 74.125.82.182 as permitted sender)
MIME-Version: 1.0
References: <8916E02D-0D7E-433F-A55D-0A6DC008D077@apache.org>
From: Kevan Miller <kevan.miller@gmail.com>
Date: Tue, 18 Mar 2014 23:00:54 +0000
Message-ID: 
 <CAM1oqKpZRy22i1rs8fpUrwPc4uouiqKtR5kNLtKn70G0AWW+qQ@mail.gmail.com>
Subject: Apache Cayenne adding data encryption - how to stay compliant
To: legal-discuss@apache.org
Cc: private@cayenne.apache.org
Content-Type: multipart/alternative; boundary=047d7bf0d62a2bb0ce04f4e982b9

--047d7bf0d62a2bb0ce04f4e982b9
Content-Type: text/plain; charset=ISO-8859-1

On Mon Mar 17 2014 at 7:26:34 AM, Andrus Adamchik <aadamchik@apache.org>
wrote:

> Hi legal-discuss,
>
> We (the Apache Cayenne project) are working on a pluggable transparent
> mechanism that will allow users to store certain columns in RDBMS in an
> encrypted form [1]. The basic code is already committed (using ROT13
> "encryption" as a proof of concept), and now we are approaching a point
> when we write the code that will manage real ciphers using JCE (Java
> Cryptography Extension) API. Cayenne itself will not contain any
> cryptographic algorithms per se, but it will be specifically designed to
> work with such algorithms provided by Java.
>
> So what do we need to do to stay compliant with US export regulations? I
> am checking the relevant page on our site [2], which has this note:
>
> "the regulations covering US export control laws for encryption were
> changed on June 25th 2010. This page describes the previous process. Until
> an updated version has been drawn up and approved by the Apache VP Legal
> Affairs, projects should check with the legal-discuss list before
> proceeding."
>
> So what is the current procedure?
>

IIRC, the last several requests have been passed by Sam to counsel. And the
response has always been follow the process described on that web page. Not
sure if Jim wants to follow a different process...

I don't know why that page was updated in the first place and I'm not
really up-to-speed with export control laws.

--kevan

--047d7bf0d62a2bb0ce04f4e982b9
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div>On Mon Mar 17 2014 at 7:26:34 AM, Andrus Adamchik &lt;<a href=3D"mailt=
o:aadamchik@apache.org">aadamchik@apache.org</a>&gt; wrote:</div><blockquot=
e class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc sol=
id;padding-left:1ex">
Hi legal-discuss,<br>
<br>
We (the Apache Cayenne project) are working on a pluggable transparent mech=
anism that will allow users to store certain columns in RDBMS in an encrypt=
ed form [1]. The basic code is already committed (using ROT13 &ldquo;encryp=
tion&rdquo; as a proof of concept), and now we are approaching a point when=
 we write the code that will manage real ciphers using JCE (Java Cryptograp=
hy Extension) API. Cayenne itself will not contain any cryptographic algori=
thms per se, but it will be specifically designed to work with such algorit=
hms provided by Java.<br>

<br>
So what do we need to do to stay compliant with US export regulations? I am=
 checking the relevant page on our site [2], which has this note:<br>
<br>
&quot;the regulations covering US export control laws for encryption were c=
hanged on June 25th 2010. This page describes the previous process. Until a=
n updated version has been drawn up and approved by the Apache VP Legal Aff=
airs, projects should check with the legal-discuss list before proceeding.&=
rdquo;<br>

<br>
So what is the current procedure?<br></blockquote><div><br></div><div>IIRC,=
 the last several requests have been passed by Sam to counsel. And the resp=
onse has always been follow the process described on that web page. Not sur=
e if Jim wants to follow a different process...</div>
<div><br></div><div>I don&#39;t know why that page was updated in the first=
 place and I&#39;m not really up-to-speed with export control laws.</div><d=
iv><br></div><div>--kevan</div>

--047d7bf0d62a2bb0ce04f4e982b9--