[X2Go-Dev] Looking for your ECCN

[Stefan Baur]

(Patrick, please subscribe to X2Go-Dev, so you get to see all the
replies and not only the ones CC'ed to your inbox. Instructions on how
to subscribe are in the e-mail I sent you off-list.)

Am 09.09.2014 um 17:36 schrieb Mullaley, Patrick S:
> Hey guys! We are trying to get x2go added to our approved software list within Verizon, and in order to do so, I need to provide them with an ECCN. Do you have, or can you provide me with the ECCN tied to your software? 

Note that this is not legal advice, only the result of my findings after
looking up the terms on Wikipedia and Google:

http://en.wikipedia.org/wiki/Export_Administration_Regulations explains
what an ECCN is.
http://en.wikipedia.org/wiki/Wassenaar_Arrangement explains what this is
all about: export limitations on dual-use technology.

X2Go is a software that was originally coded in Germany (with parts
relying on other freely available code, including, but not limited to,
the GPL'ed parts of what the Italian-based company NoMachine offered for
their NX product, or the free X server for Windows, VcXsrv) and whose
web and download servers are hosted in Germany.

So, for those software parts actually created by the X2Go developers, my
understanding is that German law applies.
Things might be a little more complicated with code contributions that
we receive from foreign (=non-German) nationals. If this is relevant to
the issue at hand, we'd have to investigate further.

Now, the Wassenaar Arrangement has been turned into EU law (which, in
turn, is binding for Germany):
"COUNCIL REGULATION (EC) No 428/2009 of 5  May 2009 setting up a
Community regime for the control of exports, transfer, brokering and
transit of dual-use items", available here:
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:134:0001:0269:en:PDF
(English)
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:134:0001:0269:de:PDF
(same in German)

The General Software Note (GSN), on Page 14, states, in a nutshell, that
Software that is generally available or in the public domain is exempt
from this regulation.

According to the definitions in this regulation, a software is
"generally available" if it is:
1. Sold from stock at retail selling points, without restriction, by
means of:
a. Over-the-counter transactions;
b. Mail order transactions;
c. Electronic transactions; or
d. Telephone order transactions; and
2. Designed for installation by the user without further substantial
support by the supplier

While GPL software isn't "public domain", it *can* legally be sold, as
the last paragraph of "TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION
AND MODIFICATION", section 1 of the GPL 2, states "You may charge a fee
for the physical act of transferring a copy, and you may at your option
offer warranty protection in exchange for a fee."
And of course, this is possible in the ways described in "1."

Regarding "2.", double-clicking a setup.exe and hitting "Continue/Next"
buttons until finished or running the package installation tol of your
Linux distribution of choice clearly qualifies as "Designed for
installation by the user without further substantial support by the
supplier".

So, we do not have an ECCN, and we do not need one - that is my take on
the situation.

-Stefan