[X2Go-Dev] Looking for your ECCN

[Mullaley, Patrick S]

Alright. Thank you for your reply. I will see what our legal team has to say. Wish me luck.

-----Original Message-----
From: Stefan Baur [mailto:x2go-ml-1 at baur-itcs.de] 
Sent: Wednesday, September 10, 2014 7:40 AM
To: x2go-dev at lists.x2go.org; x2go-dev at lists.x2go.org
Cc: Michael DePaulo; Mullaley, Patrick S
Subject: Re: [X2Go-Dev] Looking for your ECCN

(Patrick, please subscribe to X2Go-Dev, so you get to see all the replies and not only the ones CC'ed to your inbox. Instructions on how to subscribe are in the e-mail I sent you off-list.)

Am 09.09.2014 um 17:36 schrieb Mullaley, Patrick S:
> Hey guys! We are trying to get x2go added to our approved software list within Verizon, and in order to do so, I need to provide them with an ECCN. Do you have, or can you provide me with the ECCN tied to your software? 

Note that this is not legal advice, only the result of my findings after looking up the terms on Wikipedia and Google:

http://en.wikipedia.org/wiki/Export_Administration_Regulations explains what an ECCN is.
http://en.wikipedia.org/wiki/Wassenaar_Arrangement explains what this is all about: export limitations on dual-use technology.

X2Go is a software that was originally coded in Germany (with parts relying on other freely available code, including, but not limited to, the GPL'ed parts of what the Italian-based company NoMachine offered for their NX product, or the free X server for Windows, VcXsrv) and whose web and download servers are hosted in Germany.

So, for those software parts actually created by the X2Go developers, my understanding is that German law applies.
Things might be a little more complicated with code contributions that we receive from foreign (=non-German) nationals. If this is relevant to the issue at hand, we'd have to investigate further.

Now, the Wassenaar Arrangement has been turned into EU law (which, in turn, is binding for Germany):
"COUNCIL REGULATION (EC) No 428/2009 of 5  May 2009 setting up a Community regime for the control of exports, transfer, brokering and transit of dual-use items", available here:
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:134:0001:0269:en:PDF
(English)
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:134:0001:0269:de:PDF
(same in German)

The General Software Note (GSN), on Page 14, states, in a nutshell, that Software that is generally available or in the public domain is exempt from this regulation.

According to the definitions in this regulation, a software is "generally available" if it is:
1. Sold from stock at retail selling points, without restriction, by means of:
a. Over-the-counter transactions;
b. Mail order transactions;
c. Electronic transactions; or
d. Telephone order transactions; and
2. Designed for installation by the user without further substantial support by the supplier

While GPL software isn't "public domain", it *can* legally be sold, as the last paragraph of "TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION", section 1 of the GPL 2, states "You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee."
And of course, this is possible in the ways described in "1."

Regarding "2.", double-clicking a setup.exe and hitting "Continue/Next"
buttons until finished or running the package installation tol of your Linux distribution of choice clearly qualifies as "Designed for installation by the user without further substantial support by the supplier".

So, we do not have an ECCN, and we do not need one - that is my take on the situation.

-Stefan